MVP: Continuous Compliance Gate

[kuyacarlo]

Goal

Ship a minimum viable continuous compliance gate — not a hackathon demo.

Docs: docs/mvp/README.md · docs/ROADMAP.md · docs/handover/README.md

Definition of Done

• Compose / documented local path runs backend + frontend + DB
• Policy ingest persists versioned policy metadata
• pg pre-push: local A1 + /validate poll flow works
• Dashboard HITL approve/reject against live API
• Structured verdict log on every decision (Loki when configured)
• PII gate on validate path
• A1 regex smoke-tested before serve
• Handoff/onboarding match reality; CI green on dev

Sub-issues

• MVP: Policy storage schema & versioning #75
• MVP: Structured verdict logging schema #76
• MVP: Push verdicts to Loki (or configured sink) #77
• MVP: E2E happy path + live HITL #78
• MVP: Presidio PII gate on /validate #79
• MVP: A1 regex validation before serve (ReDoS guard) #80
• MVP: Sample policy pack for E2E #81
• MVP: Docs sync — handoff, onboarding, audit, roadmap #82

Related legacy issues (keep until MVP child closes)

• Policy storage schema & versioning #10 → policy versioning
• Loki structured logging schema #4 → logging schema
• Log every verdict to Loki #20 → Loki push
• Presidio PII integration #17 → Presidio

Out of scope (post-MVP)

• Load test (5s rule) #22 Load test (5s)
• RAG fine-tune & performance test #14 RAG fine-tune
• Regulatory change simulator #13 Regulatory change simulator

Already done

#61 #62 #63 #64 #73