# Control adoption matrix — machine-friendly, long-lived rollup of deterministic
# control presence across in-scope repositories. Written/updated by the
# control-adoption scan. Companion to optional narratives in
# scans/<repo>/ongoing-control-adoption-review.md.
#
# How the net-diff works:
#   - Each run reads a repo's stored controls, sets the observed status/direction/evidence.
#   - `since` = the run date the CURRENT status was first observed (last change date).
#     Unchanged controls keep their old `since`; changed controls get the new run date.
#   - repo.last_run = last date the repo was scanned.
#   - Per-run changes ({control, from, to}) are logged in reviews/YYYY-MM.yml.
#
# Copy this file into the portfolio path confirmed in the scope gate
# (commonly docs/management/compliance/control-matrix.yml) and replace the
# example repo block with real scans.

schema_version: 1
scan_id: control-adoption
updated: 2026-07-04
controls_source_of_truth: library/skills/control-adoption/references/control-catalogue.md

status_values:
  present: "control implemented and evidenced"
  partial: "partially implemented"
  absent: "not present"
  na: "not applicable to this archetype"
direction_values: [adoption, backport, parity, none]
provenance_values: [port, transplant, net-new]

controls:
  - {id: local-dev,            hoen_tag: 1-local-dev,               label: Local development & IDE}
  - {id: version-control,      hoen_tag: 1-version-control,         label: Version control}
  - {id: quality-engineering,  hoen_tag: 2-quality-engineering,     label: Quality engineering}
  - {id: static-analysis,      hoen_tag: 3-static-analysis,         label: Static analysis}
  - {id: standards,            hoen_tag: 2-standards,               label: Standards compliance}
  - {id: deployment,           hoen_tag: 2-deployment-solutions,    label: Deployment solutions}
  - {id: security,             hoen_tag: 2-security-controls,       label: Security controls}
  - {id: logging-monitoring,   hoen_tag: 1-logging-monitoring,      label: Logging & monitoring}
  - {id: iac,                  hoen_tag: 2-infrastructure-as-code,  label: Infrastructure as Code}

# Cross-repo sourcing verdict per control (refresh after each scan when the picture shifts).
control_provenance:
  local-dev:           {verdict: port,    note: "proven in scanned API repos (lockfile + pre-commit)"}
  version-control:     {verdict: port,    note: "hooks proven; secret-prevention often still net-new"}
  quality-engineering: {verdict: port,    note: "coverage gates proven in CI + local hooks"}
  static-analysis:     {verdict: port,    note: "lint/type gates proven across stacks"}
  standards:           {verdict: port,    note: "data-platform naming exemplar; N/A for many API/FE archetypes"}
  deployment:          {verdict: port,    note: "pipeline exemplars across scanned repos"}
  security:            {verdict: net-new, note: "no automated scan gate across swept repos yet"}
  logging-monitoring:  {verdict: port,    note: "OTel / structured logging proven in API archetypes"}
  iac:                 {verdict: port,    note: "Terraform (or equivalent) exemplar present in portfolio"}

repos:
  # Persona example only — replace with real repo_ids from the engagement portfolio.
  pricing_engine_api:
    archetype: python-api
    default_branch: main
    last_run: 2026-07-04
    last_git_ref: a1b2c3d
    scan_source: control-adoption
    counts: {present: 5, partial: 1, absent: 2, na: 1}
    adoption_signals: []
    controls:
      local-dev:           {status: present, direction: backport, since: 2026-07-04, evidence: "uv.lock + .pre-commit-config.yaml (ruff/mypy/pytest)"}
      version-control:     {status: partial, direction: backport, since: 2026-07-04, evidence: "pre-commit hooks; no commit-msg lint / secret scan"}
      quality-engineering: {status: present, direction: backport, since: 2026-07-04, evidence: "pytest --cov-fail-under=90 (local hook + CI blocking)"}
      static-analysis:     {status: present, direction: backport, since: 2026-07-04, evidence: "ruff + mypy in pre-commit and CI"}
      standards:           {status: na,      direction: none,     since: 2026-07-04, evidence: "not a data-platform naming archetype"}
      deployment:          {status: present, direction: backport, since: 2026-07-04, evidence: "CI Test/Lint/Build → DEV → TST → PRD"}
      security:            {status: absent,  direction: none,     since: 2026-07-04, evidence: "no bandit/pip-audit/detect-secrets/gitleaks"}
      logging-monitoring:  {status: present, direction: backport, since: 2026-07-04, evidence: "opentelemetry instrumentation + telemetry module"}
      iac:                 {status: absent,  direction: none,     since: 2026-07-04, evidence: "no terraform/bicep/pulumi"}
    backport_candidates: [coverage-gate-90, otel-wrapper, pre-commit-python-stack]

# Registered but not yet scanned into this matrix.
pending_repos: []