…egister + NIST AI RMF crosswalk (14th & 15th assurance checks)

One verified OSCAL 1.1.2 catalog (source of truth) -> multiple regulator
deliverables. Extends the round-4 Annex IV dossier generator to two more
frameworks, all assembled from the same conformance-verified catalog + live
re-run evidence.

New shared engine:
- crosswalk_common.py: load_catalogs, CONTROL_EVIDENCE, run_conformance
  (refuses to assemble against a non-conformant catalog), EvidenceRunner
  (re-runs each control's backing assurance check this run), status_for
  (SATISFIED / PARTIAL / PENDING-EVIDENCE), resolve_controls.

New deliverables (Tier A, runnable):
- generate_dora_ict_register.py + dora_framework_map.yaml: DORA
  (Reg. (EU) 2022/2554) 5-pillar ICT-risk register. Result 3/5 pillars
  SATISFIED; P4 (third-party) and P5 (info-sharing) reported as HONEST
  coverage gaps (is_coverage_gap=true, PENDING-EVIDENCE), not hidden.
- generate_nist_rmf_crosswalk.py + nist_ai_rmf_map.yaml: NIST AI RMF 1.0
  4-function (GOVERN/MAP/MEASURE/MANAGE) crosswalk with per-function
  coverage analysis. Result 4/4 functions SATISFIED (100%).
- generated/{dora_ict_register,nist_ai_rmf_crosswalk}.{json,md} samples.

Honesty guarantees (preserved): each generator embeds an integrity_statement
('not a DORA conformity attestation' / 'not a certification'); both refuse a
non-conformant catalog and raise on unknown control ids (falsifiable —
negative tests confirm exit 1).

Wiring:
- run_runnable_assurance.sh: 13 -> 15 steps (14=DORA, 15=NIST), using
  --no-verify --print piped to inline python validators.
- tests/governance: +3 tests (18 total): DORA gaps reported, NIST full
  coverage with live evidence, and --no-verify does not fabricate SATISFIED.
- CI: pytest selector adds dora/nist/crosswalk; assembles all 3 deliverables
  and uploads them as the 'regulator-deliverables' artifact.

Docs synced: RUNNABLE_ASSURANCE.md (rows 14-15, thirteen->fifteen), DECADAL
plan (13/13 -> 15/15 + 2 verification-ledger rows), pilot P6-REPRO 15/15,
oscal/README.md.

Verification (this commit):
- bash governance_artifacts/run_runnable_assurance.sh -> 15/15 PASS
- pytest tests/governance/test_governance_artifacts.py -> 18 passed
- pilot acceptance gates -> 6/6 automated PASS (P6-REPRO 15/15)
- DORA 3/5 SATISFIED (P4/P5 gaps); NIST 4/4 SATISFIED (100%);
  catalog conformance 0 failures for both.

…ckage & distribute the stack (16th assurance check)

Adds the 'finalize, package, and distribute' step the stack has been building
toward: instead of asserting regulator-readiness in prose, this PRODUCES an
auditable, tamper-evident distribution bundle whose contents are exactly the
artifacts that passed THIS run.

New tool — governance_artifacts/package_distribution_bundle.py:
- Re-runs the 3 OSCAL-native regulator-deliverable generators with LIVE
  evidence (Annex IV dossier, DORA ICT-risk register, NIST AI RMF crosswalk).
- Collects all 6 deliverable artifacts (JSON+MD) into governance_artifacts/dist/.
- Emits MANIFEST.json: per-artifact SHA-256 + byte size, the live
  SATISFIED/PARTIAL/PENDING-EVIDENCE status per unit, declared coverage gaps,
  and a single bundle_sha256 = SHA-256 over the sorted per-artifact digests
  (whole-bundle tamper evidence).
- Writes a regulator-facing DISTRIBUTION_README.md + a guided
  EXECUTION_CHECKLIST.md (command-by-command independent reproduction).
- --with-suite runs the full runnable-assurance suite and gates on it.

Honesty guarantees (falsifiable):
- REFUSES to package (exit 1) if any deliverable reports a catalog-conformance
  failure — verified by a negative test (monkeypatched conformance failure).
- bundle_sha256 recomputes from the per-artifact digests (verified in suite + test).
- Coverage gaps (DORA P4/P5) are reported, never inflated to SATISFIED.
- Explicitly an assembly-integrity + reproducibility bundle, NOT a conformity
  assessment, certification, or safety proof; ASI containment is a control
  discipline, not a guarantee.

Result this run: 6 artifacts across 3 deliverables; 15/17 units SATISFIED;
2 declared gaps (DORA P4/P5); all catalogs conformant.

Wiring:
- run_runnable_assurance.sh: 15 -> 16 steps (step 16 packages the bundle,
  --no-regenerate --print, asserts 3 deliverables / 6 artifacts / digest
  recomputes / all conformant).
- tests/governance: +3 tests -> 21 total (manifest tamper-evidence, DORA gaps
  not hidden, refuses non-conformant deliverable).
- CI: pytest selector adds 'bundle'; packages bundle with --with-suite and
  uploads it as the 'distribution-bundle' artifact (dist/ stays gitignored —
  fully reproducible output).

Docs synced: RUNNABLE_ASSURANCE.md (row 16, fifteen->sixteen), DECADAL plan
(15/15 -> 16/16 + verification-ledger row), pilot P6-REPRO 16/16,
governance_artifacts/README.md (package & distribute section), oscal/README.md.

Verification (this commit):
- bash governance_artifacts/run_runnable_assurance.sh -> 16/16 PASS
- pytest tests/governance/test_governance_artifacts.py -> 21 passed
- pilot acceptance gates -> 6/6 automated PASS (P6-REPRO 16/16)

…le (content_digest)

Closes a real honesty gap in the round-6 packager: the EXECUTION_CHECKLIST
claimed the bundle digest "matches the value above (timestamps aside)", but
bundle_sha256 in fact changed on EVERY regeneration because each deliverable
embeds a fresh generated_at timestamp. A supervisor following the checklist
would get a different digest each run, undermining the reproducibility claim.

Root cause (verified): the ONLY non-deterministic content in a deliverable is
the ISO-8601 generated_at instant (JSON "generated_at" + Markdown
**Generated:**). All live evidence and everything else is byte-stable.

Fix - two distinct digests, each with a clear purpose:
- bundle_sha256 (provenance / tamper-evidence): SHA-256 over the sorted
  per-artifact BYTE digests. Pins THIS exact build; changes each run. Use to
  detect tampering with a specific distributed bundle.
- content_digest (reproducibility): SHA-256 over the sorted per-artifact
  digests with embedded ISO-8601 instants normalized to a fixed sentinel.
  Depends only on the catalog + live-evidence state, so an independent party
  who re-runs the generators derives the SAME value. VERIFIED stable across 3+
  regenerations (f6fa38c7...) while bundle_sha256 varies.

Each artifact entry now carries both sha256 and content_sha256.

Honesty wording corrected:
- DISTRIBUTION_README.md: new 'Two digests, two purposes' section.
- EXECUTION_CHECKLIST.md: step 4 now says compare the CONTENT digest (stable),
  not bundle_sha256; step 5 adds a runnable standalone command to recompute an
  artifact's content_sha256 (verified to match the manifest).

Wiring:
- run_runnable_assurance.sh step 16: now asserts BOTH digests recompute and
  that they are distinct.
- tests/governance: +2 tests -> 23 total: content_digest reproducible across
  regenerations + recomputes; timestamp normalization changes byte digest only
  (falsifiable - a real content change still moves the normalized digest).
- RUNNABLE_ASSURANCE.md row 16, governance_artifacts/README.md, DECADAL ledger
  row updated to document the two-digest model.

Verification (this commit):
- bash governance_artifacts/run_runnable_assurance.sh -> 16/16 PASS
- pytest tests/governance/test_governance_artifacts.py -> 23 passed
- pilot acceptance gates -> 6/6 automated PASS
- content_digest stable across 3 regenerations; bundle_sha256 varies as intended

…manifest signing (17th assurance check)

Closes the trust gap left by the round-6/7 packager: a bundle recipient
previously had to trust the packager's own digest arithmetic. This adds the
missing recipient-side half of the distribution story.

New tool — governance_artifacts/verify_distribution_bundle.py:
- Standalone and deliberately INDEPENDENT: stdlib-only (optional
  dilithium-py only for the signature branch) and never imports the
  packager — the digest rules (byte SHA-256, timestamp-normalized content
  SHA-256, sorted-digest bundle digests) are re-implemented from scratch so
  a bug or backdoor in the packager cannot vouch for itself (enforced by an
  AST-based test).
- 10 named, falsifiable checks: manifest-parse, artifact-presence,
  artifact-byte-digest, artifact-content-digest, bundle-digest-recompute,
  content-digest-recompute, digests-distinct, summary-consistency,
  conformance-claims, signature.
- summary-consistency recomputes the manifest's claimed unit counts /
  coverage gaps / conformance from the bundled deliverable JSONs
  themselves — a manifest that inflates units_satisfied or hides a DORA
  P4/P5 gap FAILS even if every digest still recomputes.
- Exit 0 iff every executed check passes; missing dilithium-py reports the
  signature check SKIPPED (never silently passed); --require-signature
  turns absence/skip into FAIL.

Packager — package_distribution_bundle.py --sign / --signing-key:
- Emits a detached ML-DSA-65 (FIPS 204) MANIFEST.sig.json over the EXACT
  MANIFEST.json bytes, embedding the public key + its SHA-256 fingerprint.
- Honest key semantics: --signing-key FILE persists one signing identity
  (0600) so fingerprints are stable across bundles; without it the key is
  EPHEMERAL and the signature file says so (key_persistence) — it then
  proves integrity-since-packaging, not identity. Identity always requires
  an out-of-band fingerprint comparison (stated in the artifact).

Wiring:
- run_runnable_assurance.sh: 16 -> 17 steps. Step 17 packages a signed
  bundle and verifies it with the independent verifier in strict
  --require-signature mode, asserting all 10 checks PASS.
- Generated DISTRIBUTION_README.md + EXECUTION_CHECKLIST.md now include a
  'verify as received' section / step 6 for the recipient.
- RUNNABLE_ASSURANCE.md: row 17 documented.
- Refreshed generated OSCAL deliverables from the final suite run.

Tamper negatives (all verified by tests, 30/30 governance tests pass):
- Artifact byte edit -> artifact-byte-digest + artifact-content-digest FAIL.
- Forged manifest claims (inflated SATISFIED, hidden gaps) ->
  summary-consistency FAILs (and the signature breaks).
- Single-byte whitespace change to MANIFEST.json with digests intact ->
  ONLY the ML-DSA-65 signature check fails (precise localization).
- --require-signature on an unsigned bundle -> FAILED with explicit error.
- Persistent-key double-signing -> identical public-key fingerprints; both
  bundles VERIFIED in strict mode.

Full suite result: 17/17 runnable assurance checks PASS.

…against a digest-protected ledger (18th assurance check)

The OSCAL catalogs declare per-control freshness-sla props (env-01 PT5M,
cry-02/rte-01 P1D, con-07 P7D, cry-05 P3M, con-04 P1D/P90D) but check C3
only validated their FORMAT — nothing recorded when evidence was produced
and nothing failed when it went stale. The SLA was prose. This makes it
enforced.

New tool — governance_artifacts/check_evidence_freshness.py:
- --run executes every control's mapped runnable assurance check using the
  SAME single-source-of-truth CONTROL_EVIDENCE map the regulator deliverable
  generators use (no parallel drift-prone map) and writes a freshness ledger
  (oscal/generated/evidence_freshness_ledger.json) recording pass/fail, the
  UTC instant evidence was produced, and duration. Entries are protected by
  a SHA-256 ledger digest over the canonical entries JSON.
- --audit enforces each catalog-declared SLA against those instants with
  named, falsifiable checks: ledger-digest, evidence-recorded,
  evidence-passed, evidence-fresh. Per-control statuses: FRESH / STALE /
  FAILED / NOT-RECORDED / FUTURE-DATED / SLA-MISSING / SLA-MALFORMED /
  NOT-RUNNABLE. Exit 0 iff every runnable control is recorded, passed and
  fresh with an intact digest.
- Honest semantics: organisational-evidence controls (env-02) are disclosed
  NOT-RUNNABLE, never counted fresh and never silently passed; a failed
  check is never fresh; future-dated evidence (forged timestamp/clock skew)
  fails; a missing ledger fails, never passes vacuously. Stated conversion
  convention (1M=30d, 1Y=365d; compound P1D/P90D enforces the first period)
  so audits are reproducible. The ledger digest detects casual edits, is
  NOT a signature — pair with the ML-DSA-65-signed bundle (checks 16/17)
  for signed provenance. --as-of enables reproducible point-in-time audits.

Wiring:
- run_runnable_assurance.sh: 17 -> 18 steps. Step 18 runs --run --audit
  --print and asserts PASS, intact digest, zero failing controls, all
  runnable controls FRESH, and >=1 organisational control disclosed.
- RUNNABLE_ASSURANCE.md: row 18 documents the gate and its honesty limits.

Tests (tests/governance/test_governance_artifacts.py — round 8, +7):
- SLA parser conventions (PT5M=300s, P3M=90d, P1D/P90D first period;
  malformed P/PT/5M/P-1D/'' rejected).
- Fresh synthetic ledger -> PASS with env-02 disclosed NOT-RUNNABLE.
- Auditing 10 min later flips env-01 (PT5M) STALE and fails the gate while
  cry-05 (P3M) stays FRESH — SLA granularity actually matters.
- Timestamp edit without re-digesting -> ledger-digest MISMATCH -> FAIL.
- passed=false is never FRESH; future-dated evidence FAILs; a control
  missing from the ledger is NOT-RECORDED; missing ledger file FAILs.
- Single-source-of-truth check: every runnable CONTROL_EVIDENCE control
  with a declared SLA is covered by the committed ledger.

Full suite result: 18/18 runnable assurance checks PASS; 37/37 governance
tests PASS.