Struct DependencyCompletenessControl 

pub struct DependencyCompletenessControl;

Verifies that ALL dependencies (direct AND transitive) meet L3 verification (Dependencies L4).

Requires:

• Every dependency (regardless of is_direct) has Verified + signer_identity + transparency_log_uri
• At least one transitive dependency exists (otherwise the check is trivially satisfied and the control returns NotApplicable — a project with only direct deps should use L3)

This is the strictest dependency verification level. It ensures the entire dependency tree — not just direct dependencies — is fully provenance-verified.

Registry scoping: Only evaluates dependencies from registries that support the full trust chain (L3). Dependencies from non-L3 registries are excluded.

Trait Implementations

impl Control for DependencyCompletenessControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.