Struct OpaProfile 

pub struct OpaProfile { /* private fields */ }

OPA-based profile that evaluates Rego policies to map control findings to gate decisions, enabling per-organization customization.

Implementations

impl OpaProfile

pub fn from_file(path: &str) -> Result<Self>

Loads a custom Rego policy from the given file path.

pub fn from_rego(name: &str, rego: &str) -> Result<Self>

Loads a Rego policy from a string.

pub fn default_policy() -> Result<Self>

pub fn oss_preset() -> Result<Self>

Examples found in repository

examples/audit_scenarios.rs (line 92)

fn main() {
    let oss = OpaProfile::oss_preset().expect("oss preset");
    let soc2 = OpaProfile::soc2_preset().expect("soc2 preset");

    let secret_ctrl = SecretScanningControl;
    let codeowners_ctrl = CodeownersCoverageControl;
    let vuln_ctrl = VulnerabilityScanningControl;
    let secpol_ctrl = SecurityPolicyControl;

    // --- Scenario A: secret scanning ON, push protection OFF ---
    // Expected: Satisfied with "detection" tier (not "prevention")
    let mut posture_a = default_posture();
    posture_a.secret_scanning_enabled = true;
    posture_a.secret_push_protection_enabled = false;
    let bundle_a = bundle_from_posture(posture_a);

    // --- Scenario B: CODEOWNERS with exactly 2 entries (below threshold of 3) ---
    // Expected: Violated (insufficient targeted coverage)
    let mut posture_b = default_posture();
    posture_b.codeowners_entries = vec![
        entry("/src/auth/", &["@org/security"]),
        entry("/infra/", &["@org/platform"]),
    ];
    let bundle_b = bundle_from_posture(posture_b);

    // --- Scenario C: CODEOWNERS with exactly 3 targeted entries (at threshold) ---
    // Expected: Satisfied (intentional targeted coverage)
    let mut posture_c = default_posture();
    posture_c.codeowners_entries = vec![
        entry("/src/auth/", &["@org/security"]),
        entry("/infra/", &["@org/platform"]),
        entry("/.github/", &["@org/devops"]),
    ];
    let bundle_c = bundle_from_posture(posture_c);

    // --- Scenario D: vulnerability scanning ON, code scanning OFF ---
    // Expected: Satisfied with "sca-only" tier (not "sca+sast")
    let mut posture_d = default_posture();
    posture_d.vulnerability_scanning_enabled = true;
    posture_d.code_scanning_enabled = false;
    let bundle_d = bundle_from_posture(posture_d);

    // --- Scenario E: SECURITY.md present but no disclosure process ---
    // Expected: Violated (policy exists but incomplete)
    let mut posture_e = default_posture();
    posture_e.security_policy_present = true;
    posture_e.security_policy_has_disclosure = false;
    let bundle_e = bundle_from_posture(posture_e);

    let results = vec![
        run_scenario(
            "A: Secret scanning ON, push protection OFF",
            &secret_ctrl,
            &bundle_a,
            ControlStatus::Satisfied,
            &oss,
            &soc2,
        ),
        run_scenario(
            "B: CODEOWNERS 2 entries (below threshold)",
            &codeowners_ctrl,
            &bundle_b,
            ControlStatus::Violated,
            &oss,
            &soc2,
        ),
        run_scenario(
            "C: CODEOWNERS 3 entries (at threshold)",
            &codeowners_ctrl,
            &bundle_c,
            ControlStatus::Satisfied,
            &oss,
            &soc2,
        ),
        run_scenario(
            "D: Vuln scanning ON, code scanning OFF",
            &vuln_ctrl,
            &bundle_d,
            ControlStatus::Satisfied,
            &oss,
            &soc2,
        ),
        run_scenario(
            "E: SECURITY.md present, no disclosure",
            &secpol_ctrl,
            &bundle_e,
            ControlStatus::Violated,
            &oss,
            &soc2,
        ),
    ];

    // --- Report ---
    println!("=== SOC2 Type II Audit Edge-Case Scenarios ===\n");

    let mut all_pass = true;
    for r in &results {
        let status_ok = r.actual_status == r.expected_status;
        let marker = if status_ok { "PASS" } else { "FAIL" };
        if !status_ok {
            all_pass = false;
        }

        println!("--- {} ---", r.name);
        println!(
            "  Status:    {} (expected: {}) [{}]",
            r.actual_status, r.expected_status, marker
        );
        println!("  Rationale: {}", r.rationale);
        println!("  Subjects:  {:?}", r.subjects);
        println!(
            "  OSS decision:  {:?}   SOC2 decision: {:?}",
            r.oss_decision, r.soc2_decision
        );
        println!();
    }

    // --- Policy differentiation summary ---
    println!("=== Policy Differentiation Summary ===\n");
    for r in &results {
        let diff = if r.oss_decision != r.soc2_decision {
            format!(
                "DIFFER (OSS={:?}, SOC2={:?})",
                r.oss_decision, r.soc2_decision
            )
        } else {
            format!("SAME ({:?})", r.oss_decision)
        };
        println!("  {}: {}", r.name, diff);
    }

    // --- Tiered subject verification ---
    println!("\n=== Tiered Subject Verification ===\n");
    let tier_checks: &[(&str, &str, usize)] = &[
        ("A: detection tier", "detection", 0),
        ("D: sca-only tier", "sca-only", 3),
    ];
    for (label, needle, idx) in tier_checks {
        let found = results[*idx].subjects.iter().any(|s| s.contains(needle));
        let mark = if found { "PRESENT" } else { "MISSING" };
        println!("  {}: '{}' -> [{}]", label, needle, mark);
    }

    println!();
    if all_pass {
        println!("All scenarios produced the expected control status.");
    } else {
        println!("WARNING: Some scenarios did NOT match expected status.");
        std::process::exit(1);
    }
}

examples/startup_graduation.rs (line 129)

fn main() {
    println!("==========================================================");
    println!("  libverify: OSS -> SOC2 Graduation Path Demo");
    println!("  Startup: 15-person team preparing for SOC2 Type II");
    println!("==========================================================\n");

    // --- Describe the startup posture ---
    println!("STARTUP POSTURE:");
    println!("  - No CODEOWNERS file");
    println!("  - Dependabot enabled, no secret scanning");
    println!("  - Basic SECURITY.md (no disclosure process)");
    println!("  - Self-reviewed PRs (author == sole reviewer)");
    println!("  - Unsigned commits, no branch protection");
    println!("  - CI running (tests + lint pass), no build provenance");
    println!("  - No dependency signature verification");
    println!();

    // --- Run all 28 controls ---
    let evidence = startup_evidence();
    let controls = all_controls();
    println!("Running {} controls against evidence...\n", controls.len());
    let findings = evaluate_all(&controls, &evidence);

    // --- Evaluate through OSS preset ---
    let oss_profile = OpaProfile::oss_preset().expect("OSS preset should load");
    let oss_outcomes = apply_profile(&oss_profile, &findings);

    // --- Evaluate through SOC2 preset ---
    let soc2_profile = OpaProfile::soc2_preset().expect("SOC2 preset should load");
    let soc2_outcomes = apply_profile(&soc2_profile, &findings);

    // --- Print side-by-side comparison ---
    println!(
        "{:<40} {:<12} {:<12}  {}",
        "CONTROL", "OSS", "SOC2", "DELTA"
    );
    println!("{}", "-".repeat(90));

    let mut oss_pass = 0u32;
    let mut oss_review = 0u32;
    let mut oss_fail = 0u32;
    let mut soc2_pass = 0u32;
    let mut soc2_review = 0u32;
    let mut soc2_fail = 0u32;
    let mut graduation_blockers: Vec<(String, String)> = Vec::new();

    for (oss_out, soc2_out) in oss_outcomes.iter().zip(soc2_outcomes.iter()) {
        let oss_dec = oss_out.decision;
        let soc2_dec = soc2_out.decision;

        match oss_dec {
            GateDecision::Pass => oss_pass += 1,
            GateDecision::Review => oss_review += 1,
            GateDecision::Fail => oss_fail += 1,
        }
        match soc2_dec {
            GateDecision::Pass => soc2_pass += 1,
            GateDecision::Review => soc2_review += 1,
            GateDecision::Fail => soc2_fail += 1,
        }

        let delta = if oss_dec == soc2_dec {
            " ".to_string()
        } else {
            let arrow = format!("{} -> {}", oss_dec, soc2_dec);
            if soc2_dec == GateDecision::Fail {
                graduation_blockers.push((
                    oss_out.control_id.as_str().to_string(),
                    oss_out.rationale.clone(),
                ));
                format!("!! {arrow}")
            } else {
                format!("   {arrow}")
            }
        };

        println!(
            "{:<40} {:<12} {:<12}  {}",
            oss_out.control_id.as_str(),
            format!("{}", oss_dec),
            format!("{}", soc2_dec),
            delta,
        );
    }

    // --- Summary ---
    println!("\n{}", "=".repeat(90));
    println!("SUMMARY\n");
    println!(
        "  OSS  preset:  {} pass / {} review / {} fail",
        oss_pass, oss_review, oss_fail
    );
    println!(
        "  SOC2 preset:  {} pass / {} review / {} fail",
        soc2_pass, soc2_review, soc2_fail
    );

    println!("\n{}", "-".repeat(90));
    println!(
        "GRADUATION BLOCKERS (review in OSS, fail in SOC2): {}\n",
        graduation_blockers.len()
    );
    if graduation_blockers.is_empty() {
        println!("  None -- you are already SOC2-ready (unlikely for a startup!)");
    } else {
        for (id, rationale) in &graduation_blockers {
            println!("  [BLOCK] {id}");
            println!("          {rationale}\n");
        }
    }

    // Also show controls that fail in both (already broken)
    let both_fail: Vec<_> = oss_outcomes
        .iter()
        .zip(soc2_outcomes.iter())
        .filter(|(o, s)| o.decision == GateDecision::Fail && s.decision == GateDecision::Fail)
        .map(|(o, _)| o.control_id.as_str().to_string())
        .collect();

    if !both_fail.is_empty() {
        println!("{}", "-".repeat(90));
        println!(
            "FAIL IN BOTH presets (fix these regardless): {}\n",
            both_fail.len()
        );
        for id in &both_fail {
            println!("  [FAIL] {id}");
        }
    }

    // Controls that are review in SOC2 (needs attention but not blocking)
    let soc2_review_list: Vec<_> = soc2_outcomes
        .iter()
        .filter(|o| o.decision == GateDecision::Review)
        .map(|o| o.control_id.as_str().to_string())
        .collect();

    if !soc2_review_list.is_empty() {
        println!("\n{}", "-".repeat(90));
        println!(
            "SOC2 REVIEW items (auditor will ask questions): {}\n",
            soc2_review_list.len()
        );
        for id in &soc2_review_list {
            println!("  [REVIEW] {id}");
        }
    }

    println!("\n{}", "=".repeat(90));
    println!("GRADUATION ROADMAP:");
    println!("  1. Enable branch protection + require reviews  (unblocks review-independence,");
    println!("     two-party-review, branch-protection-enforcement, branch-history-integrity)");
    println!("  2. Enable secret scanning + push protection    (unblocks secret-scanning)");
    println!("  3. Add CODEOWNERS file                         (unblocks codeowners-coverage)");
    println!("  4. Sign commits (GPG/SSH)                      (unblocks source-authenticity)");
    println!("  5. Link issues to PRs                          (unblocks issue-linkage)");
    println!("  6. Add disclosure process to SECURITY.md       (unblocks security-policy)");
    println!("  7. Set up build provenance (SLSA)              (unblocks build-track controls)");
    println!("{}", "=".repeat(90));
}

pub fn aiops_preset() -> Result<Self>

pub fn soc1_preset() -> Result<Self>

pub fn soc2_preset() -> Result<Self>

Examples found in repository

examples/fleet_assessment.rs (line 233)

fn main() {
    let soc2 = OpaProfile::soc2_preset().expect("SOC2 preset should load");
    let profiles = repo_profiles();

    let mut assessments: Vec<RepoAssessment> =
        profiles.iter().map(|p| assess_repo(p, &soc2)).collect();

    // Sort by risk score descending (worst first)
    assessments.sort_by(|a, b| risk_score(b).cmp(&risk_score(a)));

    // ---- Fleet Summary Table ----
    println!("==========================================================================");
    println!("  FLEET-WIDE ASPM ASSESSMENT — SOC2 Preset (4 ASPM Controls x 5 Repos)");
    println!("==========================================================================");
    println!();
    println!(
        "  {:<20} {:>4}  {:>6}  {:>4}  {:>5}  {:<10}",
        "Repository", "Pass", "Review", "Fail", "Score", "Risk Tier"
    );
    println!(
        "  {:-<20} {:->4}  {:->6}  {:->4}  {:->5}  {:-<10}",
        "", "", "", "", "", ""
    );

    for a in &assessments {
        let score = risk_score(a);
        println!(
            "  {:<20} {:>4}  {:>6}  {:>4}  {:>5}  {:<10}",
            a.name,
            a.pass,
            a.review,
            a.fail,
            score,
            risk_tier(score),
        );
    }

    // ---- Fleet Totals ----
    let total_pass: u32 = assessments.iter().map(|a| a.pass).sum();
    let total_review: u32 = assessments.iter().map(|a| a.review).sum();
    let total_fail: u32 = assessments.iter().map(|a| a.fail).sum();
    let total = total_pass + total_review + total_fail;

    println!();
    println!(
        "  Fleet totals: {} pass / {} review / {} fail out of {} checks",
        total_pass, total_review, total_fail, total
    );
    println!(
        "  Fleet pass rate: {:.0}%",
        if total > 0 {
            (total_pass as f64 / total as f64) * 100.0
        } else {
            0.0
        }
    );

    // ---- Per-Repo Detail ----
    println!();
    println!("==========================================================================");
    println!("  PER-REPO FINDINGS (ordered by risk, worst first)");
    println!("==========================================================================");

    for a in &assessments {
        let score = risk_score(a);
        println!();
        println!(
            "  [{:<10}] {} — {}",
            risk_tier(score),
            a.name,
            a.description
        );

        for (control_id, decision, rationale) in &a.details {
            let symbol = decision_symbol(*decision);
            println!("    {:<6}  {:<26}  {}", symbol, control_id, rationale);
        }
    }

    // ---- Actionable Remediation Priorities ----
    println!();
    println!("==========================================================================");
    println!("  REMEDIATION PRIORITIES");
    println!("==========================================================================");
    println!();

    // Collect all failures across fleet, grouped by control
    let control_ids = [
        builtin::CODEOWNERS_COVERAGE,
        builtin::SECRET_SCANNING,
        builtin::VULNERABILITY_SCANNING,
        builtin::SECURITY_POLICY,
    ];

    for cid in &control_ids {
        let failing_repos: Vec<&str> = assessments
            .iter()
            .filter(|a| {
                a.details
                    .iter()
                    .any(|(id, d, _)| id == *cid && *d == GateDecision::Fail)
            })
            .map(|a| a.name)
            .collect();

        let review_repos: Vec<&str> = assessments
            .iter()
            .filter(|a| {
                a.details
                    .iter()
                    .any(|(id, d, _)| id == *cid && *d == GateDecision::Review)
            })
            .map(|a| a.name)
            .collect();

        if !failing_repos.is_empty() || !review_repos.is_empty() {
            println!("  {}", cid);
            if !failing_repos.is_empty() {
                println!(
                    "    FAIL ({} repos):   {}",
                    failing_repos.len(),
                    failing_repos.join(", ")
                );
            }
            if !review_repos.is_empty() {
                println!(
                    "    REVIEW ({} repos): {}",
                    review_repos.len(),
                    review_repos.join(", ")
                );
            }
            println!();
        }
    }

    // ---- Worst Repo Call-out ----
    if let Some(worst) = assessments.first() {
        let score = risk_score(worst);
        println!(
            "  Worst-posture repo: {} (score={}, tier={})",
            worst.name,
            score,
            risk_tier(score)
        );
        println!("  Recommended: prioritize enabling secret scanning and CODEOWNERS");
        println!("  for repos in CRITICAL/HIGH tiers before next SOC2 audit window.");
    }

    println!();
}

examples/audit_scenarios.rs (line 93)

fn main() {
    let oss = OpaProfile::oss_preset().expect("oss preset");
    let soc2 = OpaProfile::soc2_preset().expect("soc2 preset");

    let secret_ctrl = SecretScanningControl;
    let codeowners_ctrl = CodeownersCoverageControl;
    let vuln_ctrl = VulnerabilityScanningControl;
    let secpol_ctrl = SecurityPolicyControl;

    // --- Scenario A: secret scanning ON, push protection OFF ---
    // Expected: Satisfied with "detection" tier (not "prevention")
    let mut posture_a = default_posture();
    posture_a.secret_scanning_enabled = true;
    posture_a.secret_push_protection_enabled = false;
    let bundle_a = bundle_from_posture(posture_a);

    // --- Scenario B: CODEOWNERS with exactly 2 entries (below threshold of 3) ---
    // Expected: Violated (insufficient targeted coverage)
    let mut posture_b = default_posture();
    posture_b.codeowners_entries = vec![
        entry("/src/auth/", &["@org/security"]),
        entry("/infra/", &["@org/platform"]),
    ];
    let bundle_b = bundle_from_posture(posture_b);

    // --- Scenario C: CODEOWNERS with exactly 3 targeted entries (at threshold) ---
    // Expected: Satisfied (intentional targeted coverage)
    let mut posture_c = default_posture();
    posture_c.codeowners_entries = vec![
        entry("/src/auth/", &["@org/security"]),
        entry("/infra/", &["@org/platform"]),
        entry("/.github/", &["@org/devops"]),
    ];
    let bundle_c = bundle_from_posture(posture_c);

    // --- Scenario D: vulnerability scanning ON, code scanning OFF ---
    // Expected: Satisfied with "sca-only" tier (not "sca+sast")
    let mut posture_d = default_posture();
    posture_d.vulnerability_scanning_enabled = true;
    posture_d.code_scanning_enabled = false;
    let bundle_d = bundle_from_posture(posture_d);

    // --- Scenario E: SECURITY.md present but no disclosure process ---
    // Expected: Violated (policy exists but incomplete)
    let mut posture_e = default_posture();
    posture_e.security_policy_present = true;
    posture_e.security_policy_has_disclosure = false;
    let bundle_e = bundle_from_posture(posture_e);

    let results = vec![
        run_scenario(
            "A: Secret scanning ON, push protection OFF",
            &secret_ctrl,
            &bundle_a,
            ControlStatus::Satisfied,
            &oss,
            &soc2,
        ),
        run_scenario(
            "B: CODEOWNERS 2 entries (below threshold)",
            &codeowners_ctrl,
            &bundle_b,
            ControlStatus::Violated,
            &oss,
            &soc2,
        ),
        run_scenario(
            "C: CODEOWNERS 3 entries (at threshold)",
            &codeowners_ctrl,
            &bundle_c,
            ControlStatus::Satisfied,
            &oss,
            &soc2,
        ),
        run_scenario(
            "D: Vuln scanning ON, code scanning OFF",
            &vuln_ctrl,
            &bundle_d,
            ControlStatus::Satisfied,
            &oss,
            &soc2,
        ),
        run_scenario(
            "E: SECURITY.md present, no disclosure",
            &secpol_ctrl,
            &bundle_e,
            ControlStatus::Violated,
            &oss,
            &soc2,
        ),
    ];

    // --- Report ---
    println!("=== SOC2 Type II Audit Edge-Case Scenarios ===\n");

    let mut all_pass = true;
    for r in &results {
        let status_ok = r.actual_status == r.expected_status;
        let marker = if status_ok { "PASS" } else { "FAIL" };
        if !status_ok {
            all_pass = false;
        }

        println!("--- {} ---", r.name);
        println!(
            "  Status:    {} (expected: {}) [{}]",
            r.actual_status, r.expected_status, marker
        );
        println!("  Rationale: {}", r.rationale);
        println!("  Subjects:  {:?}", r.subjects);
        println!(
            "  OSS decision:  {:?}   SOC2 decision: {:?}",
            r.oss_decision, r.soc2_decision
        );
        println!();
    }

    // --- Policy differentiation summary ---
    println!("=== Policy Differentiation Summary ===\n");
    for r in &results {
        let diff = if r.oss_decision != r.soc2_decision {
            format!(
                "DIFFER (OSS={:?}, SOC2={:?})",
                r.oss_decision, r.soc2_decision
            )
        } else {
            format!("SAME ({:?})", r.oss_decision)
        };
        println!("  {}: {}", r.name, diff);
    }

    // --- Tiered subject verification ---
    println!("\n=== Tiered Subject Verification ===\n");
    let tier_checks: &[(&str, &str, usize)] = &[
        ("A: detection tier", "detection", 0),
        ("D: sca-only tier", "sca-only", 3),
    ];
    for (label, needle, idx) in tier_checks {
        let found = results[*idx].subjects.iter().any(|s| s.contains(needle));
        let mark = if found { "PRESENT" } else { "MISSING" };
        println!("  {}: '{}' -> [{}]", label, needle, mark);
    }

    println!();
    if all_pass {
        println!("All scenarios produced the expected control status.");
    } else {
        println!("WARNING: Some scenarios did NOT match expected status.");
        std::process::exit(1);
    }
}

examples/startup_graduation.rs (line 133)

fn main() {
    println!("==========================================================");
    println!("  libverify: OSS -> SOC2 Graduation Path Demo");
    println!("  Startup: 15-person team preparing for SOC2 Type II");
    println!("==========================================================\n");

    // --- Describe the startup posture ---
    println!("STARTUP POSTURE:");
    println!("  - No CODEOWNERS file");
    println!("  - Dependabot enabled, no secret scanning");
    println!("  - Basic SECURITY.md (no disclosure process)");
    println!("  - Self-reviewed PRs (author == sole reviewer)");
    println!("  - Unsigned commits, no branch protection");
    println!("  - CI running (tests + lint pass), no build provenance");
    println!("  - No dependency signature verification");
    println!();

    // --- Run all 28 controls ---
    let evidence = startup_evidence();
    let controls = all_controls();
    println!("Running {} controls against evidence...\n", controls.len());
    let findings = evaluate_all(&controls, &evidence);

    // --- Evaluate through OSS preset ---
    let oss_profile = OpaProfile::oss_preset().expect("OSS preset should load");
    let oss_outcomes = apply_profile(&oss_profile, &findings);

    // --- Evaluate through SOC2 preset ---
    let soc2_profile = OpaProfile::soc2_preset().expect("SOC2 preset should load");
    let soc2_outcomes = apply_profile(&soc2_profile, &findings);

    // --- Print side-by-side comparison ---
    println!(
        "{:<40} {:<12} {:<12}  {}",
        "CONTROL", "OSS", "SOC2", "DELTA"
    );
    println!("{}", "-".repeat(90));

    let mut oss_pass = 0u32;
    let mut oss_review = 0u32;
    let mut oss_fail = 0u32;
    let mut soc2_pass = 0u32;
    let mut soc2_review = 0u32;
    let mut soc2_fail = 0u32;
    let mut graduation_blockers: Vec<(String, String)> = Vec::new();

    for (oss_out, soc2_out) in oss_outcomes.iter().zip(soc2_outcomes.iter()) {
        let oss_dec = oss_out.decision;
        let soc2_dec = soc2_out.decision;

        match oss_dec {
            GateDecision::Pass => oss_pass += 1,
            GateDecision::Review => oss_review += 1,
            GateDecision::Fail => oss_fail += 1,
        }
        match soc2_dec {
            GateDecision::Pass => soc2_pass += 1,
            GateDecision::Review => soc2_review += 1,
            GateDecision::Fail => soc2_fail += 1,
        }

        let delta = if oss_dec == soc2_dec {
            " ".to_string()
        } else {
            let arrow = format!("{} -> {}", oss_dec, soc2_dec);
            if soc2_dec == GateDecision::Fail {
                graduation_blockers.push((
                    oss_out.control_id.as_str().to_string(),
                    oss_out.rationale.clone(),
                ));
                format!("!! {arrow}")
            } else {
                format!("   {arrow}")
            }
        };

        println!(
            "{:<40} {:<12} {:<12}  {}",
            oss_out.control_id.as_str(),
            format!("{}", oss_dec),
            format!("{}", soc2_dec),
            delta,
        );
    }

    // --- Summary ---
    println!("\n{}", "=".repeat(90));
    println!("SUMMARY\n");
    println!(
        "  OSS  preset:  {} pass / {} review / {} fail",
        oss_pass, oss_review, oss_fail
    );
    println!(
        "  SOC2 preset:  {} pass / {} review / {} fail",
        soc2_pass, soc2_review, soc2_fail
    );

    println!("\n{}", "-".repeat(90));
    println!(
        "GRADUATION BLOCKERS (review in OSS, fail in SOC2): {}\n",
        graduation_blockers.len()
    );
    if graduation_blockers.is_empty() {
        println!("  None -- you are already SOC2-ready (unlikely for a startup!)");
    } else {
        for (id, rationale) in &graduation_blockers {
            println!("  [BLOCK] {id}");
            println!("          {rationale}\n");
        }
    }

    // Also show controls that fail in both (already broken)
    let both_fail: Vec<_> = oss_outcomes
        .iter()
        .zip(soc2_outcomes.iter())
        .filter(|(o, s)| o.decision == GateDecision::Fail && s.decision == GateDecision::Fail)
        .map(|(o, _)| o.control_id.as_str().to_string())
        .collect();

    if !both_fail.is_empty() {
        println!("{}", "-".repeat(90));
        println!(
            "FAIL IN BOTH presets (fix these regardless): {}\n",
            both_fail.len()
        );
        for id in &both_fail {
            println!("  [FAIL] {id}");
        }
    }

    // Controls that are review in SOC2 (needs attention but not blocking)
    let soc2_review_list: Vec<_> = soc2_outcomes
        .iter()
        .filter(|o| o.decision == GateDecision::Review)
        .map(|o| o.control_id.as_str().to_string())
        .collect();

    if !soc2_review_list.is_empty() {
        println!("\n{}", "-".repeat(90));
        println!(
            "SOC2 REVIEW items (auditor will ask questions): {}\n",
            soc2_review_list.len()
        );
        for id in &soc2_review_list {
            println!("  [REVIEW] {id}");
        }
    }

    println!("\n{}", "=".repeat(90));
    println!("GRADUATION ROADMAP:");
    println!("  1. Enable branch protection + require reviews  (unblocks review-independence,");
    println!("     two-party-review, branch-protection-enforcement, branch-history-integrity)");
    println!("  2. Enable secret scanning + push protection    (unblocks secret-scanning)");
    println!("  3. Add CODEOWNERS file                         (unblocks codeowners-coverage)");
    println!("  4. Sign commits (GPG/SSH)                      (unblocks source-authenticity)");
    println!("  5. Link issues to PRs                          (unblocks issue-linkage)");
    println!("  6. Add disclosure process to SECURITY.md       (unblocks security-policy)");
    println!("  7. Set up build provenance (SLSA)              (unblocks build-track controls)");
    println!("{}", "=".repeat(90));
}

pub fn slsa_l1_preset() -> Result<Self>

pub fn slsa_l2_preset() -> Result<Self>

pub fn slsa_l3_preset() -> Result<Self>

pub fn slsa_l4_preset() -> Result<Self>

pub fn from_preset_or_file(name: &str) -> Result<Self>

Loads a built-in preset by name, or falls back to file path.

Trait Implementations

impl ControlProfile for OpaProfile

fn name(&self) -> &str

fn map(&self, finding: &ControlFinding) -> ProfileOutcome

fn severity_labels(&self) -> SeverityLabels