[chubirka]

Scope

Second reporting slice of plan 15 decision 10: compliance field precision only. No benchmark/PQC/inventory work, evaluator reruns, automatic demotion, new storage, or producer-semantic changes.

• Register ViewName.COMPLIANCE_PRECISION over DetectionQualityService.calibrate_compliance; CompliancePrecision contains the existing typed calibration under calibration without copying its fields or calculations.
• Require ViewFilter.framework; optional finite [0,1] precision_gate retains the native default and inclusive review boundary. Refuse unsupported historical/spatial/window scope and prevent other views from silently ignoring these parameters. Implicit refresh skips missing-framework views and selects compatible views when calibration parameters are given.
• Use the existing Insight REST registry with framework/precision_gate query parameters, and shared structured Markdown/HTML renderers. Raw check IDs stay intact in the model and inert in human output. Retire the standalone Markdown helper and its incidental wording tests; no re-exports/shims.
• Preserve native distinct-document digest deduplication, automatic firings, attributed human dismissals, and unmeasured empty populations. Builds/reports/publishing write no SQL rows or object bytes.

Dependency gate — keep draft

Contracts schema PR: traust-security/traust-contracts#123 (9abd7aa). A pre-existing dependency mismatch was found during real fresh-store validation: Core development already pins the unmerged contracts#117 head 620b838, whose remediation tables/order fields do not exist on contracts development. Directly pinning #123's development-based commit removes required storage resources.

This draft therefore uses temporary immutable integration commit a1648d7585b2c2350e3e0168e79e17a517073678, a normal merge of the existing Core pin and #123 (including already-merged #120). It preserves the current contract surface; no storage files are added or changed by this PR. The independent schema PR and remediation PR are untouched. No remediation redesign is included.

Before ready/merge: the owner must reconcile/merge contracts#117's dependency surface, merge #123, then replace this temporary pin with the compatible development merge commit and rerun verification. The Traust consumer remains a downstream draft until this Core PR is merged/re-pinned. No automatic merges requested.

Exercised verification

• make lint-fix: passed.
• Focused native SQLite/PostgreSQL and REST coverage: 194 passed.
• make test: 11,575 passed / 1 skipped.
• Normal pre-push lint/coverage: 95.35%, same 11,575 passing unit tests.
• make api-check: 71 paths; new view uses the existing registry route.
• Actual localhost HTTP-server smoke: schema/framework reference resolved locally; native deduplication and override counts, inclusive gate/custom gate, inert hostile check IDs, compatible implicit refresh, 401/422 refusals, and unchanged snapshots of all contract rows/object bytes.
• Contracts integration separately passed 1,449 SQLite/PostgreSQL tests / 2 SQLite concurrency skips and installed-wheel schema/DDL smoke with zero external schema retrievals.

README documents the contract, scope, semantics and retired renderer. Native producer calls remain unchanged.

[chubirka]

/agentic_review

[qodo-for-traust-sci]

Code Review by Qodo

Nice, no open findings for this group

Nice, no open findings for this group

Nice, no open findings for this group

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit 12c645c ⚖️ Balanced

Results up to commit 8fd9d03 ⚖️ Balanced

No changes from previous review

[chubirka]

The downstream consumer is now published as draft traust#379, preserving the flat sweep JSON/stdout contract and using this registered view for shared Markdown/HTML.

Follow-up 12c645c89c80cb8ea410756b93056e93326753ca applies the report recipe's unmeasured-cell convention: — for null precision, while measured zero remains 0.0. A typed mixed unknown/zero report was rendered through both shared renderers; native null/zero values remained distinct. No wording-pinning permanent tests were added. The same 194 focused cases passed, and normal pre-push coverage reran 11,575 passed / 1 skipped, 95.35%.

No model, producer, scope, dependency or persistence behavior changed in that follow-up. The consumer pin is being aligned to this immutable head. The existing contracts#117/#123 reconciliation and merge/re-pin gate remains unchanged; this PR stays draft.

[qodo-for-traust-sci]

PR Summary by Qodo

Publish native compliance field precision through Insight

✨ Enhancement 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Adds a schema-validated Insight view around native compliance calibration, without changing its
 calculations or storing results.
• Requires a framework, validates the optional precision gate, and rejects incompatible filters
 across service and REST entry points.
• Replaces the standalone Markdown helper with shared Markdown/HTML publishing and tests read-only
 behavior.

Diagram

graph TD
  REST["Insight REST"] --> Insight["Insight service"] --> View["Precision view"] --> Quality["Detection quality"] --> Records[("Recorded assessments")]
  Context["Context registry"] --> Insight
  View --> Schemas["Contract schemas"]
  View --> Renderers["Shared renderers"]

Loading

High-Level Assessment

Reusing native calibration and the existing Insight registry avoids a second precision calculation or publication path. Keep the PR draft until the temporary contracts integration pin is replaced with the compatible merged dependency and verification is rerun.

Files changed (10) +489 / -7

Enhancement (5) +123 / -3

context.pyRegister the compliance precision view +2/-0

Register the compliance precision view

• Adds CompliancePrecisionView to the Insight views constructed by Context, using the existing detection-quality service.

src/traust_core/v1/context/context.py

contracts.pyResolve local references during view validation +3/-1

Resolve local references during view validation

• Passes the existing artifact-schema registry to the view validator so the new view schema can reuse the canonical compliance framework vocabulary.

src/traust_core/v1/contracts.py

insight.pyDefine the precision view model and filters +9/-1

Define the precision view model and filters

• Adds the compliance-precision view name and a model containing the native typed calibration. Adds framework and finite, bounded precision-gate fields to ViewFilter.

src/traust_core/v1/models/insight.py

insights.pyExpose calibration filters on the existing REST route +5/-0

Expose calibration filters on the existing REST route

• Accepts a framework and validated precision gate as query parameters and forwards them through ViewFilter. No separate route is introduced.

src/traust_core/v1/rest/insight/insights.py

insight.pyBuild, validate, and report native precision +104/-1

Build, validate, and report native precision

• Adds a view that requires a framework, rejects unsupported scope, wraps native calibration, and validates its document against the view schema. It supplies human-readable report sections for shared rendering, while refresh selects compatible views and other views reject calibration-only parameters.

src/traust_core/v1/services/insight.py

Tests (2) +346 / -0

test_compliance_precision.pyCover the precision REST contract +110/-0

Cover the precision REST contract

• Tests native response data, raw check IDs, empty populations, authentication, invalid or inapplicable parameters, and absence of storage writes.

tests/v1/rest/insight/test_compliance_precision.py

test_insight_compliance_precision.pyExercise precision publishing against native stores +236/-0

Exercise precision publishing against native stores

• Tests distinct-document counts, override attribution, inclusive gate behavior, framework isolation, filter and refresh behavior, and inert human rendering. Snapshots SQL rows and object bytes to verify that builds and publishing do not write.

tests/v1/services/test_insight_compliance_precision.py

Documentation (1) +17 / -1

README.mdDocument the native precision view +17/-1

Document the native precision view

• Describes the new Insight entry point, supported filters, population semantics, unmeasured results, and read-only publishing. Removes the standalone precision renderer from the capability table.

README.md

Other (2) +3 / -3

pyproject.tomlPin the temporary compatible contracts merge +1/-1

Pin the temporary compatible contracts merge

• Changes the contracts dependency to an immutable integration commit that combines the existing dependency surface with the new view schema. The pin remains a draft dependency gate pending a compatible development merge.

pyproject.toml

uv.lockLock the temporary contracts integration commit +2/-2

Lock the temporary contracts integration commit

• Updates the resolved contracts source and project requirement to match the immutable pin in pyproject.toml.

uv.lock

[qodo-code-review]

Code review by qodo was updated up to the latest commit 12c645c