Workflow moved to .gitea/workflows/ci.yml (Gitea is the CI host). Every
gate now passes locally, step-for-step; green on main is pending an
act_runner on gitea.doesworks.net (runs #1-#5 are queued "Waiting").
Gate fixes found by actually running them:
- pip-audit: `--disable-pip` without `-r` was a usage error, so the old
step could never pass. Now `pip-audit --strict .` audits the runtime
dependency set from pyproject.
- pip-audit then flagged ecdsa (PYSEC-2026-1325, no fix), a hard dep of
python-jose. Swapped to PyJWT (HS256 only; 3-line change in
auth/security.py). Flag to OWC.
- PyJWT warned the test JWT secret was 11 bytes. JWT_SECRET now requires
>= 32 bytes (RFC 7518 s3.2) at settings load; dev/compose/test defaults
updated. Test-only value carries an inline gitleaks:allow.
- bandit B101: assert in retention._count_past replaced with a raise.
- gitleaks: gitleaks-action needs a GitHub token/license; replaced with
the pinned 8.30.1 binary, sha256-verified, scanning full history.
Added:
- SBOM: CycloneDX 1.6 from a clean runtime-only venv (39 components),
uploaded as a CI artifact. YPMS-POAM-042.
- cyclonedx-bom in dev extras; CI outputs gitignored.
158 tests passing, 95.83% coverage; ruff, mypy, bandit, pip-audit,
gitleaks clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every mapped table resolves a retention policy; a report-only job runs
over all of them and logs "N records to purge". ARCH §6.4; NIST AU-11,
SI-12; source RFP C.5.7.42.
- framework/retention.py: RetentionPolicy (data class, disposal, period,
anchor column, cadence, approved, authority), run_retention(), and a
`python -m ypms.framework.retention` entrypoint. Phase 0 never mutates
data: interim-period rows are counted (interim_eligible), approved-period
rows are counted (to_purge), nothing is purged. One retention_run audit
row per run.
- retention_classes.py: PIA §9 data classes at their interim periods, all
approved=False pending YPMS-POAM-054. Classes without a PIA basis
(hosts, operational logs, accounts, consent-derived) are unset and logged
by name with their governing POA&M item. Vendored framework tables are
mapped by table name so vendored files stay unchanged.
- stub_models.py + migration 0004: id + mixin models for the 26 stub
entities so each can carry a policy. Migration uses a literal table list.
- ypms/models.py: single import-all module used by Alembic env, the job,
and the test fixtures.
- Drift guard: test upgrades a scratch SQLite DB to head and compares to
Base.metadata. Found pre-existing drift in 0002 (named unique
constraints duplicating the unique indexes on roles.code, users.username,
users.email); allow-listed, follow-up noted in PHASE0_STATUS.
156 tests passing; ruff + mypy clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
