Loop 2: Team Evidence Pack

[sairintechnologycom]

Goal

Enable teams to aggregate PkgSafe results across repositories into one local-first evidence bundle.

Command

pkgsafe report team-evidence --repo-list benchmarks/real-repos.json --output pkgsafe-team-evidence.zip

Scope

• team-evidence report command
• team evidence ZIP manifest
• multi-repo summary JSON
• multi-repo summary Markdown
• per-repo results folder
• policy summary
• OSV DB status
• release verification status
• known limitations summary
• evidence recorded at evidence/loops/loop-02-team-evidence.md

Guardrails

• Local-first only
• No SaaS assumptions
• Reuse beta/GA evidence and benchmark logic where possible
• Keep npm-first GA; PyPI/Go/Cargo stay preview
• No secrets in evidence

[sairintechnologycom]

Loop 2 validation completed on branch loop-02-team-evidence.

Evidence: evidence/loops/loop-02-team-evidence.md
Generated sample ZIP: pkgsafe-team-evidence.zip

Summary:

• Added pkgsafe report team-evidence --repo-list <path> --output <zip>.
• Reused existing benchmark repo-list validation, production-readiness status, policy resolution, manifest, and redaction paths.
• Generated a local-first ZIP with manifest, JSON/Markdown team summaries, per-repo summaries, policy summary, OSV DB status, release verification status, and known limitations.
• Added empty repo-list validation and unit tests for ZIP shape.

Validation passed:

• gofmt -w cmd/pkgsafe/report.go cmd/pkgsafe/main.go cmd/pkgsafe/main_test.go
• go test ./cmd/pkgsafe
• go test ./...
• go test -race ./...
• go vet ./...
• make build
• make package
• ./dist/pkgsafe report team-evidence --repo-list benchmarks/real-repos.json --output pkgsafe-team-evidence.zip
• ZIP/manifest/content checks
• targeted credential-value scan
• missing repo path and empty repo-list validation

Result from sample command:
Repositories: 15 passed / 0 failed
Summary: allow=12 warn=0 block=0 false_blocks=0 scanner_crashes=0

No SaaS, billing, SSO, hosted services, or ecosystem promotion were introduced.