karlsCORE KI-Gemeinschaft KI-Wissen Systemisch Denken Erstgespräch Anmelden

Artifact Evidence Pack

Ein Evidence Pack ist wie eine Beweismappe vor Gericht: Es sammelt alle Nachweise, dass eine Änderung korrekt ist, alle Prüfungen bestanden hat und sicher deployed werden kann. Es ist die Grundlage für informierte Entscheidungen.

Nachweise statt Vertrauen

Im Mensch + KI-Code Prozess gilt: "Trust, but verify." Das Evidence Pack macht Verifizierung möglich. Es enthält alle Testergebnisse, Scan-Reports, Approvals und Metriken - alles an einem Ort, für jeden nachvollziehbar.

Vollständiges Beispiel

# Artifact: Evidence Pack
# Erstellt: Kontinuierlich während des Prozesses

artifact:
  type: "evidence_pack"
  version: "1.0"

  # Identifikation
  metadata:
    id: "EVD-2024-0058"
    change_id: "CHG-2024-0058"
    request_id: "REQ-2024-0057"
    created_at: "2024-01-17T15:00:00Z"
    finalized_at: "2024-01-17T15:30:00Z"
    status: "complete"

  # Test-Nachweise
  test_evidence:
    unit_tests:
      report: "reports/phpunit-unit-2024-0058.xml"
      summary:
        total: 12
        passed: 12
        failed: 0
        skipped: 0
      coverage: 94.2
      executed_at: "2024-01-17T14:00:00Z"

    integration_tests:
      report: "reports/phpunit-integration-2024-0058.xml"
      summary:
        total: 5
        passed: 5
        failed: 0
      executed_at: "2024-01-17T14:15:00Z"

    e2e_tests:
      report: "reports/cypress-2024-0058.json"
      summary:
        total: 3
        passed: 3
        failed: 0
      video_recordings:
        - "cypress/videos/oauth-flow.mp4"
      executed_at: "2024-01-17T14:30:00Z"

  # Security-Nachweise
  security_evidence:
    sast_scan:
      tool: "semgrep"
      report: "reports/semgrep-2024-0058.json"
      findings:
        critical: 0
        high: 0
        medium: 0
        low: 2
      executed_at: "2024-01-17T14:00:00Z"

    dependency_audit:
      tool: "composer audit"
      report: "reports/audit-2024-0058.json"
      vulnerabilities:
        critical: 0
        high: 0
        medium: 0
      executed_at: "2024-01-17T14:05:00Z"

    secrets_scan:
      tool: "gitleaks"
      report: "reports/gitleaks-2024-0058.json"
      secrets_found: 0
      executed_at: "2024-01-17T14:10:00Z"

  # Code Quality
  quality_evidence:
    static_analysis:
      tool: "phpstan"
      level: 8
      errors: 0
      report: "reports/phpstan-2024-0058.json"

    code_style:
      tool: "php-cs-fixer"
      violations: 0
      report: "reports/cs-fixer-2024-0058.json"

    complexity:
      tool: "phpmd"
      violations: 0
      report: "reports/phpmd-2024-0058.xml"

  # Review-Nachweise
  review_evidence:
    code_review:
      pull_request: "https://github.com/org/repo/pull/247"
      reviewers:
        - name: "alice@example.com"
          approved: true
          at: "2024-01-17T10:00:00Z"
          comments: 3
        - name: "bob@example.com"
          approved: true
          at: "2024-01-17T11:30:00Z"
          comments: 1
      total_comments: 4
      resolved_comments: 4

    security_review:
      type: "automated"
      approved: true
      at: "2024-01-17T14:15:00Z"
      by: "security-scanner"

  # Gate-Ergebnisse
  gate_evidence:
    - gate: "G2_ANALYSIS"
      passed: true
      at: "2024-01-15T14:00:00Z"
      predicates_passed: 4

    - gate: "G4_IMPLEMENTATION"
      passed: true
      at: "2024-01-17T14:45:00Z"
      predicates_passed: 4

    - gate: "G5_REVIEW"
      passed: true
      at: "2024-01-17T12:00:00Z"
      predicates_passed: 2

    - gate: "G6_RELEASE"
      passed: true
      at: "2024-01-17T15:00:00Z"
      predicates_passed: 4

  # Staging-Validierung
  staging_evidence:
    deployed_at: "2024-01-17T13:00:00Z"
    environment: "staging"
    smoke_tests:
      passed: true
      report: "reports/smoke-staging-2024-0058.json"
    manual_validation:
      by: "alice@example.com"
      at: "2024-01-17T13:30:00Z"
      checklist_complete: true

  # Approvals
  approval_evidence:
    - role: "tech_lead"
      by: "bob@example.com"
      at: "2024-01-17T14:00:00Z"
      comment: "LGTM - Clean implementation"

    - role: "product_owner"
      by: "alice@example.com"
      at: "2024-01-17T14:30:00Z"
      comment: "Acceptance criteria met"

Evidence Pack für Audits

# Compliance-Zusammenfassung
compliance_summary:
  evidence_pack_id: "EVD-2024-0058"

  attestations:
    - requirement: "All code is tested"
      evidence: "test_evidence.unit_tests"
      status: "met"

    - requirement: "No critical security issues"
      evidence: "security_evidence.sast_scan"
      status: "met"

    - requirement: "Code review by 2+ people"
      evidence: "review_evidence.code_review"
      status: "met"

    - requirement: "All gates passed"
      evidence: "gate_evidence"
      status: "met"

  audit_ready: true
  retention_period: "7 years"
  archived_at: "s3://evidence-archive/2024/EVD-2024-0058/"

Warum ist das wichtig?

Das Evidence Pack ist Beweissicherung für die Zukunft. Es beantwortet Fragen wie: "Wurde das getestet?" "Wer hat das freigegeben?" "Gab es Security-Issues?" Monate oder Jahre später kann jeder nachvollziehen, wie eine Änderung in Produktion kam.

Im Mensch + KI-Code Prozess: Das Evidence Pack wird kontinuierlich aufgebaut. Jeder Gate-Check, jeder Test, jedes Approval fügt Nachweise hinzu. Am Release Gate muss das Pack vollständig sein. Es wird für 7 Jahre archiviert (Compliance).