test coverage improvements; mTLS enforcement; agent broke :(

evidence/templates/standards-checklist.md

@@ -0,0 +1,44 @@
+# Standards Checklist
+
+## How To Complete
+
+1. Fill metadata and ensure it matches the evidence run folder.
+2. Use one status value per row: `Meets`, `Partially Meets`, `Does Not Meet`, `Not Evaluated`.
+3. Add at least one concrete artifact path for each status decision.
+4. In `Notes`, explain why the evidence is sufficient or insufficient.
+5. Keep `Gap Summary` focused on what still blocks compliance confidence.
+
+## Metadata
+
+Date (UTC):
+Environment URL:
+Commit:
+Run ID:
+
+## OWASP ASVS (selected)
+
+| Control | Requirement | Status | Evidence Path | Notes |
+|---|---|---|---|---|
+| V1 | Architecture/design documented |  |  |  |
+| V2 | Authentication controls |  |  |  |
+| V3 | Session management |  |  |  |
+| V4 | Access control enforcement |  |  |  |
+| V5 | Input validation and encoding |  |  |  |
+| V7 | Error handling and logging |  |  |  |
+| V8 | Data protection at rest/in transit |  |  |  |
+| V10 | Malicious code / injection resistance |  |  |  |
+
+## NIST SP 800-53 / 800-63-aligned checks (selected)
+
+| Control Family | Requirement | Status | Evidence Path | Notes |
+|---|---|---|---|---|
+| AC | Least privilege / access enforcement |  |  |  |
+| AU | Auditable events and retention |  |  |  |
+| IA | Identity proofing and authentication federation |  |  |  |
+| SC | Cryptographic protections and key handling |  |  |  |
+| CM | Configuration and change management |  |  |  |
+| CP | Resilience / single point of failure acknowledgement |  |  |  |
+
+## Gap Summary
+
+-