Class ComplianceEnforcement

java.lang.Object

com.cloudforgeci.api.core.rules.ComplianceEnforcement

public final class ComplianceEnforcement
extends Object

Shared STAGING/ADVISORY/ENFORCE enforcement policy for a FrameworkRules plugin's Node.addValidation callback -- every framework class (HipaaRules, PciDssRules, GdprRules, FedRampRules, Iso27001Rules, Soc2Rules) was independently reimplementing this identical policy, risking exactly the kind of drift that happened before this class existed (FedRAMP's STAGING/ADVISORY branches not recording to ComplianceFindingsCollector the way every other framework's did).

Policy, in order:

• No failures -- pass, nothing blocks.
• ComplianceMode.ADVISORY -- every failure is a visible, non-blocking finding.
• SecurityProfile.STAGING -- runs the same checks as PRODUCTION, but only rule IDs in stagingBlockingRules actually block synthesis; everything else is a visible, non-blocking finding. Pass Set.of() for a framework where nothing blocks in STAGING.
• Otherwise (PRODUCTION under ComplianceMode.ENFORCE) -- every failure blocks.

Every branch that produces a non-empty error list also records the underlying ComplianceRule list with ComplianceFindingsCollector, so a caller draining findings (e.g. CloudForgeSynthesizer#synthesizeAdvisoryDryRun) sees them regardless of which branch fired.

Method Summary

Modifier and Type	Method	Description
static List<String>	resolve(String frameworkDisplayName, List<ComplianceRule> rules, ComplianceMode complianceMode, SecurityProfile profile, Set<String> stagingBlockingRules, Logger log)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

resolve

public static List<String> resolve(String frameworkDisplayName,
 List<ComplianceRule> rules,
 ComplianceMode complianceMode,
 SecurityProfile profile,
 Set<String> stagingBlockingRules,
 Logger log)

Parameters:

frameworkDisplayName - name used in log lines (e.g. "HIPAA", "PCI-DSS", "SOC 2")

rules - every ComplianceRule the framework's validators produced, pass and fail

complianceMode - the resolved ComplianceMode for this deployment

profile - the resolved SecurityProfile for this deployment

stagingBlockingRules - rule IDs that still block synthesis in STAGING; ignored outside STAGING

Returns:

the error strings to return from the Node.addValidation callback -- an empty list means synthesis proceeds, a non-empty list blocks it