opschain governance posture

packs:security-governance

opschain governance posture [flags]

Renders the governance posture report (GovernanceService.GetGovernancePostureReport, opschain-governance-posture/v1): findings over the control catalog, review campaigns and the exceptions register; per-domain coverage (the framework mapping onto the security / change / agent domains); the continuous-control-monitoring metric set; and the evidence ledger's chain-verify verdict, acknowledged discontinuities and sealed-archive boundary. Every report opens with the honest posture statement: a tool-assisted attestation of recorded posture, never a certification.

Finding kinds: control_attestation_failed (high), control_never_attested (medium), control_review_overdue (medium), control_attested_with_exceptions (low) and waiver_active (info) — an excused control is posture an auditor reads, never a silent pass. The per-control verdicts read the ledger's hot window: attestations archived out of it no longer contribute (see opschain docs retention).

-o json / -o yaml emit the typed report. The command exits non-zero when the ledger reports an unacknowledged chain break, so a scheduled posture run fails loudly on tamper or data loss.

Exit codes

Code	Meaning
0	Report rendered and the evidence ledger verifies.
1	The read failed — including the named packs:security-governance refusal — or the ledger reports an unacknowledged break.
2	Usage error, including a missing server target.