DoD Compliance Report

Run date: 2026-09-02 (third run) Overall portfolio: 51% (↓ from 54% — athena added as 7th project, drags overall average) Auditor: DoD agent (scheduled, one-shot)

roomy-mobile: excluded — owner-paused (2026-05-22), skip entirely. auditPic: owner-paused prod — scored on code/CI state only, no prod-outage flag. athena: first audit this run — added to workspace DoD as of 2026-09-01.

Portfolio Summary

| Project | Score | Δ prev | Open dod-violation | |---------|-------|--------|-------------------| | mahmoud-consultancy | 65% | ↔ 65% | 17 open | | valideerleeftijd | 58% | ↔ 58% | 27 open | | europeLogin | 53% | ↔ 53% | 26 open | | developer-portal | 52% | ↔ 52% | 20 open | | claimio | 48% | ↔ 48% | 31 open | | auditPic | 47% | ↔ 47% | 33 open (owner-paused) | | athena | 35% | NEW | 8 open (filed this run #46–#53) |

1. mahmoud-consultancy (interimplaza) — 65%

Repo: mahmoudholding/interimplaza | Namespace: recruitment (LIVE prod)

Passing controls

• All required CI workflows present: ci-backend.yml, ci-frontend.yml, zap-scan.yml, backup-verify.yml, deploy-backend.yml, deploy-frontend.yml, pr-validation.yml, rotate-secrets.yml, claude.yml, nightly.yml, secret-scan.yml
• SpotBugs + FindSecBugs: effort=Max, threshold=Low, fails build
• JaCoCo BRANCH floor 0.89 (ratchet toward 0.90) + LINE 95% both in mvn verify
• OWASP Dependency-Check with failBuildOnCVSS=7 in nightly.yml
• npm audit --audit-level=high in CI
• gitleaks secret scan
• 40+ Cucumber .feature files; Testcontainers (not H2)
• docs/interimplaza/setup.md and docs/interimplaza/api.md present
• No System.out.println, printStackTrace, or @Disabled/@Ignore
• Structured JSON logging (logstash-logback-encoder)
• console.log in src/: 0 files (issue #1663 was a false positive counting node_modules/ and dist/ — commented on issue 2026-09-02)

Active violations (top 5 — statically verified this run)

1. §1 Code Quality — 5 files exceed 400-line cap (#1903 OPEN): AnthropicCvExtractionClient.java (453L), JobRepository.java (443L) in main; MercellScraperServiceTest.java (527L), JobMapperTest.java (407L), AiFieldExtractionPersistenceTest.java (401L) in test.
2. §2 Build — JaCoCo BRANCH floor 0.89 < DoD 0.90 (#1805 OPEN): jacoco.minimum.coverage=0.89 confirmed in backend/pom.xml.
3. §1 Observability — @Timed absent on key clients (#1489, #1583, #1672, #1802, #1831 OPEN): AnthropicCvExtractionClient, AnthropicTemplateClient, ClamdClient — zero @Timed on these classes.
4. §1 Security — 4 Admin controllers missing class-level @Validated (#1909 OPEN): 13/17 Admin*.java files have @Validated; AdminFeatureFlagController, AdminGemeenteBackfillController, and 2 others confirmed missing.
5. §1 Code Quality — 2 backend TODO/FIXME without linked issues (no issue yet): grep finds 2 TODO/FIXME in backend/src/main/java/ — verify linkage.

Additional open: #1604 no Snyk/Aikido, #1605 4 services missing @CircuitBreaker/@Retry, #1619 prod alerting absent, #1653 MercellScraperServiceTest 527L, #1761 JobMapperTest 407L, #1803 AiFieldExtractionPersistenceTest 401L.

2. valideerleeftijd — 58%

Repo: mahmoudholding/valideerleeftijd | Namespace: valideerleeftijd (pre-launch; no app deploy)

Passing controls

• CI: all canonical filenames present including zap-scan.yml, backup-verify.yml, security-gitleaks.yml, security-trivy.yml
• SpotBugs + FindSecBugs; OWASP Dependency-Check with failBuildOnCVSS gating
• docs/setup.md, docs/api.md present
• 4 Cucumber features; Testcontainers in test suite
• @Validated partial progress: IdinController, BankController, EudiController, YiviController now carry @Validated (commented on #296 2026-09-02)

Active violations (top 5 — statically verified this run)

1. §1 Tests / §2 Build — jacoco:check execution explicitly removed (#293 OPEN): pom.xml comment confirms "jacoco:check execution removed — Sonar is the single source of truth"; build never fails on coverage below floor.
2. §1 Security — ZAP advisory-only (#259, #303 OPEN): fail_action: false confirmed at line 67 of zap-scan.yml — high findings are reported and ignored.
3. §1 Security — 4 controllers still missing @Validated (#296 OPEN): DemoController, PlatformTokenController, VerificationController, ReceiptController confirmed missing @Validated; 4 others fixed.
4. §3 Angular — 0 components use ChangeDetectionStrategy.OnPush (#269 OPEN): grep confirms zero ChangeDetectionStrategy.OnPush across all frontend src/ TS files.
5. §2 Build — maven-enforcer-plugin and spotless-maven-plugin absent (#275 OPEN): neither plugin present in backend/pom.xml.

Additional open: #255 no alerting, #256 Sonar line 90% not 95%, #260 yiviToken logged, #264 prod sealed secret missing, #267 Testcontainers ITs never run, #268 Angular marketing not Astro, #271 ZAP scans SPA not API, #272 6 controls silently waived, #274 TLS cert stuck, #289 backup-verify never completed, #291 0 @Timed, #292 PlatformTokenController raw Map not DTO, #294 4 test files >400L, #295 TS any without justification, #302 no Snyk/Aikido, #304 IdinService no @Retry.

3. europeLogin — 53%

Repo: mahmoudholding/europeLogin | Namespace: europe-login (pre-launch)

Passing controls

• CI workflows: all canonical names present including zap-scan.yml, ci-flutter.yml, backup-verify.yml
• SpotBugs + FindSecBugs in backend/pom.xml
• JaCoCo BRANCH 90% + LINE 95% enforced in mvn verify (jacoco.minimum.coverage=0.90, jacoco.line.minimum.coverage=0.95)
• docs/setup.md, docs/api.md present; gitleaks present
• 4 Cucumber features; Testcontainers used

Active violations (top 5 — statically verified this run)

1. §1 Security — OWASP ZAP has never scanned a byte (#237 OPEN): stack start fails exit 125; zero bytes scanned — this project has never had a successful ZAP scan.
2. §1 Security — npm audit --audit-level=moderate instead of required --audit-level=high (#228 OPEN): confirmed in .github/workflows/ci-frontend.yml — DoD requires --audit-level=high.
3. §5 CI/CD — nightly.yml cancelled on all recent runs (#239 OPEN): Dep-Check + E2E never complete; blocking gate never executes.
4. §1 Tests / §4 Flutter — zero Maestro flows (#258 OPEN): .maestro/ absent from repo root — confirmed.
5. §1 Observability — 0 @CircuitBreaker/@Retry AND 0 @Timed (#262, #265, #272, #273 OPEN): grep confirms zero annotated files in backend/src/main/.

Additional open: #234 no post-deploy happy-flow, #235 test files >400L, #238 backup-verify never verified, #244 Dep-Check gates nothing, #245 branch protection gaps, #246 JDK 21 pin vs Java 25 build, #247 alerting dormant, #248 ZAP fail-open -I, #249 CRLF_INJECTION_LOGS blanket-suppressed, #250 nightly targets main not develop, #251 ZAP skipped on develop push, #252 maven-enforcer/spotless absent, #263 Karma 90% not 95%, #266 AuthController missing @Validated, #268 no Snyk/Aikido, #274 maven-enforcer/spotless absent, #276 Flutter coverage no gate.

4. developer-portal — 52%

Repo: mahmoudholding/developer-portal | Static HTML portal (no backend)

Passing controls

• CI: ci-frontend.yml, deploy-frontend.yml, zap-scan.yml, pr-validation.yml, nightly.yml, claude.yml
• a11y blocking gate in CI (axe/pa11y)
• pr-validation.yml (Conventional Commit check)
• ZAP has schedule + workflow_call triggers (runs via nightly)

Active violations (top 5 — verified via open issue list + gh api)

1. §1 Security — npm audit explicitly disabled (#86 OPEN): npm ci --no-audit --no-fund confirmed in ci-frontend.yml — audit gate permanently silenced.
2. §1 Security — nginx security headers dead (#41, #42 OPEN): no CSP/HSTS; add_header inheritance drops all headers on asset responses.
3. §1 Security — 6 prod pages execute unpinned CDN JS (#90 OPEN): no version pin, no SRI — active XSS supply-chain risk.
4. §1 Docs — docs/setup.md and docs/api.md absent (#107 OPEN): docs/ contains only runbooks/ and workspace/ subdirs.
5. §1 Observability — developer-portal absent from health-probe/ElastAlert pipeline (#101 OPEN): zero down-detection.

Additional open: #57 docs nested setup.md/api.md missing, #76 deploy smoke insufficient, #79 WCAG heading order, #80 skip-to-content missing, #83 ADR link 404, #84 branch protection residuals, #85 retire fleet-health-alert, #88 nightly scans main not develop, #91 fleet cron timing wrong, #93 fleet alert died 40h, #100 error-spike rule misses 35%, #103 FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, #89 ZAP historically dead.

5. claimio — 48%

Repo: mahmoudholding/claimio | Namespace: claimio (pre-launch; prod ns empty by design)

Passing controls

• CI: all canonical filenames present including maestro-ci.yml, backup-verify.yml, zap-scan.yml, ci-flutter.yml, security-gitleaks.yml
• SpotBugs + FindSecBugs present in backend/pom.xml (threshold Low)
• OWASP Dependency-Check in nightly.yml
• 7 Cucumber features; Testcontainers (1.20.6) used
• gitleaks in security-gitleaks.yml

Active violations (top 5 — statically verified this run)

1. §1 Tests / §2 Build — JaCoCo check goal absent (#404 OPEN): jacoco-maven-plugin present in pom but no check execution goal — mvn verify never enforces coverage floor.
2. §1 Docs — docs/setup.md and docs/api.md missing at repo root (#405 OPEN): standalone-repo convention requires these at docs/ root; docs/ contains only subdirs (claimio/, clamio/, compliance/, runbooks/), none with setup.md/api.md.
3. §1 Security — ZAP fail-open (#370 OPEN): -I flag confirmed in zap-scan.yml — suppresses all findings.
4. §5 CI/CD — rotate-secrets.yml workflow_dispatch-only (#376 OPEN): no schedule trigger; quarterly rotation never automated.
5. §1 Observability — 0 @CircuitBreaker/@Retry AND 0 @Timed (#393, #397 OPEN): confirmed by grep — all external calls unprotected, no timing instrumentation.

Additional open: #337 MVP first prod deploy, #345 no ADR decisions/, #346 Flutter coverage 85% not 90%, #352 no live verification post-deploy, #353 codemagic 4/5 stages missing, #354 frontend files >400L, #356 OWASP ZAP gate dead, #357 backup-verify never verified, #359 Java 21 vs Java 25, #362 branch protection gaps, #364 frontend unit suites never run in CI, #365 maven-enforcer/spotless absent, #366 response_time_ms never reaches ES, #369 vacuous test, #372 Flutter screen test gap, #375 no CORS in smoke, #387 docs/clamio/api.md missing, #388 console.log in a11y/serve.js, #391 JaCoCo INSTRUCTION not BRANCH, #392 Maestro flows in wrong path, #396 3 test files >400L, #398 no Snyk/Aikido, #402 docs/claimio/api.md missing, #403 docs/claimio/decisions/ missing, #409 Flutter coverage 85%, Flutter coverage: flutter test runs but no MIN_COVERAGE enforcement in codemagic.yaml.

6. auditPic — 47% (owner-paused)

Repo: mahmoudholding/auditPic | Namespace: audit-pic (owner-paused; prod empty by design)

Passing controls

• CI: ci-backend.yml, ci-flutter.yml, ci-frontend.yml, deploy-backend.yml, deploy-webapp.yml, maestro-ci.yml, rotate-secrets.yml, backup-verify.yml, secret-scan.yml, pr-validation.yml
• SpotBugs + FindSecBugs in audit-pic-backend/pom.xml (effort=Max)
• JaCoCo BRANCH 90% check in audit-pic-backend/pom.xml (BRANCH only — LINE gate missing per #374/#454)
• 5 Cucumber .feature files; Testcontainers in integration tests
• docs/api.md and docs/setup.md present

Active violations (top 5 — statically verified this run)

1. §4 Flutter — coverage gate is MIN_COVERAGE=55 in codemagic.yaml (#446 OPEN): MIN_COVERAGE=55 confirmed — DoD requires ≥90%.
2. §1 Tests / §2 Build — JaCoCo LINE 95% gate absent (#454 OPEN): BRANCH gate confirmed; LINE threshold never wired.
3. §1 Security — ZAP scheduled-only, absent from default branch (#416 OPEN): security-zap.yml has schedule: trigger but no per-PR or workflow_run trigger — ZAP never protects live code on PRs.
4. §1 Security — SpotBugs threshold Medium instead of Low (#399 OPEN): audit-pic-backend/pom.xml confirms <threshold>Medium</threshold> — DoD requires Low.
5. §1 Code Quality — camera_capture_screen.dart oversize (#409 OPEN): file not found at previously recorded path; may have been split/renamed — issue should be re-verified by manager before closing.

Additional open: #330 Next.js frontend (DoD requires Angular/Astro), #357 Flutter uses Provider not Riverpod, #404 prod alerting dormant, #410 debugPrint in prod Dart, #413 multiple files >400/300L, #415 Cucumber stub tautological, #423 raw email+link logged, #424 deploy smoke negative-path only, #426 branch protection gaps, #427 7/8 Cucumber features never executed, #428 stale default branch, #429 readiness probe trivial, #431 a11y+npm-audit gates miss main, #432 Dep-Check conditional on pom.xml change, #435 Maestro continue-on-error, #436 webapp vitest specs never run, #437 staging /actuator/health 503, #438 maven-enforcer/spotless absent, #441 analysis_options missing flutter_lints, #442 5 unlinked TODOs, #444 console.log in a11y, #449 15 external calls no @CircuitBreaker/@Retry, #450 0 @Timed, #451 no Snyk/Aikido, #453 ci-flutter.yml no coverage gate.

7. athena — 35% (NEW — first audit)

Repo: mahmoudholding/athena | Namespace: athena (pre-launch; athena-staging has staging deploy)

Passing controls

• CI workflows present: ci-backend.yml, ci-frontend.yml, deploy-backend.yml, deploy-frontend.yml, pr-validation.yml, secret-scan.yml (gitleaks)
• OWASP Dependency-Check configured in backend/pom.xml with failBuildOnCVSS=7 ✓
• npm audit --audit-level=high in ci-frontend.yml ✓
• No System.out.println or printStackTrace in main ✓

Active violations (top 5 — statically verified this run, all 8 issues filed as #46–#53)

1. §1 Security — SpotBugs + FindSecBugs absent from pom.xml (#46 NEW): no spotbugs-maven-plugin in backend/pom.xml — zero static security analysis on Java code.
2. §1 Tests / §2 Build — JaCoCo coverage gate absent (#47 NEW): no jacoco-maven-plugin configured — mvn verify enforces no coverage floor.
3. §1 Security — OWASP ZAP scan absent (#48 NEW): no zap-scan.yml workflow — DAST never runs against athena staging.
4. §1 Security — all 3 controllers missing @Validated AND @PreAuthorize (#49 NEW): ReconciliationController, AnalysisController, SupportingDocumentController confirmed with zero security annotations — endpoints are unprotected and accept unvalidated input.
5. §1 Docs — docs/setup.md and docs/api.md missing (#50 NEW): docs/ has architecture/roadmap/scope/srs/vision but no setup or API reference.

Additional filed: #51 zero @Timed + zero @CircuitBreaker/@Retry, #52 Dependency-Check non-blocking (continue-on-error: true, expires 2026-09-09), #53 backup-verify/nightly/rotate-secrets/claude.yml all absent.

Trend vs previous run

| Project | Prev score | Current | Note | |---------|-----------|---------|------| | mahmoud-consultancy | 65% | 65% | Stable; #1663 console.log was false positive (node_modules counted); other violations unchanged | | valideerleeftijd | 58% | 58% | Stable; @Validated partial fix (4/8 controllers done), 4 still missing | | europeLogin | 53% | 53% | Stable; npm audit moderate confirmed, 0 @CB/@Retry/@Timed confirmed | | developer-portal | 52% | 52% | Stable; npm audit disabled confirmed | | claimio | 48% | 48% | Stable; JaCoCo check absent + Flutter coverage ungate confirmed | | auditPic | 47% | 47% | Stable; owner-paused, no active remediation | | athena | — | 35% | NEW — 8 dod-violation issues filed (#46–#53) |

Overall portfolio: 51% (↓ from 54% — athena added as 7th project)

Worst single gap this run: athena has no SpotBugs, no JaCoCo, no ZAP, and zero @PreAuthorize on ANY endpoint — a new production-track AI financial-audit tool with structural security gate gaps across the board. Dependency-Check is also temporarily non-blocking (expires 2026-09-09 per in-code comment). Manager should prioritize resolving #46, #47, #48, #49 on athena before first staging promotion.