chore(hardening): coverage + lint + playbooks + changelog

[DevOpsMadDog]

Summary

• add a qa workflow that runs formatting, linting, mypy, targeted coverage, and uploads the xml/summary artefacts expected by phase 10 hardening
• document the operating playbooks and security posture for engineering, security, and audit teams while updating the changelog and README documentation map for the completed phases
• tighten coverage scoping and add regression tests covering telemetry fallbacks, the graph worker loop, evidence policy helpers, and risk heuristics
• refresh the README architecture overview and documentation map so provenance, signing, SBOM quality, risk scoring, probabilistic forecasting, and LLM integrations are captured end-to-end
• publish readme_updated.md as a deeply structured reference covering repository topology, features, CI/CD fit, and usage guidance across SBOM, risk, provenance, reproducible builds, graph, evidence bundles, observability, and AI-enhanced decisioning
• expand readme_updated.md with mermaid architecture diagrams, sample artefact walkthroughs, and a verification matrix tying every feature to inputs, processing stages, outputs, and recommended commands
• reorganize readme_updated.md with an executive summary, capability matrix, end-to-end data flow, and consistent “why/what/how/usage/artefacts” sections for every capability to remove ambiguity for reviewers

Testing

• PYTHONPATH=$(pwd) pytest services/provenance/tests/test_attestation.py services/graph/tests/test_graph.py services/repro/tests/test_verifier.py tests/test_sbom_quality.py tests/test_risk_scoring.py tests/test_evidence_bundle.py tests/test_graph_worker.py tests/test_telemetry_runtime.py -q --override-ini testpaths='' --override-ini "addopts=--cov=services.provenance --cov=services.graph --cov=services.repro --cov=lib4sbom --cov=risk --cov=evidence --cov=telemetry --cov=scripts.graph_worker --cov-report=term-missing --cov-report=xml:reports/coverage/coverage.xml --cov-fail-under=70"

---

https://chatgpt.com/codex/tasks/task_e_68ea30ce8c688329b8cb1cd809e5ef2f

[devin-ai-integration]

Closing as part of PR consolidation. Useful changes have been cherry-picked into PR #240.