Add atomic controls, ACXD checks, and scoped Cloudscape reports

.ash/ash.yaml

@@ -41,6 +41,9 @@ global_settings:
     - rule_id: "B108"
       path: "tests/test_cli_extended.py"
       reason: "Test-only literal /tmp path used to verify missing-checkpoint behavior; no production temp-file handling is involved."
+    - rule_id: "B108"
+      path: "tests/test_cli_input_validation.py"
+      reason: "Test-only literal /tmp path used to model a checkpoint directory while validating CLI resume errors; no production temporary-file handling is involved."
     - rule_id: "B506"
       path: "tests/test_iam_policy_consistency.py"
       reason: "Test-only CloudFormation template parsing uses yaml.load with SafeLoader plus intrinsic constructors; unsafe default loading is not used."

AGENTS.md

@@ -55,7 +55,7 @@ Key modules:
 - `checks/` — checks grouped by domain, with larger domains split across multiple modules (security, cost, resilience, performance, operational excellence, capacity, contact-flow behavior/security, AI agent security, and MVP). `base.py` defines `BaseCheck`/`CheckContext`; `registry.py` holds the registry; `registration.py` is the single `register_all_checks(registry, pillars, skip_flow_analysis)` entry point.
 - `parsers/` — contact flow JSON → directed graph (`flow_graph.py`), plus complexity scoring and pattern detection.
 - `journey/` — deeper caller journey scoring pipeline: `topology` → `super_graph` → `path_enumerator` → `journey_scorer`. Entry: `from amazon_connect_assessment.journey import run_journey_mapping`. `AssessmentEngine._compute_journey_findings()` invokes it for journey findings, while `AssessmentEngine._compute_journey_map()` builds the active HTML journey-map section.
-- `report_generator.py` — produces JSON/CSV directly and the HTML report as a thin Jinja shell (`templates/html/assessment_report.html`) that inlines the pre-built Cloudscape UI bundle plus one escaped JSON data island built by `_build_report_data()`.
+- `report_generator.py` — produces JSON/CSV directly and the HTML report from a static shell template (`templates/html/assessment_report.html`) via single-pass `@@NAME@@` placeholder substitution (no Jinja; custom templates with Jinja syntax are rejected). The shell inlines the pre-built Cloudscape UI bundle plus one escaped JSON data island built by `_build_report_data()`.
 - `report/` — additional exporters and report utilities: `asff_export.py` (AWS Security Finding Format), `findings_diff.py` (compare runs), `posture_roadmap.py`, and `s3_publisher.py`.
 - `frontend/` — React and Cloudscape source for the offline HTML report. `build.mjs` bundles `src/` into the committed `templates/app/report-app.{js,css}` assets; `test/report.test.mjs` covers the browser-side data, filtering, and export helpers.
 - `cost/` — `cost_estimator.py` for cost-optimization findings.
@@ -72,7 +72,7 @@ Key modules:
 - Python 3.12+. Ruff (lint + format, replaces black/isort/flake8), 100-char lines. mypy is configured with `disallow_untyped_defs`, but `ignore_errors = true` is currently set as a baseline.
 - Comments only when the WHY is non-obvious.
 - **Iterative algorithms only — no recursion** for graph traversal (Python stack limits). Traversal is bounded: `max_depth=50`, `max_paths_per_entry=200`, `MAX_TOTAL_PATHS=5000`.
-- Security-conscious: validate user-controlled identifiers against regex before use; subprocess calls use list form, never `shell=True`; Jinja2 autoescaping stays on for the HTML report shell, report data reaches the page only as the escaped JSON data island rendered as text by the Cloudscape UI (the only injected HTML is XSS-safe server-rendered markdown); any future file-serving path should resolve paths and check `is_relative_to()` before serving.
+- Security-conscious: validate user-controlled identifiers against regex before use; subprocess calls use list form, never `shell=True`; `@@NAME@@` placeholder values are HTML-escaped during report shell substitution (except the explicitly raw asset placeholders), and report data reaches the page only as the escaped JSON data island rendered as text by the Cloudscape UI (the only injected HTML is XSS-safe server-rendered markdown); any future file-serving path should resolve paths and check `is_relative_to()` before serving.
 
 ## Working style preferences
 

CHANGELOG.md

@@ -0,0 +1,77 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## Unreleased
+
+### Upgrade notes
+
+- The unified catalog now emits 64 canonical control outcomes. The only legacy
+  Journey input aliases are `journey-sec-001` to `sec-flow-auth-001` and
+  `journey-cost-001` to `cost-containment-001`. `journey-res-001` and
+  `journey-scope-001` remain canonical IDs. Reports and current examples emit
+  canonical IDs only.
+- Journey execution now aggregates one outcome per selected Journey control and
+  Amazon Connect Customer instance instead of emitting failure-only records per
+  phone number. Authentication and containment are manual-review records,
+  structural dead ends remain a scored control, and dormant-flow scope is a
+  manual-review record.
+- Findings now separate execution status from `CONTROL`, `MANUAL_REVIEW`, and
+  `INFORMATIONAL` disposition. Only passed and failed `CONTROL` records enter
+  the posture numerator and denominator. Skipped, Error, Not Applicable,
+  manual-review, and informational records are non-scoring.
+- ASFF exports failed `CONTROL` records only. Passing, unevaluated, Not
+  Applicable, manual-review, and informational records are omitted. ASFF
+  identity remains stable for the same provider control ID and resource ID, so
+  existing Security Hub findings remain update-compatible after the identity
+  fix. The two renamed Journey controls preserve their historical provider IDs;
+  Journey records whose resource identity changed from phone number to instance
+  are intentionally new logical findings.
+- Agentic CX error-routing now requires the exact authored
+  `InputTimeLimitExceeded` and `NoMatchingError` route tokens.
+  `NoMatchingCondition` is reported as the readable Other outcome and does not
+  satisfy either required route. Escalation review checks for an authored exact
+  `Escalation` condition token and does not claim a successful runtime handoff
+  to an agent.
+- CloudTrail coverage now requires an applicable, actively logging trail whose
+  basic or advanced selectors prove coverage of Connect management write
+  events. Indeterminate detail reads produce `Skipped` when no qualifying trail
+  is known.
+- Storage encryption now paginates all supported Connect storage resource
+  types. Explicitly unencrypted storage still fails, incomplete evidence skips
+  when no known defect exists, and AWS-managed encryption passes with guidance
+  to apply organizational customer-managed-key requirements where needed.
+- Identity semantics now treat non-SAML instance identity as inventory that
+  requires review of the real sign-in path, MFA, lifecycle, and break-glass
+  controls rather than a proven failure. Excessive-agency analysis evaluates
+  selected high-risk actions in Lambda execution-role identity policies and
+  states the policy boundaries it cannot prove.
+- The packaged report shell migrated from Jinja expressions to a static,
+  single-pass placeholder contract: `@@STYLE_SRC@@`, `@@SCRIPT_SRC@@`,
+  `@@REPORT_TITLE@@`, `@@APP_CSS@@`, `@@REPORT_DATA_JSON@@`, and `@@APP_JS@@`.
+  Custom `template_dir` users must migrate before upgrading. Missing custom
+  directories or shells, missing or unsupported placeholders, and legacy Jinja
+  syntax fail fast instead of silently falling back to the packaged shell.
+- Report scope now recomputes summaries, charts, recommendations, Journey Map
+  entries, and findings for the selected instance. Top-level JSON and CSV
+  exports remain full-run exports. Print/save-as-PDF includes every finding in
+  the selected report scope with complete descriptions, methodology,
+  remediation or review actions, and evidence, independent of table filters and
+  pagination.
+- Journey analysis is bounded static enumeration: depth 50, 200 paths per phone
+  number, and 5,000 paths per run. Cycle edges are pruned without reducing
+  structural node reachability. Reached caps, dynamic targets, and unresolved
+  cross-flow references retain partial evidence and mark analysis incomplete.
+- Assessment and finding timestamps use UTC across JSON, CSV, HTML, ASFF,
+  generated filenames, and S3 report prefixes.
+- `--s3-output` is a consequential opt-in write that also hardens an existing
+  selected bucket by applying Block Public Access and versioning and ensuring
+  default encryption before upload.
+
+### Migration integrity
+
+- No aliases or historical IDs are inferred or fabricated. Only compatibility
+  mappings proven by the prior output contract are retained.
+- Known follow-up: `AGENTS.md` still describes the report shell as Jinja-based.
+  It is intentionally unchanged in this update and should be corrected in a
+  separately approved change.

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing Guidelines
 
-Thank you for your interest in contributing to our project. Whether it's a bug report, a new feature, a correction, or additional
+Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional
 documentation, we greatly value feedback and contributions from our community.
 
 Please read through this document before submitting any issues or pull requests so that we have all the necessary
@@ -54,9 +54,14 @@ To send us a pull request, please:
    # Run unit tests
    python -m pytest tests/ -v
 
-   # Only if you changed the HTML report UI (frontend/src or its deps); Node.js 20+.
-   # Commit the rebuilt amazon_connect_assessment/templates/app/ bundle with your change.
-   cd frontend && npm ci && npm test && npm run check
+   # Only when changing the Cloudscape report UI (Node.js 20+)
+   cd frontend
+   npm ci
+   npm audit --audit-level=high
+   npm test
+   npm run build
+   npm run check
+   cd ..
    ```
 5. Commit to your fork using clear commit messages.
 6. Send us a pull request, answering any default questions in the pull request interface.
@@ -66,28 +71,28 @@ To send us a pull request, please:
 
 The following checks run automatically on every pull request:
 
-- **CI** (`ci.yml`) — `ruff check` (lint) and `ruff format --check` (formatting), `mypy` type-checking, and `pytest` with the coverage gate (`--cov-fail-under=65`), all run across the supported Python matrix; a separate job audits dependencies
+- **CI** (`ci.yml`) — Python lint, formatting, mypy, and pytest coverage plus a Node.js 20 job that audits/tests the React/Cloudscape frontend and verifies the committed `templates/app/` bundle
 - **CloudFormation Lint** (`cfn-lint.yml`) — `cfn-lint` validation of `cloudformation/*.yaml`
 - **ASH Security Scan** (`ash-security-scan.yml`, plus a full-repository scan) — [Automated Security Helper](https://github.com/awslabs/automated-security-helper) scans changed files for secrets, dependency vulnerabilities, and IaC misconfigurations
 
 All checks must pass before a pull request can be merged.
 
-GitHub provides additional documentation on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
+GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
 [creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
 
 
 ## Finding contributions to work on
-Looking at the existing issues is a great way to find something to contribute to. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.
+Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.
 
 
 ## Code of Conduct
 This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
-For more information, see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
+For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
 opensource-codeofconduct@amazon.com with any additional questions or comments.
 
 
 ## Security issue notifications
-If you discover a potential security issue in this project, we ask that you notify AWS/Amazon Security through our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public GitHub issue.
+If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security through our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.
 
 
 ## Licensing