feat: wire remaining governance subpages to persistent data

data/governance-framework.json

@@ -0,0 +1,176 @@
+{
+  "overview": {
+    "title": "Agent Governance Framework",
+    "description": "A practical governance model for designing, running, and auditing autonomous agents in production environments.",
+    "whyItMatters": [
+      "Autonomous agents can act at speed and scale, so failures can propagate quickly.",
+      "Governance creates clear ownership for decisions, incidents, and policy exceptions.",
+      "Structured controls improve trust with users, auditors, and regulators.",
+      "Maturity-based governance helps teams evolve from ad-hoc controls to resilient operations."
+    ]
+  },
+  "pillars": [
+    {
+      "slug": "accountability",
+      "title": "Accountability",
+      "description": "Define ownership for agent behavior, maintain auditability, and ensure people can intervene before high-impact actions complete.",
+      "keyPrinciples": [
+        "Every autonomous decision maps to an accountable owner.",
+        "High-risk decisions must have a documented approval path.",
+        "Escalation paths include named contacts and response SLAs.",
+        "Decision logs are tamper-evident and reviewable."
+      ],
+      "maturity": {
+        "basic": "Capture who triggered each task and store basic execution logs.",
+        "intermediate": "Add structured decision logs, approval gates, and regular governance reviews.",
+        "advanced": "Implement policy-as-code controls, immutable audit trails, and live oversight dashboards."
+      }
+    },
+    {
+      "slug": "transparency",
+      "title": "Transparency",
+      "description": "Make agent behavior understandable to operators, reviewers, and impacted users through clear explanations and visibility.",
+      "keyPrinciples": [
+        "Expose rationale summaries for non-trivial decisions.",
+        "Document model/tool versions used per execution.",
+        "Track confidence, uncertainty, and fallback behavior.",
+        "Communicate significant incidents and mitigation steps promptly."
+      ],
+      "maturity": {
+        "basic": "Provide basic task status and execution outcomes.",
+        "intermediate": "Show rationale summaries and confidence indicators in operator views.",
+        "advanced": "Offer end-to-end observability with explainability, lineage, and stakeholder reporting."
+      }
+    },
+    {
+      "slug": "safety",
+      "title": "Safety",
+      "description": "Reduce harmful outcomes with sandboxing, guardrails, kill-switches, and staged rollout patterns.",
+      "keyPrinciples": [
+        "Constrain runtime permissions with least privilege defaults.",
+        "Use hard caps on rate, spend, and resource usage.",
+        "Support instant pause/rollback and graceful recovery.",
+        "Test dangerous operations in isolated environments first."
+      ],
+      "maturity": {
+        "basic": "Use input/output filtering and simple execution constraints.",
+        "intermediate": "Apply environment isolation, rate caps, and operator-controlled emergency stop.",
+        "advanced": "Adopt multi-layer guardrails, continuous red-team testing, and automated containment workflows."
+      }
+    },
+    {
+      "slug": "compliance",
+      "title": "Compliance",
+      "description": "Align agent operations with legal, contractual, and industry obligations while preserving evidence for audits.",
+      "keyPrinciples": [
+        "Classify data and enforce policy-based handling rules.",
+        "Maintain retention and deletion controls for logs and artifacts.",
+        "Map controls to relevant standards and regulations.",
+        "Continuously verify and document control effectiveness."
+      ],
+      "maturity": {
+        "basic": "Document applicable requirements and retain core records.",
+        "intermediate": "Map controls to obligations and run recurring compliance checks.",
+        "advanced": "Continuously monitor compliance posture with automated evidence collection and alerts."
+      }
+    }
+  ],
+  "readinessChecklist": [
+    {
+      "id": "owners",
+      "label": "Each production agent has a named owner and escalation backup."
+    },
+    {
+      "id": "decision-logs",
+      "label": "Agent decisions are logged with rationale, risk level, and outcome."
+    },
+    {
+      "id": "approval-gates",
+      "label": "High-risk actions require explicit human approval before execution."
+    },
+    {
+      "id": "sandboxing",
+      "label": "Dangerous capabilities run in sandboxed environments with least privilege."
+    },
+    {
+      "id": "resource-caps",
+      "label": "Rate limits and resource/spend caps are enforced in runtime."
+    },
+    {
+      "id": "kill-switch",
+      "label": "Operators can trigger a kill-switch and rollback workflows quickly."
+    },
+    {
+      "id": "incident-playbook",
+      "label": "An incident response playbook exists and has been exercised recently."
+    },
+    {
+      "id": "audit-evidence",
+      "label": "Audit evidence is retained, queryable, and protected from tampering."
+    }
+  ],
+  "maturityCriteria": {
+    "basic": {
+      "range": [0, 3],
+      "label": "Basic",
+      "guidance": "Foundational controls exist, but operations are still mostly reactive."
+    },
+    "intermediate": {
+      "range": [4, 6],
+      "label": "Intermediate",
+      "guidance": "Core governance controls are active, with partial automation and regular review."
+    },
+    "advanced": {
+      "range": [7, 8],
+      "label": "Advanced",
+      "guidance": "Governance is proactive, measurable, and deeply integrated into delivery workflows."
+    }
+  },
+  "accountability": {
+    "auditTrailRequirements": [
+      "Unique execution IDs, actor IDs, and timestamps for every agent action.",
+      "Immutable records for policy checks, tool calls, and approval outcomes.",
+      "Versioned prompts, models, and tool manifests for reproducibility.",
+      "Evidence retention policy aligned with legal and contractual requirements."
+    ],
+    "decisionLoggingPatterns": [
+      "Capture structured fields: context, alternatives considered, chosen action, and confidence.",
+      "Attach policy evaluation results and rule IDs used during enforcement.",
+      "Store before/after state snapshots for high-impact mutations.",
+      "Tag logs by sensitivity tier for access control and retention."
+    ],
+    "escalationProtocols": [
+      "Define severity classes with response SLAs and ownership.",
+      "Automatically page responders when confidence drops or policy checks fail.",
+      "Freeze risky capabilities until human review is complete.",
+      "Run post-incident reviews with corrective and preventive actions."
+    ]
+  },
+  "safety": {
+    "sandboxingStrategies": [
+      "Isolate untrusted execution in ephemeral containers or VMs.",
+      "Use network egress allowlists and secret-scoped credentials.",
+      "Apply filesystem and syscall restrictions for tool runtimes.",
+      "Separate staging and production permissions to prevent lateral impact."
+    ],
+    "rateLimitingAndCaps": [
+      "Per-user, per-agent, and per-tool request limits.",
+      "Token, CPU, memory, and execution time budgets.",
+      "Spend controls for paid APIs and external actions.",
+      "Adaptive throttling under anomaly detection signals."
+    ],
+    "rollbackAndKillSwitch": [
+      "Atomic changes with idempotent compensation handlers.",
+      "Global kill-switch and scoped feature flags for containment.",
+      "Automated rollback triggers tied to error and risk thresholds.",
+      "Operator runbooks that define safe restart criteria."
+    ],
+    "incidentResponseTemplate": [
+      "Detect and classify the incident severity.",
+      "Contain impact by disabling risky pathways.",
+      "Preserve evidence and establish timeline.",
+      "Remediate root cause and validate fix in staging.",
+      "Communicate status updates and complete post-incident review."
+    ]
+  }
+}

src/app/api/governance/accountability/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from "next/server";
+import { readGovernanceFramework } from "@/lib/governanceFramework";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+  try {
+    const data = await readGovernanceFramework();
+
+    return NextResponse.json(
+      {
+        accountability: data.accountability,
+      },
+      {
+        headers: {
+          "Cache-Control": "no-store",
+        },
+      }
+    );
+  } catch (error) {
+    console.error("Failed to load governance accountability data", error);
+    return NextResponse.json(
+      { error: "Failed to load governance accountability data" },
+      { status: 500 }
+    );
+  }
+}

src/app/api/governance/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from "next/server";
+import { readGovernanceFramework } from "@/lib/governanceFramework";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+  try {
+    const data = await readGovernanceFramework();
+
+    return NextResponse.json(
+      {
+        overview: data.overview,
+        pillars: data.pillars,
+        readinessChecklist: data.readinessChecklist,
+        maturityCriteria: data.maturityCriteria,
+      },
+      {
+        headers: {
+          "Cache-Control": "no-store",
+        },
+      }
+    );
+  } catch (error) {
+    console.error("Failed to load governance framework", error);
+    return NextResponse.json({ error: "Failed to load governance framework" }, { status: 500 });
+  }
+}

src/app/api/governance/safety/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { readGovernanceFramework } from "@/lib/governanceFramework";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+  try {
+    const data = await readGovernanceFramework();
+
+    return NextResponse.json(
+      {
+        safety: data.safety,
+      },
+      {
+        headers: {
+          "Cache-Control": "no-store",
+        },
+      }
+    );
+  } catch (error) {
+    console.error("Failed to load governance safety data", error);
+    return NextResponse.json({ error: "Failed to load governance safety data" }, { status: 500 });
+  }
+}

src/app/governance/accountability/page.tsx

@@ -2,22 +2,19 @@
 
 import type { Metadata } from "next";
 import Link from "next/link";
-import governanceFramework from "@/data/governance-framework.json";
-
-type AccountabilityData = {
-  accountability: {
-    auditTrailRequirements: string[];
-    decisionLoggingPatterns: string[];
-    escalationProtocols: string[];
-  };
-};
+import { headers } from "next/headers";
+import type { GovernanceFrameworkData } from "@/lib/governanceFramework";
+
+type AccountabilityData = Pick<GovernanceFrameworkData, "accountability">;
 
 export const metadata: Metadata = {
   title: "Accountability for Agent Operations — forAgents.dev",
   description:
     "Audit trails, decision logging, escalation protocols, and human-in-the-loop gates for accountable autonomous agents.",
 };
 
+export const dynamic = "force-dynamic";
+
 const loggingExample = `type DecisionLog = {
   decisionId: string;
   timestamp: string;
@@ -66,8 +63,40 @@ const hitlGateExample = `export async function runWithHumanGate(input: TaskInput
   return executeTask(input);
 }`;
 
-export default function GovernanceAccountabilityPage() {
-  const data = governanceFramework as AccountabilityData;
+async function getAccountabilityData(): Promise<AccountabilityData | null> {
+  const headerStore = await headers();
+  const host = headerStore.get("x-forwarded-host") ?? headerStore.get("host") ?? "localhost:3000";
+  const proto = headerStore.get("x-forwarded-proto") ?? (host.includes("localhost") ? "http" : "https");
+
+  const response = await fetch(`${proto}://${host}/api/governance/accountability`, {
+    cache: "no-store",
+  });
+
+  if (!response.ok) {
+    return null;
+  }
+
+  return (await response.json()) as AccountabilityData;
+}
+
+export default async function GovernanceAccountabilityPage() {
+  const data = await getAccountabilityData();
+
+  if (!data) {
+    return (
+      <div className="min-h-screen bg-[#0a0a0a]">
+        <section className="mx-auto max-w-5xl px-4 py-16">
+          <Link href="/governance" className="text-sm text-[#06D6A0] hover:underline">
+            ← Back to governance hub
+          </Link>
+          <h1 className="mt-4 text-4xl font-bold tracking-tight text-[#F8FAFC] md:text-5xl">
+            Accountability Deep Dive
+          </h1>
+          <p className="mt-4 text-foreground/80">Accountability data is temporarily unavailable.</p>
+        </section>
+      </div>
+    );
+  }
 
   return (
     <div className="min-h-screen bg-[#0a0a0a]">