audit-pack silently omits tara.json/tara.md/cyber-report.json (and other newer evidence types) — §8 MUST

[SoundMatt]

Summary

audit-pack silently drops several §1.3 evidence files that exist at the project root — including tara.json, tara.md, and cyber-report.json — because auditpack.EvidenceFiles is a hardcoded list that was never updated as new evidence types were added to go-FuSa.

Spec requirement

§8 "Contents (MUST)": "The pack MUST include manifest.json plus every §1.2 input file and every §1.3 generated file that exists at the project root — except audit-pack.zip itself." §1.3 explicitly lists tara.{json,md}, cyber-report.json, coupling-report.json, comp-report.json, and <standard>-gap-report.json among the generated-evidence filenames.

What I observed

go-FuSa's own repo (project root) has .fusa-hara.json, tara.json, tara.md, and cyber-report.json committed/present. Running the actual audit-pack command against it:

$ ls .fusa-hara.json cyber-report.json tara.json tara.md
.fusa-hara.json  cyber-report.json  tara.json  tara.md
$ gofusa audit-pack --dir . --output /tmp/audit-pack.zip
Audit pack written to /tmp/audit-pack.zip
Module: github.com/SoundMatt/go-FuSa
Files packed: 16
  .fusa.json ...
  .fusa-reqs.json ...
  .fusa-evidence.json ...
  check-report.json ...
  fmea.json ...
  fmea.csv ...
  boundary.mermaid ...
  boundary.dot ...
  safety-case.json ...
  safety-case.md ...
  safety-case.mermaid ...
  sbom.json ...
  provenance.json ...
  artifact-manifest.json ...
  qualify-report.json ...
  vuln.json ...
$ unzip -l /tmp/audit-pack.zip | grep -E 'tara|cyber|hara'
(no output — none of them are in the ZIP)

I also reproduced this with a fresh release --full run (which writes tara.json/cyber-report.json into the same output directory immediately before invoking audit-pack on that directory, per the documented --full flow): the resulting audit-pack.zip still excludes both files even though they exist in the same directory audit-pack just packed.

Root cause

auditpack/auditpack.go:

// EvidenceFiles is the ordered list of evidence file names that Pack collects.
var EvidenceFiles = []string{
	".fusa.json",
	".fusa-reqs.json",
	".fusa-evidence.json",
	"check-report.json",
	"fmea.json",
	"fmea.csv",
	"boundary.mermaid",
	"boundary.dot",
	"safety-case.json",
	"safety-case.md",
	"safety-case.mermaid",
	"sbom.json",
	"provenance.json",
	"artifact-manifest.json",
	"qualify-report.json",
	"vuln.json",
}

Pack only ever looks for files named in this fixed list (dated 2026-06-08, predating tara/hara/cyber/coupling/comp/<standard>-gap-report support). It's missing at minimum: tara.json, tara.md, cyber-report.json, coupling-report.json, comp-report.json, .fusa-hara.json, .fusa-dispositions.json, .fusa-problems.json, .fusa-model-trace.json, and every <standard>-gap-report.json (iso26262-gap-report.json, iec61508-gap-report.json, do178c-gap-report.json, iso21434-gap-report.json, unece-r155-gap-report.json, iec62443-*-gap-report.json, slsa-gap-report.json, misra-*-gap-report.json).

This means a project relying on audit-pack.zip (or FuSaOps's nested per-tool pack, §8) as its evidence submission is silently missing HARA, TARA, and cyber-security analysis evidence entirely — with no warning that anything was left out.

Fix

Either extend EvidenceFiles with the missing static names, or (more robust against future additions) walk the project root for every filename in the full §1.3/§1.2 list plus a glob for *-gap-report.json, rather than maintaining a fixed slice that has to be remembered on every new evidence type.

Environment

• go-FuSa v0.45.0, built from main @ 26c025f
• x-FuSa spec v1.15.0