ROCC "Now" roadmap + Top-10 polish

[CJud25]

Summary

Lands the review's entire "Now" roadmap and all ten Top-10 recommendations as a cluster of small, low-risk, presentation-and-content fixes — converting ROCC's two weakest reviewed dimensions (Usability 5.5, Visual polish 6.0) into strengths without touching the analytical/governance core, the synthetic data generator's values, or the aggregates-by-design boundary.

Highlights:

• Shared COLUMN_LABELS map: no raw snake_case DB headers on any leadership table (Outreach queue, Site Readiness, Resource Network + 4 detail tabs, Source Performance, Ratio Forecast, Privacy inventory)
• Home + Ratio Forecast hero KPI cards: no more truncation at 1440px; formula id moved to caption; "Gap to target" stated in words, no misleading sign legend
• Resource Network zero-result empty-state; draft outreach fields marked read-only; Planning controls moved above the sidebar nav fold
• Exception-first triage: shaded overdue-queue rows + weakest-funnel-step callout
• Reconciled the two "ready hires" measures (Site Readiness vs. Ratio Forecast) with distinct labels + coverage captions
• Honest wording for the unreachable-target guard + Hq=Hd assumption disclosure
• Glossary + ODLH/DLR/QDLH/DLH/QDL/FTE expansion (governance page + README)
• Site-specific, data-driven manager action plan (was static boilerplate)
• html.escape on the one unescaped unsafe_allow_html interpolation
• Streamlit telemetry disabled (gatherUsageStats = false)
• New ruff lint gate (pyflakes + syntax) wired into CI; 7 dead-code items removed
• Validator row counts now derive from generator constants + a drift test
• CI hardening: advisory pip-audit scan (pinned, non-blocking) + container boot/health probe
• Windows quickstart (run_demo.ps1) aligned to runtime-only dependencies

Scope: 20 tasks (S0–S19) executed in order per a supervisor-reviewed one-shot plan, plus one post-review security fix (pinned an unpinned pip-audit install in the advisory CI step). 21 commits total. Test suite grew from 20 to 23 tests; pytest -q, validate_demo_data.py, and ruff check . are green locally after every commit. Byte-stability of the synthetic generator was proven unchanged (SHA-256 fingerprints of all 11 data frames match main before and after the one permitted synthetic.py edit, a dead-code deletion).

An adversarial QC + security review ran against the full branch before this PR was opened; the one confirmed finding (unpinned pip-audit version in CI) was fixed in a follow-up commit.

Does not merge itself — merge to main is an owner decision. The container-boot CI step (S18) could not be verified locally (no Docker on the build box); it needs to be confirmed green on this PR's own CI run.

Test plan

• pytest -q — 23 passed (local)
• python scripts/validate_demo_data.py — exit 0 (local)
• ruff check . — all checks passed (local)
• CI: full workflow green on this PR (incl. docker build + container boot/health probe — unverified locally, no Docker on the build box)

🤖 Generated with Claude Code

https://claude.ai/code/session_01EUwLDdWYTGrWQwqb94VGCk