Add enterprise compute quota governance

enterprise-compute-quota-governance/README.md

@@ -0,0 +1,50 @@
+# Enterprise Compute Quota Governance
+
+This module adds a focused Enterprise Tooling slice for institutional compute and
+storage governance. It helps admins see which labs, departments, and projects
+are approaching or exceeding GPU and storage allocations, then turns those
+signals into approval queue items, dashboard metrics, webhook events, and
+export-ready evidence.
+
+## Why this fits Issue #19
+
+The issue calls for admin dashboards, usage stats, custom flags, API/webhook
+integration, and export pipelines. This slice covers that surface without
+duplicating the existing open PRs for broad dashboards, export packaging,
+webhook replay, trust center, compliance packets, identity drift, retention,
+grant compliance, data residency, SLA monitoring, lab inventory, or secret
+rotation.
+
+## What is included
+
+- Portfolio dashboard metrics for GPU hours, storage, forecast cost, risk bands,
+  departments, cost centers, and top at-risk projects.
+- Deterministic quota evaluation for warning, critical, and blocked states.
+- Admin approval queue with requested decisions and action recommendations.
+- REST API catalog for dashboard, review queue, project detail, decision, and
+  export manifest routes, including service scopes and integration clients.
+- CSV quota risk register with project, lab, cost-center, quota, review queue,
+  and requested decision columns for finance and compliance exports.
+- Custom tag preservation for grant, doctoral, restricted-data, ELN sync,
+  open-science, and reproducibility initiatives.
+- Export manifest for institutional dashboards, finance chargeback ledgers,
+  compliance archives, workflow webhooks, and the REST API catalog.
+- HMAC-signed webhook payloads using synthetic sample data only.
+
+## Local verification
+
+```sh
+cd enterprise-compute-quota-governance
+npm run check
+npm test
+npm run demo
+```
+
+The implementation uses only Node.js built-ins and has no install step.
+
+## Demo output
+
+`npm run demo` prints the portfolio summary, review queue, REST API routes, CSV
+export metadata, and signed webhook event IDs. A static visual preview is
+available in `docs/demo.svg`; the PR also includes `docs/demo.mp4` as a short
+reviewer demo artifact.

enterprise-compute-quota-governance/demo.js

@@ -0,0 +1,38 @@
+"use strict";
+
+const sampleData = require("./sample-data.json");
+const { evaluateQuotaGovernance } = require("./index");
+
+const result = evaluateQuotaGovernance(sampleData);
+
+console.log("Enterprise Compute Quota Governance Demo");
+console.log(`Institution: ${result.institution}`);
+console.log(`Period: ${result.period}`);
+console.log("");
+console.log("Portfolio");
+console.log(`- Projects: ${result.dashboard.portfolio.projectCount}`);
+console.log(`- Forecast GPU hours: ${result.dashboard.portfolio.forecastGpuHours}`);
+console.log(`- Projected storage GB: ${result.dashboard.portfolio.projectedStorageGb}`);
+console.log(`- Forecast cost USD: ${result.dashboard.portfolio.forecastCostUsd}`);
+console.log(`- Risk counts: ${JSON.stringify(result.dashboard.portfolio.riskCounts)}`);
+console.log("");
+console.log("Top review queue");
+for (const item of result.approvalQueue) {
+  console.log(
+    `- ${item.severity.toUpperCase()} ${item.projectId}: ${item.requestedDecision} (${item.reasons.join("; ")})`
+  );
+}
+console.log("");
+console.log("API catalog");
+for (const endpoint of result.apiCatalog.endpoints) {
+  console.log(`- ${endpoint.method} ${endpoint.path} [${endpoint.scope}]`);
+}
+console.log("");
+console.log("CSV export");
+console.log(`- ${result.exportRegister.filename}: ${result.exportRegister.rows.length} rows`);
+console.log(`- Headers: ${result.exportRegister.headers.length}`);
+console.log("");
+console.log("Webhook events");
+for (const event of result.webhookEvents) {
+  console.log(`- ${event.id} ${event.signature.slice(0, 23)}...`);
+}