Implementation brief

## Who Uses It
A vendor security team responding to customer due-diligence questionnaires.

## What You Will Build
Build an agent that imports a customer security questionnaire, retrieves approved evidence, and drafts row-level responses. Give reviewers a spreadsheet workspace that exposes unsupported answers and preserves the original question structure.

## Inputs
- Questionnaire rows
- Approved security evidence
- Service scope and evidence expiry dates

## Workflow
1. Import questions while preserving row identifiers.
2. Retrieve evidence for each requested control and service.
3. Draft supported answers and mark evidence gaps.
4. Collect reviewer decisions and export the completed questionnaire.

## Interface
A questionnaire table with answer drafts, citations, confidence reasons, reviewer status, and spreadsheet export.

## Working Demo
Draft a supported answer to Q1 citing E1, mark Q2 as unknown, and export both rows with review status.

## Deliverables
- A working local application with the specified review interface.
- Source code, dependency lockfile, and setup commands.
- A recorded end-to-end demo using the supplied starter data.
- Example outputs, action logs, and automated tests.

## Starter Data
These fictional records are a small development fixture, not a production dataset. Implement the mock services described in the brief.

```json
{
  "service": "Service A",
  "questions": [
    {
      "id": "Q1",
      "text": "Is multi-factor authentication required for administrators?"
    },
    {
      "id": "Q2",
      "text": "Are all backups tested monthly?"
    }
  ],
  "evidence": [
    {
      "id": "E1",
      "service": "Service A",
      "text": "Administrators must use multi-factor authentication."
    }
  ],
  "approval_required": true
}
```

## Constraints
Use fictional evidence. Do not claim certification or submit responses to customers.
Choose an available model that supports your implementation. Record its identifier and version.

## Evaluation
Review the complete application, not only the starter-case answers.
- Original row identifiers are preserved.
- Q1 cites E1.
- Q2 remains unknown instead of receiving an invented yes answer.
Add one normal case, one incomplete-input case, and one failure-recovery case.