Open source · v0.1.1 · standalone pre-alpha

RigorFoundry

Evidence-bound codebase transformation. Inventory the exact Git-tracked tree, produce reproducible audit candidates, bind decisions to review evidence, and prepare remediation without turning heuristics into verdicts.

Install from PyPI Inspect the source Read the documentation

Honest status: RigorFoundry is a standalone pre-alpha. It has not been promoted as the GOTM fleet audit authority, and a clean static scan is not a clean-repository claim.

0.1.1Current release

ExactGit-tracked inventory

Ed25519Versioned trust domains

Apache-2.0Open-source licence

From signal to reviewable evidence

The tool keeps collection, human review, enforcement, and remediation as separate records. Missing evidence remains visible instead of being silently converted into a pass.

Freeze repository identity, HEAD, tree, Git executable, policy, and rule-pack provenance.

Scan only the exact tracked inventory and anchor every candidate to a blob and bounded line span.

Review candidates against the production surface; record needs-evidence, pass, fail, or accepted risk.

Promote only fresh, verified decisions into a gate, TODO, SARIF export, or dependency-ordered remediation plan.

Fail-closed by construction

Content-addressed reports

Repository, policy, tracked content, toolchain, and findings are digest-bound so stale evidence is rejected.

Candidates, not defects

Static signals stay provisional until a reviewer adjudicates them against the relevant production surface.

Native audit boundaries

Declared adapters use validated argv, bounded runtime, credential-free environments, read-only snapshots, and no shell.

Review separation

Pack and reviewer signatures use distinct versioned Ed25519 message domains; legacy raw-digest signatures are refused.

Deterministic interchange

Candidate and review state can be projected into SARIF 2.1.0 without losing exact anchors or evidence status.

Controlled remediation

Plans preserve dependencies, accepted risks, conflicts, and missing evidence without granting execution authority.

Scope boundary. RigorFoundry prepares evidence and decisions; it does not prove repository cleanliness, grant remediation authority, or infer production effectiveness from a static scan.