Rigor Foundry
evidence-bound audits
Evidence-bound codebase transformation. Inventory the exact Git-tracked tree, produce reproducible audit candidates, bind decisions to review evidence, and prepare remediation without turning heuristics into verdicts.
Stable v1.0.0 Apache-2.0
Honest status: RigorFoundry has reached its first stable release as an evidence-producing reviewer tool. It has not been promoted as the GOTM fleet audit authority or an autonomous remediation system, and a clean static scan is not a clean-repository claim.
From signal to reviewable evidence
The tool keeps collection, human review, enforcement, and remediation as separate records. Missing evidence remains visible instead of being silently converted into a pass.
1 · Freeze
Freeze repository identity, HEAD, tree, Git executable, policy, and rule-pack provenance.
2 · Scan
Scan only the exact tracked inventory and anchor every candidate to a blob and bounded line span.
3 · Review
Review candidates against the production surface; record needs-evidence, pass, fail, or accepted risk.
4 · Promote
Promote only fresh, verified decisions into a gate, TODO, SARIF export, or dependency-ordered remediation plan.
Fail-closed by construction
◈Content-addressed reports — Repository, policy, tracked content, toolchain, and findings are digest-bound so stale evidence is rejected.
◈Candidates, not defects — Static signals stay provisional until a reviewer adjudicates them against the relevant production surface.
◈Native audit boundaries — Declared adapters use validated argv, bounded runtime, credential-free environments, read-only snapshots, and no shell.
◈Review separation — Pack and reviewer signatures use distinct versioned Ed25519 message domains; legacy raw-digest signatures are refused.
◈Deterministic interchange — Candidate and review state can be projected into SARIF 2.1.0 without losing exact anchors or evidence status.
◈Controlled remediation — Plans preserve dependencies, accepted risks, conflicts, and missing evidence without granting execution authority.