Rigor Foundry
evidence-bound audits

Evidence-bound codebase transformation. Inventory the exact Git-tracked tree, produce reproducible audit candidates, bind decisions to review evidence, and prepare remediation without turning heuristics into verdicts.

Stable v1.0.0 Apache-2.0
Install from PyPI Inspect the source Read the documentation
1.0.0
Current Release
120
Python Modules
559
Test Files
SARIF
2.1.0 Export
Ed25519
Signed Decisions
Apache-2.0
Open-Source

Honest status: RigorFoundry has reached its first stable release as an evidence-producing reviewer tool. It has not been promoted as the GOTM fleet audit authority or an autonomous remediation system, and a clean static scan is not a clean-repository claim.

From signal to reviewable evidence

The tool keeps collection, human review, enforcement, and remediation as separate records. Missing evidence remains visible instead of being silently converted into a pass.

1 · Freeze
Freeze repository identity, HEAD, tree, Git executable, policy, and rule-pack provenance.
2 · Scan
Scan only the exact tracked inventory and anchor every candidate to a blob and bounded line span.
3 · Review
Review candidates against the production surface; record needs-evidence, pass, fail, or accepted risk.
4 · Promote
Promote only fresh, verified decisions into a gate, TODO, SARIF export, or dependency-ordered remediation plan.
Fail-closed by construction
◈Content-addressed reports — Repository, policy, tracked content, toolchain, and findings are digest-bound so stale evidence is rejected.
◈Candidates, not defects — Static signals stay provisional until a reviewer adjudicates them against the relevant production surface.
◈Native audit boundaries — Declared adapters use validated argv, bounded runtime, credential-free environments, read-only snapshots, and no shell.
◈Review separation — Pack and reviewer signatures use distinct versioned Ed25519 message domains; legacy raw-digest signatures are refused.
◈Deterministic interchange — Candidate and review state can be projected into SARIF 2.1.0 without losing exact anchors or evidence status.
◈Controlled remediation — Plans preserve dependencies, accepted risks, conflicts, and missing evidence without granting execution authority.
Scope boundary

RigorFoundry prepares evidence and decisions; it does not prove repository cleanliness, grant remediation authority, or infer production effectiveness from a static scan.

Explore
Pipeline →
Freeze, scan, review, promote — and the operating contract
Properties →
Fail-closed guarantees and CRA readiness
CLI →
scan, gate, promote, verify, bootstrap
Changelog →
Release history from 0.1.0 to 1.0.0

Follow this topic by RSS or confirmed email subscription. Keep a personal reading list.