From signal to reviewable evidence

The tool keeps collection, human review, enforcement, and remediation as separate records. Missing evidence remains visible instead of being silently converted into a pass.

1 · Freeze
Reports bind repository HEAD, tree, Git object format, tracked-content, policy, rule-pack, and the exact Git executable and version provenance.
2 · Scan
scan is read-only and inspects only the exact Git-tracked inventory. Every candidate binds a scanned blob and inclusive line span, or a tree and tracked-content digest.
3 · Review
Findings remain candidates until reviewed against the production surface. Missing evidence is explicit; it never resolves to pass.
4 · Promote
Promotion rejects stale reports, stale policies, changed Git provenance, duplicate findings, and mismatched repositories.
Operating contract
◈scan is read-only and inspects only the exact Git-tracked inventory.
◈Findings remain candidates until reviewed against the production surface; missing evidence never resolves to pass.
◈Reports bind HEAD, tree, Git object format, tracked content, policy, rule-pack, and exact Git executable/version provenance.
◈Promotion rejects stale reports, stale policies, changed Git provenance, duplicate findings, and mismatched repositories.
◈Pack and reviewer signatures use distinct versioned Ed25519 message domains; legacy raw-digest signatures are rejected, not reinterpreted.
◈Native audit adapters use validated argv, bounded execution time, and shell=False. Campaign records are written only below Git-ignored paths.
Deterministic interchange

A deterministic SARIF 2.1.0 exporter exposes every audit candidate without losing exact anchors or evidence status, so candidate and review state can be projected into standard tooling and back.