From signal to reviewable evidence

The tool keeps collection, human review, enforcement, and remediation as separate records. Missing evidence remains visible instead of being silently converted into a pass.

1 · Freeze
Reports bind repository HEAD, tree, Git object format, tracked-content, policy, rule-pack, and the exact Git executable and version provenance.
2 · Scan
scan is read-only and inspects only the exact Git-tracked inventory. Every candidate binds a scanned blob and inclusive line span, or a tree and tracked-content digest.
3 · Review
Findings remain candidates until reviewed against the production surface. Missing evidence is explicit; it never resolves to pass.
4 · Promote
Promotion rejects stale reports, stale policies, changed Git provenance, duplicate findings, and mismatched repositories.
Operating contract
◈scan is read-only and inspects only the exact Git-tracked inventory.
◈Findings remain candidates until reviewed against the production surface; missing evidence never resolves to pass.
◈Reports bind HEAD, tree, Git object format, tracked content, policy, rule-pack, and exact Git executable/version provenance.
◈Promotion rejects stale reports, stale policies, changed Git provenance, duplicate findings, and mismatched repositories.
◈Pack and reviewer signatures use distinct versioned Ed25519 message domains; legacy raw-digest signatures are rejected, not reinterpreted.
◈Native audit adapters use validated argv, bounded execution time, and shell=False. Campaign records are written only below Git-ignored paths.
Deterministic interchange

A deterministic SARIF 2.1.0 exporter exposes every audit candidate without losing exact anchors or evidence status, so candidate and review state can be projected into standard tooling and back.

Follow this topic by RSS or confirmed email subscription. Keep a personal reading list.