v1.1.0

Adds policyseed evidence, a read-only collector for the audit evidence auditors ask for every period, saved as timestamped JSON with an index mapped to SOC 2 criteria.

What's new

• policyseed evidence runs read-only commands through the CLIs you already have installed and signed in (gh, aws, gcloud) and writes evidence/<date>/<criterion>-<collector>.json plus an INDEX.md that lists, per criterion, what each file shows and the auditor question it answers. 18 collectors cover GitHub (repository settings, branch protection and rulesets, Dependabot alerts, organization 2FA requirement, organization admins), AWS (account summary, credential report, password policy, CloudTrail, EBS default encryption, S3 encryption and public access block, RDS encryption and backups) and Google Cloud (project IAM policy, logging sinks, Cloud SQL backups, disk encryption, organizations).
• Commands run with execFile and fixed argument arrays, never through a shell. Secret-looking values are redacted before anything is written; --redact-account-ids shortens account IDs. A missing CLI, missing credentials or a denied permission is recorded as "not collected" with the reason and the run continues.
• --dry-run prints the exact commands, --list prints the collector table. The README lists the read-only permissions each provider needs, and docs/evidence.md has a scheduled workflow that collects the GitHub evidence monthly as a workflow artifact.

init, build, check, list and mcp still make no network calls. evidence calls only the cloud CLIs you run it with.

Limits

The files show configuration at the moment they were collected. They support, but do not replace, the auditor's own testing, and a collector that is "not collected" is a gap to close another way.