Skip to content

runward v0.11.0 — compliance evidence packs

Choose a tag to compare

View all tags
@stranxik stranxik released this 10 Jul 11:48
v0.11.0
36d7e59

A new command turns the mission's conformance work into a hand-ready, regime-framed evidence pack — and makes the previously-inert docs/compliance/* references operational. A provenance layer upstream of the auditor: evidence traceable to ratified engineering decisions, emitted as OSCAL so it flows into GRC/auditor tooling. Deterministic, read-only, zero-LLM, outside the gate; never a compliance claim.

runward compliance <regime>

  • Regime lenses — iso-42001, nist-ai-rmf, eu-ai-act: assembles a per-regime assessment-readiness draft from your real artifacts (rule → OWASP ASI coverage, rule-conformance status, ADR journal, threat model). It fills the technical-evidence layer and its index, and explicitly flags every section only the operator/organization can supply (applicability, risk acceptance, sign-off, the EU declaration of conformity, post-market plans).
  • OSCAL export — every run also writes an OSCAL 1.1.2 component-definition mapping ASI01–ASI10 to implementation-status derived from the conformance manifest, with deterministic (SHA-256-seeded) UUIDs (byte-identical re-runs). This is the machine-readable interop layer.
  • Honest by construction — a readiness draft, supporting evidence only; it assembles from ratified artifacts, never LLM-drafts, never scrapes live state, and never says 'compliant/certified'.

Install: npx runward init · Full changelog: https://github.com/stranxik/runward/blob/main/CHANGELOG.md

Assets 2
Loading