Compliance

The Compliance family turns the guarantees the other modules already enforce, fail-closed RLS, WORM storage, per-tenant encryption, into something you can hand an auditor: a deterministic, byte-stable evidence pack that maps each control to a cited clause, and a hard block if any control is unresolved rather than a silent guess.

What's in the family

• compliance: the compliance evidence kit — the composition package that re-exports the framework catalogs, the evidence engine, and per-tenant signing, and adds its own OSCAL bundle assembler, tenant-crypto composition, support-impersonation audit trail, and regulatory-exemption posture worksheet.
• compliance-core: the evidence engine: typed collectors that flag or resolve a control, a byte-stable evidence pack, and an OSCAL export. Never certifies, every summary line is readiness/posture language only.
• frameworks-pack: own-authored, clean-room control catalogs for SOC 2, HIPAA Security, and the EU AI Act, crosswalked to each framework's requirement ids.
• signing-primitive: detached Ed25519 signing over the evidence pack's canonical manifest, with an optional RFC-3161 trusted-timestamp countersignature, shared with the Provenance family.
• audit-worm: the append-only SHA-256 audit chain plus S3/GCS/ R2 Object-Lock WORM storage the evidence cites, shared with the Provenance family.
• retention-runner: the CCPA/GDPR right-to-erasure runner: fans one subject's erasure across every registered store and writes one reason-tagged audit row.
• alerting: a five-stage alert pipeline (dedup, rate-cap-to- digest, quiet hours, multi-channel send, one audit row), the SOC 2 CC7.2 control.
• field-crypto: per-tenant field encryption, shared with the AI-Production, Local-first, and Provenance families.
• oscal-spine: the complete OSCAL surface — deterministic assessment-plan, assessment-results, POA&M, catalog, XML, and ISO 27001 SoA exports, plus the pinned NIST 800-53 catalog and OLIR relationship mapping.
• access-review: audit-prep access-review campaigns — a WORM-logged, per-reviewee attested approve/revoke record over an imported membership snapshot, opened on a jobs-riding cadence and closed on completion or deadline, with any undecided reviewee flagged unresolved rather than auto-approved.
• risk-register: a framework-agnostic risk register — likelihood × impact scoring with a computed (never freeform) residual, operator overrides recorded as a chained exception rather than an edit, crosswalk pointers into any shipped framework pack, and a risk-treatment-plan evidence artifact.
• artifact-render: the shared render primitive for public-facing compliance artifacts — a readiness-language claim filter, allowlist-based field redaction, and citation-row rendering, shared by the ISO 27001 SoA generator and the trust-page generator.
• trust-page: a customer-facing trust-page generator — a self-contained static HTML + JSON page built from an evidence pack and its crosswalk rollup through allowlist-based redaction, hostable anywhere to publish a compliance posture.
• verify-pack: the out-of-band evidence-pack verifier — validates the signed file manifest, the pack seal, the receipt chain, and every per-row anchor signature, without trusting executable code from inside the pack.

The family also carries the Apache-2.0 base it builds on (kernel, tenancy-rls, migrate).

Install

bunx --package @caisson-sh/cli@latest create-caisson --name caisson-app --module <id@version>
cd caisson-app
bun install

Repeat --module <id@version> once per module you want. Every module installs from public npm, no token needed; see Getting started for the full flag reference.

How it composes

compliance-core's collectors run over facts gathered by the other modules, an RLS posture snapshot, an audit-worm chain anchor, a field-crypto key policy, and refuse to guess: a control the collectors can't evidence blocks the pack rather than passing silently. frameworks-pack supplies the clause catalog each control resolves against, and signing-primitive produces the detached signature over the pack's canonical bytes so a third party can verify it wasn't edited after generation. retention-runner and alerting are the two operating controls (erasure, incident notification) the pack cites as evidence of an active program, not just point-in-time posture.

Verifying an exported audit pack

The logical audit pack contains receipts.json, an auditor README, and a signed canonical manifest of every exported file name and SHA-256 digest. It deliberately contains no executable verifier: a program travelling inside the archive it judges cannot establish its own integrity. The seal covers the manifest, so adding, removing, renaming, or substituting any file in the pack breaks the signature.

Verification is out of band by design, and it needs one input the pack cannot supply: the issuer's Ed25519 key fingerprint, obtained through a separately trusted issuer channel. A check that reads the candidate key from the pack itself proves nothing, so verification refuses PASS when that fingerprint is absent or differs from the key inside the pack.

The format is inspectable rather than proprietary. The Apache-2.0 @caisson-sh/kernel builds the canonical manifest and the exact bytes the seal signs (@caisson-sh/kernel/evidence), and checks each row's link recompute, its per-length WORM anchor, and its anchor signature (@caisson-sh/kernel/audit-verify).

The sanctioned runner for that flow is @caisson-sh/verify-pack.

Composing with the base

Every collector reads facts gathered at the tenant boundary @caisson-sh/tenancy-rls enforces: compliance-core never infers a passing RLS control it can't evidence from a live posture snapshot.

License

Every module here is Apache-2.0 and installs from public npm.