Compliance-as-code
Compliance-as-code means the controls, the evidence that they hold, and the audit trail proving neither was altered all run as versioned, tested software rather than a spreadsheet assembled by hand once a year. Caisson's Compliance bundle composes a typed control registry, a fail-closed evidence generator, and a WORM-anchored audit chain into one reachable runtime surface.
In code
export function createComplianceEdition(
options: ComplianceEditionOptions = {},
): ComplianceEdition {
const alertChannels = options.alerting?.channels ?? [];
const alertAuditSink =
options.alerting?.auditSink ?? createInMemoryAuditSink();
const erasureTargets = options.retention?.targets ?? [];
const retentionAuditSink =
options.retention?.auditSink ?? createCaptureAuditSink();
return {
alerting: {
channels: alertChannels,
auditSink: alertAuditSink,
process: (event, runtime) =>
processAlert(event, { ...runtime, channels: alertChannels, auditSink: alertAuditSink }),
},
// retention composes the same way over @caisson/retention-runner's erasureTargets and
// retentionAuditSink (elided; see packages/compliance/src/edition.ts:98-106).
};
}How it holds
The control registry is code, not a spreadsheet
CanonicalControl records are Zod .strict()-validated at author time (registry/control.ts): an own-authored requirement statement plus crosswalk references to SOC 2 and HIPAA reference ids, rejected on the first malformed field the same way any other typed domain object in the codebase is.
Evidence generation is a build artifact, not a snapshot someone remembered to run
generateEvidencePack refuses to produce a bundle at all when any control's evidence collector comes back unresolved, and identical evidence always canonicalizes to the same SHA-256, so the pack is reproducible output, not a point-in-time export.
The audit trail is verified by recomputation, not trusted by timestamp
Every mutation lands in a hash-chained, WORM-anchored chain (@caisson/audit-worm) that a compromised admin session can append to but never rewrite; verifyChain recomputes the chain end to end rather than trusting a log line's date.
The edition composes primitives, it does not fork them
createComplianceEdition wires @caisson/alerting and @caisson/retention-runner into one reachable surface at composition time; neither primitive depends back on the edition (ADR-0003 down-only), and construction alone holds no credential and makes no network call.