CarterPerez-dev
|
7ce0cb48bd
|
feat(compliance): evidence bundle export + framework control mapping
ControlMapping for SOC2 (CC6.1, CC6.6, CC6.7, CC4.1, CC7.x), PCI-DSS
(8.3.9, 8.6.3, 10.5.x, 3.7.4), ISO 27001:2022 (A.5.16, A.5.17, A.5.18,
A.8.5, A.8.15, A.8.16, A.8.24), HIPAA (164.308 / 164.312). Mapping is
intentionally minimal - each event maps only where it provides direct
evidence.
Bundle.write produces a self-verifying ZIP:
- audit_log.ndjson (raw chain rows with hex hashes)
- audit_batches.json (signed Merkle roots)
- control_mapping.json (event_type -> controls)
- manifest.json (per-file SHA-256 + size)
- README.md (verification instructions)
- public_key.pem + manifest.sig (Ed25519, when signer provided)
7 specs verify ZIP layout, manifest sha256-per-file, control mapping
content per framework.
|
2026-04-29 01:14:02 -04:00 |
|
CarterPerez-dev
|
8ebdd3fee7
|
feat(cre): source tree skeleton with empty module dirs and CI workflow
- src/cre.cr entry point + version.cr
- Empty module dirs: cli, tui, engine, events, rotators, policy, audit, crypto, persistence, notifiers, compliance, config, domain, aws, vault, github, demo
- spec/ unit + integration + fixtures structure mirroring src/
- spec_helper.cr with stdlib spec + cre require
- GitHub Actions CI: format, unit matrix (Crystal 1.19/1.20/nightly x ubuntu/macos), integration with PG service, build job
|
2026-04-28 23:54:59 -04:00 |