C

Compliance

Compliance service enforcing rules defined in the TrustFramework - Architecture Document/Compliance Document

A suite of tools to assist with reviewing Open Source Software dependencies. (Mirrored from https://github.com/oss-review-toolkit/ort)

SharedRail is an open-source, federated payment infrastructure designed to enable secure, instant, and identity-based value transfer across currencies and borders. Built on a modular architecture with mandatory encryption, KYC, and AI-assisted human intent verification, SharedRail allows users and institutions to send and receive payments using verified email identities while maintaining full transparency, auditability, and compliance through open standards. https://roxanneardary.com/sharedrail/

The conformance contract for projects under gitlab-com/public-sector.

Source of truth for the Compliance engine, validating certificate are conforming to rules, providing shapes, schemas and trusted sources

The landing page and the ten scenarios. The thesis, the claims ledger, and the public posture mirror an assessor can check without an account.

Chapter 5: a container image at cutover phase. The unsigned-image gap is planted, and the red pipeline is the point: watch the floor block it.

Maintenance, asset, and configuration-change records for accredited systems. Single static binary, pure-Go SQLite, LDAP/AD auth with local break-glass accounts, hash-chained audit trail. AGPL-3.0-or-later.

Bedrock RMF — self-hosted NIST 800-53 Rev 5 / RMF compliance management (an eMASS / Xacta alternative): control implementations to the CCI, POA&Ms, evidence, HW/SW inventory, PPSM, STIG checklists, cloud inheritance. AGPL-3.0.

Renders the Evidence Factory group README and its ten scenarios as one site. This project holds no prose; edit gitlab-profile.

Chapter 4: a Go binary at report phase. Gaps are published and advisory, so the merge request stays green while the finding rides along.

CLI tool for GitLab automation: sync groups to local filesystem and audit projects against security & OpenSSF best practices with automated scoring

Chapter 3: the driver. One tool provisions the group, assesses each control, pushes verdicts, and exports OSCAL.

Chapter 6: a CI component at enforce phase. The off-catalog include is planted, and the red pipeline is the point: watch the gate stop it.

Chapter 1: the governed CI/CD Catalog and the evidence line. Published, pinned components every workload builds from.

G.U.A.R.D. is an automated Compliance-as-Code verification tool designed for cloud-native software. It bridges the semantic gap between qualitative regulatory frameworks (such as NEN 7510 and ISO 27001) and deterministic software controls by mapping compliance requirements directly to specific code symbols (anchors) and enforcing them within CI/CD pipelines.

AI-powered GitLab CI Component that automates DISA ASD STIG compliance analysis reducing manual checklist completion from weeks or months to minutes using GitLab Duo agentic workflows to determine compliance with the 286 security controls.

Chapter 2: the policy plane. The NIST 800-53 framework, the Pipeline Execution Policy that injects the line, and the approval gates.

A Python-based CLI tool designed to scan GitLab projects for compliance against the CIS GitLab Benchmark. Check out the recommendations-as-code in this repo. Read the docs for more info.

BalanceSeal is an AGPL 3.0+ cryptographic audit module for cryptocurrency exchanges and digital wallets that generates a verifiable, time-frozen snapshot of all user assets at the moment an account is terminated. It aggregates on-chain and off-chain balances, reconciles holdings across systems, locks market pricing at the termination timestamp, and produces tamper-evident reports for compliance, auditing, and transparency. https://roxanneardary.com/balanceseal/