mirror of
https://github.com/hanzoai/trust.git
synced 2026-10-30 14:54:58 +00:00
zeekay
cc68387180
A cloud plugin (HIP-0106, the captable/plans shape) that publishes a control inventory, folds it onto published framework clause lists, and reads evidence from the platform's audit trail at /v1/trust/*. The inventory is the product. Every entry names the repo and path where the mechanism lives, and five entries record that a mechanism is weaker than a Hanzo page claims — the segment-wise prefix test and in-module key custody do not exist, the trail captures no request body, and its user column is unindexed. An inventory that cannot say that is worth nothing. Coverage is a fold, never a field. A mapping is worth the weakest of what the control claims, how much of the clause it answers, and whether anything can fail on its behalf; an absent control is worth nothing however it maps. The denominator is each framework's whole published clause list, so uncovered clauses stay visible. Every count carries its unit and nothing emits a boolean. The build validates before it bundles: an unknown status, a mapping to an undeclared clause, or prose claiming a certification stops the build, so there is no artifact and therefore no number to misread. No database and no writes — the inventory compiles into the bundle, so no tenant can inflate its own coverage. The audit query carries no org field; the host binds the trail to the tenant it validated. 77 tests over the built artifact in a bare vm, proven to fail by mutation.
15 lines
688 B
AMPL
15 lines
688 B
AMPL
// hanzoai/trust — Go embed module.
|
|
//
|
|
// This repo's PRIMARY artifact is the control inventory (controls.json,
|
|
// frameworks.json) and the goja bundle built from goja/src/*.ts. This tiny Go
|
|
// module exists ONLY so the unified hanzoai/cloud binary (HIP-0106) can embed
|
|
// the trust goja bundle WITHOUT copying it into the cloud repo. Cloud imports
|
|
// github.com/hanzoai/trust and gets Bundle().
|
|
//
|
|
// std-lib only — no third-party Go deps. The TypeScript in goja/src and the two
|
|
// JSON data files stay the single source of truth; the Go layer is a read-only
|
|
// embed, exactly like github.com/hanzoai/captable and github.com/hanzoai/plans.
|
|
module github.com/hanzoai/trust
|
|
|
|
go 1.26.5
|