Evidence Factory

"Make governance compile."

Layer 1 — Definition
Governance Kernel
Defines what must exist for a release to be acceptable
📄
governance/*.json
Structured inputs — purpose, oversight, data, risk, traceability
🔒
policy/evidence.rego
OPA rules — required files, structural checks, CI gates
📐
Stable filename API
Schema + naming conventions = machine-verifiable contract
Layer 2 — Enforcement
Evidence Factory
Enforces the kernel and produces verifiable evidence
🏋️
src/train.py · src/eval.py
Deterministic training + evaluation (model-in-the-box)
📦
scripts/make_evidence_pack.py
Assembles artifacts → content-addressed manifest → .tgz
⚙️
.github/workflows/evidence-factory.yml
CI pipeline — SBOM, vuln scan, policy gate, signing
▼  CI PIPELINE FLOW  ▼
🧠
Train
Deterministic
seed=42
→
📊
Evaluate
Metrics tied
to model hash
→
📋
SBOM
SPDX JSON
supply chain
→
🛡️
Trivy Scan
HIGH/CRITICAL
fail on vuln
→
🗂️
Assemble
SHA-256 manifest
+ git SHA
→
✅
Policy Gate
Conftest / OPA
pass or fail
→
🔏
Sign
Sigstore keyless
(main only)
▼  OUTPUT  ▼
Artifact
Evidence Bundle
Immutable, content-addressed, signed — receipts, not slide decks
🧾manifest.json 🤖model.joblib 📈eval.json 🏛️governance/*.json 📋sbom.spdx.json 🛡️trivy.sarif 🔐*.sigstore.json 📦evidence-pack.tgz
🔗 Content-addressed
📜 Append-only
🔁 Reproducible
⚖️ Policy-as-code
🔍 Auditable
🚫 Fail fast & loud