OPEN SOURCE · PYTHON + REGO · LOCAL EVIDENCE

SOC-2 readiness workspace

Understand the evidence.
Plan the next fix.

Turn GitHub configuration checks into findings you can inspect and action plans you can keep. Assess one repository locally, or learn the workflow with a clearly labeled synthetic sample.

Explore the sample Assess your repository

CHOOSE YOUR STARTING POINT

One workspace. Two distinct workflows.

PUBLIC SAMPLE

Explore without connecting a repository

The demo runs with synthetic fixtures. It presents 20 evaluated catalog controls: 11 technical checks and 9 procedural checks. The other 17 are not evaluated.

Inspect findings, add a plan, and export a review. The public demo accepts fixture reports only.

Open the interactive sample →

REAL REPOSITORY · LOCAL ONLY

Assess your GitHub configuration

The local collector makes read-only GitHub API requests for one repository. It uses your existing GitHub CLI authentication and writes private report and evidence files outside Git checkouts.

Open the report in the loopback-only workspace. Real notes stay in tab memory until you export them.

Follow the local assessment guide →

KNOW WHAT A RESULT MEANS

Three checks, with explicit limits.

CTRL-CHG-001

Branch protection and force-push settings

Inspect the default branch’s protection settings. A pass does not prove every change used a pull request or that privileged bypass is impossible.

CTRL-CHG-002

Required reviews and status checks

Check the configured approving-review count and required checks. A pass does not prove reviews happened or checks succeeded for each change.

CTRL-CHG-008

Active GitHub Actions workflow

Observe an active workflow under .github/workflows/. Its presence does not prove deployment reproducibility or successful runs.

Unreadable or unsupported settings are missing evidence. Unevaluated controls never count as passing. Planning notes do not change a policy verdict or create a waiver.

FROM YOUR OWN CHECKOUT

Collect. Inspect. Plan. Reassess.

Install Python, PyYAML, OPA, and the GitHub CLI, then follow the setup guide. Use the private report path printed by the first command.

To resume a saved review and its notes on startup, pass the exported review.json to the same --report option. Failed results stay failed.

Assess one repository

python3 scripts/assess_github.py --repo OWNER/REPO

Open your report or exported review locally

python3 scripts/serve_workspace.py \
  --report /absolute/path/report.json

Setup, permissions, and privacy →

OPEN AND INSPECTABLE

For people and coding agents.

Start with the current workflow, inspect the implementation, and keep the scope of each result visible. Historical design documents are context, not a claim that every proposed feature exists.

Project READMEPurpose, quick start, and scope
Documentation mapCurrent guides and historical design context
Contributing guideDevelopment and verification
Agent instructionsRepository commands and evidence boundaries
Machine-readable project indexA concise guide to public sources
Security policyLocal-data boundaries and private reporting

SOC-2 is an open-source readiness workspace and policy/sensor pack. It is not a SOC 2 Type I or Type II report, CPA opinion, certification, or a replacement for an audit.