LLMs drift, hallucinate, or regress after changes without detection. Risk signals scatter across repos, configs, and tooling.
No Repeatable Verification
Teams lack repeatable verification and defensible evidence artifacts. Audits are slow, inconsistent, and hard to reproduce.
How It Works
From Messy Inputs to Defensible Evidence
Three engines run in sequence. Each consumes structured input and produces named, versioned artifacts. The pipeline is deterministic - same inputs, same pack, same result.
ICB
Input Contract Builder
Takes a GitHub repo, file upload, or preset source and normalizes it into a structured declaration contract. System and inventory declarations are converted into a manifest schema with pinned version metadata. Produces deterministic "what's missing" lists - fields and evidence paths required for evaluation. Low-confidence indicators are explicitly declared, not guessed.
Static analysis scans the codebase for code-pattern indicators: network calls, execution primitives, credential handling, data flows. Each signal carries a severity level (HIGH / MEDIUM / LOW), match count, and evidence lines with path:lineno snippets. Signal counts are injected directly into the manifest, enriching it for evaluation.
This is what your auditor wants: show me what you saw and where. Not runtime proof, but strong review guidance with evidence samples.
FDY
Foundry Evaluation (Policy Pack)
The enriched manifest is evaluated against 114 executable controls. Each control produces a deterministic outcome - MEETS, REVIEW, or FAIL - with rationale and required evidence paths. The engine compares declared posture against observed indicators: if you declare tools disabled but repo signals show execution primitives, the result is REVIEW, not a false pass.
Credibility feature: when network is declared "none" but SIG-NETWORK count is 3, the outcome is intentionally "requires review." We don't overclaim governance.
RPT
Report Generation
All artifacts are assembled into an audit-ready DOCX with table of contents, executive summary, evidence tables, and manual review list. Posture is declared as GREEN / YELLOW / RED / INCOMPLETE. If contract declarations are missing, the report explicitly states posture cannot be asserted - no false confidence.