Cubiczan stack — Profile · CHP · You are here: compliance-as-code-agent

Rust agent that scans codebases against organizational compliance policies and auto-fixes violations.

Built by Cubiczan — composes patterns from Consensus Hardening Protocol and autonomous-business-os.

Every check and fix is logged to a signed append-only audit ledger (.cac/audit.jsonl).

• no-hardcoded-secrets — API keys, passwords, tokens, .env commits (SOC2)
• gdpr-data-tagging — @gdpr annotations on PII fields
• soc2-audit-trails — audit_log calls on auth, delete, and payment handlers

cargo build --release
cargo run -p cac-cli -- scan --root examples/violations
cargo run -p cac-cli -- run --root examples/violations --dry-run

cac scan              # Detector agent
cac fix [--dry-run]   # Fixer agent
cac validate          # Validator agent
cac run [--dry-run]   # Full detect → fix → validate pipeline
cac audit             # Show signed audit trail
cac serve             # PR webhook server (GitHub + Codeberg)

policies/*.yaml
      │
      ▼
┌─────────────┐    ┌─────────────┐    ┌────────────────┐
│ cac-scanner │───▶│  cac-fixer  │───▶│ cac-validator  │
│  (detect)   │    │   (fix)     │    │  (validate)    │
└──────┬──────┘    └──────┬──────┘    └───────┬────────┘
       │                  │                    │
       └──────────────────┴────────────────────┘
                          │
                    cac-core (policy + audit ledger)
                          │
                    .cac/audit.jsonl

Run the webhook server to scan pull requests automatically:

cp .env.example .env   # set CAC_WEBHOOK_SECRET, tokens
cac serve --policies policies

On each pull_request event (opened, synchronized, reopened):

1. Detector clones the PR head and scans against policies
2. Posts commit status (compliance-as-code/scan) — pass or fail
3. Posts a PR comment with violation details
4. Optionally opens an auto-fix PR when CAC_AUTO_FIX_PR=true

See docs/WEBHOOK_SETUP.md for GitHub and Codeberg webhook configuration.

- run: cargo build --release -p cac-cli
- run: ./target/release/cac scan --format json
  env:
    CAC_LEDGER_SIGNING_KEY: ${{ secrets.CAC_LEDGER_SIGNING_KEY }}

Exit code 1 when critical violations remain after validation.

• Static policy engine runs fully offline — no LLM required for detection
• Single binary (cac) suitable for on-prem CI and air-gapped environments
• Signed audit ledger provides SOC2 evidence chain

| Governance | consensus-hardening-protocol · agent-conductor · compliance-as-code-agent · cleanmandate | | Finance | Strata · meshcfo · Metabocommand |

YAML policy packs here gate cleanmandate spend rules and PR webhooks for software-factory output.

MIT — see LICENSE.