Compliance mapping: controls and evidence

This page links each control family of the platform to the audit that checks it and to the evidence sets that prove it. French version: ../compliance-mapping.md.

How to read a piece of evidence

• The requirement matrix of the kit (355 rows) is audited row by row in docs/implementation/audit: for each requirement, the code paths, the tests, the documentation, the migrations and the evidence sets.
• An evidence set (docs/implementation/evidence.yaml and docs/implementation/evidence.d) is a replayable command (folder, command, result parser). tools/traceability/trace.py runs it and records the result in docs/implementation/evidence.
• The state of a requirement is never written by hand: it is derived from the recorded evidence and published in docs/implementation/STATUS.md, docs/implementation/TEST_EVIDENCE.md and docs/implementation/TRACEABILITY.csv. What a missing resource (cluster, GPU, client decision) leaves open is listed in docs/implementation/BLOCKERS.md.
• Conformance to the reference architecture follows the same model in docs/implementation/conformance.

Control families

Domain	Expected control	Requirements	Audit	Evidence sets
AGENT_RUNTIME	Durable, bounded and isolated agent execution	17	g04-agents-llm.yaml	E-AL-GATEWAYS, E-AL-AGENTS, E-AL-SDK-RUNTIME, E-AL-DURABLE
AUDIT_EVIDENCE	Chained audit, signed and retained evidence	17	g03-iam-audit.yaml	E-G03-EVIDENCE, E-G03-CONTEXT, E-G03-AUDIT, E-G03-CONTRACTS
BACKUP_RECOVERY	Consistent backups per component, verified restore	19	g10-ha-backup-dr.yaml	E-HB-BACKUP, E-HB-UI
CLUSTER_MANAGEMENT	Controlled placement, operator and cluster agents	12	g09-hosts-clusters.yaml	E-HC-PLACEMENT, E-HC-K8S, E-HC-OPERATOR, E-HC-CLUSTER-AGENT
DATA_RAG	Data indexed with permissions, client storage	24	g05-data-multimodal.yaml	E-CP-RAG-KIT, E-CP-STORAGE, E-DM-DATA-MEDIA
DEV_MARKETPLACE	Signed publication and gates before install	22	g07-dev-frontend.yaml	E-DF-SDK-PY, E-DF-MARKETPLACE, E-PORTAL, E-SDK-TS
DISASTER_RECOVERY	Approved recovery plans, measured exercises	11	g10-ha-backup-dr.yaml	E-HB-BACKUP, E-HB-HA, E-HB-UI
DOCUMENTATION	FR and EN guides checked against the code	12	g08-docs-release.yaml	E-DO-DOCS, E-DO-NM-DOCS, E-DO-FAIL-CLOSED, E-DO-REVOCATION
FOUNDATION	Foundation, components and traceability	14	g01-foundation-licensing.yaml	E-TRACE, E-CP-FOUNDATION, E-CP-COMPONENTS, E-FL-LOTPLAN
FRONTEND	Portal limited by role, no fictitious value	18	g07-dev-frontend.yaml	E-DF-PORTAL, E-PORTAL-BUILD
HIGH_AVAILABILITY	High availability of the stateful services	18	g10-ha-backup-dr.yaml	E-HB-HA, E-HB-UI, E-HB-BACKUP, E-HB-E2E
HOST_BOOTSTRAP	Host enrolment and agent identity	18	g09-hosts-clusters.yaml	E-HC-HOSTS, E-HC-AGENT-GO, E-HC-UI
IAM_GOV	Identity, delegations and policies	18	g03-iam-audit.yaml	E-G03-IAM-REAL, E-G03-CONTEXT, E-G03-EVIDENCE, E-G03-DATA
INFRA_SDK	Infrastructure SDK tied to operations and audit	5	g02-manager.yaml	E-MG-SDK, E-MG-SDK-TS, E-MG-SDK-GO, E-MG-SERVER
INFRA_UI	Infrastructure console	8	g02-manager.yaml	E-MG-UI, E-NM-BACKUP-DR, E-NM-INFRA-HOSTS, E-HC-HOSTS
LICENSING_RELEASE	Signed offline licence, reproducible distribution	16	g01-foundation-licensing.yaml	E-CP-LICENSING, E-LICENSE-ISSUER, E-FL-RELEASE, E-FL-RELEASE-CI
LLM_FINOPS	Model gateway and provider cost attribution	16	g04-agents-llm.yaml	E-AL-LLM, E-AL-FINOPS, E-AL-SDK-RUNTIME
MANAGER	Platform Manager: services, configurations, operations	23	g02-manager.yaml	E-MG-SERVER, E-MG-K8S, E-NM-OPERATOR, E-MG-UI
MULTIMODAL	Voice and media processed locally	12	g05-data-multimodal.yaml	E-CP-VOICE, E-DM-DATA-MEDIA, E-CP-COMPONENTS
OBSERVABILITY	Traces, metrics, logs and SLO	14	g06-observability-soc.yaml	E-G06-OBS, E-G06-FINOPS-PERF, E-G06-SOC
RELEASE_ACCEPTANCE	Acceptance: isolated install and scenarios	16	g08-docs-release.yaml	E-DO-INSTALL, E-DO-AIRGAP, E-DO-SOC, E-DO-MARKETPLACE
SECURITY_SOC	SOC, Kill Switch and OPA policies	25	g06-observability-soc.yaml	E-G06-SOC, E-G06-OPA

The test services/control-plane/tests/test_compliance_mapping.py checks that this table covers each domain of the matrix with its number of requirements, that the cited audit holds the requirements of the domain and that each cited evidence set exists and proves at least one requirement of the domain.

Cross-cutting controls

• Policy decision before every action, refusals included: security-hardening.md.
• Audit exported to WORM storage separate from the backups: siem-audit.md.
• Component licences and exceptions awaiting client approval: third-party-licences.md and catalog/licence-exceptions.yaml.