The Real-⁠Time Evidence Layer

A dependency scanner reports what the pull request would bring in.

{
  "event": "scan.completed",
  "source": "dependency-scanner",
  "repository": "digital-retail/payments-api",
  "pull_request": 482,
  "commit": "9f3e2c1",
  "components": [
    { "name": "express", "version": "4.19.2", "license": "MIT" },
    { "name": "pg", "version": "8.11.3", "license": "MIT" },
    { "name": "mysql-client", "version": "8.0.33", "license": "GPL-2.0-only" },
    … 212 more
  ]
}

Every component's license must appear in the policy's approved list. One license outside it fails the control.

package controls
import rego.v1

default pass := false

pass if {
  every component in input.evidence.components {
    component.license in policy.approved_licenses
  }
}

The approved list lives in Fianu, owned by the people who decide it.

Each evaluation produces a signed attestation that names the exact violation.

{
  "attestation_id": "att_01J9…K3F",
  "control": "oss-license-check",
  "control_version": 3,
  "policy": "approved-oss-licenses",
  "policy_version": 4,
  "subject": {
    "repository": "digital-retail/payments-api",
    "pull_request": 482,
    "commit": "9f3e2c1"
  },
  "result": "fail",
  "violations": [
    { "component": "mysql-client@8.0.33", "license": "GPL-2.0-only" }
  ],
  "evidence": "dependency-scanner · scan.completed · ev_7Q2…",
  "evaluated_at": "2026-09-27T14:02:11Z",
  "signature": "sigstore · verified"
}

The merge gate includes the control, so a failing attestation blocks the merge.

A container registry reports a new artifact, where it came from, and the SBOM that claims to describe it.

{
  "event": "artifact.pushed",
  "source": "container-registry",
  "repository": "digital-retail/checkout",
  "tag": "2.14.0",
  "digest": "sha256:7c1a…e93f",
  "provenance": {
    "source_repo": "digital-retail/checkout",
    "commit": "b41d0f7",
    "build_id": "ci-58213"
  },
  "attached": {
    "sbom": {
      "format": "spdx-2.3",
      "subject": "sha256:7c1a…e93f",
      "packages": [ "express@4.19.2", "pg@8.11.3", … 185 more ]
    },
    "signature": "present"
  }
}

The SBOM must be in an accepted format, must name this artifact's digest as its subject, and must contain every dependency the upstream module declares. That is the CRA's Annex I, Part II (1) requirement made checkable.

package controls
import rego.v1

default pass := false

pass if {
  sbom := input.evidence.attached.sbom
  sbom.format in policy.accepted_formats
  sbom.subject == input.evidence.digest
  every dependency in input.upstream.module.dependencies {
    dependency in sbom.packages
  }
}

What counts as an acceptable SBOM is set once, by the people accountable for CRA conformity.

Each evaluation produces an attestation that records what was checked and against which upstream asset.

{
  "attestation_id": "att_01JA…R8M",
  "control": "cra-sbom-coverage",
  "control_version": 2,
  "policy": "eu-cra-sbom-requirements",
  "policy_version": 2,
  "subject": {
    "artifact": "digital-retail/checkout:2.14.0",
    "digest": "sha256:7c1a…e93f"
  },
  "upstream": {
    "module": "digital-retail/checkout",
    "commit": "b41d0f7"
  },
  "result": "pass",
  "checks": {
    "format": "spdx-2.3 · accepted",
    "subject": "matches artifact digest",
    "coverage": "42 of 42 declared dependencies present"
  },
  "evidence": "container-registry · artifact.pushed · ev_3N8…",
  "evaluated_at": "2026-09-28T09:14:37Z"
}

One gate holds every control that maps to the CRA. When the artifact and its upstream assets satisfy all of them, the webhook fires.

The source control platform exposes each workflow file and which version of the enterprise-tooling reusable workflows it pins.

{
  "event": "push",
  "source": "source-control",
  "repository": "digital-retail/orders-service",
  "ref": "refs/heads/main",
  "commit": "e77b2a4",
  "workflows": [
    {
      "path": ".ci/workflows/build.yml",
      "uses": [
        "enterprise-tooling/container-build@v2.4.1",
        "enterprise-tooling/k8s-deploy@v3.0.0"
      ]
    },
    … 2 more
  ]
}

Every library a workflow pins must be at or above the minimum the policy sets for it. Libraries the policy doesn't list default to v0.0.0, so they always pass.

package controls
import rego.v1

default pass := false

pass if {
  every workflow in input.evidence.workflows {
    every reference in workflow.uses {
      [library, version] := split(reference, "@")
      minimum := object.get(policy.minimum_versions, library, "v0.0.0")
      semver.compare(
        trim_prefix(version, "v"),
        trim_prefix(minimum, "v")
      ) >= 0
    }
  }
}

Platform Engineering keeps one list of minimum versions. A workflow is measured only against the libraries it uses.

The attestation records each library in use, the version pinned, the minimum it was measured against, and how much room is left.

{
  "attestation_id": "att_01JB…T2Q",
  "control": "pipeline-version",
  "control_version": 5,
  "policy": "pipeline-library-minimums",
  "policy_version": 11,
  "subject": {
    "repository": "digital-retail/orders-service",
    "workflow": ".ci/workflows/build.yml",
    "commit": "e77b2a4"
  },
  "result": "pass",
  "evaluated": [
    { "library": "enterprise-tooling/container-build",
      "in_use": "v2.4.1", "minimum": "v2.4.0", "status": "ahead" },
    { "library": "enterprise-tooling/k8s-deploy",
      "in_use": "v3.0.0", "minimum": "v3.0.0", "status": "at minimum" }
  ],
  "not_applicable": 6,
  "evidence": "source-control · push · ev_9K1…",
  "evaluated_at": "2026-09-28T10:41:05Z"
}

One gate, three enforcement points: block the build, block the deployment, and warn at merge before either happens.

An SCA platform reports what it found in the image and ties it back to the repository and commit that built it.

{
  "event": "sca.completed",
  "source": "sca",
  "image": "digital-retail/inventory-api",
  "digest": "sha256:4b8e…a217",
  "repository": "digital-retail/inventory-api",
  "commit": "c58d19e",
  "tag": "3.7.2",
  "findings": [
    {
      "component": "org.apache.logging.log4j:log4j-core",
      "version": "2.14.1",
      "cve": "CVE-2021-44228",
      "severity": "critical",
      "cvss": 10.0
    },
    … 3 more
  ]
}

No finding may carry a CVE that appears on the priority remediation list.

package controls
import rego.v1

default pass := false

pass if {
  every finding in input.evidence.findings {
    not policy.cves[finding.cve]
  }
}

The security team keeps the list of CVEs that must never reach production. Adding one re-evaluates every artifact.

The attestation names the CVE, the component carrying it, and the commit that introduced it.

{
  "attestation_id": "att_01JC…W7H",
  "control": "priority-remediation",
  "control_version": 4,
  "policy": "priority-remediation",
  "policy_version": 23,
  "subject": {
    "artifact": "digital-retail/inventory-api:3.7.2",
    "digest": "sha256:4b8e…a217",
    "repository": "digital-retail/inventory-api",
    "commit": "c58d19e"
  },
  "result": "fail",
  "matched": [
    {
      "cve": "CVE-2021-44228", "name": "Log4Shell",
      "component": "org.apache.logging.log4j:log4j-core@2.14.1",
      "severity": "critical", "cvss": 10.0
    }
  ],
  "evidence": "sca · sca.completed · ev_5D4…",
  "evaluated_at": "2026-09-28T11:06:52Z"
}

Everything that must be true before production, in one gate. Releases hear about a failure early; deployments are stopped on the spot.