OSCAL bundle viewer + Cedar playground.
Pick a control. See the predicate. Trace it to the upstream receipts that satisfy it. Edit the predicate, re-derive.
Assessment Results as one signed document
An OSCAL 1.1.2 Assessment Results (SAR) bundle. 11 findings, each linking by BLAKE3 hash to a Cedar predicate and to every upstream receipt that satisfied it. The bundle is the only artifact the assessor consumes — no spreadsheets, no PDF appendices, no screenshot folders.
Anatomy — operational specs
Controls as compiled code
Cedar 4.2 policy expressions replace control narratives. AU-12 reads: permit(principal, action == Action::"emit", resource) when { resource.sig != null }. The control is the predicate; the predicate is what the auditor evaluates; the evaluator is open.
Anatomy — operational specs
Receipts as audit primary sources
Every finding links to the upstream receipts that satisfied it, by content hash. The chain for AC-2 (Account Management) traces 8 trust.id.token.issued receipts, each pinning a vp_hash that resolves to a verifiable credential. Breaking the chain requires breaking a signature.
Anatomy — operational specs
NIST 800-53 → Cedar → receipts
A three-column map: NIST 800-53 Rev 5 control id, the Cedar predicate that implements it, the receipt kinds that feed it. AC-1, AC-2, AC-3 fed by trust.id.token.issued. AU-2, AU-12 fed by every state-mutating receipt. SC-12 fed by trust.key.rotation events. The map is the OSCAL profile.
Anatomy — operational specs
ESRS E1 as a sum over joules
CSRD Article 29b energy disclosure (ESRS E1-5) is a SUM(joules) projection over the receipt log, partitioned by entity and reporting window. The Q2-2026 row reads 2,418,902 J = 0.672 kWh for entity tx_science:row_4408. Re-running the projection on the same window returns the same number, byte-for-byte.
Anatomy — operational specs
ComplianceOS, in one line
predicate, made inspectable.
Click anything. The same primitives that compose the rest of the Transaction Science family — receipts, joules, signed transport — show up here too. The family is one system.