The Scenario

Eleven OSCAL controls satisfied. Derived from 31 receipts.
6.00 joules.

OFAC screening, beneficial-ownership disclosure, FinCEN Real-Estate Reporting Rule, CSRD energy disclosure. Every check is a Cedar predicate over receipts already in the log. 6 joules to compose the bundle.

Start the walkthrough Skip to the artifact
01
Profile
OSCAL 1.1.2
0.31 J

An OSCAL profile names 11 controls — and nothing else.

Profile fincen-rre-2026 imports NIST SP 800-53 Rev 5 baseline-low and selects AC-1, AC-2, AC-3, AU-2, AU-12, CA-1, SC-12, SI-4, CM-2, RA-3, PE-3. The profile is a 217-line OSCAL JSON document signed by the compliance officer at issuance time.

JWP ReceiptPayload
kind "compliance.profile.loaded"
controls 11
baseline 800-53 Rev 5 low
joules 0.31
cite "OSCAL 1.1.2 profile · NIST SP 800-53 Rev 5"
sig "ed25519:0x4f...c1a"
02
Predicate
Cedar 4.2
0.87 J

Each control compiles to a Cedar predicate over the receipt stream.

AC-2 (Account Management) becomes: forall trust.id.token.issued receipts in window, assurance ≥ iso29115:loa-3 AND vp_hash present. AU-12 (Audit Generation) becomes: every state-mutating receipt has a non-null sig. The control catalog is code, not prose.

JWP ReceiptPayload
kind "compliance.predicate.compiled"
predicates 11
engine Cedar 4.2
joules 0.87
cite "Cedar 4.2 · OSCAL 1.1.2 implementation layer"
sig "ed25519:0x4f...c1a"
03
Evidence
Receipt log
1.42 J

31 upstream receipts qualify as evidence on first pass.

Evidence selector scans the receipt log for kinds matching each predicate's input set: 8 trust.id.token.issued, 6 settlement.dvp, 5 legal.statute.snapshot, 4 terra.property.read, 4 cyber.attestation, 4 advisor.quote.signed. Every selected receipt is hash-pinned into the bundle's links[].

JWP ReceiptPayload
kind "compliance.evidence.selected"
receipts_pinned 31
kinds_distinct 6
joules 1.42
cite "OSCAL 1.1.2 §SAR links · BLAKE3 content addressing"
sig "ed25519:0x4f...c1a"
04
FinCEN RRE
31 CFR §1031
0.63 J

The FinCEN Real-Estate Report is one Cedar query, not a workflow.

31 CFR §1031.320 requires reporting of non-financed transfers of residential real estate to legal entities. Predicate: settlement.dvp.asset_leg.kind == "deed" AND legal_entity_buyer == true AND financing_chain.empty(). Result this run: 0 reportable transfers (the buyer was a natural person), with the evaluation itself receipt-stamped.

JWP ReceiptPayload
kind "compliance.fincen.rre.eval"
reportable false
predicate_inputs 4
joules 0.63
cite "31 CFR §1031.320 (effective 2025-12-01)"
sig "ed25519:0x4f...c1a"
05
OFAC + BO
SDN / FinCEN BOI
0.94 J

OFAC SDN screening and beneficial-ownership reconcile against identity receipts.

trust.id.token.issued receipts carry vp_hash references to verifiable credentials. The screener resolves each VP subject against OFAC SDN list (2026-05-06 daily push) and FinCEN BOI registry. Zero hits, two BOI lookups, total 0.94 J. The screening output is itself a receipt that AC-3 cites as evidence.

JWP ReceiptPayload
kind "compliance.ofac.screened"
sdn_hits 0
boi_lookups 2
joules 0.94
cite "OFAC SDN · 31 CFR §1010.380 BOI"
sig "ed25519:0x4f...c1a"
06
CSRD §29b
Energy projection
0.55 J

CSRD energy disclosure is a projection over joules receipts.

CSRD Article 29b (Delegated Regulation EU 2023/2772 ESRS E1) requires gross energy consumption disclosure. Projection: sum(joules) across all receipts in window 2026-Q2 attributable to entity tx_science:row_4408 = 190.65 J for this transaction, rolling 2,418,902 J across the quarter. The CSRD row is derived, never compiled.

JWP ReceiptPayload
kind "compliance.csrd.projection"
joules_q2_2026 2,418,902
esrs_metric E1-5
joules 0.55
cite "EU 2023/2772 ESRS E1 §29b"
sig "ed25519:0x4f...c1a"
07
Bundle
OSCAL SAR
1.18 J

The bundle assembles as a single OSCAL Assessment Results document.

SAR (Security Assessment Results) 1.1.2 document: 11 findings, all status=satisfied, each linking to its Cedar predicate hash and the constituent receipt hashes. Total bundle size 184 KB, signed Ed25519 by the assessment authority, content-addressed under BLAKE3.

JWP ReceiptPayload
kind "compliance.bundle.assembled"
findings 11
bundle_kb 184
joules 1.18
cite "OSCAL SAR 1.1.2 · BLAKE3"
sig "ed25519:0x4f...c1a"
08
Audit
Re-derivation
0.10 J

An external auditor re-runs the predicates and gets the same 11 satisfied.

Auditor pulls the bundle, the receipt log, and the Cedar predicates. Re-evaluation costs 0.10 J — predicates are pure functions over signed inputs. Disagreement would imply a signature break, not an interpretive dispute. The audit IS the log.

JWP ReceiptPayload
kind "compliance.audit.rederived"
satisfied_match 11 / 11
rederive_joules 0.10
joules 0.1
cite "Cedar 4.2 evaluation · OSCAL 1.1.2"
sig "ed25519:0x4f...c1a"

ComplianceOS, in one line

6.00 joules. One receipt.

ComplianceOS handles predicate as a typed, signed, energy-metered operation. The whole pillar is one shape: take a claim, do the work, sign the receipt.

Open the artifact → See the receipt format →