Compliance-as-Code Agent

Cubiczan stack — Profile · CHP · You are here: compliance-as-code-agent

Rust agent that scans codebases against organizational compliance policies and auto-fixes violations.

Built by Cubiczan — composes patterns from Consensus Hardening Protocol and autonomous-business-os.

What it does

Agent	Role
Detector	Walks the repo and evaluates YAML policy packs
Fixer	Proposes and applies rule-based auto-fixes
Validator	Re-scans + CHP-style adversarial review

Every check and fix is logged to a signed append-only audit ledger (.cac/audit.jsonl).

Policy packs (included)

no-hardcoded-secrets — API keys, passwords, tokens, .env commits (SOC2)
gdpr-data-tagging — @gdpr annotations on PII fields
soc2-audit-trails — audit_log calls on auth, delete, and payment handlers

Install

cargo install cac-cli
cac scan --root .

crates.io (publish order: cac-core → cac-scanner / cac-fixer → cac-validator → cac-webhook → cac-cli):

Crate	Role
`cac-core`	policy + signed audit ledger
`cac-scanner`	detector
`cac-fixer`	auto-fix
`cac-validator`	re-scan + adversarial review
`cac-webhook`	GitHub/Gitea PR webhook
`cac-cli`	binary `cac`

See PUBLISH.md for the crates.io sequence.

Quick start (from source)

cargo build --release
cargo run -p cac-cli -- scan --root examples/violations
cargo run -p cac-cli -- run --root examples/violations --dry-run

MCP (optional, later)

A thin MCP stdio wrapper around cac scan / cac run / cac audit is planned (same pattern as @cubiczan/chp-mcp) but not shipped yet. Use the CLI binary directly until then.

CLI

cac scan              # Detector agent
cac fix [--dry-run]   # Fixer agent
cac validate          # Validator agent
cac run [--dry-run]   # Full detect → fix → validate pipeline
cac audit             # Show signed audit trail
cac serve             # PR webhook server (GitHub + Codeberg)

Options

Flag	Default	Description
`--root`	`.`	Repository root to scan
`--policies`	`policies`	Policy YAML directory
`--format`	`text`	`text` or `json`
`--signing-key`	env `CAC_LEDGER_SIGNING_KEY`	HMAC key for audit signatures

Architecture

policies/*.yaml
      │
      ▼
┌─────────────┐    ┌─────────────┐    ┌────────────────┐
│ cac-scanner │───▶│  cac-fixer  │───▶│ cac-validator  │
│  (detect)   │    │   (fix)     │    │  (validate)    │
└──────┬──────┘    └──────┬──────┘    └───────┬────────┘
       │                  │                    │
       └──────────────────┴────────────────────┘
                          │
                    cac-core (policy + audit ledger)
                          │
                    .cac/audit.jsonl

PR webhook integration

Run the webhook server to scan pull requests automatically:

cp .env.example .env   # set CAC_WEBHOOK_SECRET, tokens
cac serve --policies policies

On each pull_request event (opened, synchronized, reopened):

Detector clones the PR head and scans against policies
Posts commit status (compliance-as-code/scan) — pass or fail
Posts a PR comment with violation details
Optionally opens an auto-fix PR when CAC_AUTO_FIX_PR=true

See docs/WEBHOOK_SETUP.md for GitHub and Codeberg webhook configuration.

CI integration

- run: cargo build --release -p cac-cli
- run: ./target/release/cac scan --format json
  env:
    CAC_LEDGER_SIGNING_KEY: ${{ secrets.CAC_LEDGER_SIGNING_KEY }}

Exit code 1 when critical violations remain after validation.

Air-gap / regulated deployments

Static policy engine runs fully offline — no LLM required for detection
Single binary (cac) suitable for on-prem CI and air-gapped environments
Signed audit ledger provides SOC2 evidence chain

Cubiczan stack

YAML policy packs here gate cleanmandate spend rules and PR webhooks for software-factory output.

License

MIT — see LICENSE.

cac-core 0.1.0