the regime table, then what the gate means for each market
Regulated industries are the proof point. Every team is the market.
The gate was built for patient-facing and life-science software, where an auditor asks how each release was built and asks again a year later. The table first, then each market, then everyone else.
The frameworks table.
Live means the control set runs on every fleet scan and its result lands on the certificate. Not live means a scanner is registered and no fleet certificate carries its result, because the fleet passes no profile today.
| control set | state | on a fleet certificate |
|---|---|---|
| HIPAA | live | runs on every scan; result on the certificate |
| SOC 2 | live | runs on every scan; result on the certificate |
| HITRUST | live | runs on every scan; result on the certificate |
| ISO 27001 | not live | registered control set with its own Annex A rules; no fleet certificate carries its result |
| GxP | not live | registered control set; neither scans nor vetoes a fleet build |
| 21 CFR Part 11 | not live | registered control set; neither scans nor vetoes a fleet build |
| PCI-DSS | not live | registered control set; neither scans nor vetoes a fleet build |
- packages/compliance/src/verify.ts DEFAULT_VERIFY_FRAMEWORKS
- apps/worker/src/fleet-certificate.ts runComplianceVerify(files, {})
- packages/compliance/src/frameworks/iso27001.ts, gxp-21cfr11.ts, pci-dss.ts, registry.ts
Healthcare.
- has to prove
- A HIPAA audit asks you to prove no patient data leaked and every access was controlled, for every release, and to prove it again a year later.
- runs today
- The HIPAA and HITRUST control sets scan the pull request tree of every completed mission and their results land on the certificate. The publication screen withholds any text the fleet would publish that carries an identifier. Every gate decision is an audit row that cannot be updated or deleted.
- not live
- Softwerk signs no BAA and holds no attestation report. The factory is not a business-associate context and handles no PHI by design; the publication screen exists for the case where an issue, a report or a pull request body carries identifiers anyway. Nothing screens the executor's file writes inside a mission: the worker's write screen (PHI_GUARD_ENFORCE) runs on the inherited generation path, is 0 on production, and a fleet certificate carries no PHI-guard result.
Life science.
- has to prove
- Patient-access and hub software sits between a telehealth partner and a pharmacy, and a validation team wants to see, in writing, exactly how each release was built and that nothing was altered afterwards.
- runs today
- The HIPAA control set runs on every scan. One certificate per file tree, keyed on the sha256 of the tree, archived write-once for 2190 days in COMPLIANCE mode, exported as a canonical bundle a validation team checks offline; the bundle is signed with ed25519 when the deployment holds a signing key, which production does not today.
- not live
- GxP and 21 CFR Part 11 are registered control sets and are not live: they neither scan nor veto a fleet build, and no validation claim is made. The certificate is usable evidence in a risk-proportionate framing; it is not a substitute for a validation checklist.
Finance.
- has to prove
- Change management is the control a SOC 2 auditor tests first: who changed what, who approved it, and whether the approval record can be produced on request.
- runs today
- The SOC 2 control set runs on every scan. The run names every role and the credential it ran on, a person merges the pull request, every mission-gate decision is an audit row the database refuses to update or delete, and release gate reviews are append-only with segregation of duties.
- not live
- PCI-DSS is a registered control set and is not live: it neither scans nor vetoes a fleet build, and no cardholder-data claim is made. Softwerk holds no SOC 2 report of its own.
Public sector.
- has to prove
- An assessor wants evidence they can verify without trusting the vendor, and a change record that survives a vendor change.
- runs today
- The SOC 2, HIPAA and HITRUST control sets run on every scan. Evidence exports as a deterministic bundle of canonical bytes, signed with ed25519 when the deployment holds a signing key, which production does not today, and a zero-dependency script checks it offline with no network and without cloning any repository.
- not live
- ISO 27001 is a registered control set and is not live: no fleet certificate carries its result today. No government authorisation of any kind is claimed, and the whole stack runs in Softwerk's AWS account.
Regulated consumer.
- has to prove
- Supplements, OTC, device brands and health-adjacent fintech answer to several regulators at once, and the customer data behind a checkout or a consent flow is the thing each of them asks about.
- runs today
- The SOC 2 and HIPAA control sets scan the pull request tree of every completed mission. The publication screen runs on every word the fleet publishes from an issue, a report or a pull request body, and withholds it on a detection.
- not live
- PCI-DSS is a registered control set and is not live. Nothing screens the executor's file writes inside a mission: the worker's write screen (PHI_GUARD_ENFORCE) runs on the inherited generation path and is 0 on production.
The same certificate for teams nobody regulates.
Most engineering teams are not covered entities and never will be, and their security review still asks four questions about agent-written code.
- who wrote it
- The run names every role and the credential it ran on.
- who reviewed it
- A separate model from the one that wrote it, recorded on every build. Both are Anthropic models: claude-sonnet-4-6 reviews what claude-opus-4-8 wrote.
- who approved it
- A person merged the pull request, and with the gates on, a person approved the plan first; every decision is an audit row that cannot be updated or deleted.
- a year from now
- One certificate per file tree, archived write-once for six years, exported as a canonical bundle a reviewer checks offline, signed with ed25519 when the deployment holds a signing key, which production does not today.
SOC 2's change-management control (CC8.1) asks for exactly this trail, and the SOC 2 control set runs on every scan regardless of industry. ISO 27001 is a registered control set and not live on fleet certificates today.
- apps/agent/src/roles.ts
- apps/web/src/components/factory/run-detail.tsx Ran on
- apps/agent/src/executor.ts
- apps/web/prisma/migrations/20260412_audit_log_immutability/migration.sql
- cdk/lib/worm-bucket.ts
- apps/web/src/lib/evidence/sign-bundle.ts not_configured
- scripts/verify-evidence-bundle.mjs
- packages/compliance/src/verify.ts DEFAULT_VERIFY_FRAMEWORKS
What to bring.
A repository, an issue, an Anthropic API key, a GitHub App installation, a Linear team. Everything else stays where it is.
Connect a repository, a Linear team and an API key. Keep everything else.
Softwerk is not self-serve: sign-in is Google SSO on an allowlisted workspace domain, and a workspace is set up by Softwerk on request. The GitHub App and the Linear application are configured once for the whole deployment by Softwerk, not per workspace, and the app offers each connect step only when that deployment-level configuration is in place. On production today the Linear application is not yet seeded, so its connect step is not offered, and the GitHub App private key is a placeholder, so no mission can clone a repository or open a pull request yet. Once both are seeded, you connect your Anthropic key, your GitHub App installation and your Linear team, and the first mission ends in a pull request with its certificate beside it.
Book a factory walkthrough