30-second answer
Two principles. Every conclusion declares what kind of truth it is, and automation may verify a claim but never strengthen it.
First principle
Every governance conclusion must declare what kind of truth it is.
Governance reports often present requirements, recommendations, conventions and opinions with identical visual weight. A reader cannot tell which statements they are free to disagree with.
This project does not do that. Every rule declares the nature of its claim in
basis, and the report
prints it beside the finding.
Second principle
Automation may verify a claim. It may never strengthen it.
Automation may verify that evidence exists, that required sources are present, that schemas are valid, that documentation links resolve, and that conclusions are reproducible.
Automation must never infer that a recommendation is a requirement, that a convention becomes documented guidance because somebody attached a link, or that missing evidence means compliance.
The third of those is the one that shows up in the output every day. It is why
unknown is a result and never a pass.
What every gate proves, and what it does not
Every check in CI is narrower than the sentence people will summarise it as, and the project writes both halves down. Both were learned by watching a gate pass while the thing it guarded failed anyway.
The read-only gate is the clearest case. It parses every file in the collector tree and fails on any mutating verb. What that establishes and what it leaves open is set out in what a read only gate proves.
What an assessment lets a recipient establish
An assessment carries the findings, the evidence they were decided from, the versions that decided them, and digests over all of it.
A recipient runs verify
and establishes that nothing moved, without having this engine and without
trusting whoever sent it. That is why verify is a separate command: a check
that needed the producer would only ever be telling the recipient what the
producer already believes.
Reproducibility is what makes it possible. The clock is read at exactly one boundary and passed as a value, so the same inputs rebuild the same bytes.
Responsibility
The engine does not decide what an organisation should do. It establishes what is observable, what the vendor documents, and where the two differ. The decision, and the risk in it, stay with the people who own the tenant.