Compliance programs

Hyperoru compliance programs are evidence views over your existing architectural truth. They do not create a second scanner result or let a favorable label hide an unresolved finding.

Enable the workspace capability

Compliance libraries are released per workspace with the compliance_libraries feature flag. A workspace owner can enable the capability during a canary rollout. Members need compliance:read to inspect a program, compliance:write to adopt or propose changes, and compliance:approve to decide exceptions.

Adopt an immutable version

Open Compliance programs, select a published library version, and review its publisher, source, license, change summary, controls, and evidence requirements. Set a program name, scope, owner, and review cadence before adoption.

The selected version is pinned. A newer version appears as an upgrade diff and requires a new, explicit adoption. Hyperoru never rewrites historical assessments when a library changes.

Read a control status

Every control drill-down shows:

• the calculation and mapping versions;
• a canonical input hash for replay;
• accepted, stale, conflicting, and missing evidence inputs;
• mapped findings and architecture relationships;
• applicability rationale and overlay version;
• exception and program event history.

Supported requires enough fresh, accepted, non-conflicting evidence and no unresolved mapped finding. Partial, gap, and unknown keep missing or uncertain inputs visible. Not applicable requires a workspace rationale. Excepted means an approved, unexpired exception exists; the underlying finding remains visible.

Change applicability

Workspace admins can mark a control applicable or not applicable with a rationale. The update uses optimistic versioning, creates a program event, and rebuilds the projection. It does not modify the shared library.

Propose and approve an exception

An analyst can propose a time-bounded exception with a rationale and optional workspace evidence. An admin or owner other than the proposer must approve it. Only one proposed or approved exception can be active for a control. Expiry automatically restores the evidence-derived status.

Export and replay

Canonical reports include the same versioned assessments used by the dashboard. Report records retain the program, framework version, mapping version, input hash, linked evidence, findings, architecture relationships, and exception reference so reviewers can reproduce the conclusion.

Operator diagnostics

Platform operators can inspect projection health for any workspace and trigger a rebuild with an audit reason. Operators cannot directly edit status. Correct the evidence, mapping, applicability overlay, or exception instead.

Rollback

Stop new adoption by deprecating a library version. Existing programs remain pinned and readable. To move a workspace back, explicitly adopt the prior published version; never mutate or delete historical assessments.