One approved fix testifies four times. Dossier turns verified closures into auditor-ready evidence — collected once, mapped across frameworks, signed.
Every product sends its verified closures: the fix, its rescan, its approval.
Each closure is mapped to controls across frameworks — SOC 2, ISO/IEC 42001, NIST AI RMF, the EU AI Act — starter crosswalks, applied once and reused everywhere.
Manifest, findings, controls, and evidence bundle into the auditor pack — evidence as a byproduct of engineering, not audit-season archaeology.
The pack is cryptographically signed; GRC approves it before any auditor sees it; the auditor verifies it offline — no portal account, no trust-me.
Watch a verified closure become a signed, auditor-ready pack.
Setright closure — PR #482 fix — re-scanned, verified closed at the source
Vestibule scan — everything-server — safer manifest verified clean
Sparring assessment — sample bundle — signed assessment pack on file
Signed — the pack is tamper-evident — any change after signing fails verification
GRC gate — exceptions are reviewed and the pack approved before an auditor sees it
Verified offline — the auditor checks the signature and the evidence chain with no Tokynd account
Per evidence cycle