Architecture

Component vocabulary for ComplyTime. This document names the functional roles and describes how they relate — not how they work internally or which repositories implement them.

Component Map#

┌──────────────────────────────────────┐  ┌─────────────────────────┐
│          Content Registry            │  │  Cross-Framework        │
│  ┌──────────────┐  ┌──────────────┐  │  │  Mapping                │
│  │ Compliance   │  │ Assessment   │  │  │                         │
│  │ Content      │  │ Logic        │  │  │  Relationship graph,    │
│  │ (policies,   │  │ (evaluation  │  │  │  standard comparison,   │
│  │  catalogs)   │  │  packages)   │  │  │  traceability           │
│  └──────┬───────┘  └──────┬───────┘  │  └─────────────────────────┘
└─────────┼─────────────────┼──────────┘
          │                 │
          ▼                 ▼
┌─────────────────────────────────────────────────────────────────┐
│                     Runtime Client                              │
│                                                                 │
│  ┌──────────┐  ┌──────────────┐  ┌───────────────────────────┐  │
│  │ Content  │  │ Policy       │  │ Scan                      │  │
│  │ Pull     │  │ Resolution   │  │ (orchestrate evaluators,  │  │
│  │          │  │ (compose,    │  │  merge results)           │  │
│  │          │  │  flatten)    │  │                           │  │
│  └──────────┘  └──────────────┘  └────────────┬──────────────┘  │
└────────────────────────────────────────────────┼────────────────┘
                                                 │
                         ┌───────────────────────┼───────────────┐
                         │                       │               │
                         ▼                       ▼               ▼
                ┌──────────────┐      ┌──────────────┐   ┌────────────┐
                │ Evaluator    │      │ Evaluator    │   │ Evaluator  │
                │ (filesystem  │      │ (API-based   │   │ (policy-   │
                │  scanning)   │      │  assessment) │   │  as-code)  │
                └──────┬───────┘      └──────┬───────┘   └─────┬──────┘
                       │                     │                 │
                       └─────────────────────┼─────────────────┘
                                             │ evidence
                                             ▼
                              ┌──────────────────────────┐
                              │   Evidence Platform      │
                              │                          │
                              │   Ingestion, storage,    │
                              │   verification, posture  │
                              └──────────┬───────────────┘
                                         │
                                         ▼
                              ┌──────────────────────────┐
                              │   Audit Preparation      │
                              │                          │
                              │   Analysis, artifact     │
                              │   drafting, reporting    │
                              └──────────────────────────┘

Roles#

Content Registry#

Distributes two independent streams: compliance content (what must be true) and assessment logic (how to verify it). Both streams use the same transport mechanism and have independent lifecycles.

Runtime Client#

Pulls content, resolves policies, discovers evaluators, orchestrates scans, merges results. The core client routes evaluator content by metadata without interpreting it. Evaluator plugins within the client boundary handle the mapping between evaluator-specific results and the common evidence model.

Evaluators#

Standalone processes that perform data collection and evaluation. Each evaluator owns its collection and evaluation logic entirely. The runtime client never participates in evaluation.

Evidence Platform#

Ingests, stores, and verifies compliance evidence produced by evaluators. Provides posture analytics and evidence traceability. See the Evidence problem doc for the domain exploration.

Cross-framework Mapping#

Compares compliance standards, maps relationships between requirements across frameworks, and stores the complete graph with traceability. Enables organizations assessed against multiple frameworks to understand overlapping requirements without manual spreadsheet exercises. See the Cross-Framework Mapping problem doc for the domain exploration.

Audit Preparation#

Consumes stored evidence to support audit activities — analysis, artifact drafting, and reporting. Downstream of the evidence platform.

Current State#

Role	Status	Implementation
Content Registry	Operational	OCI registries via oras-go
Runtime Client	Operational	complyctl
Evaluators	Operational	complytime-providers (OpenSCAP, AMPEL); OPA in development
Cross-Framework Mapping	Experimental	crosscodex
Evidence Platform	Experimental	complytime-core
Audit Preparation	Experimental	complytime-studio

Supporting repositories: complypack (pack authoring), complytime-policies (published bundles), org-infra (CI/CD), community (governance).

Boundaries#

Boundary	Left	Right	Interface
Distribution	Content registry	Runtime client	Content pull
Orchestration	Runtime client	Evaluators	Plugin interface
Evidence	Evaluators	Evidence platform	Evidence submission
Audit	Evidence platform	Audit preparation	Evidence query

Edit this page on GitHub

Adr Template

Complypack Phase0

Docs

ComplyTime

Title here