ComplyTime
Title here
Summary here
Complypack Phase0
Implementation plan for the ComplyPack OCI distribution envelope. Extracted from CEP-0001.
Status: complete
Related ADRs: 0003, 0005, 0006
Goal#
Define and ship the ComplyPack as a uniform OCI distribution envelope that complyctl can pull and route to providers generically.
Deliverables#
| Step | Deliverable | Repo |
|---|---|---|
| Define OCI manifest structure (config with ComplyPack ID, evaluator-id + opaque content layers) | ComplyPack OCI artifact spec | complypack |
Extend complyctl get to pull ComplyPack artifacts and route to provider by evaluator-id | complyctl get handles ComplyPacks | complyctl |
| Build OPA ComplyPack: standard OPA bundle inside envelope | OPA ComplyPack published to OCI registry | complypack |
Oci Artifact Structure#
OCI Manifest
├── Config: application/vnd.complypack.config.v1+json
│ (ComplyPack ID, evaluator-id, version, provenance)
└── Layer: application/vnd.complypack.content.v1.tar+gzip
(provider-specific assessment content)Config fields:
id— reverse-domain identifier for this ComplyPack (e.g.,io.complytime.opa.cis-k8s)evaluator-id— which provider consumes this pack (e.g.,opa)version— pack version (semver)source.gemara_content— provenance: Gemara content version this was generated fromsource.policy_id— provenance: which policy this implements
Verification Requirements#
| Test | Criteria |
|---|---|
| OCI delivery | complyctl get pulls ComplyPack, routes to provider by evaluator-id |
| Signature verification | Unsigned pack rejected; signed pack accepted; tampered pack rejected |
| Content safety | Rejects anomalously large or malformed content, validates paths |
Next Phase#
Phase 1: OPA Native Provider — ships the OPA evaluation provider that consumes ComplyPack content.
Prev
Architecture