Cloud Native Compliance. Reimagined. on ComplyTime

Overview

Mon, 13 Apr 2026 02:36:36 +0000

ComplyBeacon is an open-source observability toolkit designed to collect, normalize, and enrich compliance evidence, extending the OpenTelemetry (OTEL) standard.

By bridging the gap between raw policy scanner output and modern logging pipelines, it provides a unified, enriched, and auditable data stream for security and compliance analysis.

Overview

Mon, 13 Apr 2026 01:10:00 +0000

A lightweight compliance runtime that pulls Gemara policies from an OCI registry and executes scans via plugins.

Architecture#

┌──────────────────────────────────────────────────────────────────┐
│ Host │
│ │
│ ┌──────────────┐ complyctl get ┌───────────────────────┐ │
│ │ OCI Registry │ ◄────────────────── │ │ │
│ │ │ ───────────────────►│ complyctl CLI │ │
│ │ Gemara │ catalog + policy │ │ │
│ │ policies │ layers (YAML) │ init / get / list │ │
│ └──────────────┘ │ generate / scan │ │
│ │ doctor / providers │ │
│ │ version │ │
│ └─────┬────────┬────────┘ │
│ │ │ │
│ ┌────────────┘ │ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌────────────────┐ │
│ │ Cache │ │ Providers │ │
│ │ │ │ │ │
│ │ ~/.complytime│ │ ~/.complytime/ │ │
│ │ /policies/ │ │ providers/ │ │
│ │ state.json │ │ │ │
│ │ │ │ complyctl- │ │
│ │ OCI Layout │ │ provider-* │ │
│ │ per policy │ │ │ │
│ └──────────────┘ │ gRPC: Describe │ │
│ │ Generate, Scan │ │
│ ┌──────────────┐ └────────────────┘ │
│ │ Workspace │ │
│ │ │ complytime.yaml defines: │
│ │ ./complytime │ - registry URL │
│ │ .yaml │ - policy IDs + versions │
│ │ │ - targets + variables │
│ │ ./.comply- │ │
│ │ time/scan/ │ │
│ │ (output) │ Scan output (EvaluationLog, OSCAL, │
│ └──────────────┘ SARIF, Markdown) written to workspace │
└──────────────────────────────────────────────────────────────────┘

Components:

Overview

Fri, 10 Apr 2026 15:55:45 +0000

An OCI-compliant content delivery and enrichment service for Gemara compliance artifacts. Clients can discover and download Gemara content (L1 guidance, L2 catalogs, L3 policies) as OCI artifacts using standard tooling.

Overview

Wed, 08 Apr 2026 07:59:35 +0000

ComplyScribe is a CLI tool that assists users in leveraging Compliance-Trestle in CI/CD workflows for OSCAL formatted compliance content management.

WARNING: This project is currently under initial development. APIs may be changed incompatibly from one commit to another.

Overview

Wed, 25 Mar 2026 06:57:47 +0000

No README available. Visit the repository on GitHub for more information.

Compliance

Mon, 13 Apr 2026 02:36:36 +0000

Compliance#

Compliance Assessment Attributes#

Attributes added by compliance assessment tools to map policy results to compliance frameworks. Provides compliance context, risk assessment, and regulatory mapping for audit and reporting. Maps to GEMARA Layer 5 (Enforcement) for Policy-as-Code workflows.

Design

Mon, 13 Apr 2026 02:36:36 +0000

Key Features#

OpenTelemetry Native: Built on the OpenTelemetry standard for seamless integration with existing observability pipelines.
Automated Enrichment: Enriches raw evidence with risk scores, threat mappings, and regulatory requirements via the Compass service.
Composability: Components are designed as a toolkit; they are not required to be used together, and users can compose their own pipelines.
Compliance-as-Code: Leverages the gemara model for a robust, auditable, and automated approach to risk assessment.

Architecture Overview#

Design Principles#

Modularity: The system is composed of small, focused, and interchangeable services.

Development

Mon, 13 Apr 2026 02:36:36 +0000

This guide provides comprehensive instructions for setting up, building, and testing the ComplyBeacon project. It complements the DESIGN.md document by focusing on the practical aspects of development.

Policy

Mon, 13 Apr 2026 02:36:36 +0000

Policy#

Policy Engine Attributes#

Attributes emitted by policy engines (OPA, Gatekeeper, etc.) during policy evaluation and enforcement. Maps to GEMARA Layer 4 (Evaluation) for Policy-as-Code workflows.

Publish Image

Mon, 13 Apr 2026 02:36:36 +0000

This guide explains how to publish in GHCR and promote in Quay for container images by using the org-infra reusable workflows.