Layer 04 · When someone asks · binder

Will an auditor
accept it?

An underwriting questionnaire or an audit request asks you to describe your controls. The honest answer takes a week of writing prose that nobody can check, and the dishonest answer is indistinguishable from it.

Binder does the opposite. It reads the artifacts the layers above already produced — run records, claim dossiers, scan exports, trace exports — maps them onto a control framework, and writes down, per control, what exists and what is missing. A control is marked covered only when a specific artifact carries a specific supporting claim, cited by path, SHA-256 digest, and JSON pointer.

A thick dossier clamped in a brass screw-post binding with a stamped wax seal.

In detail

How it
works.

Readsagent-work/record@0 · touchstone/dossier@0 · shipsafe scan exports · OpenTelemetry trace exports
Emitsbinder.md for a person and manifest.json for a machine
Per controlcovered · partial · missing · not-applicable — with the citation that justifies it
Never writes“We probably do this.” An uncited control is reported as evidence absent
The frameworkYour file, not ours. The bundled one is illustrative and is not the text of any named standard
The disclaimer ships inside the document.

Every pack carries this on its face, not in a footnote: this binder is self-assembled evidence, not an attestation, audit opinion, or certification. No underwriter, auditor, or assessor has reviewed it, and nothing here grants, binds, or implies insurance coverage. A pack that overstated itself would be worse than no pack, because the first reviewer to catch it discounts everything else in the file.

Straight answers

What this
does not prove.

Stated here, at full size, rather than in a footnote. Every tool in the stack carries its own ceiling, and they are not the same ceiling.

Evidence present or absent not an audit opinion

Binder reports what your artifacts support. It does not assess, certify, or approve anything, and no assessor has reviewed its output.

Cited to the field not a judgement of quality

A covered control means an artifact exists carrying that claim, at that digest. Whether the underlying control is well designed is a human question.

Run it

Free,
and local.

build itnpm install && npm run build
assemble a packnode bin/binder --framework frameworks/your.json \ --evidence ./evidence --out out
covered · partial · missing, with citationscat out/binder.md

Everything above runs on your machine with no account and no network call. Checking an artifact is free permanently — see what we actually charge for.

Previous in the stackIs the result actually true? Next in the stackThe format underneath all four

The agent will act either way.

The only question is whether anything survives it that a stranger can check.

Check a record See all four