Don't trust us. Verify us.
Every other compliance vendor tells you their controls work. We show you the SHA-256 tamper-hash gate, the corpus-parity heartbeat, and the 10-lens crosswalk auditor — live, on this page, with no login, no sales call, no NDA. If anything below is red, we don't get to claim "provable" today.
Tamper-Hash Gate
Every deploy is gated by a SHA-256 hash of the canonical-JSON-encoded control corpus. If any control definition, framework crosswalk, or NIST anchor changes — by us, by an attacker, or by accident — the hash changes, the gate fails, and the deploy is blocked before it reaches a customer. Re-hash the published constants yourself; if your number matches ours, the gate is honest.
SHA-256 of the canonical-JSON-encoded control corpus. Matches the value baked into the gate at last release — deploy passes.
49 deterministic verifiers run against the corpus on every commit and every page load, alongside 220 CI checks across 28 regression suites. Each one is a reviewable check — corpus parity, anchor coverage, framework-version pinning, crosswalk integrity, and more. Failure of any one fails the deploy. Byte-identical across runs.
Snapshot timestamp (UTC): 2026-06-21T11:42:53.667463
Corpus Parity at Last Boot
Most compliance tools self-check once a year, at audit. Guardian Posse self-checks at every restart — the C86 heartbeat compares every NIST anchor declared by our static crosswalk corpus against every edge actually emitted into the runtime graph. The result is logged AND surfaced here. If they disagree, this card turns red the moment a worker boots.
Clean — 100% Parity
Captured at 2026-06-21T05:23:33.931113Z UTC. Same number written to the boot log under the grep token [C86_PARITY_HEARTBEAT]. Recomputes at every worker restart.
The 10-Lens Crosswalk Auditor
Your auditor can ask the same compliance question ten different ways and get ten deterministically consistent answers — each one byte-identical across runs. Below is the full catalogue. The endpoints are login-gated (you'll need an account to hit them), but the questions they answer and the URLs themselves are public, because a "proof" anyone can demand is the only kind of proof that counts.
Take the catalogue offline as CSV (spreadsheet) or JSON (machine-citable) for your audit working papers — public, no login. Existing customers verify all ten in the auditor UI at /admin/graph_auditor. The same primitives back the C87 (136 checks across 18 suites) and C88 (84 checks across 10 suites) test harnesses that run as hard gates on every pre-publish.
Built for Nuclear customers via kojie.works
Nuclear customers cannot accept probabilistic AI. The NRC, IAEA, and DOE assessors want a falsifiable trail — every decision a machine made, who seconded it, which regulation it cited, and the cryptographic signature on the submission. Guardian Posse supplies the cyber-defense spine; kojie.works supplies the nuclear-domain agents; both run the same Kojie Standard contract and certify against the same SHA-256 corpus-parity baseline. One gated corpus, two regulated surfaces, zero hand-off gap.
Cyber spine
Guardian Posse Cybersecurity
gpcybersecurity.com
12 cyber-defense agents
CPAS Standard
SHA-256 Gated
Nuclear vertical
Kojie Works — Nuclear Decommissioning Platform
kojie.works
4 nuclear-decommissioning agents
The Four Nuclear Agents
SurveySentry
MARSSIM survey design, statistical sampling, scan-MDC analysis
NRCNotary
NRC docketing, NESHAPs compliance, license termination workflow
HealthPhysicist
DCGL/WRS dose modeling, ALARA, radiation worker safety
ComplianceChief
Report formalization, crypto-signed submission packaging, regulator-facing output
Registry-Bound Coverage Tier 1 · Machine-Citable
NRC 10 CFR 73.54 (b) — Cyber Security Program for Nuclear Facilities
registry_key=nrc_10_cfr_73_54 · section=(b)-Program
IAEA NSS 17 Rev 1 §4 — Computer Security at Nuclear Facilities
registry_key=iaea_nss_17_r1 · section=§4-Program
Verifiable in /cpas/manifest.json — re-fetchable as JSON by any 3PAO.
Manifest-Declared Coverage Tier 2 · Inventory-Declared
NRC 10 CFR 20 (Standards for Protection Against Radiation)
NRC 10 CFR 50 (Domestic Licensing of Production & Utilization Facilities)
MARSSIM (Multi-Agency Radiation Survey and Site Investigation)
EPA NESHAPs (40 CFR Part 61)
OSHA 29 CFR 1910.1096 (Ionizing Radiation)
DOT 49 CFR 173 (Shippers — General Requirements)
Declared in cross_platform_agent_manifest.py (kojie platform regulatory_focus + per-agent regulatory_coverage). Source-of-truth for the cross-platform showcase, registered with regulators at the platform tier; formal ToolCitation rows are queued as the kojie integration matures.
Verify the cross-platform pairing:
Both platforms run the same Kojie Standard (N-agent consensus, crypto-signed audit, deterministic tool inventory, explicit regulatory coverage, machine-to-machine output) and certify against the same SHA-256 corpus-parity baseline. One gated corpus. Two regulated surfaces. Zero hand-off gap.
Now imagine handing this to your assessor.
A live proof URL beats a 400-page binder. CMMC L2 in 6 weeks, NIST and HIPAA on the same map, and an auditor surface your prime can re-run any second of any day.