The audit evidence operating system

Framework-shaped agents plan collection, inspect sufficiency, map artifacts, flag redaction risk, and draft reviewer next actions without bypassing human approval.

• Agents show control references, evidence references, confidence, and risk flags.
• Skeptical auditor and security gatekeeper roles keep weak evidence visible.
• Agent output is positioned as recommendation, not approval.

Private runners and approved connectors collect browser, API, cloud, identity, code, ticket, document, and storage evidence while target access stays inside the customer or operator boundary.

• Runner jobs can be claimed, leased, heartbeated, completed, failed, or retried.
• Signed upload/download and object storage scaffolds keep artifact access controlled.
• Demo mode is clearly separated from production evidence collection.

Evidence does not become package-ready because it exists. It moves through source mapping, validation, sensitive-data review, human decisions, manifest checks, and package readiness gates.

• Package readiness calls out missing, stale, rejected, and sensitive artifacts.
• Reviewer notes, client-visible notes, and internal notes stay separated.
• Transfer ZIPs and sandbox data are labeled honestly before export.