Skip to content

Workflow — Compliance check

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.
Workflow id compliance-check · version 1 · Draft (Draft → InReview → Published → Deprecated, BC-04)
Coordinator compliance-validator-coordinator · family Observability, Security & Compliance
Owner service WorkflowEngineService (BC-38) under Run Control (BC-03)
Starts on GenerationCompleted from GenerationRecipeService (event)
Steps 7 · gated 0 · agents 2
Budget per run 600000 tokens · cap 60.0 USD · 240 min
Descriptor workflow-definition-v1 · schema
Status target

Checks generated code and infrastructure against the selected compliance rule sets, raises findings to audit and blocks on critical findings.

Authored design, Draft (D54, D57)

These definitions were authored on 2026-10-14 from the coordinator cards as design assumptions. None is published, evaluated or has run; agents are named by id as design bindings, not as tested integrations.

Definition

flowchart TD
    start(("GenerationCompleted"))
    select_rule_sets["Select the rule sets"]
    fan_out_scans[/"Scan in parallel"/]
    scan_code["Scan the code"]
    scan_infrastructure["Scan the infrastructure"]
    join_scans[/"Join"/]
    raise_findings["Raise the findings"]
    block_on_critical{"Critical findings?"}
    start --> select_rule_sets
    select_rule_sets --> fan_out_scans
    fan_out_scans --> scan_code
    fan_out_scans --> scan_infrastructure
    scan_code --> join_scans
    scan_infrastructure --> join_scans
    join_scans --> raise_findings
    raise_findings --> block_on_critical
    done(("WorkflowRunCompleted"))
    block_on_critical --> done
    classDef gated stroke:#B45309,stroke-width:2px
Hold "Alt" / "Option" to enable pan & zoom

Shapes: rectangle = agent attempt · double rectangle = tool call · stadium = human decision · diamond = condition evaluated by the engine · parallelogram = fan-out or join · circle = timer · cylinder = sub-workflow · flag = compensation. A thick amber border marks a gated step.

Steps

# Step Kind Runs Gate Class Depends on Retry Timeout Compensation What it does
1 Select the rule sets
select-rule-sets		 agent privacy-compliance none read — exponential ×2 PT30M — Chooses the rule sets from the tenant's classification, residency and the product's edition.
2 Scan in parallel
fan-out-scans		 parallel engine none sandbox select-rule-sets none PT1M — Code and infrastructure scans run in parallel.
3 Scan the code
scan-code		 agent security-engineer none sandbox fan-out-scans exponential ×2 PT30M — Runs the static and dependency checks against the rule sets in the sandbox.
4 Scan the infrastructure
scan-infrastructure		 agent security-engineer none sandbox fan-out-scans exponential ×2 PT30M — Checks the Infrastructure Blueprint and the program against the policy rules.
5 Join
join-scans		 parallel engine none sandbox scan-code, scan-infrastructure none PT1M — Waits for both scans.
6 Raise the findings
raise-findings		 agent privacy-compliance none sandbox join-scans exponential ×2 PT30M — Records every finding with severity, owner and evidence through AuditService.
7 Critical findings?
block-on-critical		 condition engine none sandbox raise-findings none PT1M — A critical finding fails the run so no promotion can proceed on this generation. Condition: findings.critical == 0.

Gates and approvals

No approval is required: every step runs in the read or sandbox class; the agents' own tool calls still carry their classes (D21). Compensation steps run in reverse order of the succeeded steps on failure after the last checkpoint; a step without a compensation leaves its sandbox output in place and the run ends Failed with the evidence (ADR-0014, recovery not replay).

Inputs, outputs and events

Direction Name Descriptor
in generated-outputs change-set-v1
in infrastructure-blueprint blueprint-infrastructure-v1
out findings audit-evidence-v1

Starts on GenerationCompleted; emits FindingRaised, plus the engine's WorkflowRunStarted, StepReady, StepRunStateChanged and WorkflowRunCompleted / WorkflowRunFailed and Run Control's run and attempt events (ADR-0014).

Decisions and traceability

FR: FR-05 Governed tool boundaryXL: XL-10 Controlled repository change · XL-11 Generated product accepted into operationADRs: ADR-0014, ADR-0019 · ADR index

Definition authored 2026-10-14 from the coordinator card compliance-validator-coordinator (D54); Draft until an evaluation gate (ADR-0021) and a review publish it as a BC-04 asset release.