Public experiments in how an organization keeps a record when software is involved. These repositories are not a catalog of production products. Each one says what it refuses to be.
- Autonomous-EHS-Management — record an incident, walk a CAPA to verified, and read a TRIR that uses annual hours when the month grid is incomplete. Optional AI may suggest wording. A person closes the record. Not an OSHA filing tool. This is the repository to clone.
- FidusGate — an MCP tool call that records a decision and an Ed25519 receipt.
npm run devdoes not start the Cedar daemon. A down daemon denies the call. Not a production security product. - CorpOS — one scripted company day. Not an agent framework and not production SaaS.
- corporate-site-harness — evidence-gated Cursor delivery. Not a production governance product.
- HR-ERP — multi-tenant fixture for agent-governance tests. Not a certified payroll product.
- Professional-Service-Automation — consulting billing sketch. Not a time-tracker replacement.
- Financial-Digital-Twin-Compliance — one mock payment through Debezium, a per-record Flink streaming job, Cedar, and immudb. Not Flink CEP, XBRL, SDMX, or a core-banking system.
- Healthcare-Data-Exchange — one Compose stack. A synthetic FHIR R4 Patient is read from an EU or US HAPI cell only after a per-cell bearer passes OPA. Not a health-information exchange. Policy edits belong in this repository.
- healthcare-policy — OPAL mirror of Healthcare-Data-Exchange. Do not edit Rego here.
- Asclepius — nine-resource FHIR teaching kit. Not for clinical use. Not Medplum or HAPI.
- SOC-2 — small OPA sensor pack. Not a certification and not a claim of one.
The application repositories are Apache-2.0. This profile is too: LICENSE. It has no application code.
Product changes belong on the product repository (Contributing). Vulnerability reports belong on the product repository (Security).
LinkedIn: sage-hart-csp