# CRAne

> Compliance evidence and audit workflow platform. Tracks which products and components
> exist, how they relate, who owns them, whether they are in scope under each competing
> definition, and whether their evidence holds up. Distributed as a container image; the
> database is a single SQLite file.

Run it with `docker run --rm -v "$PWD/data:/data" ghcr.io/oscarvalenzuelab/crane:latest <command>`.
Every path you pass is resolved inside the container, which is the mistake most people
make first.

Two contracts are generated from the code and are more authoritative than any page here:
`crane import spec --json` for the data format, and `/api/openapi.json` for the HTTP API.

Never record an approval, a scope decision, or an exception that a human did not actually
make. Everything imported is an observation; a decision is a separate act carrying a name
and a rationale.

## Start here

- [Everything, in one file](https://oscarvalenzuelab.github.io/CRAne/llms-full.txt): the whole documentation set concatenated, for reading in a single request
- [For AI agents](https://oscarvalenzuelab.github.io/CRAne/agents): the working loop, exit codes, JSON contracts and the guardrails that matter
- [Data contract](https://oscarvalenzuelab.github.io/CRAne/reference/data-contract): every dataset and column the importer accepts, generated from the code

## Docs

- [Home](https://oscarvalenzuelab.github.io/CRAne/): what it is and why it is shaped this way
- [Install](https://oscarvalenzuelab.github.io/CRAne/install): image variants, volumes, compose, upgrading
- [First run](https://oscarvalenzuelab.github.io/CRAne/first-run): the demo portfolio and the four-command loop
- [Populate](https://oscarvalenzuelab.github.io/CRAne/populate): getting your own portfolio in, and the modelling mistakes to avoid
- [Operate](https://oscarvalenzuelab.github.io/CRAne/operate): validating, scoring, reporting, scheduling, backups
- [Configure](https://oscarvalenzuelab.github.io/CRAne/configure): environment variables, authentication, exposure
- [Troubleshooting](https://oscarvalenzuelab.github.io/CRAne/troubleshooting): real error messages and what causes them
- [Security](https://oscarvalenzuelab.github.io/CRAne/security): reporting a vulnerability, the decisions that are not findings, hardening a real deployment

## Reference

- [Interface contract](https://oscarvalenzuelab.github.io/CRAne/interfaces): every command, route and endpoint
- [Data model](https://oscarvalenzuelab.github.io/CRAne/erd): the logical model, the lens mechanism, worked SQL
- [Design decisions](https://oscarvalenzuelab.github.io/CRAne/adr/0001-foundation): why it is shaped this way, and what was rejected

## Optional

- [Authentication decision](https://oscarvalenzuelab.github.io/CRAne/adr/0002-authentication): why one shared token, and what would have to change for accounts