evidence-factory

Tag a project NIST 800-53 and a governed pipeline manufactures control evidence inside the build, placed there from outside the project. Every control's verdict is published, gaps included, each with a named owner. What a failing check does to the merge is set by the project's adoption phase. A GitLab compliance and CI/CD Catalog demonstration.