ksi-harness

Continuous control monitoring for FedRAMP 20x. It pins FedRAMP's own machine-readable rules as source of truth, collects evidence with population reconciliation, and reports coverage that refuses to overstate — then emits schema-valid 20x artifacts from that same state.

Source · This runs the real tool against bundled synthetic fixtures — no credentials, no cloud account, nothing contacts a real system.

The headline number is zero fully-automated indicators, and that is the point. There are 29 implemented checks and 25 indicators with real, chain-verified passing evidence behind them — but an indicator only reaches automated when someone writes the argument that its checks leave nothing material out. A conventional tool would render this as “north of 50% coverage.”

Emit these FedRAMP 20x / OSCAL artifacts from the collected state:

Security Decision Record
The 20x SDR (KSI section), schema-validated before write.Ongoing Certification Report
The quarterly 20x artifact, from the same state.Significant Change Notification
Which indicators a declared change touches.OSCAL Assessment Results
Rev5 projection of the same control state.