| Filename | Latest commit message | Latest commit date |
|---|---|---|
60eab96364
Wires the no-vanity-metrics policy from prose-only into structural
enforcement. Without this, the next time a count creeps into a
README it stays there until I notice; with this, the PR fails.
What lands:
- scripts/check-no-vanity-metrics.sh — bash scanner, dep-free,
targets marketing/spec/governance Markdown only (per-phase
progress docs, CHANGELOGs, conformance/notes/research dirs
exempt by design). Regex is tuned to the patterns we've actually
had to fix and rejects false positives on RFC / codec / version
references. Lines that legitimately need a number opt out with
`<!-- allow-vanity: <reason> -->`.
- .github/workflows/no-vanity-metrics.yml — CI workflow runs the
scanner on every PR and `main` push that touches Markdown.
- .githooks/pre-commit — same scanner, local guard so the failure
happens before push. Activated per-clone via
`scripts/install-hooks.sh`.
- CHARTER.md — adds a "Messaging — no vanity metrics" section
documenting the policy and pointing to the scanner.
Also strips the four remaining drift sites the scanner found on
first run: a ~5 LOC stub note, a "98 crates" + "≤ 120 LOC" mention
in jouleclaw-stack/examples/AGENTS.md, and "26 crates" in the PCI
scope-map doc. The CAMT.054 ISO 20022 message-name reference is
preserved via an allow-vanity marker.
|
||
| .. | ||
| hsm-kms-guidance.md | ||
| pci-zero-architecture.md | ||
| qsa-checklist.md | ||
| README.md | ||
| scope-map.md | ||
OpenPay PCI-DSS Readiness Package
This directory is the PCI-DSS v4.0.1 readiness package for an OpenPay deployment. It maps the cardholder-data (CHD) and sensitive-authentication-data (SAD) handling of every crate in this workspace onto the twelve PCI-DSS v4.0.1 requirements, describes a deployment topology where merchant application servers never touch a primary account number (PAN), gives integration guidance for AWS KMS, GCP KMS, HashiCorp Vault, and Fortanix DSM, and provides a checklist a Qualified Security Assessor (QSA) can run against an OpenPay deployment before formal assessment. None of this material has been blessed by the PCI Security Standards Council, a card scheme, or a QSA; it is an engineering self-assessment intended to make a real assessment short.
Files
compliance/
├── README.md this file
├── scope-map.md per-crate PCI-DSS scope table; how the
│ op-core `pci-scope` feature gates raw-PAN
│ handling at the code-of-the-stack boundary
├── pci-zero-architecture.md deployment topology where merchant servers
│ never see PAN; references examples/pci-zero
├── hsm-kms-guidance.md AWS KMS / GCP KMS / HashiCorp Vault /
│ Fortanix DSM integration, modelled on the
│ existing op-rails-crypto::EvmSigner trait
└── qsa-checklist.md pre-assessment checklist mapping the twelve
PCI-DSS v4.0.1 requirements to artifacts
in this repository
Companion code
examples/pci-zero/ runnable example: vault tokenization →
orchestrator → card rail with no raw PAN
crossing process boundaries on the merchant
application server