Governance Packs

Profile-mapped bundles of governance capability with declared enforcement levels.

Governance Packs

Profiles are RStack’s posture dial; governance packs (#78) make the posture concrete and inspectable. Each pack is a named bundle of governance capability with a declared enforcement level, defined by a pack.json under the package’s packs/ directory. Packs are declarative metadata over enforcement that lives in the harness — enabling a pack records intent and surfaces posture in the Business Hub; the enforcement code ships with RStack either way.

The packs

Pack	Enforcement	What it provides
dor-basic	advisory	Decision queue + readiness report, non-blocking
dor-enterprise	blocking	Same, but pending required decisions block build prep
cross-harness-review	warning	Contract identity + review independence policy (#72)
attestations	warning	Tamper-evident evidence envelopes + verification (#73)
drift-detection	warning	Traceability drift scanner + Hub card (#74)
untrusted-pr-gate	blocking	Supply-chain PR boundary for public repos (#75)
compliance-nist-ai-rmf	advisory	NIST AI RMF ↔ RStack evidence mapping table
compliance-iso-42001	advisory	ISO/IEC 42001 ↔ RStack evidence mapping table

Which profile fits which team

• lean-mvp → dor-basic. Prototypes and MVPs: see what’s unresolved and what it costs, without any gate stopping you. Choose this when speed of iteration matters more than review ceremony — the evidence trail still accrues.
• business-flex → dor-basic, cross-harness-review (warning), drift-detection (warning). Client-facing delivery teams: approval gates and contracts are active, same-harness self-validation and traceability drift are reported rather than blocking. Choose this when a human reviews the warnings weekly.
• enterprise-webapp → dor-enterprise, cross-harness-review (blocking), attestations, drift-detection, untrusted-pr-gate, both compliance mappings. Regulated or audit-facing teams: unresolved decisions and same-harness validation block, evidence is envelope-wrapped, and the repo boundary is gated. Choose this when “prove it” is a stakeholder, not a preference.

The ladder changes governance posture, not process weight — the same 15-stage pipeline runs in every profile; packs decide what blocks versus what reports.

Using packs

rstack-agents init --profile enterprise-webapp   # records the enterprise pack set
rstack-agents list packs                          # all packs, enforcement, profile defaults

init writes the active set to .rstack/rstack.config.json:

{ "profile": "enterprise-webapp", "enabled_packs": ["dor-enterprise", "cross-harness-review", "..."] }

Override enabled_packs to tune posture without changing profile; rstack-agents config validate names unknown pack names instead of ignoring them. The Business Hub’s policy ledger shows the active packs with their enforcement levels next to the operating profile.