> ## Documentation Index
> Fetch the complete documentation index at: https://sdlc-rstack.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance Packs

> Profile-mapped bundles of governance capability with declared enforcement levels.

# Governance Packs

Profiles are RStack's posture dial; governance packs (#78) make the posture **concrete and inspectable**. Each pack is a named bundle of governance capability with a declared enforcement level, defined by a `pack.json` under the package's `packs/` directory. Packs are declarative metadata over enforcement that lives in the harness — enabling a pack records intent and surfaces posture in the Business Hub; the enforcement code ships with RStack either way.

## The packs

| Pack                     | Enforcement | What it provides                                       |
| ------------------------ | ----------- | ------------------------------------------------------ |
| `dor-basic`              | advisory    | Decision queue + readiness report, non-blocking        |
| `dor-enterprise`         | blocking    | Same, but pending required decisions block build prep  |
| `cross-harness-review`   | warning     | Contract identity + review independence policy (#72)   |
| `attestations`           | warning     | Tamper-evident evidence envelopes + verification (#73) |
| `drift-detection`        | warning     | Traceability drift scanner + Hub card (#74)            |
| `untrusted-pr-gate`      | blocking    | Supply-chain PR boundary for public repos (#75)        |
| `compliance-nist-ai-rmf` | advisory    | NIST AI RMF ↔ RStack evidence mapping table            |
| `compliance-iso-42001`   | advisory    | ISO/IEC 42001 ↔ RStack evidence mapping table          |

## Which profile fits which team

* **`lean-mvp`** → `dor-basic`. Prototypes and MVPs: see what's unresolved and what it costs, without any gate stopping you. Choose this when speed of iteration matters more than review ceremony — the evidence trail still accrues.
* **`business-flex`** → `dor-basic`, `cross-harness-review` (warning), `drift-detection` (warning). Client-facing delivery teams: approval gates and contracts are active, same-harness self-validation and traceability drift are *reported* rather than blocking. Choose this when a human reviews the warnings weekly.
* **`enterprise-webapp`** → `dor-enterprise`, `cross-harness-review` (blocking), `attestations`, `drift-detection`, `untrusted-pr-gate`, both compliance mappings. Regulated or audit-facing teams: unresolved decisions and same-harness validation block, evidence is envelope-wrapped, and the repo boundary is gated. Choose this when "prove it" is a stakeholder, not a preference.

The ladder changes **governance posture, not process weight** — the same 15-stage pipeline runs in every profile; packs decide what blocks versus what reports.

## Using packs

```bash theme={null}
rstack-agents init --profile enterprise-webapp   # records the enterprise pack set
rstack-agents list packs                          # all packs, enforcement, profile defaults
```

`init` writes the active set to `.rstack/rstack.config.json`:

```json theme={null}
{ "profile": "enterprise-webapp", "enabled_packs": ["dor-enterprise", "cross-harness-review", "..."] }
```

Override `enabled_packs` to tune posture without changing profile; `rstack-agents config validate` names unknown pack names instead of ignoring them. The Business Hub's policy ledger shows the active packs with their enforcement levels next to the operating profile.