██████╗  ██████╗ ███████╗██╗███████╗
██╔══██╗██╔═══██╗██╔════╝██║██╔════╝
██████╔╝██║   ██║███████╗██║█████╗
██╔══██╗██║   ██║╚════██║██║██╔══╝
██║  ██║╚██████╔╝███████║██║███████╗
╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝╚══════╝
              v1.1.0

Compliance as Code
for GxP Systems

ROSIE treats the GxP SDLC as a graph-based data problem, not a document-heavy administrative task.

GAMP 5 CSA 21 CFR Part 11
⚙

Truth-in-Code

All requirements and design artifacts live in the repository. URS, FRS, and design specs in Markdown. No shadow documents. No drift.

⚖

Dual-Ledger Model

Git stores what was built and why. System of Record stores who approved it and when. Cryptographic handshake ensures immutability.

⚠

Hard Gates

Deployment is cryptographically blocked unless integrity checks pass. No green check, no release.

✓

Self-Validating Pipeline

Every CI/CD run proves system integrity. Compliance is continuously re-proven, not assumed.

The Trace Model

URS ──┬──▶ FRS ──┬──▶ DESIGN ──┬──▶ TEST ──┬──▶ RELEASE
      └──────────┴─────────────┴───────────┴── HASHED ── SIGNED

Traceability is treated as a first-class graph, not a spreadsheet.

Integrity Guard

commit → hash → sign → verify → attest → GATE → deploy
                                      │
                             BLOCK IF CHECK FAILS

The Integrity Guard enforces:

  • Deterministic builds
  • Immutable artifacts
  • Cryptographic traceability
  • Signature enforcement
  • Release gating

Philosophy

If it isn't in the repo, it isn't real.
If it isn't signed, it isn't trusted.
If it can't be traced, it can't be released.

The RFC Stack

RFCTitleFocus
RFC-001Data StandardTagging syntax, manifest schema
RFC-002Engine SpecHard-gates, AI protocols, sync logic
RFC-003Evidence StandardArtifact packaging, 21 CFR Part 11
RFC-004API InterfaceSoR connector, REST contracts
RFC-005TQ BaselineSelf-validation, product archetypes

ROSIE Boundary

ROSIE is a specification, not a complete system. It defines:

  • How to structure compliance artifacts in repositories
  • How to compute deterministic integrity hashes
  • The API contract for approval systems (System of Record)

Your System of Record (SoR)—whether a commercial QMS, PLM, or custom system—handles user management, approval workflows, electronic signatures, and audit storage. ROSIE defines the interface; the SoR implements the approval logic.

Status

SELF-VALIDATING PIPELINE .............. ENABLED
CRYPTO SIGNATURE CHECKS .............. ENFORCED
ARTIFACT CO-LOCATION ................ REQUIRED
DOCUMENT DRIFT ...................... IMPOSSIBLE

Project Mascots

        /)  (\
   .-._((,~~,))_.-.
    `-.  @  @  .-'
       /   ^   \        _
      (  \___/  )     _(o)>
       `-.___.-'     /  \\
          / \       /____\\
         /___\        ||
       Unicorn      Flamingo

ROSIE is named for Rose — inspiration officer, unicorn specialist, flamingo enthusiast.