Control Evidence Mapper

Inspiration

Audit preparation is mostly file archaeology. A small team gets a control list (ISO 27001, SOC 2) and a NAS full of policies, logs and screenshots. The auditor's question is always the same: which file, which version, and where in it? Answering by hand is slow. Asking a generic AI "chat with files" tool is fast, but it answers fluently without showing its basis, and a confident wrong answer is worse than a gap.

I wanted a Skill that treats "I found no evidence" as a valid result and can show its work.

What it does

Control Evidence Mapper takes a control list and a folder you approve. It then:

1. lists the files and waits for your explicit yes before reading anything;
2. hashes each file with SHA-256 before reading it, then extracts verbatim text with locators;
3. maps files to controls and re-verifies every mapping with a fresh hash and a fresh extract;
4. produces a report with path, hash, citation and status for each control, plus gaps and unreadable files;
5. optionally copies cited files into a per-control binder (copy only, never move) after a separate approval.

A second Re-check mode takes a saved report later and shows which cited evidence was modified or went missing. This is the main difference from tools that only collect files.

Statuses form a one-way ladder: re-verification can keep a status or lower it, never raise it.

How I built it

The package is Markdown orchestration only, following the Uliya Skill Development Standard. The Skill delegates every action to UGOS experts (file-agent for find, stat, sha256sum, mkdir and cpmv; document-agent for extract; knowledge-agent for saving) and runs nothing itself. Matching and status rules live in linked reference files. Everything stays read-only until you confirm, and writes need your confirmation plus platform approval.

What I learned

Writing the workflow as a state machine exposed logic holes that prose hides. A fresh-context adversarial review of my own draft found real ones:

• the report fingerprint was circular (a file cannot contain its own hash);
• the approval gate came before the step that produced the file list;
• "downgrade one level" could leave a broken citation marked Evidenced;
• hashing after extraction left a window for a file to change in between.

All were fixed. The fingerprint now lives outside the report, and hashing happens before reading.

Challenges

• No NAS in Round 1. The capability names come from the Developer Package docs and need confirming on real hardware. Whether save-text writes a file at a known path is the biggest open question, and it is first on my Finalist test list.
• Scanned and image-only PDFs may fail extraction. The Skill reports them as "Not assessed" rather than guessing.
• Honest claims. "Evidenced" means relevant text exists as of a recorded hash. It does not mean a control is effective. Hashes show change, not authorship, and this version has no signatures.

What's next

Test on the UGREEN AI NAS, tune matching on real documents, and add signed reports so an auditor can verify who produced them.

Built With

• agent-orchestration
• compliance
• iso-27001
• markdown
• sha256
• soc-2
• ugos
• ugreen-ai-nas
• uliya-skill