An audit trail you can export

Custom clause attributes, a coverage gap from Completion Status, HTML export for the auditor.

Standards are ideas with evidence — and a report you can hand over.

compliance/access.rq

"SOC2 CC6.1 access control" {
    login must use oauth
    session timeout aligns with [session_policy]
    @clause CC6.1
    @evidence ["./docs/access-control.md"]
    @verified_by ["./auth/access.test.ts:enforces session timeout"]
    @status verified
    @tags (
        soc2
        cc6.1
    )
}

session_policy {
    idle timeout is 15 minutes
    implemented in ["./src/auth/session.ts".idleTimeoutMs]
    @status done
}

"SOC2 CC6.2 privilege" {
    role changes require dual control
    @clause CC6.2
    @status pending
    @tags (
        soc2
        cc6.2
    )
}

Reqlan: Completion Status

$ Reqlan: Completion Status

blocking: 1
  "SOC2 CC6.2 privilege"  @status pending

verified: 1
  "SOC2 CC6.1 access control"

coverage: 50% of soc2-tagged ideas

export

Reqlan: Export HTML → multi-page static site
Ideas, files, clusters, searchable graph
Hand the folder to the auditor — no wiki drift