An audit trail you can export

Custom clause attributes, a coverage gap from Completion Status, HTML export for the auditor.

Standards are ideas with evidence - and a report you can hand over.

compliance/access.rq

"SOC2 CC6.1 access control" {
  login must use oauth
  session timeout aligns with [session_policy]
  @clause CC6.1
  @evidence ["./docs/access-control.md"]
  @verified_by ["./auth/access.test.ts:enforces session timeout"]
  @status verified
  @tags (
      soc2
      cc6.1
  )
}

session_policy {
  idle timeout is 15 minutes
  implemented in ["./src/auth/session.ts".idleTimeoutMs]
  @status done
}

"SOC2 CC6.2 privilege" {
  role changes require dual control
  @clause CC6.2
  @status pending
  @tags (
      soc2
      cc6.2
  )
}

Reqlan: Completion Status

$ Reqlan: Completion Status

blocking: 1
  "SOC2 CC6.2 privilege"  @status pending

verified: 1
  "SOC2 CC6.1 access control"

coverage: 50% of soc2-tagged ideas

export

Reqlan: Export HTML → multi-page static site
Ideas, files, clusters, searchable graph
Hand the folder to the auditor - no wiki drift