Launch RiskStitch v0.1.0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,30 @@
+name: Pattern defect
+description: Report an unsafe, incorrect, inconsistent, or low-quality pattern behavior.
+title: "[defect] "
+labels: [defect]
+body:
+  - type: input
+    id: pattern
+    attributes:
+      label: Pattern name
+    validations:
+      required: true
+  - type: textarea
+    id: sanitized_input
+    attributes:
+      label: Sanitized reproduction input
+      description: Remove secrets, client information, personal data, and proprietary text.
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed output or behavior
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected boundary or behavior
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/pattern_request.yml

@@ -0,0 +1,33 @@
+name: Pattern request
+description: Propose one bounded GRC task for a new pattern.
+title: "[pattern] "
+labels: [pattern-request]
+body:
+  - type: textarea
+    id: task
+    attributes:
+      label: Bounded task
+      description: Define the single GRC task and the practitioner who performs it.
+    validations:
+      required: true
+  - type: textarea
+    id: inputs
+    attributes:
+      label: Required inputs
+      description: List source material and required context. Do not include real confidential data.
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Output contract
+      description: List required sections or fields.
+    validations:
+      required: true
+  - type: textarea
+    id: decision
+    attributes:
+      label: Human decision retained
+      description: State what the model must not decide.
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Pattern or repository change
+
+- Task boundary:
+- Evidence model:
+- Output contract:
+- Human decision retained:
+- Known failure modes:
+- Evaluation cases:
+- Proprietary or confidential content check:
+
+## Validation
+
+- [ ] `make validate` passes
+- [ ] No secrets, personal data, client material, or proprietary standards text
+- [ ] No compliance, legal, audit, or risk-acceptance claim is delegated to the model
+- [ ] Generated files match `specs/patterns.json`

.github/workflows/validate.yml

@@ -0,0 +1,19 @@
+name: validate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: make validate

.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+*.py[cod]
+.DS_Store
+.idea/
+.vscode/
+.env
+.venv/
+dist/

AGENTS.md

@@ -0,0 +1,11 @@
+# Repository instructions
+
+RiskStitch is an EXPERIMENTAL public GRC pattern library.
+
+- Treat `specs/patterns.json` as the source for generated pattern files.
+- Run `python3 tools/render_patterns.py` after changing specifications.
+- Run `make validate` before proposing changes.
+- Preserve evidence-state labels and human-review gates.
+- Do not claim compliance, legal sufficiency, audit assurance, or risk acceptance.
+- Do not add secrets, personal data, client information, or proprietary standards text.
+- Do not change a pattern to `validated` without a maintainer-approved evaluation record.

CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## 0.1.0 - 2026-08-28
+
+- Added 28 experimental Fabric-compatible GRC patterns.
+- Added the RiskStitch evidence contract and human-review gate.
+- Added machine-readable catalog and output schemas.
+- Added deterministic rendering, repository validation, installer scripts, and worked examples.

CITATION.cff

@@ -0,0 +1,11 @@
+cff-version: 1.2.0
+message: "If you use RiskStitch, cite this repository."
+title: "RiskStitch: Open GRC Pattern Library"
+type: software
+authors:
+  - family-names: Mohamed
+    given-names: Ahmed
+repository-code: "https://github.com/envokeME/riskstitch"
+license: MIT
+version: 0.1.0
+date-released: 2026-08-28

CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+# Code of Conduct
+
+Participate professionally. Critique claims, methods, evidence, and code rather than people. Do not disclose private, regulated, client, or security-sensitive information. Maintainers may remove content or participation that violates these boundaries.

CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to RiskStitch
+
+RiskStitch accepts patterns, evaluation cases, documentation, schemas, and corrections that improve defensibility of GRC work.
+
+## Contribution requirements
+
+A pattern contribution must:
+
+1. solve one bounded GRC task;
+2. define required inputs and explicitly tolerate missing information;
+3. distinguish facts, source-derived statements, inferences, assumptions, and unknowns;
+4. require evidence locators for consequential conclusions;
+5. prohibit fabricated evidence, citations, owners, dates, scores, and compliance claims;
+6. define a deterministic output structure;
+7. end with a human-review gate;
+8. include at least one evaluation case;
+9. avoid proprietary standards text and confidential material;
+10. pass `make validate`.
+
+## Workflow
+
+1. Edit `specs/patterns.json`.
+2. Run `python3 tools/render_patterns.py`.
+3. Add or update an evaluation case.
+4. Run `make validate`.
+5. Open a pull request describing the task boundary, evidence model, known failure modes, and testing performed.
+
+Do not hand-edit generated files under `patterns/`. The renderer will overwrite them.
+
+## Content boundaries
+
+Never contribute:
+
+- secrets, tokens, credentials, internal URLs, or personal data;
+- real client assessments, audit evidence, contracts, reports, or findings;
+- proprietary control or regulatory text without documented permission;
+- claims that a pattern guarantees compliance, eliminates professional review, or produces an audit opinion;
+- instructions that let a model approve its own output.
+
+## Status labels
+
+- `experimental`: structurally valid; model behavior has not been broadly evaluated.
+- `candidate`: evaluation cases exist across at least two model families and identified failures are documented.
+- `validated`: requires maintainer approval, a published evaluation record, and defined version scope.
+
+No contribution may self-promote to `validated`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ahmed Mohamed
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,15 @@
+.PHONY: render check test validate list
+
+render:
+	python3 tools/render_patterns.py
+
+check:
+	python3 tools/render_patterns.py --check
+
+test:
+	python3 -m unittest discover -s tests -v
+
+validate: check test
+
+list:
+	python3 scripts/list-patterns.py