Instructions don’t enforce
Static instruction files give AI agents guidelines, but they do not enforce method, traceability, review boundaries, or evidence production by themselves.
v1.0 governance kit — public release summer 2026
Governance-as-code for AI-assisted software development
AI power to build. NAOS-Governance to trust.
Your AI assistant writes clean code, follows instructions, and passes tests. It also just duplicated a function that exists three directories away — and nothing caught it. NAOS-Governance turns your methodology into executable repository artifacts: machine-enforced rules, deterministic conformance checks, auto-generated traceability, and profile-aware evidence.
Source code goes public in summer 2026 — follow on GitHub to catch the release.
- Tool-neutral
- Deterministic
- Repository-local
- Human-reviewed
The Problem
“I asked the AI to follow the rules” is not evidence
Vibe coding, spec-driven development, agentic workflows — however you build with AI, the gap is the same: speed without repository-local proof of method.
Review comes too late
Code review often catches violations after they have already reached a branch or pull request — duplicated intent, orphaned tasks, hallucinated tests.
Linters check style, not method
Pre-commit linters usually check syntax and formatting. They don’t verify that the governed methodology was actually followed — or leave proof that it was.
NAOS-Governance targets the gap between “I asked the AI to follow the rules” and “the repository contains reviewable evidence that the governed method was followed.”
What Is NAOS-Governance
Not an assistant. Not a linter.
A methodology encoded as executable artifacts.
NAOS-Governance is tool-neutral by design: it governs AI coding assistants and coding agents — GitHub Copilot, Claude Code, Cursor, or any agentic workflow — through repository files, commands, hooks, schemas, reports, and human-reviewed evidence, never through a single assistant or IDE. The result is repository governance for AI-assisted software engineering, fully inspectable inside your repo.
Profile-scoped hooks
Commit-time governance checks that scale from a low-friction quickstart to fully assured profiles.
Traceability & validators
Machine-checkable links among requirements, tasks, source, tests, and evidence — validated deterministically.
Deterministic reports
Local JSON/Markdown evidence for conformance, gates, dashboards, hygiene, provenance, compliance posture, and readiness.
Human-review boundaries
Explicit non-claims for approval, compliance, runtime safety, publication, and advisory or model-backed work.
Function-index & duplicate-intent review
Frontmatter validation for agents, skills & instructions
Test-hallucination detection
Secret & dependency hygiene
SARIF 2.1.0 export
How It Works
A file-first control plane, from command to evidence
Capability contracts, centralized policy, profile-aware gates, standalone validators, evidence-pack export, and dashboard summaries wrap one consistent operating model:
- Commands
& agents - Preventive
review - Capability
contracts - Profile
policy - Validators
- Gates
- Evidence
pack - Dashboard
- Remediation
or next action
Control-plane principle
Deterministic controls are primary; advisory controls may challenge them but never replace them. Define truth, index context, query candidates, package task context, review evidence, and record decisions — with a human on every durable decision. A governed learning loop feeds lessons back through the same discipline — captured, verified, and human-reviewed before anything becomes durable. Nothing promotes itself.
Seen in a real run
The numbers, statuses, and command output below are real — taken from an actual
naos adopt brownfield run and a recorded pilot on a production
local knowledge-base app — presented here in styled panels for readability.
Outcomes depend on repository scope and the selected profile.
Governance Profiles
Start advisory. Graduate to assured.
Profiles control enforcement posture, not instant maturity. A graduated exit-code ramp increases across profiles, ships warn-by-default so upgrades never break you, and a capability only enforces once it reaches target maturity — never block a scaffold.
Quickstart
First-time users & evaluation
- 5 rules
- Advisory posture
- ~9 files
≈ 5 min setup
Lite
Solo devs, early AI integration
- 9 rules
- 4 blocking
- ~67 files
≈ 15–30 min setup
Recommended
Standard
Small teams, production projects
- 19 rules
- 15 blocking
- ~125 files
≈ 1–2 h setup
Assured
Regulated & enterprise projects
- 19 rules
- 19 blocking
- ~125 files
≈ 2–4 h setup
Upgrade any time with naos upgrade . --tier assured — conflict-aware tier migration designed to preserve existing project content.
Quick Start
5 minutes to governance
One pip install, one init, one hook. The quickstart profile installs a starter scaffold with 5 rules and 3 core pre-commit checks — advisory by default, so nothing blocks until you say so. This is a preview of the installation flow planned for the public release.
Follow the release on GitHubThe package and repository open to the public in summer 2026.
# Install the kit
$ pip install naos-governance
$ naos-governance init . --tier quickstart --activate
# Enable the pre-commit hook
$ chmod +x .githooks/pre-commit
$ git config core.hooksPath .githooks
# First-run evidence route
$ naos-governance first-run --profile quickstart
✓ doctor · adoption dry-run · recommendations
✓ evidence pack · dashboard generatedEvidence & Compliance
Build with AI every day.
Be ready when auditors ask.
NAOS-Governance is for anyone shipping software with AI — vibe coding, spec-driven development, or agentic workflows. The evidence it produces as you work is the same evidence you hand to reviewers, second and third lines of defense, or regulators when they ask how AI-generated code is controlled.
Evidence packs & dashboards
Machine-readable posture in evidence_pack.json and
dashboard_summary.json: current evidence, stale artifacts, waivers,
and missing reports — without fake green lights.
Public compliance mappings
Published evidence maps for OSFI E-23 and DORA, plus an admissibility guide covering what NAOS-Governance artifacts prove — and what stays outside the kit.
Interoperable findings
SARIF 2.1.0 export lets code-scanning and security tooling consume NAOS-Governance findings. Signable evidence envelopes and audit logs support tamper-evidence review.
Honest boundaries, by design
NAOS-Governance supports governance evidence and review. It does not prove legal or regulatory compliance, guarantee secure code, prove runtime safety, or approve releases. Every report is review input for humans — documented non-claims are part of the contract.
Editions
Open core for every repository.
Enterprise depth where auditors are involved.
Community
Free & open source
Planned Apache 2.0 license at public release — everything a developer or team needs to govern AI-assisted work.
- All four governance profiles, quickstart to assured
- Pre-commit hooks, validators & deterministic conformance
- Traceability, dashboards & evidence-pack export
- Duplicate-intent review & test-hallucination detection
- SARIF export and AI tool activation surfaces
Enterprise
For regulated organizations
Commercial capabilities being defined for teams that answer to auditors, regulators, and risk functions.
- Compliance evidence packs structured for audit review (OSFI E-23, DORA)
- Admissibility bundles & regulator-facing templates
- Multi-team and fleet governance dashboards
- Assured-profile activation assistance
- Priority support with SLA
The public roadmap below is edition-neutral: core capabilities land in the open kit, organizational capabilities in Enterprise. Final licensing is announced with the public release.
Roadmap
v1.0 is the foundation — here’s what’s next
Compliance evidence
Deeper OSFI E-23 and DORA mappings, clearer assurance guidance, and better evidence packaging for review and handoff.
Control-plane maturity
Explicit capability maturity across the kit while gatekeepers keep surfacing missing, stale, waived, and experimental states.
Conformance & anti-hallucination
Stronger deterministic checks, documented test-hallucination detection, and richer conformance output for CI and audit workflows.
Adoption ergonomics
Faster onboarding, clearer generated-project docs, and structured intake for non-developer stakeholders in regulated contexts.
Capability catalogue
A generated inventory of agents, skills, instructions, and scenarios, with static checks that keep their metadata complete.
AI tool activation surfaces
Templates today for Claude Code, GitHub Copilot, Cursor, and generic agents; generated tool-specific surfaces next. AI tools stay optional, never required.
AI power to build.
NAOS-Governance to trust.
For software engineering teams: developers, technical leads, platform engineers, and reviewers who want governed method — not just good intentions — in every repository.
Public release: summer 2026. Questions? contact@naos-governance.com