<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Compliance as Code — API Reference

## OPA Commands

```bash
# Check policy syntax
opa check policies/

# Run policy tests
opa test policies/ -v

# Evaluate policy against input
opa eval -d policies/ -i input.json "data.compliance.violation"

# Format Rego files
opa fmt -w policies/

# Build policy bundle
opa build -b policies/ -o bundle.tar.gz
```

## Conftest Commands

```bash
# Test Terraform plan
conftest test tfplan.json -p policies/ --output json

# Test Kubernetes manifests
conftest test k8s/ -p policies/k8s/ --all-namespaces

# Test Dockerfile
conftest test Dockerfile -p policies/docker/

# Verify with specific namespace
conftest test tfplan.json -p policies/ --namespace compliance.pci

# Pull remote policies
conftest pull oci://registry.example.com/policies:latest
```

## InSpec Commands

```bash
# Execute compliance profile
inspec exec cis-profile -t ssh://user@host --reporter json:/tmp/results.json

# Check profile validity
inspec check cis-profile

# Generate new profile
inspec init profile my-compliance --platform os

# Run with attributes
inspec exec profile --input-file attributes.yml
```

## CI/CD Integration Patterns

```bash
# GitHub Actions — policy gate
conftest test tfplan.json -p policies/ --output json > results.json
FAILURES=$(jq '[.[].failures[]] | length' results.json)
if [ "$FAILURES" -gt 0 ]; then echo "Policy violations found"; exit 1; fi

# Generate evidence hash
sha256sum results.json > evidence-hash.txt

# Collect evidence artifact
node scripts/agent.js --action evidence --input results.json \
  --output evidence/$(date +%Y%m%d-%H%M%S).json
```

## Framework Cross-Reference

| Control Area | PCI DSS | NIST 800-53 | SOC 2 | ISO 27001 |
|-------------|---------|-------------|-------|-----------|
| Encryption at rest | 3.4.1 | SC-28 | CC6.1 | A.8.24 |
| Encryption in transit | 4.2.1 | SC-8 | CC6.1 | A.8.24 |
| Network segmentation | 1.3.1 | SC-7 | CC6.6 | A.8.22 |
| Access control | 7.1.1 | AC-3 | CC6.3 | A.8.3 |
| Logging | 10.2.1 | AU-2 | CC7.2 | A.8.15 |
