FedRAMP SC-13 & AU-2
Two controls that reduce to properties a scanner can actually decide.
SC-13 — approved cryptography only
SC-13 requires that cryptographic modules be FIPS-validated. In a codebase that reduces to a checkable property: no MD5, no SHA-1 for signatures, no DES or 3DES, no RC4, no Blowfish, no RSA below 2048 bits, no elliptic curve below P-256, and no ECB mode.
Each of those is a primitive whose mere presence is an audit finding regardless of what it was used for. COODDEE scans for them and fails the card, so the finding surfaces at the commit that introduced it rather than during an assessment months later.
AU-2 — the audit record
Every run writes a ledger entry: which card, which role, which worker, which model, what it spent, and what verdict each gate returned. The board's status is derived from that ledger rather than asserted alongside it.
Credential values never enter it. Types that carry secrets redact themselves in both repr and str, so the audit trail can be shipped to an assessor without a scrubbing pass that might miss one.
What this is, and is not
COODDEE enforces and evidences these controls in the code it builds and in its own execution. That is a genuine, checkable contribution to a control set — and it is not an authorisation to operate.
An ATO is granted to a system, a boundary and an operator. No dependency can confer one. What the engine gives an assessor is evidence: signed, timestamped, and traceable to the run that produced it.