ecz-id-dora 0.1.0

Inspects operational-resilience evidence posture. Explains and routes only; never a compliance verdict.

ECZ-ID DORA Readiness Inspection

You have a DORA operational-resilience register and you need to see, at a glance, what evidence you have actually declared — and which referenced files are really on disk — before anyone relies on it. ecz-id-dora reads your resilience-evidence descriptor and shows exactly what is declared, present or absent, locally, offline, in one command.

It inspects, explains and routes only. It never issues or activates an ECZ-ID, never determines BOUND, never prices or carts, never executes discovered project, agent, MCP or robot code. It is not a DORA compliance verdict, regulatory approval, audit outcome or statement of legal sufficiency. A missing item is a neutral observation, not a judgement. Missing public proof is neutral. Local policy decides. Re-check before reliance.

Machine Interface · Manifest · Resolve · Operator Setup · Developer Guidance

One-command free trial

$ uvx ecz-id-dora inspect ./my-resilience-register
# or: pipx run ecz-id-dora inspect ./my-resilience-register

No account, no network and no config required. The public Resolver check is strictly opt-in (--check-public).

Example result

ECZ-ID inspection: ./my-resilience-register [ecz-id-dora]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
means        : Local ECZ-ID configuration was found for this subject. | Public Resolver proof was not checked.
does not mean: This is not a DORA compliance verdict, regulatory approval, audit outcome or statement of legal sufficiency. | ...
reason codes : ECZ-1000, ECZ-2002

Export the evidence-readiness table for a register:

$ ecz-id-dora export-csv ./my-resilience-register
evidence_item,declared,file_referenced,file_present
ICT provider identity,true,provider-attestation.txt,true
service inventory,true,,
contract references,true,,
continuity/recovery references,true,recovery-plan.md,true
exit-plan evidence,true,exit-plan.md,true
discontinuation-impact references,true,impact-analysis.md,false
API/package/cloud/SBOM relationships,true,sbom.json,true

Supported inputs

• A directory or descriptor file. Recognised names: resilience_evidence.json, dora_evidence.json, dora_register.json.
• Declared sections observed as neutral findings: ICT vendor / provider identity; service inventory and customer/service relationships; contract references; provider/subcontractor mapping; operational locations; important-function references; substitutability declarations and alternatives; continuity / recovery references; incident contacts; exit-plan evidence; discontinuation-impact references; and API / package / cloud / SBOM relationships.
• Where a section names an evidence file, that file's presence under the inspected root is reported (present / absent). Files are matched by basename inside the root only; the root is never escaped and symlinks are refused.

Free capabilities

• Two-sided posture: local configuration evidence vs public Resolver evidence.
• export-csv — a deterministic evidence-readiness table of evidence_item, declared, file_referenced, file_present.
• compare for drift; JSON / Markdown / text / SARIF / CSV output; secret redaction on every export.

Unsupported inputs

• Not a resilience scanner, uptime monitor, penetration tester or crawler.
• Does not open, validate or attest the content of any referenced evidence file — only whether it is present.
• Does not fetch or execute your project, and never follows arbitrary redirects to internal hosts.

What the result means

PRESENT / PARTIAL / ABSENT / INVALID describes your local resilience-evidence register: whether a register was found, how much of the expected evidence it declares, and whether it parses. PROOF_FOUND or a neutral posture describes public Resolver evidence.

What it does not mean

Not a safety, approval, insurance or premium decision. Not a DORA compliance verdict, regulatory approval, audit outcome or statement of legal sufficiency. "Declared" and "present" describe what the descriptor records and what is on disk — nothing about adequacy or correctness. Missing public proof is neutral — it does not mean unsafe.

Compare / drift

$ ecz-id-dora compare ./last-review ./current --json

Shows posture changes and reason-code / finding additions and removals — useful in review and on a schedule.

CI use

$ ecz-id-dora inspect . --sarif > dora.sarif      # upload to code scanning
$ ecz-id-dora inspect . --json  > dora.json       # exit 0 for any completed inspection
$ ecz-id-dora export-csv . > dora-evidence.csv    # evidence-readiness table

Exit code is 0 for every completed inspection regardless of posture (the neutrality rule); non-zero only for genuine input / tool errors.

Machine Interface & Quiet manifest

Every install ships a public-safe manifest, ecz_quiet_machine_interface.json, and every JSON report embeds a compact machine_interface object with the canonical roots and safe actions.

Machine Interface | Manifest | Resolve | Operator Setup | Developer Guidance

• Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
• Manifest: ecz-id-dora manifest --json
• Resolve (read-only public proof): https://resolver.ecocitizenz.org
• Operator Setup (TrustOps): https://trustops.ecocitizenz.com/start
• Developer Guidance: https://developers.ecocitizenz.com

It exposes the interface and protects the playbook: none of the private commercial machinery lives in these packages. If you operate the target and choose to begin, TrustOps handles recommendation, acquisition, setup, lifecycle and repair. This package only routes you there; it never prices, carts or sells.

Privacy and no telemetry

Bounded, read-only, symlink-refusing inspection. No telemetry, no source upload. The optional public check sends only minimal safe context (source, package, version, typed intent) to validated public hosts over HTTPS. Secrets are redacted on every export. Offline mode (--offline / ECZ_ID_OFFLINE=1) skips all network.

Licence and trademarks

Apache-2.0. See LICENSE and NOTICE.

The Apache-2.0 code licence grants no trademark rights. "ECZ-ID", "EcoCitizenz" and related names and logos are trademarks of their owner(s). See TRADEMARKS.md. See CHANGELOG.md and SECURITY.md at the repository root.

CLI: ecz-id-dora  |  Import: ecz_id_dora  |  Plugin group: ecz_id.plugins