GovernanceOS

Open-source tools from GovernanceOS, under the Apache License 2.0. They run on your own machine and make no network calls. gos-verify needs Python 3 and nothing else; goslint adds two libraries, openpyxl and PyYAML.

pip install governanceos              # gos-verify
pip install "governanceos[lint]"      # gos-verify and goslint

gos-verify: verify an evidence pack offline

An institution that keeps its AI governance records in GovernanceOS can share an evidence pack with an examiner. gos-verify checks that pack on the examiner's own machine:

1. It recomputes the SHA-256 hash of every record, checks that each links to the one before it, and checks that the positions run without a gap.
2. It checks the Ed25519 signature over the whole pack: the header, every record and the summaries.
3. It prints the signing key's hash and compares it with the one the institution sent you by another route (--key), and compares the head with a head it sent you (--expect).
4. It says plainly that the public anchor was not checked, because that needs a network.

gos-verify PACK.json --key KEYHASH [--expect HEAD]

What it proves: the pack was not changed after the key you pinned signed it. What it does not prove: that the records were true when they were written. That is for the examination.

The same verifier is the single-file download at governanceos.si/verify. The two are byte-identical.

goslint: lint a model register offline

Many practitioners keep their AI and model inventory in a spreadsheet. goslint checks that spreadsheet (.xlsx, .xlsm or .csv) against regulator rule packs on your own machine and reports four things:

1. Missing fields. Each pack lists the fields an instrument names for an inventory, each with its basis in the instrument's own words (required, expected or recommended) and a citation. A missing column is reported once; an empty cell, or a placeholder such as "TBD", once per row.
2. Next review date. Where the instrument's field list names a next review date (OSFI E-23 Appendix 1 field 17, and the QCB AI Guideline's next planned risk assessment or audit, Article 10.9), dates that have passed, and dates that cannot be read, such as 03/04/2027. goslint reads the date the register holds and computes none of its own.
3. Typed or derived. Whether each cell was typed by a person or derived by a formula, read from the workbook itself.
4. What a spreadsheet cannot prove. No history, no signers, no hashes. True of every spreadsheet, so it is stated once.

goslint lint REGISTER.xlsx --pack osfi-e23 [--sheet NAME] [--as-of YYYY-MM-DD] [--grace-days N]
                           [--json findings.json] [--quiet | --verbose]
goslint packs

Packs are chosen, never assumed: without --pack, goslint lists the installed packs by region and stops, so a register is checked only against the jurisdictions it answers to. Name several with commas: --pack osfi-e23,amf-ai. Severity follows the basis: required is an error, expected a warning, recommended a note.

Notes and check 4 do not change the exit code.

The workbook is read, never written. goslint reads the file once, prints the SHA-256 of what it read, and parses that copy in memory. --json writes the findings (schema goslint-findings/1) to a file you name; the export names the workbook by file name, never by path.

What it checks: that fields are present, that next review dates have not passed, and where values come from. What it does not check: whether the values are true.

Each pack is generated from GovernanceOS's register coverage research, which read every source at its official URL on 2026-10-19 (tools/gen_packs.py). Header synonyms are working guesses for matching column names, not source text.

Try it

tests/data holds a sample pack from a fictional institution and a tampered copy of it, the same institution's model register, kept by hand with the gaps such registers have, and the registers of two more fictional institutions. Nebula Mutual, Nebula Gulf Bank and Nebula Regional Health are fictional institutions constructed for illustration; any resemblance to a real organization is unintended.

goslint lint tests/data/nebula-mutual-register.xlsx --pack osfi-e23,amf-ai --as-of 2026-10-19
goslint lint tests/data/nebula-gulf-bank-register.csv --pack cbuae-ai-gn,cbuae-mms
goslint lint tests/data/nebula-regional-health-register.csv --pack nist-ai-600-1,nist-ai-rmf-playbook-gv16

The tests need the lint extra:

pip install ".[lint]"
python -m unittest discover -s tests -v

License

Apache License 2.0; see LICENSE and NOTICE. The license grants no rights to the GovernanceOS name or marks (section 6).