model-wtf

Compliance as code for Model W projects.

Why

A GDPR register, a rights matrix and a threat model are descriptions of what the code does. Written by hand they are wrong the week after; written once, they never meet the pull request that breaks them.

model-wtf derives them from the repository instead. It introspects the application (Django models and URL confs, task registries, SvelteKit routes) into inventories — data items, the touchpoints that handle them, where the data flows, the stores it lives in — and lets humans or agents record the judgements the code cannot carry (is this field personal? does this endpoint serve the subject or the staff? is that threat mitigated?) in a SQLite database committed next to the code. Everything downstream — the Art. 30 register, rights coverage, the weighed findings — is computed from that. A gate runs on every pull request and fails the change that introduces a gap; a challenger agent reads the diff and re-opens the reviews it undermines. The to-do list is, at all times, exactly the distance between the code and its declarations.

How

In the root of a Model W repository (a snow.yml, or a .model-wtf.yml), with an OpenRouter key in OPENROUTER_API_KEY — or a Scaleway IAM key in SCALEWAY_SECRET_KEY, plus SCALEWAY_INFERENCE_ENDPOINT for a dedicated inference deployment of your own:

uvx model-wtf compliance init                     # compliance.db, snow.yml blocks, CI workflow
uvx model-wtf compliance data auto-review         # agents classify every field, model by model
uvx model-wtf compliance touchpoints auto-review  # and declare what each route / task / screen does
uvx model-wtf compliance activities list          # the register of processing activities, from the code
uvx model-wtf compliance check                    # what is still open — and the gate on your next PR

Nothing is overwritten, what the agents cannot know is left as !todo for a human, and every row they wrote is queryable and diffable. Without an API key the same commands work by hand (data review, touchpoints set-data, threats stamp).

Learn more

https://modelw.github.io/wtf/

• The cycle — the model in one page: data, touchpoints, flows, activities, threats, the gate.
• Add model-wtf to a project · My PR failed the gate · Answer a threat finding · Add a third-party service · Run the reviewer swarm · Read the register
• Reference: CLI · MCP tools · file schemas · threat catalogue

Misc

• Install for good: uv add --dev model-wtf, then uv run model-wtf ….
• The gate in CI: uses: ModelW/wtf@v1 (see action.yml; init writes the workflow).
• Contributing and releasing: docs/contributing.md.
• Changes: CHANGELOG.md. License: MIT.