Vanta remains the GRC system of record. Warestack is the engineering control that runs change management on GitHub, Linear, and Slack, then leaves an evidence trail Vanta and an auditor can sample.
Warestack does not attest SOC 2. The auditor does.
Warestack also does not replace Vanta tests for HR, vendors, laptops, access control, or penetration testing. A Slack reminder is not proof somebody reviewed a diff; the attributable GitHub review and its evidence are.
| Vanta asks | Warestack produces | Artifact |
|---|---|---|
| Was this change authorized? | Linked, assigned Linear issue | Identifier, assignee, URL, association time |
| Was it reviewed by a human? | Requested reviewers + evidence-in-body rule | Reviewer identity, timestamps, quoted evidence |
| Were tests run? | Feature-test rule + CI on the live card | Check names, conclusions, head SHA |
| Did it match the ticket? | Scope-drift vs stored Linear description | Finding that cites issue + files |
| Who owned the exception? | Unresolved findings, attention, SLA DMs | Recipient role, delay, delivery time |
| What shipped to production? | Deploy changelog chain | Deploy SHA, associated PRs and issues |
| Can we sample the period? | Saved report + weekly delivery + per-event timeline | Run history and CSV today; dedicated period export is a maturity item |
First weeks
Controls running, merge-blocking off, weekly digest and changelog posting, and adjustments driven by real findings. Cross-repository pairs are not a self-serve control; do not describe them as enabled unless you have an explicit, named-pair setup.
For authorization and review evidence, use these IDs: custom.linear_issue_required, 7, 8, 12, 13, and custom.evidence_in_approval_body. Catalog 1 is concise PRs.
Observation window
Available building blocks:
- Saved report populations with run history and CSV.
- Per-event timeline with repository, SHA, ticket, reviews, checks, and findings.
- Production deployment changelog.
- Point-in-time People and repository-owner evidence.
- Optional merge gate by requiring Warestack Rules in GitHub branch protection.
Maturity items to agree and validate before describing them as operating controls:
- Dedicated period export with the exact Vanta/auditor schema.
- Exception register with accepted risk, owner, and expiry; the current console does not expose a complete waiver workflow.
- Production-path tightening for
deploy/, Terraform, or workflow paths. - Cross-repository pairs, which are not generally available.