Vanta remains the GRC system of record. Warestack is the engineering control that runs change management on GitHub, Linear, and Slack, then leaves an evidence trail Vanta and an auditor can sample.
Warestack does not attest SOC 2. The auditor does.
Warestack also does not replace Vanta tests for HR, vendors, laptops, access control, or penetration testing. A Slack reminder is not proof somebody reviewed a diff; the attributable GitHub review and its evidence are.
| Vanta asks | Warestack produces | Artifact |
|---|---|---|
| Was this change authorized? | Linked, assigned Linear issue | Identifier, assignee, URL, association time |
| Was it reviewed by a human? | Requested reviewers + evidence-in-body rule | Reviewer identity, timestamps, quoted evidence |
| Were tests run? | Feature-test rule + CI on the live card | Check names, conclusions, head SHA |
| Did it match the ticket? | Scope-drift vs stored Linear description | Finding that cites issue + files |
| Who owned the exception? | Revision-bound finding acknowledgement with a required reason, plus attention and SLA DMs | Admin actor, reason, finding and pull-request revision, delivery evidence |
| What shipped to production? | Deploy changelog chain | Deploy SHA, associated PRs and issues |
| Can we sample the period? | Saved report + weekly delivery + per-event timeline | Run history and CSV today; dedicated period export is a maturity item |
First weeks
Controls running, merge-blocking off, weekly digest and changelog posting, and adjustments driven by real findings. Cross-repository pairs are not a self-serve control; do not describe them as enabled unless you have an explicit, named-pair setup.
For authorization and review evidence, use the recommended first-enablement pack. Require concise pull requests (pull_request.size_limit) is a size cap.
Observation window
Available building blocks:
- Saved report populations with run history and CSV.
- Per-event timeline with repository, SHA, ticket, reviews, checks, and findings.
- Production deployment changelog.
- Point-in-time People and repository-owner evidence.
- Optional merge gate by requiring Warestack Rules in GitHub branch protection.
Maturity items to agree and validate before describing them as operating controls:
- Dedicated period export with the exact Vanta/auditor schema.
- Complete exception register with accepted risk owner and expiry. The current console supports an audited, reason-required acknowledgement for an eligible blocking finding, bound to the exact pull-request revision; it is not a reusable or time-bounded waiver.
- Production-path tightening for
deploy/, Terraform, or workflow paths. - Cross-repository pairs, which are not generally available.