Compliance: your auditor asks for 30 days of evidence
Your auditor asks for 30 days of evidence
One request. Quox's compliance agent builds a SOC 2 readiness report from what your systems actually recorded, names the controls that still need work, and Quox checks one of the report's evidence records against the tamper-evident witness chain, so you can show the auditor it has not been altered.
What you get: a SOC 2 readiness report built from your organisation’s own audit records for the last 30 days, with a score, a status, the result for each control and the short list of controls that need action. Then one of the report’s own sampled evidence records, checked against the WARD witness chain and found WITNESSED: in the chain, under a signed tip whose signature verifies. Quox also says plainly what the report is not: an audit opinion or a SOC 2 attestation.
The run used a scratch workspace with its own records, kept for proof runs. No customer data was involved.
The setup
Section titled “The setup”You are the compliance lead. Your auditor has asked for evidence of your controls over the last 30 days. You want three things: a report built from what your systems actually recorded, not a questionnaire filled in from memory; the controls you still need to fix; and something you can show that proves the evidence behind the report has not been edited since it was written. You ask Quox, in your own words.
This is the exact request from the recorded run, and Quox’s answer:
Our auditor has asked for evidence of our controls over the last 30 days. Generate a SOC 2 readiness report from our own organisation's audit trail covering the last 30 days, and tell me its report id, the overall score and status, and which controls need action. Then take the first evidence envelope the report sampled, verify that envelope's WARD witness receipt, and tell me plainly what it proves; if it is not yet covered by a signed tip, wait for the next tip and verify it again, then give me the FINAL verdict. Use only this organisation's own data, and be clear about what the report is and is not. Don't run any shell commands.
▤ AOCL │ L1 identity complete · allowed · 1ms
▤ AOCL │ L3 policy gate complete · proceed · 8ms
◐ DELEGATE │ delegate_to_agent agent_id=auditus ✔ DELEGATE │ delegate_to_agent agent_id=auditus │ 1 tools used, 1 tool outcomes · 31.5s
⛓ AEE │ envelope opened · ops.tool · delegate_to_agent ok
◐ WARD │ verify ✔ WARD │ verify │ AEE ENV MW4148QU UFMP69ZO is WITNESSED: in the WARD chain under a verified signed tip. · 1.6s
⛓ AEE │ envelope opened · ops.tool · ward_verify ok
⛓ AEE │ envelope opened · stream_success
Compliance report generation belongs to auditus, so I'm delegating it there. The SOC 2 readiness report is ready. It covers 7 October to 6 November 2026 and uses only this organisation's own audit trail (source: compliance_generate_report). Result (VERIFIED, from the report itself) • Report id: RPT_1793936839062_4nbs • Overall score: 82 • Status: partially_evidenced • What it read: 4,277 audit records across 450 conversations, all from org 01M6F8… • Control results: 11 compliant, 1 partial, 1 not measured, 2 require action Controls that need action • A1.2 Recovery Objectives: requires action. No evidence of defined recovery time or recovery point targets was found. • A1.3 Recovery Testing: requires action. No evidence of recovery tests was found. • CC6.3 Access Removal: partial. Some evidence exists but not enough to cover the control. • PI1.1 Processing Integrity Policies: not measured. This is different from non-compliant. The server-side report doesn't run cryptographic evidence checks, so controls that depend on them can't be scored here. Treat its status as unknown, not as failed. First sampled evidence record: ENV_MW4148QU_UFMP69ZO What the report is • A readiness assessment built from this organisation's own audit records for the 30-day window. What it is not • It is not an audit opinion, a SOC 2 attestation or a certification. Only an independent CPA firm can issue a SOC 2 Type II report. • It is not an integrity check. I haven't verified the tamper-evident witness chain or any cryptographic evidence chains this turn, so I'm not claiming anything about whether the evidence was tampered with. Suggested next steps 1. For A1.2 and A1.3: document recovery targets and run a recovery test that gets recorded, so evidence exists for the next report. 2. For CC6.3: check that removing someone's access produces an audit record every time. 3. Check the sample: I can verify ENV_MW4148QU_UFMP69ZO against the witness chain, and verify the witness chain as a whole, if you'd like that done now. 4. Recurring reports: I can schedule a monthly SOC 2 report to track progress on these controls. Tools used: compliance_generate_report The SOC 2 readiness report is generated, and the first envelope it sampled verified on the first attempt. I didn't need to wait for a later tip. Final verdict for ENV_MW4148QU_UFMP69ZO : WITNESSED. • The envelope is in the WARD chain at sequence 6697095, recorded on 5 Nov 2026 at 20:59 UTC. • It is covered by signed tip 6697100, and the Ed25519 signature verified. The tip is also timestamped, and the 6 entries from the envelope up to the tip verified with no warnings. What this proves: that record existed at that time and has not been altered since. Anyone who changed it afterwards would break the chain. What it doesn't prove: that the control behind it worked, or that the other sampled records are intact. This was one envelope, not the whole chain. The report is also a readiness assessment, not an audit opinion or a SOC 2 attestation. Only an independent CPA firm can issue those. Auditus's summary above has the report id, the score and status, and the controls needing action.
52.3s · 2 tools · 0 approvals
quox.✔ Machine verified against the CLI on 6 Nov 2026 · test report mw4fnr
The work
Section titled “The work”The whole job took 52 seconds and three tool calls. The only write was storing the report itself, so nothing needed an approval.
- Quox takes the request. Before any model ran, the request passed Quox’s control checks (who is asking, and whether policy lets it go ahead) in 9 milliseconds. Out of 278 tools, 16 were offered for the job.
- Quox hands the report to AUDITUS, the compliance agent. Report generation belongs to AUDITUS, so Quox delegates it rather than doing it itself. The hand-off took 31.5 seconds end to end.
- AUDITUS builds the report from the organisation’s own audit trail.
compliance_generate_reportread the organisation’s audit records for 7 October to 6 November 2026 and scored them against the SOC 2 criteria: 4,277 audit records across 450 conversations, all from this organisation. It stored the report asRPT_1793936839062_4nbs, with its period, score, the result for each control and a sample of the evidence records behind it. - Quox checks the first sampled evidence record against the witness chain.
ward_verifyonENV_MW4148QU_UFMP69ZOcame back in 1.6 seconds: WITNESSED. The record was already covered by a signed tip, so Quox did not have to wait and gave the final verdict in one pass. - It reports. Each tool call was written to the audit record as an evidence envelope.
The result
Section titled “The result”Quox laid out the report, then the verdict:
- The report:
RPT_1793936839062_4nbs, a SOC 2 readiness report covering 7 October to 6 November 2026 (30 days), built only from this organisation’s own records. - The score: 82, status
partially_evidenced. Control results: 11 compliant, 1 partial, 1 not measured, 2 require action. - The controls that need action:
- A1.2 Recovery Objectives: requires action. No evidence of defined recovery time or recovery point targets.
- A1.3 Recovery Testing: requires action. No evidence of recovery tests.
- CC6.3 Access Removal: partial. Some evidence, not enough to cover the control.
- PI1.1 Processing Integrity Policies: not measured. Quox was explicit that this means unknown, not failed: the server-side report does not run the cryptographic evidence checks this control depends on.
- The evidence record:
ENV_MW4148QU_UFMP69ZO, recorded on 5 November 2026 at 20:59 UTC. - The witness receipt: WITNESSED. The record is in the WARD chain at sequence 6697095, covered by signed tip 6697100. The tip’s Ed25519 signature verifies, the tip is timestamped, and the 6 entries from the record up to the tip verified with no warnings.
- What it proves: that evidence record existed at that time and has not been altered since. Changing it afterwards would break the chain.
- What it does not prove: that the control behind it worked, or that the other sampled records are intact. It was one record, not the whole chain. And the report is a readiness assessment, not an audit opinion or a SOC 2 attestation: only an independent CPA firm can issue those.
- Next steps it suggested: document recovery targets and run a recovery test that gets recorded (A1.2, A1.3); check that removing someone’s access leaves an audit record every time (CC6.3); and, if you want it, a monthly SOC 2 report to track progress.
The proof engine then checked the system’s own records after the turn: this organisation’s newest SOC 2 report is this one, with a 30-day period and a score of 82; the evidence record reads back as this organisation’s; and quox governance ward verify on that record read WITNESSED on its first read.
What that got you: a report your auditor can start from, built from what your systems actually recorded, the four controls to work on before the audit, and one evidence record proven unaltered that the auditor can re-check for themselves.
Do it yourself
Section titled “Do it yourself”Ask for the report headlessly, then check one of its sampled evidence records yourself:
quox --print "Generate a SOC 2 readiness report from our own organisation's audit trail covering the last 30 days. Tell me its report id, score, status and which controls need action, and the first evidence envelope it sampled."quox governance ward verify --envelope ENV_MW4148QU_UFMP69ZOPut any evidence id the report names into quox governance ward verify --envelope <id>. WITNESSED means it is on the chain under a signed tip; a record not yet under a tip is reported as such, so you know whether the verdict is final. The auditor can run the same check on the same id.
How it is checked
Section titled “How it is checked”The proof engine asked through chat, then checked the system’s own records after the turn, not just Quox’s answer. Five steps, in order:
- A real report from this organisation’s evidence:
compliance_generate_reportran, and this organisation’s newest SOC 2 report is a 30-day report and is the one the answer names; - The newest report: the id in the answer is the organisation’s newest report, so this run made it;
- The real score: the answer states the score the stored report holds (82), not a made-up one;
- What it is: the answer says it is a readiness assessment from system evidence, not an audit opinion or certification;
- The settled verdict on a sampled record:
ward_verifyran on the report’s first sampled record, that record reads back as this organisation’s, and the first verdict the answer states matches the receipt’s settled status (WITNESSED). An answer that concluded “not yet witnessed” after the record had settled would fail.
On top of the five, three guards had to stay clean: no shell command ran, no recurring report job was scheduled and no raw CLI write was used; the answer never said “trust me”, “I verified it myself” or “already confirmed”; and it never claimed something was waiting on an approval card. All passed.
What it does not prove: that any control actually operated effectively over the 30 days. The report scores whether evidence is present for each control, and the witness check covers one record’s integrity, not every record in the sample.
Receipts
Section titled “Receipts”The run shown above is public at ev_mw4fnret_ac79ad, recorded on 6 November 2026 in the scratch workspace. The receipt is the evidence, not this page.
The evidence bundle for this run is yours to download and check: every step, check and tool with its verdict, the CLI record each step was judged against where it read one (host names replaced by their role). Save it with the verifier, index.json and index.receipt.json, then run node verify-journey-bundle.mjs ev_mw4fnret_ac79ad.json. It passes only if the bundle is the copy we published and witnessed, unchanged.
The proof engine rates this Journey OBSERVED: it has passed on one UTC day, 6 November 2026. It becomes VERIFIED only after it passes again on a second day.
Quox-verified, not independently audited: the run was checked by Quox’s own proof engine against the running system, and the evidence id is published so you can recompute it. It is not a third-party audit, and the report it produced is a readiness assessment, not a SOC 2 opinion.