Commit envelopes
Matrix Scroll signs every agent-assisted merge — actor, tool, and scope in an Ed25519 envelope your assessor verifies offline.
PyPI SDK ↗Keys never leave your machine
Fintech door-opener · voluntary framework
Signed proof for AI-assisted code changes
Matrix Scroll signs merges locally; SSX360 hosts the control plane — commit envelopes, Scroll Gate CI, and audit packs assessors verify offline. We map a deliberate SDLC / change-management slice of FS AI RMF: the part institutions struggle to defend when Copilot, Cursor, and agent tools land on protected branches.
Voluntary framework — produces evidence aligned to FS AI RMF control objectives; not certified by CRI or Treasury. Scoped to SDLC / change-management only (not all 230 objectives).
For CRI / ecosystem reviewers
Three artifacts examiners ask for
Scroll Gate (CI)
Protected branches gate merges before deploy. Copilot, Cursor, and agent tools on main need examiner-ready proof — not policy slides alone.
CI integrationAudit packs
Export ssx360.evidence-pack.v1 JSON with compliance_mappings for FS AI RMF — verify in browser or CLI without trusting SSX360.
Sample packScoped control mapping (SDLC slice)
Illustrative rows for AI-authored code changes — internal shorthand, not official CRI RCM numbers. Full draft mapping · feedback welcome at mission@ssx360.com
| ID | Control theme | SSX360 evidence |
|---|---|---|
| SDLC-01 | Software changes attributable to human or agent actor | Envelope provenance.actor_type, provenance.tool |
| SDLC-02 | Unauthorized changes blocked on critical branches | Scroll Gate blocked / review events in ledger |
| SDLC-03 | Change record exportable for independent verification | Signed evidence pack + detached signature |
| SDLC-04 | Agent tooling declared at commit time | MCP / hook metadata in envelope |
| SDLC-05 | Payments-adjacent paths require trusted actor | financial-infra policy rule outcomes |
| AUD-01 | Sample-ready JSON for assessor review | compliance_mappings[] includes FS AI RMF entry |
| AUD-02 | Offline verification without platform trust | matrixscroll verify / browser verifier at ssx360.com/verify |
What SSX360 maps
- ✓Signed commit envelopes with declared actor, tool, and scope
- ✓Scroll Gate CI on protected branches
- ✓Offline-verifiable evidence pack export
- ✓FS AI RMF and PCI DSS v4.0.1 Req 6.5 compliance_mappings
- ✓Financial-infra policy preset for payments and ledger paths
Out of scope
- —Model risk management and training-data governance
- —Board-level AI governance programs
- —Third-party AI vendor due diligence (beyond your code changes)
- —Full 230 FS AI RMF control objectives