Compliance Foundation — Public Registries and Sourced References (DYONYSOS)

What the base provides

Lookup in a public registry, and above all its degraded mode. Dated cache, queue, log, and no network call in a process that serves a page. Registry unreachable, quota exceeded, unexpected response: the lookup says so, keeps the last known response with its date, and never blocks data entry. A compliance module that stops people from working because an interface is coughing gets uninstalled the same day.

Provenance, everywhere. A verdict entered by hand and a verdict obtained from the source do not carry the same weight, and the screen, the list and the export all say so. It is the only thing that makes the declarative fallback acceptable: without it, what is merely declared would be presented as verified, which is worse than not verifying anything at all.

A repository of sourced regulatory references. Each value carries the text that establishes it, the exact URL where it was read, a verbatim quotation, and the date of that reading. A reference whose last review exceeds the configured frequency automatically reverts to “to be rechecked” — because a value checked three years ago is an unchecked value that believes it is safe. And “searched for and NOT found” is a status in its own right: a named gap gets filled, an unspoken gap gets copied.

What the base does not do

• No regulatory values are provided. The reference data is empty on installation. Shipping a catalog of thresholds in a distributed module freezes one version of it, which will age without anyone noticing while the module keeps displaying it with the authority of a fact. Examples exist only in the demo database.

• It never concludes. "Not found in the register" is a finding about the register, not a judgment about the company: a register may be behind, an update may not have gone through. The word "compliant" is written nowhere.

• It enforces nothing. The reference data is not read by any business rule: it blocks no entry and calculates no compliance.

• No menu. The base module is not an app: each host app exposes its own screens, with its own vocabulary.

Why a shared base rather than a copy in every app

Because the duplicate already existed. The register lookup layer was present, identical — four hundred and thirty-five lines, give or take five — in two apps of the suite. Two copies of the same code means two places to fix a defect, and only one where anyone remembers to do so.

Apps that already had their own company settings keep them: the foundation reads its three settings through overridable methods, never through hard-coded field names. A foundation that wipes out a setting entered in production is not a foundation; it is a regression disguised as a refactoring.