MIND

Compliance Toolkit

Automated compliance artifacts, deterministic builds with cryptographic proof, and regulatory checklists mapped to your framework. What PyTorch, JAX, and Mojo cannot offer.
Learn about the pilot
An evidence chain: each artefact block carries the hash of the one before it.
What the toolkit gives you
  • Deterministic buildsBuilt in
  • Evidence chain (RFC 0016)Built in
  • PQC hybrid signatureOpt-in
  • Audit log exporterCommercial
  • SBOM: SPDX, CycloneDXBuilt in
  • SLSA attestation exportBuilt in
  • Audit and provenance CLIBuilt in

Toolkit

What MIND provides

Compliance artifacts come out of the build itself: every step from source to verification leaves a record.

dot.mind lowers to mic@3 bytes, hashed into trace_hash a34382f8…eebeea, embedded in the evidence MAP and checked by mindc verifysourcedot.mindcanonical IRmic@3 bytestrace_hasha34382f8623e15a0…d508aebeeaevidence MAPsubstrate · toolchainmindc verifytrace_hash_valid: yes

  • Deterministic builds

    Bit-identical output from identical source on x86/x64, ARM, GPU and any chip. SHA-256 verified at every stage: source, IR, binary.

  • Evidence chains

    Every compiled artifact carries its evidence chain (RFC 0016): determinism class, substrate, toolchain identity and trace hash.

  • SBOM generation

    SPDX and CycloneDX bills of materials, with transitive dependencies and license classification.

  • Audit log exporter

    Commercial runtime

    Timestamped, structured records of compilation, deployment and inference events for regulatory traceability.

Signing

PQC hybrid signature, opt-in

ML-DSA-87 + SLH-DSA, both legs required. Signing runs with your own keys inside your own pipeline, and only when you turn it on.

How signing works

  • Signing you operate with your own keys inside your own build pipeline
  • Enabled only when you supply a key seed out-of-band
  • Nothing is signed by default; an unsigned artifact stays byte-identical
  • mindc verify --signer-pubkey pins a trusted-key allowlist and fails closed on an unknown signer

The post-quantum legs are compiled in via the evidence-mldsa and evidence-slhdsa build features, and the verifier's trusted-signer allowlist is operator-supplied. Ed25519 is deliberately excluded from that scheme; it survives only as a legacy interop tag and is not PQC-compliant.

  • ML-DSA-87FIPS-204, lattice
  • SLH-DSA-SHAKE-256sFIPS-205, hash-based
AND

Both verify

accepted

Leg stripped

fails closed

Two mathematically independent post-quantum foundations, with a non-degradable verifier that fails closed rather than collapsing to a single leg.

Audit trail

Audit trail in action

Deterministic builds and the tamper-evident evidence chain (RFC 0016) are embedded in every compiled artifact; one build flag adds provenance and SBOMs.

mindc verify
$ mindc dot.mind --emit-evidence dot.mic3
Wrote mic@3 evidence artifact: dot.mic3 (291 bytes, self-check ok)
$ mindc verify dot.mic3
artifact:         dot.mic3
substrate:        cpu
determinism:      deterministic
toolchain:        0.10.2
parent:           (root)
trace_hash:       a34382f8623e15a05bc28b816feb3b4de7cdc17ac59df3f9daa710d508aebeea
trace_hash_kind:  mic3-bytes
trace_hash_valid: yes
fp_mode:          strict
ssa_valid:        yes
signature:        absent
verified: IR body attested (tamper-evident) — trace_hash matches the re-emitted canonical IR
verified: IR body is SSA well-formed
note: artifact carries no signature (unsigned but attested)
note: provenance (substrate/toolchain/parent) is NOT authenticated — these MAP fields sit outside trace_hash; sign the artifact and pin --signer-pubkey to authenticate them
Captured from mindc 0.10.2. The artifact proves its own IR; signing is opt-in.
model.mind
// Source: model.mind
@audit(level="full")
@provenance(slsa_level=3)
@sbom(format=["spdx-3.0", "cyclonedx-1.5"])

param weights: Tensor<f32, 784, 10>

fn forward(x: Tensor<f32, ?, 784>) -> Tensor<f32, ?, 10> {
    matmul(x, weights)  // Shape verified at compile time
}

// Build with full audit trail:
// $ mindc build model.mind --audit --provenance --sbom
//
// Generated artifacts:
//   model.bin          (compiled binary)
//   model.bin.sha256   (binary hash)
//   model.slsa.json    (SLSA v1.0 provenance)
//   model.spdx.json    (SPDX 3.0 SBOM)
//   model.cdx.json     (CycloneDX 1.5 SBOM)
//   model.audit.json   (execution audit log)
Audit, provenance and SBOM attributes on a model, and the artifacts one build produces.

Checklists

Regulatory framework checklists

For each framework: what MIND automatically satisfies, where it helps, and what your team still needs to provide.

  • Auto-satisfied
  • MIND helps with
  • You still need

  • FDA 510(k) / De Novo

    IEC 62304, ISO 14971, ISO 13485

    Auto-satisfied

    • Software verification (compile-time shape checks)
    • Configuration management (tamper-evident evidence chain, SHA-256)
    • Reproducible builds (deterministic execution)

    MIND helps with

    • Cybersecurity (memory safety, supply chain)
    • Performance reporting (deterministic benchmarks)

    You still need

    • Risk management process documentation
    • Clinical performance studies
    • Device labeling

  • EU AI Act

    Regulation 2024/1689, Articles 9-17

    Auto-satisfied

    • Record-keeping and logging (Article 12)
    • Build provenance and traceability

    MIND helps with

    • Risk management system (Article 9)
    • Technical documentation (Article 11)
    • Transparency (Article 13)

    You still need

    • Data governance (Article 10)
    • Human oversight mechanisms (Article 14)
    • Quality management system (Article 17)

  • ISO 26262

    Parts 6, 8, 9, 11 (Functional Safety)

    Auto-satisfied

    • Software unit design (compile-time guarantees)
    • Software unit verification (static analysis)

    MIND helps with

    • Tool qualification evidence (Part 11)
    • Integration verification
    • Safety-critical runtime checks

    You still need

    • ASIL classification and analysis (Part 9)
    • Software development plan (Part 6)
    • Hardware-software interface spec (Part 8)
One build's evidence pack, its binary, SBOM, SLSA provenance and sealed audit log, wired to three regulatory checklists, FDA, EU AI Act and ISO 26262, whose rows tick off as the evidence arrives.

Start a compliance pilot

Free 4-8 week pilot. Migrate one model, get full compliance artifacts, and see exactly what MIND automates for your regulatory framework.

Learn about the pilot