Binary Networks — Status & Index
A single map of every doc, grouped by what it is: something we're building, something already deployed, or a governing policy. Files stay where they live; this page is the cross-cutting view.
Status legend: 🟢 Deployed / As-built · 🟡 In progress · ⚪ Planned (spec) · 📘 Approved policy
1. Build Plan — the S.E.T product (being built)
The S.E.T (Secure·Enforce·Train) GRC platform. These are specifications for the product we are building across Phases 0–7. Most are ⚪ specs until their phase lands. The application code lives in IONTWRKS/set-app (monorepo); infra/governance in IONTWRKS/set-platform.
| Doc | Covers | Status |
|---|---|---|
| Overview | Product vision, tenants, scope | ⚪ |
| UI / UX | Neumorphism design system | ⚪ |
| Tech Stack | React/Vite · NestJS · Postgres · WorkOS | ⚪ |
| Architecture | System architecture | ⚪ |
| Authentication | WorkOS (AuthKit / SSO / MFA) | ⚪ |
| Multi-tenancy | Tenant = WorkOS org ⇄ Postgres schema | ⚪ |
| Observability | Logging tiers, audit events | ⚪ |
| Data Model | Schema-per-tenant, entities | ⚪ |
| Environments | dev / nonprod / prod | ⚪ |
| Admin User Flows | Back-office journeys | ⚪ |
| Customer User Flows | Customer-portal journeys | ⚪ |
| Downloads | Exports / file handling | ⚪ |
| Report Generation | PDF / compliance reports | ⚪ |
| Notifications | Email + scheduled jobs (BullMQ) | ⚪ |
| Testing & QA | Test strategy, isolation tests | ⚪ |
| Search | Search architecture | ⚪ |
Roadmap: Phase 0 (scaffold → local Postgres/Redis → Drizzle + tenant provisioning →
WorkOS) → Phase 1 (identity/tenancy) → Phases 2–7. The Phase/Module/Scope breakdown
(with QA + design hours) is tracked in the external SET - Phases Modules Scopes workbook.
2. Completed / As-built — what's deployed today
Platform security & evidence (delivered this cycle)
| Capability | Where it's documented | Status |
|---|---|---|
CI security gate — one reusable security-core.yml (TruffleHog · OSV · Trivy · Semgrep · zizmor/actionlint/pin-ratchet) called by every repo | Supply Chain § As-built implementation | 🟢 |
Evidence Archive (WORM S3) — iontwrks-ci-evidence, eu-north-1, acct 429134227608, gha-log-archive OIDC role, log-archive.yml pipeline | Evidence & Retention §8 | 🟢 |
| Org guardrails — 2FA required, default-no-access; per-repo branch protection; org rollout across 6 repos | Supply Chain § As-built | 🟢 |
| Repo topology — set-platform (infra/cage) vs set-app (product) | repos + set-app/CLAUDE.md | 🟢 |
| code-graph cross-repo brain — Terraform module (merged, deploy pending) | set-platform/infra/code-graph | 🟡 |
Scanners — live product
The scanners platform runs on ECS Fargate (eu-north-1). Its docs are as-built. 🟢
- Overview · Architecture · API
- Modules: Cloud · DAST · EASM
- Operations: Deployment · Monitoring · Logging/SIEM · Releasing
GolemSec — deployed lab environment 🟢
Overview · AWS Architecture · Build Status · DR (and 7 more under golemsec/)
3. SDLC & Policies — governance 📘
The umbrella lifecycle policy and its version-controlled sub-policies (ISO 27001 / SOC 2 / NIST SSDF aligned). All 📘 Approved.
- Secure SDLC (SSDLC) — the umbrella policy + framework mapping
- Supply Chain & CI/CD Security — pipeline design + as-built
Policies (governance/policies/):
Access Reviews ·
Audit Testing Scope ·
Backup & Recovery ·
Change Management ·
Cryptography Standard ·
DAST & Pen-testing ·
Decommissioning ·
Developer Security Training ·
Evidence & Retention ·
Incident Response ·
Release Gate Criteria ·
Risk Assessment ·
Roles & Responsibilities ·
Root-Cause Analysis ·
Secure Coding Standard ·
Security Requirements & Threat Modeling ·
Separation of Duties ·
Test Data Protection ·
Vulnerability Management
How to keep this current: when a Build-Plan spec becomes deployed, move its row to §2 and flip its badge to 🟢. When a new control ships, add it to §2 and register its evidence in Evidence & Retention §3.