reference developer public

Signal YAML reference

Configure Continuous Verification and Continuous Compliance in .drc/signal.yml. The file is shared; the cv and cc sections stay separate.

Unknown fields fail closed. Extra keys, empty required values, and values outside the bounds below prevent drc signal from loading the file.

Requirements

Place the file at <project-root>/.drc/signal.yml. The CLI walks from the current directory toward filesystem root until it finds that path. It loads signal.yml only; .drc/signal.yaml is ignored.
Set version: 1.
Declare at least one service and at most 256 services.
Keep the file at or under 1 MiB.
Name services with ASCII letters, digits, -, _, or ., up to 128 bytes.
When cc.enabled is true, declare a framework profile and at least one control.

Top-level fields

Field	Required	Meaning
`version`	yes	Must be `1`.
`project`	no	Optional project label.
`project.name`	no	Non-empty name, at most 128 bytes.
`services`	yes	Map of service name to service configuration.

Service fields

Each key under services is the service name you pass to drc signal <service>.

Field	Required	Default	Meaning
`path`	no	unset	Relative service path, at most 512 bytes.
`run`	yes	—	Command DRC executes for this service.
`cv`	no	enabled Continuous Verification with defaults below	Continuous Verification policy.
`cc`	no	disabled	Continuous Compliance profile and controls.
`cache`	no	disabled	Bounded runner caches. Cache contents are not evidence.

`run`

Field	Required	Default	Meaning
`command`	yes	—	Non-empty command, at most 8,192 bytes.
`working_directory`	no	project root	Relative working directory, at most 512 bytes.
`timeout_seconds`	no	`3600`	Command timeout from 1 through 86,400.

drc signal <service> runs this command, captures bounded stdout and stderr (2 MiB combined), and uses the exit status as the first pass/fail input for Continuous Verification.

`cv`

See Continuous Verification for the product meaning. Fields:

Field	Required	Default	Meaning
`enabled`	no	`true`	When false, `drc signal` lists the service but does not run CV for it.
`execution_mode`	no	`self_hosted`	`self_hosted` or `hosted`.
`environment`	no	`ci`	Non-empty environment label, at most 128 bytes.
`baseline`	no	automatic head for the service and environment	Pin a baseline.
`comparison`	no	strict outputs, errors, and side effects; recorded resources	Difference policy.

`cv.baseline`

Field	Required	Meaning
`commit`	no	Commit SHA, at most 256 bytes, no whitespace.
`environment`	no	Baseline environment label, at most 256 bytes.
`lockfile_hash`	no	Lockfile digest, at most 256 bytes.
`config_hash`	no	Configuration digest, at most 256 bytes.

When commit is unset, DRC selects the current head baseline for the service and environment.

`cv.comparison`

Field	Required	Default	Allowed values
`outputs`	no	`strict`	`strict`, `allow`
`errors`	no	`strict`	`strict`, `allow`
`side_effects`	no	`strict`	`strict`, `allow`
`resources`	no	`recorded`	`recorded`, `threshold`
`allowed_differences`	no	empty	At most 256 bytes per entry. Matches a difference path or explanation.
`expected_changes`	no	empty	At most 64 approvals.

Each expected_changes item:

Field	Required	Bounds
`id`	yes	Non-empty, at most 128 bytes.
`paths`	yes	1 to 64 paths; each non-empty and at most 256 bytes.
`reason`	yes	Non-empty, at most 1,024 bytes.
`expires_at`	yes	RFC 3339 timestamp.
`commit`	yes	Non-empty, at most 256 bytes.
`reviewer`	yes	Non-empty, at most 256 bytes.

`cc`

See Continuous Compliance for the product meaning. Fields:

Field	Required when `enabled`	Default	Meaning
`enabled`	yes (must be `true` to evaluate)	`false`	Hosted CC only runs when true.
`profile`	yes	empty	Framework profile for this service.
`profiles`	no	empty	Additional profiles. Each must use `technical_subset` coverage.
`controls`	yes	empty	At least one control. Duplicate `id` values fail closed.

`cc.profile`

Field	Required when CC is enabled	Default	Meaning
`framework`	yes	unset	Framework id from `drc signal cc frameworks`.
`version`	yes	unset	Pinned framework version string.
`coverage`	no	`technical_subset`	Must be `technical_subset`.
`environment`	no	unset	Non-empty label, at most 128 bytes.
`scope`	no	`{}`	JSON object. Service, repository, and data classification belong here.

Control framework and framework_version must match this profile.

Team includes technical-subset profiles for SOC 2, ISO 27001, and CIS Controls v8. PCI DSS, HIPAA, and GDPR require the matching compliance pack.

`cc.controls[]`

Field	Required	Default	Meaning
`id`	yes	—	Control id; same character rules as service names.
`framework`	yes	—	Must equal `cc.profile.framework`.
`framework_version`	no	profile version	When set, must equal `cc.profile.version`.
`title`	yes	—	Non-empty, at most 512 bytes.
`owner`	yes	—	Non-empty, at most 128 bytes.
`interval_seconds`	no	`86400`	1 through 31,536,000.
`test_kind`	no	`evidence_lineage`	Runnable kinds: `evidence_lineage`, `execution_integrity`.
`premium_pack`	no	unset	Pack id when the control is not included, at most 128 bytes.
`required_checks`	no	checks for `evidence_lineage`	Must be exactly the server list for `test_kind`.
`required_evidence`	no	`[signed_evidence]`	At most 32 unique names, each at most 128 bytes.
`scope`	no	profile scope	JSON object, or omit to inherit the profile scope.
`source_integration_id`	no	unset	Optional integration id. Runnable kinds do not require it.
`detector_config`	no	`{}`	JSON object.

Runnable test_kind values and exact checks:

`test_kind`	`required_checks`
`evidence_lineage`	`evidence_present`, `evidence_signed`, `lineage_complete`
`execution_integrity`	`manifest_finalized`, `events_committed`, `replay_reference`

Any other test_kind fails closed. Listed controls are validated even when cc.enabled is false. Do not copy a hosted catalog entry into YAML until drc signal cc check accepts it.

`cache`

Field	Required	Default	Meaning
`enabled`	no	`false`	Restore listed paths in CI.
`paths`	no	empty	Relative cache paths, at most 32 entries.
`dependencies`	no	empty	Relative dependency paths, at most 32 entries.

Each path is at most 512 bytes, must be relative, and must not contain ... Caches accelerate the runner. They are not evidence and are not compliance records.

Example


version: 1
project:
  name: payments-platform
services:
  checkout-api:
    path: services/checkout-api
    run:
      command: ./scripts/test-checkout.sh
      working_directory: services/checkout-api
      timeout_seconds: 3600
    cv:
      enabled: true
      execution_mode: self_hosted
      environment: staging
      comparison:
        outputs: strict
        errors: strict
        side_effects: strict
        resources: recorded
        allowed_differences: []
    cc:
      enabled: true
      profile:
        framework: iso27001
        version: "2022"
        coverage: technical_subset
        environment: staging
        scope:
          service: checkout-api
          repository: acme/payments-platform
      controls:
        - id: A.8.15
          framework: iso27001
          framework_version: "2022"
          title: Logging evidence lineage
          owner: platform
          test_kind: evidence_lineage
          required_checks: [evidence_present, evidence_signed, lineage_complete]
          required_evidence: [signed_evidence]
    cache:
      enabled: true
      paths: [.drc/cache]

Validate with drc signal and drc signal cc check. Then run Continuous Verification with drc signal checkout-api and Continuous Compliance with drc signal cc sync and drc signal cc run checkout-api.