Work / Evgraph
Evgraph
Stops governance reviewers stitching Model Cards, approvals and registry entries together by hand.
The problem
The artifacts exist — a Model Card here, an approval ticket there, a registry entry somewhere else. Nothing connects them, so a reviewer rebuilds the same picture by hand every time and cannot show how they reached their conclusion.
Scan
Four adapters read a model card, an approval record, a deployment record and an MLflow registry entry, and assemble them into a single evidence graph. Rules traverse the graph: the model card links to its approval, and the MLflow run links to the deployment. The deployment has no linked approval, so a rule emits a finding at structural certainty citing deployment.json. Certainty runs from structural through consistency and heuristic to interpretive, and is only ever lowered as reasoning becomes less certain, never raised.
How it works
- 01
Point it at what you already have
Adapters read Model Cards, approvals, deployment records, dataset manifests and MLflow registry entries as they are.
- 02
The pieces become one graph
Scattered files link into a single evidence graph, so a claim in a Model Card is connected to the approval and deployment that should support it.
- 03
Rules read the graph, not the files
Deterministic rules traverse it and return findings with citations back into the graph — you always see why, not just a green or red badge.
- 04
Findings never overclaim
Certainty runs STRUCTURAL → CONSISTENCY → HEURISTIC → INTERPRETIVE, and is only ever lowered as reasoning gets softer, never raised.
Engineering notes
- Four packages versioned together — evgraph-core, evgraph-rules, evgraph and evgraph-cli — installable from PyPI on Python 3.10+.
- Rules are pure over the graph: they emit findings without mutating it, so a scan is reproducible and explainable.
- Reporters emit JSON, Markdown, SARIF and OSCAL, so results land in code scanning or a compliance toolchain unchanged.
- Third-party rule packs register through entry points; promotion scans are report-only by default so CI collects evidence without blocking a build.
Trade-offs
Findings over pass/fail stamps
instead of a green or red badge
A badge hides its reasoning. A cited finding can be argued with, which is what a reviewer actually needs.
A library, not a platform
instead of a hosted service
Governance artifacts are sensitive and CI is where the check belongs. Shipping packages means no data leaves and no vendor is in the path.
Report-only promotion scans by default
instead of blocking the build
A tool that breaks CI on day one gets removed on day two. Collecting evidence first lets a team tighten the gate when they trust it.
Evidence
4
packages on PyPI
4
report formats
4
certainty levels
0.1.2
current version