Specialist Packs
A Specialist Pack adds domain expertise to the crew. Today every Specialist Pack is a specialist agent: an agent the Coordinator consults during a gap analysis, which returns findings grounded in your declared stack. There are two.
| Specialist | What it covers | Tier |
|---|---|---|
| Baseline Security | Image scanning, SAST/SCA, secret scanning, SBOM and signing | Every tier |
| SOC 2 | SOC 2 control families CC1 through CC9, with evidence hints | Included from Developer |
No Specialist Pack Rego bundles ship yet. Specialists advise; they do not add rules to the policy gate. The only rules your proposals are judged against are the constitution and any overlay rules you run yourself. HIPAA, PCI, FedRAMP, and ITIL are coming soon.
When specialists run
Specialists run during a gap analysis, not during a code analysis or a
proposal. Start one from Gap analyses, or type /gaps in the Workspace
chat. The Coordinator decides which specialists are in scope and consults
them; the chat shows each consultation and reply as its own turn.
A finding can be remediated from the gap report, which creates a proposal that goes through the same validation, policy gate, and human review as any other. See Proposal lifecycle.
Baseline Security
Consults on the four security tooling categories of your
environment profile: image_scanning,
sast_sca, secret_scanning, and sbom_signing. Returns findings with a
severity and tool candidates that fit what you already run. Included at every
tier.
SOC 2
Returns findings mapped to a SOC 2 control family and control ID (for example CC8.1), with the related tooling categories and hints about what evidence an auditor would ask for.
The Compliance page shows, per SOC 2 control, how much evidence your
TruStacks activity has produced. It deliberately shows counts, not pass or
fail: whether a control is met is your auditor’s call. Audit reports
(#/audit) exports that evidence as JSON or PDF on demand, with a SHA-256
digest in the header. Reports are not signed.
Tier gating while billing is off. SOC 2 is included from the Developer tier. While billing is not configured on hosted TruStacks, the gate is not enforced and SOC 2 is available to every workspace.
Coming soon
HIPAA, FedRAMP, PCI, and ITIL specialists. When regulatory packs ship they may include Rego rules alongside the agent, curated by TruStacks so the mapping to each control holds up in an audit. Nothing here is available today, and the shape may change before it is.
Where to go next
- Maturity scoring · how gap analyses become a score
- Constitution · the rules every proposal is judged against
- Architecture · where the crew runs