+ );
+}
diff --git a/app/home-poc/_components/Faq.tsx b/app/home-poc/_components/Faq.tsx
new file mode 100644
index 00000000..54f27dcb
--- /dev/null
+++ b/app/home-poc/_components/Faq.tsx
@@ -0,0 +1,40 @@
+/**
+ * FAQ — native accordion (no JS, robust). Real answers sourced from
+ * the trust/audit-chain/objection content.
+ */
+
+const QA = [
+ ['Which frameworks ship today?', 'Eight framework packs ship in the template and policy library now — NDIS Practice Standards, Aged Care Quality Standards, NSQHS, SOC 2, ISO 27001, HIPAA, Essential Eight and more — cross-mapped so one evidence item can satisfy multiple frameworks.'],
+ ['How is the audit log tamper-evident?', 'Each row is HMAC-SHA256 chained to the previous one and the chain top is anchored daily to Sigstore Rekor (an RFC 6962 transparency log). A BEFORE UPDATE OR DELETE trigger plus restrictive RLS reject any mutation — even a service-role admin is stopped by the database, not application code.'],
+ ['Where is our data stored?', 'AU-hosted by default (Sydney region). Additional residency requirements are reviewed during procurement, with a Data Processing Agreement available for legal review.'],
+ ['Can we export our data if we leave?', 'Yes. Evidence, controls, audit trails, and framework mappings export in standard formats (PDF, CSV, JSON). Full data portability is guaranteed.'],
+ ['Do you support SSO and MFA?', 'SAML 2.0 SSO (Okta, Azure AD, Google) and MFA enforcement are available on all plans, with role-based access across four roles and session timeout / IP controls.'],
+ ['How long does audit preparation take?', 'On demand. An auditor bundle — framework summary, SHA-256 evidence references, automation log, score history, and the Rekor-anchored chain top — exports as a single ZIP, rather than days of reconstruction.'],
+] as const;
+
+export function Faq() {
+ return (
+
+
+ FormaOS turns NDIS Practice Standards, Aged Care Quality Standards, and the
+ rest of your obligations into enforced workflows — named owners, blocked
+ failure paths, and an immutable evidence trail that passes review the first time.
+
+ ))}
+
+
+
+ );
+}
diff --git a/app/home-poc/_components/HowItWorks.tsx b/app/home-poc/_components/HowItWorks.tsx
new file mode 100644
index 00000000..6bad191d
--- /dev/null
+++ b/app/home-poc/_components/HowItWorks.tsx
@@ -0,0 +1,49 @@
+import { Reveal } from './Reveal';
+
+/**
+ * The enforced operating loop — verbatim from the production HowItWorks.
+ * Five steps as a heavy numbered ledger; step 03 (enforcement) carries the
+ * red "ENFORCING" badge because that's the load-bearing idea.
+ */
+
+const STEPS = [
+ ['01', 'Define compliance workflow', 'Map the operational process — owners, due dates, evidence, and review points.', false],
+ ['02', 'Assign rules', 'Set what must be present before work can move forward.', false],
+ ['03', 'System enforces execution', 'FormaOS runs checks continuously and blocks incomplete paths.', true],
+ ['04', 'Evidence generated automatically', 'Actions, approvals, timestamps, and context become audit evidence.', false],
+ ['05', 'Audit-ready anytime', 'Export the evidence chain instead of rebuilding it under pressure.', false],
+] as const;
+
+export function HowItWorks() {
+ return (
+
+
+
+ How it works
+
+ From obligation to enforced evidence chain.
+
+
+
+ Compliance as a continuous operating loop — not a document clean-up project
+ before an audit.
+
+
+
+
+
+ {STEPS.map(([n, t, d, enforce]) => (
+
+ {n}
+
+
{t}
+
{d}
+
+ {enforce ? ● Enforcing : }
+
+ ))}
+
+
+
+ );
+}
diff --git a/app/home-poc/_components/Ledger.tsx b/app/home-poc/_components/Ledger.tsx
new file mode 100644
index 00000000..f0d7655f
--- /dev/null
+++ b/app/home-poc/_components/Ledger.tsx
@@ -0,0 +1,126 @@
+'use client';
+
+import { useEffect, useRef, useState } from 'react';
+import { useInView, useReducedMotion } from 'framer-motion';
+
+/**
+ * Terminal-style framework ledger: a monospaced data table that reads like
+ * a compliance trading desk. The aggregate score counts up on view; each
+ * row carries a coverage bar and a live tag. Replaces the usual "trust
+ * strip + posture card" with something data-forward and brutal.
+ */
+
+type Row = {
+ framework: string;
+ controls: string;
+ coverage: number; // %
+ score: number; // %
+};
+
+// Real control counts from the framework registry; scores illustrative,
+// mirroring how /app/compliance/health renders live posture.
+const ROWS: Row[] = [
+ { framework: 'SOC 2 Type II', controls: '61 TSC controls', coverage: 94, score: 94 },
+ { framework: 'ISO 27001', controls: '93 controls', coverage: 88, score: 88 },
+ { framework: 'NDIS Practice', controls: '25 evaluators', coverage: 96, score: 96 },
+ { framework: 'HIPAA', controls: '10 safeguards', coverage: 96, score: 96 },
+ { framework: 'Essential Eight', controls: '8 mitigations', coverage: 93, score: 93 },
+];
+
+function useCountUp(target: number, run: boolean) {
+ const reduce = useReducedMotion();
+ const [v, setV] = useState(reduce ? target : 0);
+ useEffect(() => {
+ if (!run || reduce) {
+ if (reduce) setV(target);
+ return;
+ }
+ let raf = 0;
+ let start: number | null = null;
+ const dur = 1100;
+ const tick = (t: number) => {
+ if (start === null) start = t;
+ const p = Math.min((t - start) / dur, 1);
+ setV(Math.round((1 - Math.pow(1 - p, 3)) * target));
+ if (p < 1) raf = requestAnimationFrame(tick);
+ };
+ raf = requestAnimationFrame(tick);
+ return () => cancelAnimationFrame(raf);
+ }, [run, reduce, target]);
+ return v;
+}
+
+export function Ledger() {
+ const ref = useRef(null);
+ const inView = useInView(ref, { once: true, amount: 0.4 });
+ const agg = useCountUp(94, inView);
+
+ return (
+
+ {/* aggregate readout */}
+
+
+
+ {agg}
+ %
+
+
+ COMPOSITE
+
+ POSTURE
+
+
+
+
+
+ REFRESHED NIGHTLY · 06:00 UTC
+
+
+ ILLUSTRATIVE — NOT A CUSTOMER CLAIM
+
+
+
+
+
+
+
+
Framework
+
Controls
+
Coverage
+
Score
+
Status
+
+
+
+ {ROWS.map((r) => (
+
+
{r.framework}
+
{r.controls}
+
+
+
+
+
+
{r.score}%
+
+ TRACKED
+
+
+ ))}
+
+
+
+ );
+}
diff --git a/app/home-poc/_components/Magnetic.tsx b/app/home-poc/_components/Magnetic.tsx
new file mode 100644
index 00000000..83afb903
--- /dev/null
+++ b/app/home-poc/_components/Magnetic.tsx
@@ -0,0 +1,33 @@
+'use client';
+
+import { motion, useMotionValue, useReducedMotion, useSpring } from 'framer-motion';
+import type { ReactNode } from 'react';
+
+/** Magnetic hover: the child is gently pulled toward the cursor and springs
+ * back on leave. Micro-delight on primary actions. */
+export function Magnetic({ children, strength = 0.35 }: { children: ReactNode; strength?: number }) {
+ const reduce = useReducedMotion();
+ const x = useMotionValue(0);
+ const y = useMotionValue(0);
+ const sx = useSpring(x, { stiffness: 220, damping: 14 });
+ const sy = useSpring(y, { stiffness: 220, damping: 14 });
+
+ if (reduce) return {children};
+
+ return (
+ {
+ const r = e.currentTarget.getBoundingClientRect();
+ x.set((e.clientX - (r.left + r.width / 2)) * strength);
+ y.set((e.clientY - (r.top + r.height / 2)) * strength);
+ }}
+ onMouseLeave={() => {
+ x.set(0);
+ y.set(0);
+ }}
+ >
+ {children}
+
+ );
+}
diff --git a/app/home-poc/_components/ObjectionHandling.tsx b/app/home-poc/_components/ObjectionHandling.tsx
new file mode 100644
index 00000000..277cb76d
--- /dev/null
+++ b/app/home-poc/_components/ObjectionHandling.tsx
@@ -0,0 +1,74 @@
+import { Reveal } from './Reveal';
+
+/** Enterprise procurement: the four objections + the evaluation path + the
+ * buyer-facing artifacts that ship on day one. Verbatim from production. */
+
+const OBJ = [
+ ['How do we complete security review before sign-off?', 'A security review packet — architecture overview, DPA, and vendor questionnaire material — so your team starts immediately.', 'Security packet included'],
+ ['Where is our data stored?', 'AU-hosted by default. Additional residency is reviewed during procurement, with a DPA available for legal review.', 'Data sovereignty controls'],
+ ['Can we get our data out if we leave?', 'Evidence, controls, audit trails, and framework mappings export in standard formats. Full portability, guaranteed.', 'Full data portability'],
+ ['Does it work across multiple sites?', 'Multi-entity and multi-site management is core, with centralized oversight and local accountability per site.', 'Multi-entity by design'],
+] as const;
+
+const PATH = [
+ ['01', 'Start buyer review', 'Bring security, compliance, procurement, and operations into a guided evaluation from day one.'],
+ ['02', 'Run security review in parallel', 'Use the security packet and trust-center artifacts while teams validate implementation fit.'],
+ ['03', 'Close with defensible proof', 'Present ownership trails, evidence chains, and readiness posture for approval without rework.'],
+] as const;
+
+const ARTIFACTS = [
+ 'Security review packet', 'Trust center documents', 'Framework mapping overview',
+ 'DPA & data residency docs', 'Access & identity model', 'Enterprise service terms',
+];
+
+export function ObjectionHandling() {
+ return (
+
+
+
+ Enterprise ready
+
+ From evaluation to procurement, no blockers.
+
+
+
+ Ships with the trust artifacts, security documentation, and buyer-facing proof
+ procurement teams need on day one.
+
+ );
+}
diff --git a/app/home-poc/_components/Ticker.tsx b/app/home-poc/_components/Ticker.tsx
new file mode 100644
index 00000000..b11b5d2a
--- /dev/null
+++ b/app/home-poc/_components/Ticker.tsx
@@ -0,0 +1,66 @@
+/**
+ * Bloomberg-style kinetic ticker. Two strips scrolling opposite directions;
+ * the top runs live framework posture, the bottom runs the operating creed.
+ * Pure CSS animation (robust, no JS), pauses on reduced-motion via CSS.
+ */
+
+// Real framework packs shipping today (from FrameworkTrustStrip).
+const POSTURE = [
+ 'NDIS PRACTICE STANDARDS',
+ 'AGED CARE QUALITY STANDARDS',
+ 'NSQHS STANDARDS',
+ 'AHPRA',
+ 'ASIC s912A',
+ 'APRA CPS 230',
+ 'AUSTRAC AML/CTF',
+ 'ISO 27001',
+ 'SOC 2',
+ 'HIPAA',
+ 'GDPR',
+ 'NIST CSF',
+ 'ESSENTIAL EIGHT',
+];
+
+const CREED = [
+ 'NAMED OWNERS',
+ 'IMMUTABLE EVIDENCE',
+ 'CONTINUOUS POSTURE',
+ 'AU-HOSTED BY DEFAULT',
+ 'BLOCKED FAILURE PATHS',
+ 'NO SPREADSHEETS',
+];
+
+export function Ticker() {
+ return (
+
+
+
+ {[0, 1].map((dup) => (
+
+ {POSTURE.map((f) => (
+
+
+ {f}
+
+ ))}
+
+ ))}
+
+
+
+
+ {[0, 1].map((dup) => (
+
+ {CREED.map((c) => (
+
+ {c}
+ /
+
+ ))}
+
+ ))}
+
+
+
+ );
+}
diff --git a/app/home-poc/_components/TrustWall.tsx b/app/home-poc/_components/TrustWall.tsx
new file mode 100644
index 00000000..1a666ba5
--- /dev/null
+++ b/app/home-poc/_components/TrustWall.tsx
@@ -0,0 +1,50 @@
+import { Reveal } from './Reveal';
+
+/**
+ * Framework coverage wall + the production infrastructure FormaOS is built on.
+ * Static, structured proof (the ticker is the kinetic counterpart).
+ */
+
+const FRAMEWORKS = [
+ 'NDIS Practice Standards', 'Aged Care Quality', 'NSQHS Standards', 'AHPRA',
+ 'ASIC s912A', 'APRA CPS 230', 'AUSTRAC AML/CTF', 'ACECQA NQF',
+ 'WHS Act', 'ISO 27001', 'SOC 2', 'GDPR',
+ 'NIST CSF', 'PCI DSS', 'HIPAA', 'CIS Controls',
+ 'ISO 9001', 'Essential Eight',
+];
+
+const BUILT_ON = ['Vercel', 'Supabase', 'Stripe', 'Sentry', 'Resend'];
+
+export function TrustWall() {
+ return (
+
+
+
+ Framework coverage
+
+ Eighteen packs. One evidence model.
+
+
+
+ Australian regulatory coverage and international standards, shipping today in the
+ template and policy library — cross-mapped so one evidence item satisfies many.
+
+
+
+
+
+ {FRAMEWORKS.map((f) => (
+
{f}
+ ))}
+
+
+
+
+ Built on production infrastructure
+ {BUILT_ON.map((b) => (
+ {b}
+ ))}
+
+
+ );
+}
diff --git a/app/home-poc/_components/UseCases.tsx b/app/home-poc/_components/UseCases.tsx
new file mode 100644
index 00000000..3043378d
--- /dev/null
+++ b/app/home-poc/_components/UseCases.tsx
@@ -0,0 +1,119 @@
+'use client';
+
+import { useState } from 'react';
+import { AnimatePresence, motion, useReducedMotion } from 'framer-motion';
+
+/**
+ * Interactive use-case scenarios — anonymized, verbatim from production.
+ * Tab list on the left, animated detail on the right.
+ */
+
+const CASES = [
+ {
+ org: 'NDIS Provider',
+ framework: 'NDIS Practice Standards · all 8 modules',
+ challenge: 'Reportable incidents tracked in spreadsheets; Commission audits required days of reconstruction across multiple sites.',
+ outcomes: [
+ 'Reportable-incident response inside the 24h immediate / 5 business-day detailed timelines',
+ 'Audit preparation time measured in hours, not weeks',
+ 'Named control owner at every Practice Standard module',
+ ],
+ },
+ {
+ org: 'Healthcare Operator',
+ framework: 'NSQHS Standards · AHPRA · RACGP',
+ challenge: 'Clinical governance controls existed on paper, but proof was inconsistent across sites; practitioner registration tracked manually.',
+ outcomes: [
+ 'AHPRA registration expiry alerts at 90 / 60 / 30 days',
+ 'Control-to-evidence mapping with NSQHS Standards linkage',
+ 'Live executive posture view across sites',
+ ],
+ },
+ {
+ org: 'Aged Care Provider',
+ framework: 'Aged Care Quality Standards · 8 standards',
+ challenge: 'Policy changes were hard to roll out uniformly; periodic reviews slipped without reliable triggers; Standard 8 governance reporting consumed executive time.',
+ outcomes: [
+ 'Policy review cadence enforced with automated task triggers',
+ 'Evidence renewal and expiry tracking across all facilities',
+ 'Standard 8 governance reporting compressed from weeks to days',
+ ],
+ },
+ {
+ org: 'Financial Services',
+ framework: 'ISO 27001 · APRA CPS 234 · AML/CTF',
+ challenge: 'Third-party risk grew with fintech partnerships, but control ownership and evidence collection remained manual; ASIC breach reporting relied on email threads.',
+ outcomes: [
+ 'APRA CPS 234 control mapping with named owners and evidence trails',
+ 'ASIC reportable-situation response inside the statutory window',
+ 'Board governance packs generated from live data, not reconstructed',
+ ],
+ },
+];
+
+export function UseCases() {
+ const [active, setActive] = useState(0);
+ const reduce = useReducedMotion();
+ const c = CASES[active];
+
+ return (
+
+
+
+ Use-case scenarios
+
+ How regulated teams operate with FormaOS.
+
+
+
+ Anonymized scenarios from regulated organizations. Outcomes reflect conditions at
+ the time of deployment.
+
+
+
+
+
+ {CASES.map((cs, i) => (
+
+ ))}
+
+
+
+
+
+ The challenge
+
+
{c.challenge}
+
+ What changed
+
+
+ {c.outcomes.map((o) => (
+
{o}
+ ))}
+
+
+
+
+
+
+ ANONYMIZED · WE CAN WALK THROUGH FULL DEPLOYMENTS DURING EVALUATION
+
+
+ );
+}
diff --git a/app/home-poc/layout.tsx b/app/home-poc/layout.tsx
new file mode 100644
index 00000000..839ebaad
--- /dev/null
+++ b/app/home-poc/layout.tsx
@@ -0,0 +1,47 @@
+import type { Metadata } from 'next';
+import { Archivo, Spline_Sans_Mono } from 'next/font/google';
+import './poc.css';
+
+/**
+ * Brutalist-editorial type system.
+ * — Archivo (variable, incl. width axis) carries the whole grotesque voice:
+ * pushed to Black + Expanded it gives monumental poster headlines without
+ * the Inter/Sora/Fraunces "AI default" tell.
+ * — Spline Sans Mono is the technical metadata voice (mastheads, ledgers,
+ * coordinates, callouts).
+ *
+ * PRODUCTION UPGRADE: swap --bru-sans for a licensed grotesque (GT America /
+ * Söhne / ABC Diatype) and the display face for Druk Wide — one var change in
+ * poc.css. Stand-ins here are the closest self-hostable equivalents.
+ */
+const archivo = Archivo({
+ subsets: ['latin'],
+ display: 'swap',
+ variable: '--bru-sans',
+ weight: 'variable',
+ axes: ['wdth'],
+});
+
+const mono = Spline_Sans_Mono({
+ subsets: ['latin'],
+ display: 'swap',
+ variable: '--bru-mono',
+ weight: ['400', '500', '700'],
+});
+
+export const metadata: Metadata = {
+ title: 'FormaOS — Homepage POC (Brutalist-Editorial)',
+ robots: { index: false, follow: false },
+};
+
+export default function HomePocLayout({
+ children,
+}: {
+ children: React.ReactNode;
+}) {
+ return (
+
+ {children}
+
+ );
+}
diff --git a/app/home-poc/page.tsx b/app/home-poc/page.tsx
new file mode 100644
index 00000000..a90d7444
--- /dev/null
+++ b/app/home-poc/page.tsx
@@ -0,0 +1,489 @@
+import { Reveal } from './_components/Reveal';
+import { Atmosphere } from './_components/Atmosphere';
+import { PostureSimulator } from './_components/PostureSimulator';
+import { Schematic } from './_components/Schematic';
+import { DashboardPreview } from './_components/DashboardPreview';
+import { Ticker } from './_components/Ticker';
+import { CountUp } from './_components/CountUp';
+import { HeroIntro } from './_components/HeroIntro';
+import { TrustWall } from './_components/TrustWall';
+import { HowItWorks } from './_components/HowItWorks';
+import { SecurityGrid } from './_components/SecurityGrid';
+import { UseCases } from './_components/UseCases';
+import { ObjectionHandling } from './_components/ObjectionHandling';
+import { Faq } from './_components/Faq';
+import { SiteFooter } from './_components/SiteFooter';
+import { StickyCTA } from './_components/StickyCTA';
+
+export const dynamic = 'force-static';
+
+const CONVICTION = [
+ {
+ step: 'For operators',
+ title: 'Controls run as workflows, not documents',
+ body: 'Named tasks, approval gates, and evidence chains execute inside daily operations — not in a separate compliance layer.',
+ cta: 'See how it works',
+ href: '/product',
+ },
+ {
+ step: 'For enterprise buyers',
+ title: 'One flow from security review to rollout',
+ body: 'Identity controls, audit exports, hosting posture, and procurement artifacts stay in a single narrative buyers can verify.',
+ cta: 'See enterprise path',
+ href: '/enterprise',
+ },
+ {
+ step: 'For security reviewers',
+ title: 'Trust evidence is visible before the first call',
+ body: 'Trust documentation, evidence defensibility, and review-ready context surface early so reviewers can verify substance upfront.',
+ cta: 'Visit trust center',
+ href: '/trust',
+ },
+];
+
+const ENGINE = [
+ ['Obligation', 'Framework requirements mapped to controls'],
+ ['Control', 'Ownership and review cadence assigned'],
+ ['Task', 'Work routed to the accountable owner'],
+ ['Evidence', 'Artifacts linked and sealed to the control'],
+ ['Audit', 'Complete, exportable compliance trail'],
+];
+
+const CAPS = [
+ ['Automation Engine', 'Triggers for evidence, tasks, policies, and certifications with auto-task generation and escalation.'],
+ ['Evidence Vault', 'Every upload, review, and approval tracked with full audit-trail context and chain of custody.'],
+ ['8 Framework Packs', 'SOC 2, ISO 27001, GDPR, HIPAA, PCI-DSS, NIST CSF, CIS, NDIS Practice Standards & Essential Eight — pre-built.'],
+ ['Compliance Gates', 'Block non-compliant actions before they happen with real-time validation and enforcement.'],
+ ['Executive Dashboard', 'C-level visibility into posture, framework health, risk trends, and control ownership.'],
+ ['Multi-Site Operations', 'Each entity keeps its own controls and evidence with cross-site rollup for executive governance.'],
+ ['REST API + Webhooks', 'API v1 for compliance data, evidence uploads, and task management. Webhooks for SIEM and tooling.'],
+ ['AI Compliance Assistant', 'Context-aware AI drafts policies, runs gap analysis, and gives steps — powered by your live org data.'],
+];
+
+const PILLARS = [
+ {
+ tag: 'Tamper-evident by construction',
+ h: 'HMAC-chained rows',
+ body: 'Each row carries a sequence number and an HMAC-SHA256 signature linking it to the previous row. A nightly cron re-walks the chain; any drift surfaces as a chain-integrity break before the next audit.',
+ },
+ {
+ tag: 'Verifiable without trusting us',
+ h: 'External anchor at 05:30 UTC',
+ body: 'Daily, each org’s chain top is submitted to Sigstore Rekor as an RFC 6962 Merkle entry. An auditor can verify the timestamp of any event through Linux Foundation infrastructure — not ours.',
+ },
+ {
+ tag: 'Immutable, even to platform admins',
+ h: 'Append-only at the database',
+ body: 'A BEFORE UPDATE OR DELETE trigger rejects any mutation of audit rows, backed by restrictive RLS deny policies. Even a service-role admin that bypasses RLS is stopped by the trigger. Enforced by Postgres, not app code.',
+ },
+];
+
+const FACTS = [
+ ['HMAC-SHA256', 'Row signature'],
+ ['RFC 6962', 'Merkle proof'],
+ ['05:30 UTC', 'Daily anchor'],
+ ['Append-only', 'DB trigger + RLS'],
+ ['Sigstore Rekor', 'External log'],
+];
+
+const INDUSTRIES: Array<{ name: string; tags: string[]; href: string }> = [
+ { name: 'Healthcare', tags: ['HIPAA', 'RACGP', 'AHPRA', 'NSQHS'], href: '/healthcare-compliance' },
+ { name: 'NDIS Providers', tags: ['Practice Standards', 'Q&S Commission'], href: '/ndis-providers' },
+ { name: 'Mental Health', tags: ['NSMHS', 'Restrictive Practices'], href: '/mental-health-compliance' },
+ { name: 'Financial Services', tags: ['SOC 2', 'ISO 27001', 'ASIC', 'APRA CPS 230'], href: '/financial-services-compliance' },
+ { name: 'Education', tags: ['TEQSA', 'ASQA', 'RTO', 'VRQA'], href: '/industries' },
+ { name: 'Government', tags: ['ISM', 'PSPF', 'Essential Eight', 'FOI'], href: '/use-cases/government-public-sector' },
+];
+
+const BA = [
+ {
+ impact: 'Auditor bundle, on demand',
+ before: 'Evidence scattered across email threads, shared drives, and spreadsheets. Days lost reconstructing trails.',
+ after: 'On-demand ZIP export: framework summary, evidence references with SHA-256 hashes, automation log, score history, chain top anchored to Sigstore Rekor.',
+ tag: 'Hash-chained',
+ },
+ {
+ impact: 'Statutory clock, automated',
+ before: 'Email threads, ad-hoc severity tagging, statutory timelines tracked by memory.',
+ after: 'org_incidents writes carry severity, named owner, and the NDIS SIRS 24h-immediate / 5-business-day-detailed clock encoded in the predicate.',
+ tag: '24h / 5bd',
+ },
+ {
+ impact: 'Refreshed nightly',
+ before: 'Manual status reconciliation. The board gets a stale quarterly snapshot. Drift surfaces too late.',
+ after: 'Nightly cron at 06:00 UTC writes org_control_evaluations; /app/compliance/health renders live posture with a 4-week sparkline.',
+ tag: 'Cron-driven',
+ },
+];
+
+const STATS = [
+ ['8', 'Framework packs'],
+ ['252', 'Controls mapped'],
+ ['102', 'Auto-evaluated'],
+ ['150', 'Manual attestations'],
+ ['16', 'Production crons'],
+];
+
+export default function HomePocPage() {
+ return (
+
+
+
+ {/* ========== MASTHEAD ========== */}
+
+
+ Other tools store documents. FormaOS enforces the program — so posture moves
+ the moment a control does. Try it: toggle controls and watch it recompute.
+
+ Every org’s audit log is hash-chained, RLS-locked against mutation, and anchored
+ daily to Sigstore Rekor — the same transparency log the Linux Foundation runs for
+ signed open-source releases.
+