30-second answer
Two principles. Every conclusion declares what kind of truth it is, and automation may verify a claim but never strengthen it.
First principle
Every governance conclusion must declare what kind of truth it is.
Governance reports often present requirements, recommendations, conventions and opinions with identical visual weight. A reader cannot tell which statements they are free to disagree with.
This project does not do that. Every rule declares the nature of its claim in
basis, and the report
prints it beside the finding.
Second principle
Automation may verify a claim. It may never strengthen it.
Automation may verify that evidence exists, that required sources are present, that schemas are valid, that documentation links resolve, and that conclusions are reproducible.
Automation must never infer that a recommendation is a requirement, that a convention becomes documented guidance because somebody attached a link, or that missing evidence means compliance.
The third of those is the one that shows up in the output every day. It is why
unknown is a result and never a pass.
Where it runs, and what leaves your machine
The principles above are about what a conclusion means. This is about where the software is and what it touches, which is the other half of the same question and was written down separately from it until now.
Where does it run? On your machine. It is a command-line program you install and start; there is no hosted service, no account with pH7x Systems and no sign-in to us. Nothing about running it involves a system we operate.
What network destinations does it use? Microsoft's, and the ones you point
it at. The Graph reader talks to https://graph.microsoft.com. The PowerShell
collectors talk to the SharePoint endpoints of the tenant URL you supply. There
is no third destination: the schemas it validates against are files inside the
package, read from disk, not fetched.
Where is evidence written? Where you tell it. collect, migration-read
and the report commands all take an explicit output path and write there.
Evidence, findings and reports are files on your filesystem.
What reaches pH7x Systems? Nothing that the software sends. It carries no telemetry, no usage reporting and no licence check. Tenant evidence processed by the software is not transmitted to pH7x Systems by the software. If you choose to send us a report, attached to a question or in a review we do with you, that is you sending it, and it is the only path by which we would see it.
What credentials does pH7x Systems receive? None. Authentication happens between you and Microsoft: the Graph reader never acquires a token, it spends one you supply, and the PowerShell path uses the connection you established with an identity you registered. If anything ever asks you to hand tenant credentials to pH7x Systems in order to run this, it did not come from us.
These are properties of the current version, established by reading what it does rather than by describing what it is for. The open source and security statement says the same thing for the site as a whole.
What every gate proves, and what it does not
Every check in CI is narrower than the sentence people will summarise it as, and the project writes both halves down. Both were learned by watching a gate pass while the thing it guarded failed anyway.
The read-only gate is the clearest case. It parses every file in the collector tree and fails on any mutating verb. What that establishes and what it leaves open is set out in what a read only gate proves.
What an assessment lets a recipient establish
An assessment carries the findings, the evidence they were decided from, the versions that decided them, and digests over all of it.
A recipient runs verify
and establishes that nothing moved, without having this engine and without
trusting whoever sent it. That is why verify is a separate command: a check
that needed the producer would only ever be telling the recipient what the
producer already believes.
Reproducibility is what makes it possible. The clock is read at exactly one boundary and passed as a value, so the same inputs rebuild the same bytes.
Responsibility
The engine does not decide what an organisation should do. It establishes what is observable, what the vendor documents, and where the two differ. The decision, and the risk in it, stay with the people who own the tenant.