Three working instruments carry Compliance by Construction from evidence to enforcement. None of them is the product. The method is an operating model of people, patterns, and decision rights; the tooling is the accelerant.
A skill that runs inside your organization's own AI coding tools, against each significant repository, and produces a short container-level architecture summary: what the system is, its deployable units, every integration with its style, data flows, third parties, and the contradictions between what the code does and what the documents claim. It is bounded by design: it refuses implementation detail, schemas, and configuration, because those are below the ceiling of what architecture governance assesses.
Source code never leaves your environment; only the summaries travel. Code is the one witness that cannot be aspirational, and the extracts become the ground truth every other piece of evidence gets checked against.
The answer to the cold-start problem. Most organizations have nothing codified, which is exactly why they need the method most. The bootstrapper ingests what already exists: design documents, review-board minutes, structured interview notes, the legacy standards binder, and the bounded extracts. From that evidence it drafts corpus v0: pattern candidates with their observed instances and the engineers who built them, standards candidates ranked by what violations have already cost, a draft estate inventory, and a gap report of stated-versus-actual contradictions. Every claim cites its source. Humans curate; the machine drafts. Nothing becomes a rule because a machine said so.
One boundary is enforced in code, not policy: the disposition firewall. Lines describing anyone's attitude, alliance, or politics are excluded before the model ever sees them and are never stored. The instrument takes decision rights, frictions, and architecture facts. It is constitutionally incapable of holding a political map.
In testing against a synthetic bank's evidence pack, it recovered the working patterns with their authors, ranked core-access control first on incident evidence, and caught every planted contradiction, including a "contained" system quietly growing new integrations.
The instrument that runs forever. Business requirements go in; a solution design comes out, composed from the ratified patterns, reusing the existing estate, bounded to container level, with a line-by-line traceability matrix proving which standard each decision satisfies. Where a requirement genuinely cannot conform, the generator does not hide it and does not silently comply: it surfaces the exception, classifies it, and prices the mitigation options for the review board to adjudicate. The board receives evidence, not homework.
In the reference demonstration: fifteen standards assessed, fourteen conformant by construction, one exception routed to human judgment with mitigations costed. Seconds, against a nineteen-day baseline. And when it invented something clever that no pattern covered, the method's answer was built in: the invention was surfaced as a candidate pattern for human ratification, not silently adopted.
The playbook shows where each instrument enters the ninety days, and why the tooling stays holstered until the practice has earned its place.