DOCSEARCHbyAlgolia
Submit Docs

FINOS Architecture as Code (AasC)

repository·main·Indexed 18 days ago

https://github.com/finos/architecture-as-code

A framework providing the Common Architecture Language Model (CALM) to manage software architecture via version-controlled, machine-readable code. It includes a CLI, VSCode plugins, and AI integration tools for automating prompt generation for providers like GitHub Copilot, AWS Kiro/Q, and Codex. The repository also features CALMGuard, a multi-agent AI pipeline (including Scout, Ranger, Arsenal, and Sniper agents) designed to analyze CALM architectures for compliance, risk assessment, and CI/CD pipeline generation.

Tokens
368.1K
Snippets
958
Records
1.5K
Agent score
59%

What's inside Architecture as Code

  1. Overview of CALM Core Concepts

    main

    CALM (Architecture as Code) allows you to define and manage software architecture through a structured model. The system is built upon several key abstractions that allow you to represent complex systems as code:

    • Nodes: The primary building blocks of your architecture.
    • Relationships: The connections and interactions between nodes.
    • Interfaces: The specific interaction points exposed by nodes.
    • Controls: Domain-specific constraints applied to your architecture.
    • Standards: Organizational requirements that extend CALM components.
    • Timelines: Mechanisms to track architectural evolution through significant moments.
    • Decorators: Supplementary information (e.g., deployments, security context, business metadata) attached to architecture elements.
    • Metadata: Additional information used to enrich architecture models.
    • Widgets: Reusable template components used to generate Markdown documentation from architecture models.

  3. Overview of NIST Cybersecurity Framework (CSF) 2.0

    main

    The NIST Cybersecurity Framework (CSF) 2.0 is a risk-based, outcome-focused framework designed to help organizations manage and reduce cybersecurity risk. Unlike prescriptive standards like PCI-DSS or HIPAA, CSF 2.0 is adaptable to an organization's specific risk profile.

    Key Characteristics

    • Target Audience: All organizations, with high relevance to critical infrastructure (financial services, energy, healthcare, transportation) and U.S. federal agencies.
    • Core Structure: The framework is organized into three hierarchical levels:
      1. 6 Functions: High-level cybersecurity outcomes.
      2. Categories: Groups of outcomes within each function (23 total).
      3. Subcategories: Specific outcomes to achieve (106 total).

    Major Changes in CSF 2.0 (vs 1.1)

    • New Function: Added the GOVERN (GV) function, bringing the total to 6 functions.
    • Supply Chain: Expanded focus on supply chain risk management.
    • Context: Enhanced guidance on organizational context and cybersecurity outcomes.
    • Alignment: Improved alignment with ISO 27001, NIST SP 800-53, and CIS Controls.
    • Implementation: Shifted focus from maturity levels to outcomes in implementation tiers.

  5. Overview of CALMGuard

    main

    CALMGuard is a CALM-native continuous compliance platform designed for financial institutions. It automates the assessment of architecture decisions against regulatory frameworks by ingesting FINOS CALM (Common Architecture Language Model) architecture definitions.

    Instead of manual audits, CALMGuard uses a squad of 6 specialized AI agents to analyze machine-readable JSON architecture files in real-time. The platform provides:

    • Real-time AI Analysis: Findings are streamed live as agents work in parallel.
    • Multi-Framework Coverage: Supports SOX, PCI-DSS, NIST-CSF, FINOS CCC, SOC2, and Protocol Security.
    • Visualizations: Includes an Architecture Graph with compliance coloring and a Risk Heat Map for node-level risk assessment.
    • Automated Remediation: Generates security scanning configurations for CI/CD pipelines and provides actionable remediation recommendations.

  6. Overview of FINOS Common Cloud Controls (CCC)

    main

    The FINOS Common Cloud Controls (CCC) project provides a set of cloud-agnostic security and compliance controls designed for financial services organizations. These controls are defined in YAML format and map to major compliance frameworks such as PCI-DSS, SOX, NIST, ISO 27001, and SOC 2.

    CCC is designed to be implemented across major cloud providers (AWS, Azure, GCP) and aims to reduce duplicative compliance efforts by establishing common control definitions that can be validated across multiple frameworks. It is specifically tailored to meet regulatory requirements from bodies like SEC, FINRA, and FFIEC.

  7. What is the Common Architecture Language Model (CALM)?

    main
    The Common Architecture Language Model (CALM) is a specification designed to define system architectures in formats that are both machine-readable and human-readable. It provides a common language for describing architectures, enabling a suite of tools to support the creation, validation, and visualization of these architectural models.

  8. Overview of Architecture as Code (AasC)

    main

    Architecture as Code (AasC) is a methodology and set of tools designed to devise and manage software architecture using a human and machine-readable, version-controlled codebase. This approach fosters a robust understanding, efficient development, and seamless maintenance of complex software architectures.

    The core of this repository is the Common Architecture Language Model (CALM) Specification, along with various capabilities built to utilize that specification.

    To begin using CALM, refer to the CALM tutorials.

  9. Overview of CALM Draft 2026-03

    main

    CALM Draft 2026-03 contains draft schemas and specifications intended for the CALM (Common Architecture Language Model) 1.3 release. This draft specifically introduces the Deployment Decorator Schema, which allows developers to annotate CALM architectures with standardized deployment-related metadata.

    Note: This specification is currently in Draft status and is subject to change.

  10. Introduction to CALM

    main

    CALM (Common Architecture Language Model) is designed to bring consistency, automation, and control to software architecture. It addresses common architectural challenges by providing a structured way to define, validate, and visualize architecture through code.

    To get started with CALM, you should explore the following core areas:

    • What is CALM?: Understanding the fundamental purpose and the problems it solves in software architecture.
    • Why Use CALM?: Learning about the benefits of standardization, automation, and compliance.
    • Key Features: Exploring the technical capabilities such as architectural patterns, validation rules, and visualization tools.

  11. Overview of CALM capabilities

    main

    CALM (Architecture as Code) provides a suite of tools to define, validate, and visualize software architecture. The ecosystem includes tools for AI-assisted modeling, visual design, command-line interaction, and IDE integration.

    Key components include:

    • CALM AI Tools: Support for AI Assistants during architecture modeling.
    • CALM Hub: A visual registry for inspecting architectures, patterns, and compliance controls.
    • CALM Studio: A visual design tool for drawing architecture diagrams that automatically generate validated CALM code.
    • CALM CLI: A command-line interface for generating, validating, and documenting architectures, as well as interacting with the CALM Hub.
    • Validation Server: A standalone HTTP server used for remote CALM architecture validation.
    • Voice Mode: Hands-free interaction with CALM Copilot Chat via voice commands.
    • VS Code Extension: Provides live validation, visualization, and navigation of CALM architectures directly within the editor.

  12. Overview of CALM Hub

    main

    CALM Hub is the central artifact store and API server for the CALM ecosystem. It acts as a versioned, queryable registry for architecture models, patterns, compliance controls, standards, and related assets.

    Key capabilities include:

    • Namespace-scoped storage: Organize architectures, patterns, flows, and ADRs under user-defined namespaces.
    • Version control: Every artifact has an incrementing version history.
    • Flexible storage: Supports MongoDB (production), NitriteDB (standalone/development), or a baked-in read-only database.
    • Access Control: Enforces fine-grained OAuth2 scopes (e.g., architectures:read, architectures:all, namespace:admin).
    • API Access: Provides a RESTful HTTP API, an OpenAPI/Swagger UI at /q/swagger-ui, and an experimental Model Context Protocol (MCP) endpoint at /mcp for AI agents.