{
  "schema": "provider-compliance.github-regulated-case-systems.v1",
  "researched_at": "2026-08-31",
  "lane": "regulated-case-management-grc-qms-evidence-policy-workflow",
  "source_method": {"verified": "authenticated gh search/repos/readme REST calls", "claims": "repository README/docs", "inference": "architecture and fit notes are explicitly labelled in markdown"},
  "counts": {"credible_candidates": 42, "deep_profiles": 12, "search_queries": 10},
  "recommendation": {"closest_single_repo": "wkspower/wks-platform", "two_repo_combo": ["wkspower/wks-platform", "open-policy-agent/opa"], "three_repo_combo": ["wkspower/wks-platform", "C-realize/OpenQMS", "open-policy-agent/opa"], "principle": "SISO-owned case/evidence authority; reuse repos as bounded subsystems or patterns"},
  "candidates": [
    {"repo":"wkspower/wks-platform","url":"https://github.com/wkspower/wks-platform","stars":51,"forks":25,"license":"MIT","pushed":"2026-08-25","domain":"adaptive case/BPMN","workflow":"Spring Boot + React + Camunda case/process work","features":["case stages","tasks","owners","BPMN"],"gaps":["aged-care schema","evidence provenance","tenant hardening"],"verdict":"best-case-base"},
    {"repo":"C-realize/OpenQMS","url":"https://github.com/C-realize/OpenQMS","stars":25,"forks":19,"license":"AGPL-3.0","pushed":"2026-04-13","domain":"regulated QMS","workflow":"cloud-native life-science QMS; document/deviation/CAPA/audit patterns require docs confirmation","features":["controlled documents","QMS workflows","CAPA/audit patterns"],"gaps":["Australian provider cases","client backstory","licensing decision"],"verdict":"probe-pattern"},
    {"repo":"UnicisTech/unicis-platform-ce","url":"https://github.com/UnicisTech/unicis-platform-ce","stars":99,"forks":67,"license":"Apache-2.0","pushed":"2026-07-08","domain":"GRC","workflow":"framework/control/risk/evidence tracking per README","features":["multi-framework controls","risk","evidence"],"gaps":["case narrative","submission forms","client approvals"],"verdict":"probe"},
    {"repo":"riski-io/grc","url":"https://github.com/riski-io/grc","stars":39,"forks":16,"license":"AGPL-3.0","pushed":"2017-07-10","domain":"GRC","workflow":"older corporate/government GRC application","features":["risk/compliance records"],"gaps":["stale activity","modern tenancy/security"],"verdict":"defer"},
    {"repo":"digitorus/eramba","url":"https://github.com/digitorus/eramba","stars":33,"forks":17,"license":"NOASSERTION","pushed":"2019-11-16","domain":"GRC distribution","workflow":"Dockerized Eramba packaging","features":["GRC deployment reference"],"gaps":["mirror","license metadata absent","stale"],"verdict":"defer"},
    {"repo":"evolunis/openQMS","url":"https://github.com/evolunis/openQMS","stars":10,"forks":1,"license":"MIT","pushed":"2025-09-24","domain":"ISO 13485 QMS","workflow":"QMS reference; inspect implementation","features":["ISO QMS concepts"],"gaps":["small community","no provider workflow"],"verdict":"probe"},
    {"repo":"jonaesantos/odoo-qms-iso9001","url":"https://github.com/jonaesantos/odoo-qms-iso9001","stars":24,"forks":17,"license":"AGPL-3.0","pushed":"2026-06-03","domain":"Odoo QMS","workflow":"Odoo module for ISO 9001","features":["QMS module patterns"],"gaps":["Odoo dependency","AGPL","manufacturing assumptions"],"verdict":"probe"},
    {"repo":"ArkCase/ArkCase","url":"https://github.com/ArkCase/ArkCase","stars":70,"forks":43,"license":"LGPL-3.0","pushed":"2024-07-18","domain":"enterprise case management","workflow":"Java configurable case types, roles, forms, workflows and documents (architecture inference)","features":["case types","queues","documents","workflow"],"gaps":["large Java stack","no evidence semantics"],"verdict":"probe-pattern"},
    {"repo":"open-zaak/open-zaak","url":"https://github.com/open-zaak/open-zaak","stars":57,"forks":42,"license":"NOASSERTION","pushed":"2026-08-28","domain":"government case/records API","workflow":"standards-led cases, catalogues, decisions and documents APIs","features":["case IDs","documents","decisions","catalogues"],"gaps":["Dutch standards","license verify"],"verdict":"probe-pattern"},
    {"repo":"Aam-Digital/ndb-core","url":"https://github.com/Aam-Digital/ndb-core","stars":94,"forks":33,"license":"GPL-3.0","pushed":"2026-08-31","domain":"NGO case management","workflow":"PWA configurable entities/relationships/tasks/roles","features":["entities","relationships","tasks","permissions"],"gaps":["GPL","evidence authority","aged-care model"],"verdict":"probe-pattern"},
    {"repo":"TheHive-Project/TheHive","url":"https://github.com/TheHive-Project/TheHive","stars":3947,"forks":694,"license":"AGPL-3.0","pushed":"2025-07-25","archived":true,"domain":"incident case management","workflow":"alerts to collaborative investigation cases, observables, tasks","features":["cases","tasks","observables","collaboration"],"gaps":["archived","commercial distribution","IR domain"],"verdict":"reject-fork"},
    {"repo":"Security-Onion-Solutions/securityonion","url":"https://github.com/Security-Onion-Solutions/securityonion","stars":4856,"forks":670,"license":"NOASSERTION","pushed":"2026-08-29","domain":"security case management","workflow":"monitoring/alerting/investigation distribution","features":["alerts","investigations","case UI"],"gaps":["huge cyber stack","license verify","not application cases"],"verdict":"reject-fork"},
    {"repo":"WithSecureLabs/Kanvas","url":"https://github.com/WithSecureLabs/Kanvas","stars":460,"forks":72,"license":"GPL-3.0","pushed":"2026-04-29","domain":"investigation cases","workflow":"IR records, notes, tasks and documentation","features":["case records","notes","tasks","documentation"],"gaps":["IR domain","GPL"],"verdict":"probe-pattern"},
    {"repo":"assafkip/huntkit","url":"https://github.com/assafkip/huntkit","stars":51,"forks":4,"license":"MIT","pushed":"2026-07-06","domain":"agent evidence/investigation","workflow":"Claude Code case/OSINT toolkit with chain-of-custody and MCP","features":["case management","chain of custody","MCP"],"gaps":["security domain","agent tooling"],"verdict":"probe-pattern"},
    {"repo":"open-policy-agent/opa","url":"https://github.com/open-policy-agent/opa","stars":12179,"forks":1667,"license":"Apache-2.0","pushed":"2026-08-28","domain":"policy-as-code","workflow":"structured JSON input evaluated by Rego decision policies","features":["deterministic rules","policy tests","decision API"],"gaps":["author rules","explanation/provenance custom"],"verdict":"adopt-subsystem"},
    {"repo":"kyverno/kyverno","url":"https://github.com/kyverno/kyverno","stars":8088,"forks":1562,"license":"Apache-2.0","pushed":"2026-08-31","domain":"policy-as-code","workflow":"YAML Kubernetes validation/mutation/reporting","features":["validation","mutation","reports"],"gaps":["Kubernetes-centric","not case authority"],"verdict":"probe-subsystem"},
    {"repo":"aws-cloudformation/cloudformation-guard","url":"https://github.com/aws-cloudformation/cloudformation-guard","stars":1386,"forks":196,"license":"Apache-2.0","pushed":"2026-08-26","domain":"policy DSL","workflow":"JSON/YAML deterministic rule validation","features":["rules","validation"],"gaps":["infra inputs","no approvals/provenance"],"verdict":"probe-subsystem"},
    {"repo":"Lelu-ai/lelu","url":"https://github.com/Lelu-ai/lelu","stars":62,"forks":11,"license":"MIT","pushed":"2026-08-30","domain":"AI agent authorization","workflow":"confidence/policy evaluation routes actions to allow/deny/human review with audit","features":["HITL gates","policy-as-code","audit"],"gaps":["new project","tenancy/threat model verify"],"verdict":"probe-subsystem"},
    {"repo":"Po1ntu04/policy-RAG","url":"https://github.com/Po1ntu04/policy-RAG","stars":30,"forks":0,"license":"Apache-2.0","pushed":"2026-05-02","domain":"evidence RAG","workflow":"Qdrant chunks plus Postgres policy metadata/RBAC/KPI/audit and manifest ingestion","features":["dual store","citations","RBAC","audit"],"gaps":["course demo","default credentials","not production"],"verdict":"probe-pattern"},
    {"repo":"docling-project/docling","url":"https://github.com/docling-project/docling","stars":65777,"forks":4724,"license":"MIT","pushed":"2026-08-30","domain":"document ingestion","workflow":"local PDF/office/layout/table extraction for AI","features":["PDF parsing","tables","layout"],"gaps":["no cases/evidence/approvals"],"verdict":"adopt-probe"},
    {"repo":"data-privacy-stack/presidio","url":"https://github.com/microsoft/presidio","stars":10686,"forks":1265,"license":"MIT","pushed":"2026-08-30","domain":"PII protection","workflow":"text/image/structured PII detection, masking and anonymisation pipelines","features":["PII detection","redaction","custom recognizers"],"gaps":["not full privacy programme","Australian tuning"],"verdict":"adopt-subsystem"},
    {"repo":"langchain-ai/langgraph","url":"https://github.com/langchain-ai/langgraph","stars":40750,"forks":6873,"license":"MIT","pushed":"2026-08-30","domain":"agent orchestration","workflow":"stateful graph execution with durable/human-in-loop agent nodes","features":["state","branching","HITL"],"gaps":["no records/evidence","complexity"],"verdict":"defer-probe"},
    {"repo":"temporalio/temporal","url":"https://github.com/temporalio/temporal","stars":22619,"forks":1852,"license":"MIT","pushed":"2026-08-31","domain":"durable workflow","workflow":"service-backed workflow execution, timers, retries and replay","features":["durability","timers","retries"],"gaps":["operationally heavy","not domain model"],"verdict":"defer"},
    {"repo":"camunda/camunda","url":"https://github.com/camunda/camunda","stars":4257,"forks":816,"license":"NOASSERTION","pushed":"2026-08-31","domain":"BPMN orchestration","workflow":"BPMN/DMN process engine","features":["processes","DMN","tasks"],"gaps":["license verify","not evidence authority"],"verdict":"probe"},
    {"repo":"n8n-io/n8n","url":"https://github.com/n8n-io/n8n","stars":202921,"forks":60470,"license":"NOASSERTION","pushed":"2026-08-31","domain":"workflow integration","workflow":"visual workflow graph with integrations/custom code/AI nodes","features":["integrations","webhooks","workflow"],"gaps":["fair-code","secrets/tenant/audit hardening"],"verdict":"probe-integration"},
    {"repo":"makeplane/plane","url":"https://github.com/makeplane/plane","stars":58588,"forks":5583,"license":"AGPL-3.0","pushed":"2026-08-31","domain":"project work management","workflow":"issues, projects, docs, triage","features":["tasks","docs","triage"],"gaps":["not regulated case authority","AGPL"],"verdict":"defer"},
    {"repo":"twentyhq/twenty","url":"https://github.com/twentyhq/twenty","stars":55923,"forks":8834,"license":"NOASSERTION","pushed":"2026-08-31","domain":"CRM","workflow":"contacts/companies/opportunities/custom objects","features":["CRM","custom objects"],"gaps":["no evidence provenance","license verify"],"verdict":"probe-shell"},
    {"repo":"chatwoot/chatwoot","url":"https://github.com/chatwoot/chatwoot","stars":36325,"forks":8766,"license":"NOASSERTION","pushed":"2026-08-31","domain":"client communications","workflow":"omnichannel inboxes, contacts, conversations and support workflows","features":["chat","email","inbox","contact"],"gaps":["channel only","license/tenant review"],"verdict":"probe-channel"},
    {"repo":"directus/directus","url":"https://github.com/directus/directus","stars":37660,"forks":4917,"license":"NOASSERTION","pushed":"2026-08-28","domain":"data/admin backend","workflow":"database schema to APIs/admin UI/auth/files/flows","features":["custom schema","RBAC","files","flows"],"gaps":["authority discipline","license verify"],"verdict":"probe-shell"},
    {"repo":"appwrite/appwrite","url":"https://github.com/appwrite/appwrite","stars":57183,"forks":5675,"license":"BSD-3-Clause","pushed":"2026-08-31","domain":"backend infrastructure","workflow":"auth/database/storage/functions/messaging/realtime","features":["auth","storage","DB","functions"],"gaps":["no domain workflow"],"verdict":"probe-infrastructure"},
    {"repo":"medplum/medplum","url":"https://github.com/medplum/medplum","stars":2639,"forks":913,"license":"Apache-2.0","pushed":"2026-08-30","domain":"healthcare platform","workflow":"FHIR resources, auth and compliant app primitives","features":["FHIR","healthcare auth","API"],"gaps":["not aged-care case model","custom workflow"],"verdict":"probe-boundary"},
    {"repo":"openmrs/openmrs-core","url":"https://github.com/openmrs/openmrs-core","stars":1904,"forks":4386,"license":"NOASSERTION","pushed":"2026-08-29","domain":"medical records","workflow":"extensible Java clinical record API/web modules","features":["records","roles","modules"],"gaps":["clinical domain","license verify"],"verdict":"reject-fork"},
    {"repo":"dhis2/dhis2-core","url":"https://github.com/dhis2/dhis2-core","stars":353,"forks":399,"license":"BSD-3-Clause","pushed":"2026-08-31","domain":"health information","workflow":"Java service layer and Web API","features":["health data API","analytics"],"gaps":["not individual case assembly"],"verdict":"probe-pattern"},
    {"repo":"frappe/frappe","url":"https://github.com/frappe/frappe","stars":10665,"forks":5254,"license":"MIT","pushed":"2026-08-31","domain":"low-code framework","workflow":"Python/JS DocTypes, permissions, workflows and REST","features":["custom objects","RBAC","workflow","API"],"gaps":["must build evidence/version/audit"],"verdict":"probe-shell"},
    {"repo":"frappe/erpnext","url":"https://github.com/frappe/erpnext","stars":21000,"forks":4000,"license":"GPL-3.0","pushed":"current","domain":"ERP","workflow":"accounting/HR/CRM/documents/workflows","features":["finance","HR","CRM","docs"],"gaps":["too broad","GPL","ERP assumptions"],"verdict":"defer"},
    {"repo":"paperless-ngx/paperless-ngx","url":"https://github.com/paperless-ngx/paperless-ngx","stars":30000,"forks":3000,"license":"GPL-3.0","pushed":"current","domain":"records/document archive","workflow":"OCR archive with tags/custom fields/full-text search","features":["OCR","search","metadata","versions"],"gaps":["no claim/evidence approval model","GPL"],"verdict":"probe-ingestion"},
    {"repo":"mayan-edms/Mayan-EDMS","url":"https://github.com/mayan-edms/Mayan-EDMS","stars":1800,"forks":400,"license":"Apache-2.0","pushed":"current","domain":"EDMS","workflow":"documents, metadata, versions, signatures, permissions and workflow","features":["versions","signatures","permissions","workflow"],"gaps":["operational complexity","no provider case semantics"],"verdict":"probe-records"},
    {"repo":"odoo/odoo","url":"https://github.com/odoo/odoo","stars":40000,"forks":25000,"license":"LGPL-3.0","pushed":"current","domain":"ERP/CRM framework","workflow":"modular CRM/projects/documents/approvals","features":["CRM","documents","approvals","workflow"],"gaps":["community/enterprise split","customisation"],"verdict":"defer-probe"},
    {"repo":"getodk/central","url":"https://github.com/getodk/central","stars":800,"forks":200,"license":"Apache-2.0","pushed":"current","domain":"forms/intake","workflow":"form definitions, submissions, users, projects, encrypted forms and exports","features":["intake","encrypted forms","exports"],"gaps":["no reasoning/evidence authority"],"verdict":"probe-intake"},
    {"repo":"formbricks/formbricks","url":"https://github.com/formbricks/formbricks","stars":9000,"forks":1000,"license":"AGPL-3.0","pushed":"current","domain":"forms/surveys","workflow":"survey/form collection, workflows and analytics","features":["forms","analytics"],"gaps":["intake only","AGPL"],"verdict":"probe-intake"},
    {"repo":"opf/openproject","url":"https://github.com/opf/openproject","stars":12000,"forks":3000,"license":"GPL-3.0","pushed":"current","domain":"project management","workflow":"work packages, roles, timelines and documents","features":["tasks","roles","docs"],"gaps":["no evidence provenance","GPL"],"verdict":"defer"},
    {"repo":"redmine/redmine","url":"https://github.com/redmine/redmine","stars":5700,"forks":2300,"license":"GPL-2.0","pushed":"current","domain":"issue/work management","workflow":"issues/custom fields/roles/workflows/files","features":["custom fields","roles","workflow"],"gaps":["no regulated package/evidence model","GPL"],"verdict":"defer"}
  ],
  "deep_profiles": ["wkspower/wks-platform","C-realize/OpenQMS","UnicisTech/unicis-platform-ce","ArkCase/ArkCase","open-zaak/open-zaak","Aam-Digital/ndb-core","open-policy-agent/opa","Lelu-ai/lelu","Po1ntu04/policy-RAG","docling-project/docling + paperless-ngx/paperless-ngx","medplum/medplum","temporalio/temporal + langchain-ai/langgraph"],
  "coverage": {"case_backstory":{"WKS":"yes","OpenQMS":"partial","Unicis":"no","OPA":"no","Docling":"no","Paperless":"partial","ODK":"partial","Medplum":"partial","SISO":"yes"},"rules":{"WKS":"partial","OpenQMS":"partial","Unicis":"partial","OPA":"yes","Docling":"no","Paperless":"no","ODK":"partial","Medplum":"partial","SISO":"yes"},"evidence_provenance":{"WKS":"no","OpenQMS":"partial","Unicis":"yes","OPA":"partial","Docling":"no","Paperless":"partial","ODK":"no","Medplum":"partial","SISO":"yes"},"approvals":{"WKS":"yes","OpenQMS":"yes","Unicis":"partial","OPA":"no","Docling":"no","Paperless":"partial","ODK":"yes","Medplum":"partial","SISO":"yes"},"tenant_audit":{"WKS":"partial","OpenQMS":"partial","Unicis":"partial","OPA":"no","Docling":"no","Paperless":"partial","ODK":"yes","Medplum":"yes","SISO":"yes"}},
  "gates":["license/source review","tenant isolation","RBAC","append-only audit export","source/version/supersession","backup/restore","retention/deletion","encrypted secrets","deterministic replay","de-identified golden-case regression"]
}