Compliance control mapping

Halos is open-source software. It holds no SOC 2 report, no ISO/IEC 27001 certificate and no attestation of any kind, and nothing on this page says otherwise. You are the party that gets audited. This page lists the controls Halos helps you implement and the evidence it produces, so you can point an auditor at a file, a command or a log instead of a promise.

Read it with three limits in mind:

• A row says Halos can produce evidence for a criterion. It does not say that using Halos satisfies the criterion. Whether a control is designed and operating is the auditor’s call, on your environment.
• No auditor or assessor has reviewed this mapping. It was written from the code and the ADRs. The security claims are held by the tests listed in the security model; the rest of the evidence is only as good as how you deploy it.
• Halos has had no third-party penetration test (SECURITY.md, threat model).

Companion pages: data flow and PII inventory and security overview.

Evidence artifacts

The tables below refer to these by name.

Artifact	What it is	How you get it	Verify it
Signed release	Content-addressed OCI artifact: rendered config, manifest, hash-pinned CLI installs, pinned artifacts; ed25519 signature, optional cosign co-signature	halo release build, halo release publish (ADR-0005)	halod verifies before it writes anything; internal/bundle/sign.go
Signed ring pointer	{org, ring, digest, seq, issuedAt, expiresAt}, signed; says which release a ring runs	halo release publish, promote, rollback, refresh (ADR-0008)	internal/bundle/pointer.go; halod status
Audit log hash chain	Append-only audit.jsonl (or Postgres halo_audit); each entry has seq, prev, hash	automatic in halo-server	halo audit verify; GET /api/v1/audit returns verified and head (audit log)
SIEM export	The same entries, in order and at least once, native or OCSF, to Splunk HEC, a signed webhook or syslog over TLS	--audit-config (SIEM export, ADR-0016)	seq gap query in the SIEM; internal/server/audit_export.go
Session ledger	One redacted, identity-linked record per agent session	halo sessions import, then halo sessions list | show | export (session ledger, ADR-0031)	each export says whether the audit chain verified
Promotion PR	The pull request that moves a ring pointer or concludes an experiment; body carries the verdict report	halo exp promote, MCP propose_promotion; internal/promote/pr.go (OpenPR)	the merge is the human approval; git history
Eval scorecard	Pass rates, regression against control, pass@k, cost, per variant	halo eval run --output json; consumed by rollout scorecard gates (internal/policy/rollout.go, ScorecardGate)	internal/eval/scorecard.go (BuildScorecard)
Plan and impact output	What a policy change renders, and who it moves, by unit	halo plan, halo plan --diff <ref> (change governance, ADR-0030)	internal/impact/impact.go (Compute)
AI-BOM	CycloneDX 1.6 BOM: harnesses, rendered files, artifacts, model aliases, MCP servers, remote agents, policy commit	written by halo release build; halo release bom (agent supply chain, ADR-0028)	internal/release/attest.go (VerifyAttestations)
SLSA provenance (your releases)	in-toto Statement v1 with a SLSA provenance v1 predicate, attached to the release as a signed OCI referrer	halo release bom --provenance	same
Halos release evidence	checksums.txt signed with cosign keyless, GitHub build-provenance attestations for archives, SBOMs, cosign-signed images, re-verified by the verify job	release.yml	cosign verify-blob, gh attestation verify (as the verify job runs them)
DLP findings	dlp.secret and dlp.injection audit entries (detector, 8-hex hash, location; never the secret), and counters	gateway.dlp (DLP, ADR-0033)	halo dlp test; SIEM
Rollout and approval state	Per-step gates, approvals with the approver, ticket and change hash, freezes in force	halo rollout status, MCP rollout_status	audit entries for approvals

SOC 2 (2017 Trust Services Criteria)

Criteria are from the AICPA 2017 TSC (with the 2022 points of focus). Common Criteria not listed here (CC1 control environment, CC2 communication, CC3 risk assessment, CC4 monitoring of controls, CC5 control activities, CC6.4 and CC6.5 physical access and disposal) are not something software supplies: see what Halos does not cover.

Criterion	Halos feature	Implemented in	Evidence	Your part
CC6.1 Logical access security over information assets	Gateway verifies the caller’s OIDC JWT (issuer, audience, expiry, RS256/ES256/EdDSA only) and derives cohort from it; client x-halo-* headers stripped; fail-closed model allowlist; console behind OIDC login with a 12-hour HMAC-signed session cookie; every console route in one deny-by-default permission table	internal/identity/oidc.go (AllowedAlgs), internal/gateway/prepare.go (admit), internal/server/rbac.go (routePerms), internal/server/auth.go; ADR-0011, ADR-0015	Audit log hash chain (authz.deny), SIEM export, gateway request log and /metrics	IdP configuration and MFA; TLS termination in front of halo-proxy and halo-server (neither has a TLS listener); network policy
CC6.2 Registration and authorization of users; removal when access ends	SCIM 2.0 provisioning: deactivation ends sessions, revokes device tokens and drops enrollment tokens at once; single-use 15-minute enrollment tokens; device tokens stored as SHA-256 and expiring after 90 days; per-credential revocation for agent and workload credentials	internal/server/scim.go, internal/server/portal.go, internal/server/devices.go (DefaultDeviceTTL), internal/server/revocations.go; ADR-0022, ADR-0023, ADR-0026	Audit entries with actor scim, device enrollment and revocation, credential.revoke; halo agents revocations	The joiner, mover, leaver process that drives the IdP; who may request access
CC6.3 Role-based access, least privilege, segregation of duties	Five roles (viewer, operator, approver, auditor, admin) from IdP groups, recomputed per request; the requester never counts toward an approval quorum; org-unit overlays can tighten, never loosen; halo units codeowners emits the owners file	internal/server/rbac.go, internal/policy/governance.go, internal/policy/unit.go; ADR-0015, ADR-0018, ADR-0030	authz.deny entries; access-request decisions and rollout approvals in the audit log	Periodic access reviews. Halos holds the role and group data; it does not run the review
CC6.6 Protection against threats from outside the system boundary	Gateway fails closed on unknown models, paths and batches; trusted_header only from pinned CIDRs; failed-auth rate limits per endpoint class; signed kill list; egress allowlist and sandbox rendered per harness	internal/gateway/prepare.go, internal/server/auth.go, internal/gateway/killswitch.go; ADR-0009, ADR-0032	Gateway metrics, halo egress test, threat model controls C9 to C11	Network perimeter, WAF, DDoS (Halos does not defend against denial of service)
CC6.7 Restrict transmission, movement and removal of information; protect it in transit	Gateway DLP blocks or redacts secrets in model-call requests and scores injection in tool results; ledger records cannot hold prompt text; shadow pairs optionally AES-256-GCM encrypted; https-only for token-bearing exports and webhooks; Postgres to a remote host requires sslmode=verify-full	internal/gateway/dlp.go, internal/ledger/ledger.go (Validate), internal/shadow/shadow.go, internal/server/audit_export.go, internal/pgstore/pgstore.go (CheckTLS); ADR-0033	dlp.secret audit entries, halo_proxy_dlp_* metrics	TLS in front of the services; endpoint DLP; what developers may paste. DLP is pattern-based and misses unformatted secrets
CC6.8 Prevent or detect unauthorized or malicious software	halod applies only releases that verify against the pinned ed25519 key, installs only hash-pinned artifacts, never runs shell installers by default; skills, plugins and hooks are pinned by digest and statically scanned	internal/bundle/sign.go, cmd/halod/install.go, cmd/halod/paths.go, internal/supplychain/scan.go; ADR-0005, ADR-0028	Signed release, AI-BOM, halo artifact scan output, halod drift report	Endpoint malware protection (Halos is not an EDR)
CC7.1 Detect configuration changes and new vulnerabilities	halod reports drift from the signed release; gateway posture and versionGate refuse drifted or unpinned clients (warn by default); halo admin plan fails CI when vendor consoles drift; halod reports unapproved MCP servers	cmd/halod/agent.go, cmd/halod/mcpdrift.go, internal/gateway/enforce.go, internal/vendoradmin/vendoradmin.go; ADR-0011, ADR-0025	Fleet reports (Drift), halo admin plan exit code 2, gateway gate counters	Vulnerability scanning of your hosts and dependencies. Posture is halod’s self-report; root can forge it (limits)
CC7.2 Monitor system components for anomalies	Prometheus metrics on halo-server, halo-proxy, halo-shadow; OTel evidence plane into ClickHouse; DLP findings; budgets; SIEM export of every privileged action	internal/server/metrics.go, internal/telemetry/collector.go, metrics reference	SIEM export, metrics, ClickHouse halo_metrics	Alert routing, on-call, review cadence (the operations guide ships example alert rules)
CC7.3, CC7.4 Evaluate and respond to security events	Kill switch (signed list, gateways within seconds), incident freeze, session, device and credential revocation, all requiring a reason and audited fail closed; controller auto-rollback on gateway-sourced evidence	internal/server/killswitch.go, internal/gateway/killswitch.go, internal/controller/controller.go; ADR-0009, ADR-0026	Audit entries (experiment.kill, credential.revoke, freeze on and off) with the stated reason	The incident response plan, roles and post-incident review. Halos supplies the levers and the record
CC7.5 Recover from incidents	Rollback is a pointer re-point to an earlier immutable release (halo rollback); HA halo-server on Postgres with a fenced controller lease; documented backup and restore	internal/bundle/pointer.go, internal/pgstore/pgstore.go; ADR-0002, ADR-0021	New signed pointer with higher seq; backup and restore	Running the backups and testing restores. The kill list file is the one you cannot lose
CC8.1 Authorize, design, test, approve and implement changes	Policy is YAML in your repo; halo validate runs the guardrails; halo plan and plan --diff show the render and who it moves; evals and experiments gate promotion; a promotion is a PR and a human merges (no auto-merge, no auto-promote); releases are immutable; freeze windows and approver quorums with tickets hold forward changes, never rollbacks	internal/policy/guardrails.go, internal/release/check.go, internal/impact/impact.go, internal/promote/promote.go, internal/policy/governance.go; ADR-0007, ADR-0030; invariants 5 and 6 in AGENTS.md	Promotion PR and its review, plan and impact output, signed release and manifest, eval scorecard, rollout approvals in the audit log	Branch protection and required reviewers on the policy repo (Halos ships a CODEOWNERS template, halo freeze check as a required check, but cannot set GitHub or GitLab settings); emergency change procedure
CC9.1, CC9.2 Risk from disruption; vendor and business partner risk	Controls what third parties your developers can reach: model allowlist, upstream routes resolved from policy, CLI version pins, MCP server registry, vendor-console sync, budgets, provider failover; the AI-BOM lists every model alias, MCP server and remote agent a release uses	internal/gateway/route.go, internal/gateway/decision.go (failover), internal/gateway/budget.go, internal/release/attest.go, internal/policy/mcp.go; ADR-0017, ADR-0029	AI-BOM per release, ledger records of models and tools actually used	Vendor due diligence, contracts, DPAs, review of each provider’s own SOC 2 or ISO report
C1.1, C1.2 Identify, protect and dispose of confidential information	Documents what each component stores and for how long; defaults for shadow, ClickHouse and budget retention; redaction in the ledger and harvested evals	Data flow and PII inventory, internal/eval/redact.go	The inventory; retention settings	Classifying your data; enforcing retention where Halos leaves it unbounded (audit log, delivery ROI rows)

ISO/IEC 27001:2022 Annex A

Control numbers and titles are from ISO/IEC 27001:2022 Annex A. Halos is a tool inside your ISMS; the ISMS clauses (4 to 10), risk assessment and the statement of applicability are yours.

Control	Halos feature	Implemented in	Evidence	Your part
5.15 Access control	One permission table, deny by default; ring, model and tool access derived from verified identity; org-unit scoping	internal/server/rbac.go, internal/gateway/prepare.go, internal/policy/resolve.go	authz.deny audit entries	The access control policy itself
5.16 Identity management	OIDC at the gateway and console; SCIM lifecycle; workload identity via RFC 8693 exchange (15-minute default, 1-hour maximum credential); delegated agent credentials with an act chain; workload: subject prefix reserved	internal/identity/, internal/server/tokenexchange.go, internal/server/delegation.go; ADR-0023, ADR-0024	workload.token.exchange, agent.token.exchange audit entries; session ledger who chain	The IdP and its identity proofing
5.17 Authentication information	Tokens stored as SHA-256 (device, enrollment); single-use enrollment; gateway tokens must be 32+ characters and 128+ bits of estimated entropy; vendor and provider credentials read from a file or environment variable, never a flag or policy; secrets never logged	internal/server/devices.go, internal/server/portal.go, cmd/halo-server/main.go; TestSecretsNeverLogged in cmd/halo-proxy/security_test.go	Startup refusal; tests in the security model	Password and MFA policy at the IdP; secret storage (Kubernetes Secrets, vault)
5.18 Access rights	Provisioning and revocation as above; roles recomputed from current groups on every request; device tokens expire; credential revocation reaches gateways within 30 seconds when directory.url is set	internal/server/scim.go, internal/server/revocations.go, internal/gateway/revocation.go	Audit entries; halo agents revocations	Access reviews and rights recertification
5.21 Managing information security in the ICT supply chain	For what your developers run: signed releases, hash-pinned CLI installs, digest-pinned and scanned skills, plugins and hooks, optional signature requirement, AI-BOM, MCP registry. For Halos itself: SHA-pinned GitHub Actions, cosign-signed checksums and images, SBOMs, build-provenance attestations	internal/bundle/, internal/supplychain/, internal/release/attest.go, release.yml; ADR-0028, ADR-0029	AI-BOM, signed release, Halos release evidence	Supplier selection and agreements (5.19, 5.20, 5.22)
5.23 Information security for use of cloud services	Model providers are cloud services: Halos holds the provider credentials at the gateway (Bedrock requests are SigV4-signed with the gateway’s own identity; client credentials are dropped), restricts models and routes, meters spend, and governs cloud agents it does not host (ADR-0034)	internal/gateway/upstreamauth/bedrock.go, internal/gateway/route.go, internal/policy/cloudagents.go	Session ledger (cloudagents source), budget counters, AI-BOM	The acquisition, use, management and exit process for each cloud service; the contract terms
8.8 Management of technical vulnerabilities	versionGate and rollouts get a patched CLI to the fleet in rings and refuse unpinned versions; the Halos repo runs govulncheck on every PR	internal/gateway/enforce.go, internal/rollout/; vuln job in ci.yml	Rollout state; CI results	Scanning your own estate; patch SLAs
8.9 Configuration management	The whole control: desired config is policy in git, rendered per harness, signed, delivered, and checked for drift. immutable: true flags managed files	internal/harness/, internal/release/, cmd/halod/agent.go; ADR-0001	Signed release, halo plan, fleet drift report, halo admin plan	Configuration of everything Halos does not render (OS, network, IdP)
8.12 Data leakage prevention	Gateway DLP (monitor, redact, block) on requests; monitor-only scan of streamed responses; injection tripwire on tool results	internal/gateway/dlp.go, internal/policy/dlp.go; ADR-0033	dlp.secret and dlp.injection entries	Coverage outside the gateway (email, chat, paste sites)
8.15 Logging	Hash-chained audit log of privileged actions, fsynced before the action is acknowledged and failing closed; gateway request log without bodies; session ledger	internal/server/audit.go (AuditStrict, VerifyAuditChain), cmd/halo-proxy/proxy.go	Audit log, SIEM export, ledger	Log protection and retention policy, clock synchronization (8.17), log review
8.16 Monitoring activities	Metrics, evidence plane, DLP counters, kill switch, controller guardrails	internal/telemetry/, internal/controller/	Metrics, SIEM	Who watches, and what they do
8.24 Use of cryptography	ed25519 or ECDSA P-256 (releases, pointers, kill list; keys in a file, AWS KMS or an HSM via an external signer, ADR-0038), ed25519 (workload and agent credentials), cosign (optional co-signature, release pipeline), HMAC-SHA256 (session cookies, webhooks, ledger path hashes, telemetry unit pseudonyms), AES-256-GCM (shadow pairs), SHA-256 content addressing. Algorithms are listed in security overview	internal/bundle/sign.go, internal/bundle/keys.go, internal/signer/, internal/gateway/killswitch.go, internal/identity/workload.go, internal/shadow/shadow.go	Source and tests; the CI fips job (GODEBUG=fips140=only)	Your cryptography policy; key custody (awskms://, exec:// HSM adapter, or CI secret); deploy the _fips / -fips artifacts where FIPS 140-3 is required. Halos holds no FIPS certificate of its own (FIPS 140-3 builds)
8.25 to 8.29 Secure development life cycle, application security requirements, secure architecture, secure coding, security testing	For Halos: CI runs lint, go test -race, govulncheck, native Go fuzz targets (10 s per PR, 10 minutes per target nightly), end-to-end and kind UAT suites; invariants in AGENTS.md; threat model. For you: guardrails on what agents may be configured to do	ci.yml, fuzz-nightly.yml, scripts/fuzz.sh	CI run history	Your own SDLC. Halos does not review your application code
8.31 Separation of development, test and production environments	Partial. Rings and experiments separate who gets a change first; they are cohorts on one fleet, not separate environments. The eval runner executes trials in Docker with no network by default	internal/eval/docker.go, internal/policy/rollout.go	Rollout state, eval scorecard	Environment separation
8.32 Change management	As SOC 2 CC8.1	as CC8.1	as CC8.1	as CC8.1

NIST SSDF and SLSA

Two different things are mapped here, and they should not be confused:

• Consumer side. Halos as the control you put around the agent software your developers install and the skills, plugins and hooks they load.
• Producer side. How the Halos project builds and releases itself.

SSDF numbering is NIST SP 800-218 v1.1.

Practice	Consumer side (your fleet)	Producer side (Halos releases)
PS.1 Protect all forms of code from unauthorized access and tampering	Policy repo plus signed releases; halod refuses anything that does not verify; path allowlist and ownership checks on what a release may write	Changes reach main by PR; the human merge gate depends on branch protection and CODEOWNERS, which are GitHub settings (UNVERIFIED here, see security overview)
PS.2 Provide a mechanism for verifying software release integrity	ed25519 release signature, signed ring pointers, hash-pinned artifacts	checksums.txt cosign keyless signature; image signatures; install.sh verifies; the verify job re-checks the published artifacts
PS.3 Archive and protect each release; collect and share provenance	Releases are immutable and content-addressed; AI-BOM and SLSA provenance attach to each release as a signed referrer	GitHub releases keep archives, SBOMs and attestations; actions/attest-build-provenance in release.yml
PW.4 Reuse existing, well-secured software; verify third-party components	Artifact pins, signatures (requireSignatures), static scan, MCP registry	Dependencies are in go.mod/go.sum and web/package-lock.json; govulncheck in CI; no automated dependency-update bot is configured in the repo
PW.7 Review or analyze code	halo validate guardrails and the release backstop check what an agent is allowed to be configured to do	Required CI checks, agent review labels, human review (see security overview); golangci-lint
PW.8 Test executable code	Eval gates and experiments test a change on your tasks before promotion	go test -race, fuzzing, end-to-end and UAT suites
PW.9 Configure software to have secure settings by default	Guardrails default on; bypassPermissions and danger-full-access are never emitted; posture and versionGate default to warn and DLP actions to monitor, so tightening is an explicit choice	allowShellInstall: false, anonymous gateway access off by default
RV.1 Identify and confirm vulnerabilities on an ongoing basis	versionGate and rollouts for fast CLI upgrades	govulncheck, nightly fuzzing, weekly OpenSSF Scorecard run (scorecard.yml), private vulnerability reporting
RV.2 Assess, prioritize and remediate vulnerabilities	Rollback and kill switch as the fast path	Disclosure process and targets in SECURITY.md

SLSA (Build track, v1.0):

• Halos releases. Built on GitHub-hosted runners by GoReleaser. Archives get a build-provenance attestation (actions/attest-build-provenance), checked in CI with gh attestation verify --signer-workflow. Halos does not claim a SLSA Build level. The attestation and the verify job are the evidence; the level is a judgment you make from them.
• Your agent releases. halo release build writes an in-toto Statement v1 with a SLSA provenance v1 predicate whose builder.id is the halo binary and version (internal/release/attest.go). It records the policy commit, resolved artifacts and harness installs. The tool writes it about itself, on whatever machine runs it, so it is an input record, not isolated-build evidence. If you need a SLSA level for your policy releases, build them in a CI platform that produces its own attestation and treat Halos’ provenance as additional detail.

EU AI Act

Regulation (EU) 2024/1689. Read this section before the table:

• Halos is not an AI system provider for the coding agents it manages. The agents are vendors’ products. Halos itself contains no model; the optional judge, halo eval online and halo copilot call a model you configure.
• Risk classification is yours. A general coding assistant is not in the high-risk categories of Annex III by default. Articles 12, 14, 19 and 26 attach to high-risk systems. If you use agent or ledger data to evaluate or monitor individual workers’ performance or behavior, take legal advice: Annex III, point 4 (employment, workers management) may then apply to that use. Halos’ ROI report compares randomized arms and is informational; the session ledger is per user.
• General-purpose model obligations (Articles 53 to 55) fall on model providers, not on Halos or on you as deployer. Transparency duties in Article 50 are not addressed by Halos.
• UNVERIFIED: article numbers are from the Regulation as adopted. Application dates and some provisions (Article 4 among them) were the subject of amendment proposals; check the current consolidated text before relying on any row.

Provision	Applies to	What Halos provides	Evidence	Not covered
Art. 4 AI literacy	Providers and deployers of any AI system, regardless of risk class	Nothing that trains people. Guardrail and gate messages tell a developer what was refused and why; the halos-onboard skill walks an operator through setup	None that counts as a literacy measure	The measures themselves: training, guidance, records of who completed it
Art. 14 Human oversight	A design requirement on providers of high-risk systems	The agents’ own oversight features belong to their vendors. What Halos adds is deployer-side: it never emits permission-bypass modes (invariant 1), promotion and merge are human (invariant 5), a signed kill switch and incident freeze can stop a change	Promotion PRs, approval entries, kill and freeze entries in the audit log	Whether the agent vendor’s system meets Art. 14
Art. 26(2) Assign human oversight to competent people	Deployers of high-risk systems	Named roles (operator, approver) and approver quorums with distinct groups and tickets give a place to record who holds the authority	Role mappings in policy; approvals in the audit log	Choosing the people, and their competence, training and authority
Art. 12 Record-keeping (automatic event logging)	A design requirement on providers of high-risk systems	Not applicable to Halos as a product. Halos does not implement the agent’s own event log	n/a	The agent vendor’s logging
Art. 19 Logs kept by providers (at least six months)	Providers of high-risk systems	Not applicable to Halos itself	n/a	n/a
Art. 26(6) Logs kept by deployers (at least six months, to the extent under their control)	Deployers of high-risk systems	Halos keeps governance records: hash-chained audit log, session ledger metadata (who, release, models, tools, tokens, cost, outcome), gateway metrics. Retention defaults are in the inventory: the audit log is unbounded unless you prune it; the ledger copy in ClickHouse expires at 400 days	Audit log, ledger export, SIEM	Halos does not log prompts or completions (the ledger cannot hold prompt text; the gateway request log has no bodies). If your classification needs the system’s input and output logs, they must come from the agent vendor or from your own capture. Reconcile the period with data protection law
Art. 26(7) Inform workers’ representatives and affected workers before use at the workplace	Deployers who are employers, of high-risk systems	Not applicable	n/a	The notice, and works-council consultation under national law

What Halos does not cover

These stay with you, whatever the framework.

Area	Why Halos cannot do it
Physical and environmental security (SOC 2 CC6.4, CC6.5; ISO 27001 Annex A 7.x)	Software
People: hiring, screening, training, disciplinary process (SOC 2 CC1; ISO 27001 Annex A 6.x)	Software
Risk assessment, ISMS governance, statement of applicability, management review	Process
Identity proofing, MFA, password policy	Halos speaks OIDC (console, gateway), SAML 2.0 (console) and SCIM 2.0; the IdP does the rest
TLS termination, certificates, network segmentation	halo-server, halo-proxy and halo-shadow have no TLS listener. Terminate TLS at your ingress or load balancer
Endpoint protection, OS patching, disk encryption	Halos manages AI CLI configuration, not the machine
Backups and disaster recovery execution	Halos documents what to back up; you run and test it
Incident response plan, breach notification, legal reporting	Halos provides levers and a record
Vendor due diligence and contracts, including each model provider	Halos limits what can be reached, not whether you should
Data protection: legal basis, DPIA, records of processing, data subject requests, transfer mechanisms	See the data flow and PII inventory for the facts you need
Retention enforcement where Halos has no default	Audit log, halo_eval_results, halo_delivery_prs, Postgres journal rows
Independent assurance	No third-party penetration test or code audit of Halos exists; FIPS 140-3: _fips builds use the Go Cryptographic Module v1.0.0; Halos itself is not validated
Policy-repo branch protection and review rules	GitHub settings; Halos supplies a CODEOWNERS template and halo freeze check