Axis 6: Templates

OSCAL Catalog Template

GCBoK defines German compliance taxonomies as OSCAL catalogs - a market novelty:

oscal_catalog:
  groups:
    - id: "gobdControls"
      title: "GoBD - Traceability"
      controls:
        - id: "GOBD-01"
          title: "Progressive Navigation"
          description: "Every business transaction traceable backwards"
    - id: "bsiControls"
      title: "BSI IT-Grundschutz Module"
      controls:
        - id: "APP.3.1.A1"
          title: "Data Backup"
    - id: "dsgvoControls"
      title: "GDPR Requirements"
      controls:
        - id: "DSGVO-Art.17"
          title: "Right to be Forgotten"

OPA Policy Template

Example of a Rego policy for evidence validation:

package gitcover.compliance

deny[msg] {
    input.class == "INVOICE"
    not input.prev_sha256
    msg := "INVOICE muss prev-hash referenzieren"
}

deny[msg] {
    input.class == "PAYMENT"
    not input.gpg_fingerprint
    msg := "PAYMENT muss GPG-signiert sein"
}

allow {
    count(deny) == 0
}

V7GUID Schema

The canonical V7GUID metadata schema:

v7guid: "0197a3b2-f3c0-7b00-8001-000000000042"
class: INVOICE          # PERSON | INVOICE | PAYMENT | CONTRACT | ...
sha256: "7d4e2f..."
prev_sha256: "3f2a1c..."  # null for genesis evidence
gpg_fingerprint: "ABCD1234..."
timestamp_iso: "2026-06-14T11:18:00+02:00"
gobd_periode: "FY2026"

DMS Container Template

The .v7g.zip container for GCDMS (scope depends on use case):

document.v7g.zip
├── .v7g.md          # Metadata, possibly with structure information in Markdown artifacts (JSON/YAML/XML, SHA256 hash of the original document, etc.)
├── .v7g.sig         # GPG signature
├── document.pdf     # Original document
├── document.json    # Machine-readable extracts
├── document.xml     # Machine-readable extracts (e.g. X-Rechnung)
└── attachments/     # Attachments

Format Selection by Use Case

V7GUID Sidecar Template

Canonical sidecar (*.v7g.md) for a digital original document. Schema: https://gitcover.org/schemas/v7g-sidecar-1.0.schema.json; the instance metadata follows record-metadata-1.0.schema.json (ISO 15489).

DocID = uuidv7 (instance identifier) vs. v7guid (class/context identifier). Both are kept in the sidecar and linked via composite_key ({v7guid}:{uuidv7}). Minimum content: sha256 of the original document.

# V7G Sidecar - {original_filename}

**SHA-256:** `{sha256}`
**Tenant:** {tenant}
**Category:** {category}
**Sphere:** {sphere}
**Tags:** {tags}

```json
{
  "$schema": "https://gitcover.org/schemas/v7g-sidecar-1.0.schema.json",
  "uuidV7": "{uuidv7}",
  "sha256": "{sha256}",
  "title": "{original_filename}",
  "original_filename": "{original_filename}",
  "locations": [
    { "unc_path": "./{tenant}/{path}", "from": "{YYMMDD}", "to": null, "note": "Primary storage location" }
  ],
  "v7g_taxonomy": [
    { "v7guid": "{v7guid}", "taxonomy": "{tenant}/{taxonomy}", "valid_from": "{YYMMDD}", "valid_to": null }
  ],
  "gcpn": { "prima_nota_ref": null, "journal_entry_ref": null },
  "obsolescence": { "status": "active", "superseded_by": null, "last_checked_at": "{ts}", "last_checked_by": "{user}" },
  "verification": { "verified_at": "{ts}", "verified_by": "auto", "method": "sha256_file", "intact": true },
  "tags": ["{tag}"],
  "sphere": "{sphere}"
}
```

DocID assignment: When a document is newly admitted to the DMS, the sidecar tool generates a UUIDv7 from a TimeStamp argument as the DocID (uuidV7). The default source is the file mtime; if the filename or content yields a business-relevant date, that date is used instead (see Axis 5: Procedures).