The models are the product, so here is exactly what they do

Whatever you paste is split into passages and each one is triaged: is this a policy, a ticket, a settings export, a chat log? Triage runs on the cheapest model that can read, because this step is volume work and does not need judgement.

Nothing is discarded. A passage Trellis cannot classify still goes to the mapping step.

Every control in scope is put to the model together with its criterion, its plain-language meaning and the evidence an auditor asks for. The model returns a status, the gap, the evidence it saw, the evidence still needed and a supporting quote.

The prompt is explicit that silence means missing, intent does not count, and no numeric score may be produced.

This step has no model in it. Quotes are matched against your submitted material verbatim after normalising whitespace and quote characters. Fragments under eighteen characters are rejected outright. Anything unfound is dropped and the finding is labelled unsupported.

A control returned as met with no evidence named is downgraded to weak here, in code, with the reason shown to you.

Readiness is arithmetic on the statuses. Met counts one, weak counts a half, missing counts nothing, divided by the controls in scope.

We never ask a model for the number, because a number a model invented is a number you cannot defend to an auditor.

The largest open gap is drafted into a real document: purpose, scope, the policy itself, the evidence retained, and the three fields reviewers always check, which are owner, effective date and review cadence.

Drafts must not claim you already do something. Unknown specifics come back as bracketed placeholders so it is obvious what to fill in.