Verified obligation sets, with honest coverage gaps

Every pack pulls its requirements from the Verified Compliance Pack registry — sourced requirements only. Where we don’t have verified data, we show an honest “not yet covered” gap instead of fabricating coverage.