go-fips-toolkit

Runs a FIPS 140-3 crypto compliance audit across Go repositories, classifying every crypto/ import by risk and generating per-component reports. Separates first-party code from vendored dependencies and flags non-cryptographic uses of crypto primitives that break under GODEBUG=fips140=only. Use when auditing Go services for FIPS compliance, assessing new repos before adding them to FIPS CI, re-running an audit after vendor bumps, or generating evidence for compliance documentation.

Classifies an individual FIPS crypto audit finding as real cryptography or a non-cryptographic use of a crypto primitive, using structured diagnostic reasoning. Follows the abductive triage methodology of resolving coordinate mismatches first, since most findings are non-crypto, then tracing data flow and protocol requirements only when a usage is genuinely ambiguous. Use when an audit surfaces a CRITICAL or WARNING finding that needs classification, when a vendored dependency's crypto usage may not ship in the binary, or when producing evidence for a compliance review.

Generates component-specific FIPS remediation TODO lists from crypto audit results, with effort estimates and suggested PR sequencing. A directed workflow following the Inspect-Decide-Generate pattern, splitting findings into must-fix, primitive swaps, no-change-needed, and upstream dependencies. Use after a FIPS crypto audit when a component team asks what they need to fix, when planning sprint work for a FIPS migration, or when writing remediation PR descriptions.