{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"AiAuditor","informationUri":"https://github.com/drhus/ai-auditor","version":"v0.1.0","rules":[{"id":"eu-ai-act-2024-08/1d-predictive-policing","name":"eu-ai-act-2024-08/1d-predictive-policing","shortDescription":{"text":"Predictive policing solely from profiling"},"fullDescription":{"text":"EU AI Act, Art 5(1)(d) — Predictive policing solely from profiling"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-5(1)(d)","fairness"],"regulation":"EU AI Act","article":"5(1)(d)","principle":"fairness"}},{"id":"eu-ai-act-2024-08/1e-facial-scraping","name":"eu-ai-act-2024-08/1e-facial-scraping","shortDescription":{"text":"Untargeted facial image scraping for face databases"},"fullDescription":{"text":"EU AI Act, Art 5(1)(e) — Untargeted facial image scraping for face databases"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-5(1)(e)","privacy"],"regulation":"EU AI Act","article":"5(1)(e)","principle":"privacy"}},{"id":"eu-ai-act-2024-08/1f-emotion-workplace-edu","name":"eu-ai-act-2024-08/1f-emotion-workplace-edu","shortDescription":{"text":"Emotion recognition in workplace and education"},"fullDescription":{"text":"EU AI Act, Art 5(1)(f) — Emotion recognition in workplace and education"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-5(1)(f)","privacy"],"regulation":"EU AI Act","article":"5(1)(f)","principle":"privacy"}},{"id":"eu-ai-act-2024-08/risk-management","name":"eu-ai-act-2024-08/risk-management","shortDescription":{"text":"Risk management system established, implemented, documented"},"fullDescription":{"text":"EU AI Act, Art 9 — Risk management system established, implemented, documented"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-9","safety"],"regulation":"EU AI Act","article":"9","principle":"safety"}},{"id":"eu-ai-act-2024-08/data-governance","name":"eu-ai-act-2024-08/data-governance","shortDescription":{"text":"Data and data governance practices documented"},"fullDescription":{"text":"EU AI Act, Art 10 — Data and data governance practices documented"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-10","privacy"],"regulation":"EU AI Act","article":"10","principle":"privacy"}},{"id":"eu-ai-act-2024-08/technical-documentation","name":"eu-ai-act-2024-08/technical-documentation","shortDescription":{"text":"Technical documentation drawn up before placing on market"},"fullDescription":{"text":"EU AI Act, Art 11 — Technical documentation drawn up before placing on market"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-11","auditability"],"regulation":"EU AI Act","article":"11","principle":"auditability"}},{"id":"eu-ai-act-2024-08/p1-automatic-logs","name":"eu-ai-act-2024-08/p1-automatic-logs","shortDescription":{"text":"Automatic recording of events over the lifetime"},"fullDescription":{"text":"EU AI Act, Art 12(1) — Automatic recording of events over the lifetime"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-12(1)","auditability"],"regulation":"EU AI Act","article":"12(1)","principle":"auditability"}},{"id":"eu-ai-act-2024-08/p2-traceability","name":"eu-ai-act-2024-08/p2-traceability","shortDescription":{"text":"Logging ensures traceability appropriate to risk"},"fullDescription":{"text":"EU AI Act, Art 12(2) — Logging ensures traceability appropriate to risk"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-12(2)","auditability"],"regulation":"EU AI Act","article":"12(2)","principle":"auditability"}},{"id":"eu-ai-act-2024-08/deployer-instructions","name":"eu-ai-act-2024-08/deployer-instructions","shortDescription":{"text":"Transparent operation and instructions for use"},"fullDescription":{"text":"EU AI Act, Art 13 — Transparent operation and instructions for use"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-13","transparency"],"regulation":"EU AI Act","article":"13","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p1-oversight-measures","name":"eu-ai-act-2024-08/p1-oversight-measures","shortDescription":{"text":"Effective human oversight designed and built-in"},"fullDescription":{"text":"EU AI Act, Art 14(1) — Effective human oversight designed and built-in"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(1)","human-oversight"],"regulation":"EU AI Act","article":"14(1)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p4d-stop-button","name":"eu-ai-act-2024-08/p4d-stop-button","shortDescription":{"text":"Interrupt / stop function reachable by overseer"},"fullDescription":{"text":"EU AI Act, Art 14(4)(d) — Interrupt / stop function reachable by overseer"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(4)(d)","human-oversight"],"regulation":"EU AI Act","article":"14(4)(d)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p4e-override","name":"eu-ai-act-2024-08/p4e-override","shortDescription":{"text":"Ability to override / reverse the system's output"},"fullDescription":{"text":"EU AI Act, Art 14(4)(e) — Ability to override / reverse the system's output"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(4)(e)","human-oversight"],"regulation":"EU AI Act","article":"14(4)(e)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p4-robustness","name":"eu-ai-act-2024-08/p4-robustness","shortDescription":{"text":"Resilience to errors, faults, inconsistencies"},"fullDescription":{"text":"EU AI Act, Art 15(4) — Resilience to errors, faults, inconsistencies"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(4)","safety"],"regulation":"EU AI Act","article":"15(4)","principle":"safety"}},{"id":"eu-ai-act-2024-08/p5-cybersecurity","name":"eu-ai-act-2024-08/p5-cybersecurity","shortDescription":{"text":"Cybersecurity measures appropriate to circumstances"},"fullDescription":{"text":"EU AI Act, Art 15(5) — Cybersecurity measures appropriate to circumstances"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(5)","security-governance"],"regulation":"EU AI Act","article":"15(5)","principle":"security-governance"}},{"id":"eu-ai-act-2024-08/p6-keep-logs","name":"eu-ai-act-2024-08/p6-keep-logs","shortDescription":{"text":"Deployer log-retention capability supported"},"fullDescription":{"text":"EU AI Act, Art 26(6) — Deployer log-retention capability supported"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-26(6)","accountability"],"regulation":"EU AI Act","article":"26(6)","principle":"accountability"}},{"id":"eu-ai-act-2024-08/p1-ai-disclosure","name":"eu-ai-act-2024-08/p1-ai-disclosure","shortDescription":{"text":"Users informed they are interacting with an AI"},"fullDescription":{"text":"EU AI Act, Art 50(1) — Users informed they are interacting with an AI"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(1)","transparency"],"regulation":"EU AI Act","article":"50(1)","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p2-synthetic-content","name":"eu-ai-act-2024-08/p2-synthetic-content","shortDescription":{"text":"AI-generated content marked as such, machine-readable"},"fullDescription":{"text":"EU AI Act, Art 50(2) — AI-generated content marked as such, machine-readable"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(2)","transparency"],"regulation":"EU AI Act","article":"50(2)","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","name":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","shortDescription":{"text":"Emotion recognition / biometric categorisation disclosure"},"fullDescription":{"text":"EU AI Act, Art 50(3) — Emotion recognition / biometric categorisation disclosure"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(3)","transparency"],"regulation":"EU AI Act","article":"50(3)","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p4-deepfake-disclosure","name":"eu-ai-act-2024-08/p4-deepfake-disclosure","shortDescription":{"text":"Deepfake content labelled as artificially generated"},"fullDescription":{"text":"EU AI Act, Art 50(4) — Deepfake content labelled as artificially generated"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(4)","transparency"],"regulation":"EU AI Act","article":"50(4)","principle":"transparency"}},{"id":"nist-ai-rmf-1.0/govern-1.4","name":"nist-ai-rmf-1.0/govern-1.4","shortDescription":{"text":"Risk management process documented and accountable"},"fullDescription":{"text":"NIST AI RMF, Art GOVERN 1.4 — Risk management process documented and accountable"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-GOVERN 1.4","accountability"],"regulation":"NIST AI RMF","article":"GOVERN 1.4","principle":"accountability"}},{"id":"nist-ai-rmf-1.0/map-1.1","name":"nist-ai-rmf-1.0/map-1.1","shortDescription":{"text":"Context of use established and understood"},"fullDescription":{"text":"NIST AI RMF, Art MAP 1.1 — Context of use established and understood"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MAP 1.1","auditability"],"regulation":"NIST AI RMF","article":"MAP 1.1","principle":"auditability"}},{"id":"nist-ai-rmf-1.0/map-3.4","name":"nist-ai-rmf-1.0/map-3.4","shortDescription":{"text":"Risks and benefits to people identified"},"fullDescription":{"text":"NIST AI RMF, Art MAP 3.4 — Risks and benefits to people identified"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MAP 3.4","safety"],"regulation":"NIST AI RMF","article":"MAP 3.4","principle":"safety"}},{"id":"nist-ai-rmf-1.0/measure-2.7","name":"nist-ai-rmf-1.0/measure-2.7","shortDescription":{"text":"Security and resilience evaluated"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.7 — Security and resilience evaluated"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.7","security-governance"],"regulation":"NIST AI RMF","article":"MEASURE 2.7","principle":"security-governance"}},{"id":"nist-ai-rmf-1.0/measure-2.8","name":"nist-ai-rmf-1.0/measure-2.8","shortDescription":{"text":"Privacy risk of the AI system evaluated"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.8 — Privacy risk of the AI system evaluated"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.8","privacy"],"regulation":"NIST AI RMF","article":"MEASURE 2.8","principle":"privacy"}},{"id":"nist-ai-rmf-1.0/manage-2.3","name":"nist-ai-rmf-1.0/manage-2.3","shortDescription":{"text":"Mechanisms to supersede or deactivate AI systems"},"fullDescription":{"text":"NIST AI RMF, Art MANAGE 2.3 — Mechanisms to supersede or deactivate AI systems"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MANAGE 2.3","human-oversight"],"regulation":"NIST AI RMF","article":"MANAGE 2.3","principle":"human-oversight"}},{"id":"nist-ai-rmf-1.0/manage-4.1","name":"nist-ai-rmf-1.0/manage-4.1","shortDescription":{"text":"Post-deployment monitoring, appeal and override, change management"},"fullDescription":{"text":"NIST AI RMF, Art MANAGE 4.1 — Post-deployment monitoring, appeal and override, change management"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MANAGE 4.1","auditability"],"regulation":"NIST AI RMF","article":"MANAGE 4.1","principle":"auditability"}}]}},"automationDetails":{"id":"aiauditor/aud_01KS3CV6740WCQZ9S5N1G0"},"originalUriBaseIds":{"%SRCROOT%":{"uri":"https://github.com/drhus/ai-auditor/blob/46479044bd8e085cecce58d702e6419a50ad789c/"}},"versionControlProvenance":[{"repositoryUri":"https://github.com/drhus/ai-auditor","revisionId":"46479044bd8e085cecce58d702e6419a50ad789c","branch":"46479044bd8e085cecce58d702e6419a50ad789c"}],"results":[{"ruleId":"eu-ai-act-2024-08/1d-predictive-policing","level":"error","message":{"text":"Predictive policing solely from profiling — verdict: FAIL (79% conf).\n\nComposite raw score 0.76 (1/1 rules matched).\n\nEvidence: crime-likelihood / recidivism / \"risk to commit X\" scores when the input contains only person profile data (no obje"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":199,"endLine":199}}}],"properties":{"verdict":"fail","score":0,"confidence":0.7887640052032225,"rawScore":0.7612359947967775,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1d-predictive-policing"}},{"ruleId":"eu-ai-act-2024-08/1d-predictive-policing","level":"error","message":{"text":"Predictive policing solely from profiling — verdict: FAIL (79% conf).\n\nComposite raw score 0.76 (1/1 rules matched).\n\nEvidence: names like `crime_risk`, `recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pa"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"fail","score":0,"confidence":0.7887640052032225,"rawScore":0.7612359947967775,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1d-predictive-policing"}},{"ruleId":"eu-ai-act-2024-08/1d-predictive-policing","level":"error","message":{"text":"Predictive policing solely from profiling — verdict: FAIL (79% conf).\n\nComposite raw score 0.76 (1/1 rules matched).\n\nEvidence: recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pass_default: 4, fail_on_match: 0 }"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"fail","score":0,"confidence":0.7887640052032225,"rawScore":0.7612359947967775,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1d-predictive-policing"}},{"ruleId":"eu-ai-act-2024-08/1d-predictive-policing","level":"error","message":{"text":"Predictive policing solely from profiling — verdict: FAIL (79% conf).\n\nComposite raw score 0.76 (1/1 rules matched).\n\nEvidence: ms\", pattern: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/pipeline/stages/recon.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":330,"endLine":330}}}],"properties":{"verdict":"fail","score":0,"confidence":0.7887640052032225,"rawScore":0.7612359947967775,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1d-predictive-policing"}},{"ruleId":"eu-ai-act-2024-08/1d-predictive-policing","level":"error","message":{"text":"Predictive policing solely from profiling — verdict: FAIL (79% conf).\n\nComposite raw score 0.76 (1/1 rules matched).\n\nEvidence: n: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signa"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/pipeline/stages/recon.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":330,"endLine":330}}}],"properties":{"verdict":"fail","score":0,"confidence":0.7887640052032225,"rawScore":0.7612359947967775,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1d-predictive-policing"}},{"ruleId":"eu-ai-act-2024-08/1d-predictive-policing","level":"error","message":{"text":"Predictive policing solely from profiling — verdict: FAIL (79% conf).\n\nComposite raw score 0.76 (1/1 rules matched).\n\nEvidence: ime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals -----"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/pipeline/stages/recon.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":330,"endLine":330}}}],"properties":{"verdict":"fail","score":0,"confidence":0.7887640052032225,"rawScore":0.7612359947967775,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1d-predictive-policing"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: \" description: \"Biometric ID, categorisation, emotion recognition\" - signal: critical_infra_signals category: \"2\" description:"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":32,"endLine":32}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: otion recognition / biometric categorisation\" - signal: agent_framework # any interactive AI is in scope paragraph: \"50(1)\""},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":62,"endLine":62}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: calls (mediapipe, face_recognition, dlib, opencv haar cascade). score_mapping: { pass_default: 4, fail_on_match: 0 } remediation_h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":231,"endLine":231}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: \"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":3913,"endLine":3913}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: }, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":3923,"endLine":3923}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: uests.get / fetch / playwright in iteration) targeting image content combined with face-detection calls (mediapipe,"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":229,"endLine":229}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1f-emotion-workplace-edu","level":"error","message":{"text":"Emotion recognition in workplace and education — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: ms\", pattern: /\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ---"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/pipeline/stages/recon.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":348,"endLine":348}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu"}},{"ruleId":"eu-ai-act-2024-08/1f-emotion-workplace-edu","level":"error","message":{"text":"Emotion recognition in workplace and education — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: \\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/pipeline/stages/recon.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":348,"endLine":348}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu"}},{"ruleId":"eu-ai-act-2024-08/1f-emotion-workplace-edu","level":"error","message":{"text":"Emotion recognition in workplace and education — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/pipeline/stages/recon.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":348,"endLine":348}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu"}},{"ruleId":"eu-ai-act-2024-08/1f-emotion-workplace-edu","level":"error","message":{"text":"Emotion recognition in workplace and education — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: ppet\": \"OMMANDS for candidate in tokens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employme"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":1001,"endLine":1001}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu"}},{"ruleId":"eu-ai-act-2024-08/1f-emotion-workplace-edu","level":"error","message":{"text":"Emotion recognition in workplace and education — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: ens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employment_terms\" }, {"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":1001,"endLine":1001}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu"}},{"ruleId":"eu-ai-act-2024-08/1f-emotion-workplace-edu","level":"error","message":{"text":"Emotion recognition in workplace and education — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: \"snippet\": \"1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break for path_candidate in candidate_paths(candidate):\", \"rule"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":1010,"endLine":1010}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu"}},{"ruleId":"eu-ai-act-2024-08/risk-management","level":"warning","message":{"text":"Risk management system established, implemented, documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.55 (2/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"RISK_REGISTER.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.55,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-9/risk-management"}},{"ruleId":"eu-ai-act-2024-08/risk-management","level":"warning","message":{"text":"Risk management system established, implemented, documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.55 (2/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"SECURITY.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.55,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-9/risk-management"}},{"ruleId":"eu-ai-act-2024-08/data-governance","level":"error","message":{"text":"Data and data governance practices documented — verdict: FAIL (75% conf).\n\nComposite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: \"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":3913,"endLine":3913}}}],"properties":{"verdict":"fail","score":0,"confidence":0.75,"rawScore":0.1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-10/data-governance"}},{"ruleId":"eu-ai-act-2024-08/data-governance","level":"error","message":{"text":"Data and data governance practices documented — verdict: FAIL (75% conf).\n\nComposite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: }, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":3923,"endLine":3923}}}],"properties":{"verdict":"fail","score":0,"confidence":0.75,"rawScore":0.1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-10/data-governance"}},{"ruleId":"eu-ai-act-2024-08/technical-documentation","level":"error","message":{"text":"Technical documentation drawn up before placing on market — verdict: FAIL (80% conf).\n\nComposite raw score 0.15 (1/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 2 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.8,"rawScore":0.15,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-11/technical-documentation"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":38,"endLine":38}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: -1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase="},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":68,"endLine":68}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":69,"endLine":69}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: = \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":70,"endLine":70}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-iso-gdpr.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":6,"endLine":6}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":38,"endLine":38}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: -1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":38,"endLine":38}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: -1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase="},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":68,"endLine":68}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":69,"endLine":69}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: = \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":70,"endLine":70}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-iso-gdpr.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":6,"endLine":6}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":38,"endLine":38}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: -1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (90% conf).\n\nComposite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 2 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.25,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (90% conf).\n\nComposite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.25,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (90% conf).\n\nComposite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.25,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/p1-oversight-measures","level":"warning","message":{"text":"Effective human oversight designed and built-in — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/3 rules matched).\n\nEvidence: in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":817,"endLine":817}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p1-oversight-measures"}},{"ruleId":"eu-ai-act-2024-08/p1-oversight-measures","level":"warning","message":{"text":"Effective human oversight designed and built-in — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/3 rules matched).\n\nEvidence: For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":838,"endLine":838}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p1-oversight-measures"}},{"ruleId":"eu-ai-act-2024-08/p1-oversight-measures","level":"warning","message":{"text":"Effective human oversight designed and built-in — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/3 rules matched).\n\nEvidence: import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":162,"endLine":162}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p1-oversight-measures"}},{"ruleId":"eu-ai-act-2024-08/p1-oversight-measures","level":"warning","message":{"text":"Effective human oversight designed and built-in — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/3 rules matched).\n\nEvidence: import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":171,"endLine":171}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p1-oversight-measures"}},{"ruleId":"eu-ai-act-2024-08/p1-oversight-measures","level":"warning","message":{"text":"Effective human oversight designed and built-in — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/3 rules matched).\n\nEvidence: chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":198,"endLine":198}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p1-oversight-measures"}},{"ruleId":"eu-ai-act-2024-08/p1-oversight-measures","level":"warning","message":{"text":"Effective human oversight designed and built-in — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/3 rules matched).\n\nEvidence: a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\""},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":207,"endLine":207}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p1-oversight-measures"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":902,"endLine":902}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":907,"endLine":907}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":342,"endLine":342}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: , hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/design-exploration/_data.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":26,"endLine":26}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":817,"endLine":817}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":838,"endLine":838}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":902,"endLine":902}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":907,"endLine":907}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4-robustness","level":"error","message":{"text":"Resilience to errors, faults, inconsistencies — verdict: FAIL (81% conf).\n\nComposite raw score 0.16 (0/3 rules matched).\n\nEvidence: nippet\": \"import os from langchain.callbacks.streaming_stdout import StreamingStdOutCallbackHandler from langchain_openai import ChatOpenAI\""},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":90,"endLine":90}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81,"rawScore":0.16000000000000003,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p4-robustness"}},{"ruleId":"eu-ai-act-2024-08/p4-robustness","level":"error","message":{"text":"Resilience to errors, faults, inconsistencies — verdict: FAIL (81% conf).\n\nComposite raw score 0.16 (0/3 rules matched).\n\nEvidence: dOutCallbackHandler from langchain_openai import ChatOpenAI\", \"rule\": \"langchain_import\" }, { \"f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":90,"endLine":90}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81,"rawScore":0.16000000000000003,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p4-robustness"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: (hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":344,"endLine":344}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1121,"endLine":1121}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1124,"endLine":1124}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">="},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1135,"endLine":1135}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1143,"endLine":1143}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":260,"endLine":260}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1127,"endLine":1127}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: 0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":264,"endLine":264}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\","},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/preview/_report-mock.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":341,"endLine":341}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: , reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/preview/_report-mock.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":483,"endLine":483}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/preview/_report-mock.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":485,"endLine":485}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"note","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PASS (90% conf).\n\nComposite raw score 0.80 (3/4 rules matched).\n\nEvidence: const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\","},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":491,"endLine":491}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p6-keep-logs","level":"warning","message":{"text":"Deployer log-retention capability supported — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":38,"endLine":38}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-26/p6-keep-logs"}},{"ruleId":"eu-ai-act-2024-08/p6-keep-logs","level":"warning","message":{"text":"Deployer log-retention capability supported — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: -1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/seed-audit.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-26/p6-keep-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-ai-disclosure","level":"error","message":{"text":"Users informed they are interacting with an AI — verdict: FAIL (80% conf).\n\nComposite raw score 0.20 (1/2 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.7999999999999999,"rawScore":0.2,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p1-ai-disclosure"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/analysis-tiers.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":102,"endLine":102}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/analysis-tiers.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":102,"endLine":102}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: ` | 50(2) | **1** | C2PA / watermark library imports | | `art-50/p3-emotion-biometric-disclosure` | 50(3) | **1** | Deterministic disclosure"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/llm-judge-policy.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":78,"endLine":78}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: ovenance_hooks` | C2PA, watermarking, content labelling | Article 50(2) synthetic content disclosure"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/pipeline-design.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":75,"endLine":75}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: o/text) | C | C2PA / watermarking libraries; metadata writers; output post-processing. | | 50(3) | Emotion-recognition / biometri"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/regulations-matrix.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":63,"endLine":63}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: ntent> | Drives the C2PA / watermarking signal expectations for clause 50(2). | 2026-05-17 | | 10 | *AI Act Service Desk* + FAQs — <https://"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/regulations-matrix.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":175,"endLine":175}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/analysis-tiers.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":102,"endLine":102}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p2-synthetic-content","level":"note","message":{"text":"AI-generated content marked as such, machine-readable — verdict: PASS (78% conf).\n\nComposite raw score 0.82 (2/2 rules matched).\n\nEvidence: aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/analysis-tiers.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":102,"endLine":102}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7776544327964814,"rawScore":0.8223455672035186,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p2-synthetic-content"}},{"ruleId":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","level":"error","message":{"text":"Emotion recognition / biometric categorisation disclosure — verdict: FAIL (55% conf).\n\nComposite raw score 0.00 (0/1 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":0,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure"}},{"ruleId":"eu-ai-act-2024-08/p4-deepfake-disclosure","level":"note","message":{"text":"Deepfake content labelled as artificially generated — verdict: PASS (85% conf).\n\nComposite raw score 0.70 (1/1 rules matched).\n\nEvidence: ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/analysis-tiers.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":102,"endLine":102}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8500000000000001,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-50/p4-deepfake-disclosure"}},{"ruleId":"eu-ai-act-2024-08/p4-deepfake-disclosure","level":"note","message":{"text":"Deepfake content labelled as artificially generated — verdict: PASS (85% conf).\n\nComposite raw score 0.70 (1/1 rules matched).\n\nEvidence: aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".agent/docs/analysis-tiers.md","uriBaseId":"%SRCROOT%"},"region":{"startLine":102,"endLine":102}}}],"properties":{"verdict":"pass","score":3,"confidence":0.8500000000000001,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-50/p4-deepfake-disclosure"}},{"ruleId":"nist-ai-rmf-1.0/govern-1.4","level":"note","message":{"text":"Risk management process documented and accountable — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"RISK_REGISTER.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/govern-1.4"}},{"ruleId":"nist-ai-rmf-1.0/govern-1.4","level":"note","message":{"text":"Risk management process documented and accountable — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"RISK_REGISTER.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/govern-1.4"}},{"ruleId":"nist-ai-rmf-1.0/map-1.1","level":"error","message":{"text":"Context of use established and understood — verdict: FAIL (90% conf).\n\nComposite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 2 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.3,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/map-1.1"}},{"ruleId":"nist-ai-rmf-1.0/map-1.1","level":"error","message":{"text":"Context of use established and understood — verdict: FAIL (90% conf).\n\nComposite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.3,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/map-1.1"}},{"ruleId":"nist-ai-rmf-1.0/map-3.4","level":"note","message":{"text":"Risks and benefits to people identified — verdict: PASS (80% conf).\n\nComposite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"RISK_REGISTER.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/map-3.4"}},{"ruleId":"nist-ai-rmf-1.0/map-3.4","level":"note","message":{"text":"Risks and benefits to people identified — verdict: PASS (80% conf).\n\nComposite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"SECURITY.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":3,"confidence":0.7999999999999999,"rawScore":0.8,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/map-3.4"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: (hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":344,"endLine":344}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1121,"endLine":1121}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1124,"endLine":1124}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">="},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1135,"endLine":1135}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1143,"endLine":1143}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":260,"endLine":260}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":1127,"endLine":1127}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: 0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":264,"endLine":264}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\","},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/preview/_report-mock.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":341,"endLine":341}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: , reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/preview/_report-mock.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":483,"endLine":483}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/preview/_report-mock.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":485,"endLine":485}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\","},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":491,"endLine":491}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched).\n\nEvidence: description: \"Code redacts or hashes PII before logging or sending to external models\" - rule: privacy_documentation weig"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":290,"endLine":290}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched).\n\nEvidence: p \\\"$SCRIPT_DIR/mcp/redaction.js\\\" \\\"$TARGET_ABS/mcp/\\\" cp \\\"$SCRIPT_DIR/mcp/lib/\\\"*.js \\\"$TARGET_ABS/mcp/lib/\\\" rm -rf \\\"$TARGET_ABS/mcp/li"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":817,"endLine":817}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched).\n\nEvidence: t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\\\"foot\\\"><span\", \"rule\": \""},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":826,"endLine":826}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched).\n\nEvidence: h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\\\"code-card\\\"> <div\", \"rule\": \"pii_red"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":835,"endLine":835}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched).\n\nEvidence: n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\\\"slide\\\" data-title=\\\"Egress\\\"> <\", \"r"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":844,"endLine":844}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched).\n\nEvidence: b collects bounded, redacted evidence packs for final reportable findings.</p> <div class=\\\"pill-row\\\"> <span class=\\\"pil\", \"rul"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":853,"endLine":853}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"note","message":{"text":"Privacy risk of the AI system evaluated — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"PRIVACY.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":902,"endLine":902}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":907,"endLine":907}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/nist-ai-rmf-1.0.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":342,"endLine":342}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: , hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/app/design-exploration/_data.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":26,"endLine":26}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":817,"endLine":817}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":838,"endLine":838}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":902,"endLine":902}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":906,"endLine":906}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"regulations/eu-ai-act-2024-08.yaml","uriBaseId":"%SRCROOT%"},"region":{"startLine":907,"endLine":907}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package.json","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}}],"properties":{"auditId":"aud_01KS3CV6740WCQZ9S5N1G0","bundleHash":"e75bef04804dfab68ed0d99dd365ae500d38469b14379fc8c40a318b9bb6c3c7","durationMs":28785,"overallScore":2.032258064516129,"regulationCoverage":["eu-ai-act-2024-08","nist-ai-rmf-1.0"]}}]}