{"auditId":"aud_01KS3E0YX5BHC4EMC7M5E9","status":"completed","startedAt":"2026-05-20T19:32:57.381Z","updatedAt":"2026-05-20T19:34:45.702Z","progressNote":"Risk class: high — running clause checkers","report":{"auditId":"aud_01KS3E0YX5BHC4EMC7M5E9","source":{"kind":"repo","owner":"drhus","repo":"ai-auditor"},"input":{"auditId":"aud_01KS3E0YX5BHC4EMC7M5E9","source":{"kind":"repo","owner":"drhus","repo":"ai-auditor"},"repoUrl":"https://github.com/drhus/ai-auditor","regulations":["eu-ai-act-2024-08","nist-ai-rmf-1.0","iso-42001-2023","gdpr-2016"]},"fetch":{"repoUrl":"https://github.com/drhus/ai-auditor","owner":"drhus","repo":"ai-auditor","ref":"35addea1c2f98e6944f65eaa4de967af7aac4501","commitSha":"35addea1c2f98e6944f65eaa4de967af7aac4501","worktreeDir":"/tmp/ai-auditor/aud_01KS3E0YX5BHC4EMC7M5E9","fileCount":240,"totalBytes":8291741,"languages":{"Markdown":417462,"HTML":5412,"CSS":14748,"TypeScript":664173,"JSON":598926,"Solidity":4031,"JavaScript":63,"YAML":96078,"Shell":2906},"inventory":{"hasReadme":true,"hasLicense":true,"hasModelCard":false,"hasDataCard":false,"hasRiskRegister":true,"hasThreatModel":false,"hasSecurityMd":true,"hasPrivacyMd":true,"hasCodeOfConduct":false,"hasContributing":false,"hasCiWorkflows":false,"hasEvalDir":false,"hasTestsDir":false,"governanceDocFiles":[".agent/docs/README.md","LICENSE","PRIVACY.md","README.md","RISK_REGISTER.md","SECURITY.md","contracts/README.md","regulations/README.md"],"configFiles":["package.json"]},"fetchedAt":"2026-05-20T19:32:59.121Z"},"recon":{"signals":{"agent_framework":{"signal":"agent_framework","fired":true,"strength":0.8704365036222725,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"nippet\": \"import os from langchain.callbacks.streaming_stdout import StreamingStdOutCallbackHandler from langchain_openai import ChatOpenAI\"","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"dOutCallbackHandler from langchain_openai import ChatOpenAI\", \"rule\": \"langchain_import\" }, { \"f","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[99,99],"snippet":"dOutCallbackHandler from langchain_openai import ChatOpenAI model = ChatOpenAI( model=os.getenv(\\\"MODEL_NAME\\\"), temperature=0.1,\",","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[117,117],"snippet":"\"import load_dotenv from langchain.globals import set_llm_cache from langchain_community.cache import SQLiteCache from termcolor import colo","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[117,117],"snippet":"mport set_llm_cache from langchain_community.cache import SQLiteCache from termcolor import colo\", \"rule\": \"langchain_import\"","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[108,108],"snippet":"\"rt OpenAI client = OpenAI( base_url=os.getenv(\\\"OPENAI_API_BASE\\\"), api_key=os.getenv(\\\"OPENAI_API_KEY\\\") ) response = client.chat.complet\"","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[89,89],"snippet":"\"st import requests from anthropic import Anthropic, AnthropicBedrock, AnthropicVertex, APIResponse from anthropic.types import ToolResultBl","rule":"anthropic_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[121,121],"snippet":"ity import tiktoken from anthropic import APIConnectionError, APIStatusError from pydantic import SecretStr from forge.models.config import\"","rule":"anthropic_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[130,130],"snippet":"ippet\": \"er=logger) from anthropic import AsyncAnthropic self._client = AsyncAnthropic( **self._credentials.get_api_acc\", \"rule\"","rule":"anthropic_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[103,103],"snippet":"et\": \"\\\"\\\"\\\"Newer ``openai-python`` declares ``cache_write_tokens`` as a typed attribute on ``PromptTokensDetails`` — it no longer l\",","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[112,112],"snippet":"ippet\": \"response = OpenAI( api_key=self.openai_credentials.api_key.get_secret_value(), organization=(\", \"rule\": \"openai_sdk_use","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[139,139],"snippet":"//github.com/openai/openai-python/blob/120d225b91a8453e15240a49fb1c6794d8119326/chatml.md \\\" # noqa \\\"for information on how\", \"","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[3321,3321],"snippet":"et\": \"\\\"\\\"\\\"Newer ``openai-python`` declares ``cache_write_tokens`` as a typed attribute on ``PromptTokensDetails`` — it no longer l\",","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[3330,3330],"snippet":"ippet\": \"response = OpenAI( api_key=self.openai_credentials.api_key.get_secret_value(), organization=(\", \"rule\": \"openai_sdk_use\"","rule":"openai_sdk_use"},{"file":"src/pipeline/stages/recon.ts","lines":[291,291],"snippet":"s|openai\\.responses|openai-python|openai\\.OpenAI)/g }, { signal: \"agent_framework\", rule: \"agent_loop_pattern\", pattern: /\\b(?:while\\s+not","rule":"openai_sdk_use"}]},"model_usage":{"signal":"model_usage","fired":true,"strength":1,"evidence":[{"file":"src/app/preview/_report-mock.ts","lines":[183,183],"snippet":".create({\\n model: \"claude-opus-4-7\",\\n messages,\\n});\\n// Raw model output returned with no provenance marker.\\nreturn res.json({ reply:","rule":"model_string_anthropic","detail":"claude-opus-4-7"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[100,100],"snippet":"\"detail\": \"claude-opus-4-7\" } ], \"meta\": { \"models\": {} } }, \"logging_hook","rule":"model_string_anthropic","detail":"claude-opus-4-7"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[306,306],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"gpt_engineer/core/ai.py\", \"lines\": [ 90","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[316,316],"snippet":"\"detail\": \"gpt-4-turbo\" }, { \"file\": \"gpt_engineer/core/ai.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4-turbo"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[326,326],"snippet":"\"detail\": \"gpt-4\" }, { \"file\": \"gpt_engineer/core/ai.py\", \"lines\": [ 112","rule":"model_string_openai","detail":"gpt-4"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[336,336],"snippet":"\"detail\": \"gpt-4-turbo\" }, { \"file\": \"gpt_engineer/core/token_usage.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4-turbo"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[346,346],"snippet":"\"detail\": \"gpt-4\" }, { \"file\": \"gpt_engineer/core/token_usage.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[107,107],"snippet":"\"detail\": \"gpt-4o-mini\" }, { \"file\": \"interpreter/core/computer/browser/browser.py\", \"","rule":"model_string_openai","detail":"gpt-4o-mini"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[117,117],"snippet":"\"detail\": \"gpt-4o-mini\" }, { \"file\": \"interpreter/core/llm/llm.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4o-mini"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[127,127],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\", \"line","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[187,187],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"interpreter/terminal_interface/profiles/defaults/aws-docs.py\",","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[207,207],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"interpreter/terminal_interface/profiles/defaults/default.yaml\",","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[137,137],"snippet":"\"detail\": \"Llama-3.1-8B-Instruct\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\",","rule":"model_string_llama","detail":"Llama-3.1-8B-Instruct"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[147,147],"snippet":"\"detail\": \"Mixtral-8x7B-Instruct\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\",","rule":"model_string_llama","detail":"Mixtral-8x7B-Instruct"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[157,157],"snippet":"\"detail\": \"mixtral-8x7b-instruct-v0.1.Q5_K_M.llamafile\" }, { \"file\": \"interpreter/terminal_interfa","rule":"model_string_llama","detail":"mixtral-8x7b-instruct-v0.1.Q5_K_M.llamafile"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[167,167],"snippet":"\"detail\": \"llama3\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\", \"line","rule":"model_string_llama","detail":"llama3"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[177,177],"snippet":"\"detail\": \"llama3.1\" }, { \"file\": \"interpreter/terminal_interface/profiles/defaults/assistant.py\",","rule":"model_string_llama","detail":"llama3.1"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[167,167],"snippet":"\"detail\": \"claude-sonnet-4-20250514\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-","rule":"model_string_anthropic","detail":"claude-sonnet-4-20250514"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[175,175],"snippet":"\\\": \\\"anthropic\\\", \\\"claude-opus-4-20\", \"rule\": \"model_string_anthropic\", \"detail\": \"claude-haiku-4-5-20251001\"","rule":"model_string_anthropic","detail":"claude-opus-4-20"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[177,177],"snippet":"\"detail\": \"claude-haiku-4-5-20251001\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c","rule":"model_string_anthropic","detail":"claude-haiku-4-5-20251001"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[185,185],"snippet":"\\\": \\\"anthropic\\\", \\\"claude-opus-4-5-202\", \"rule\": \"model_string_anthropic\", \"detail\": \"claude-opus-4-1-20250805\"","rule":"model_string_anthropic","detail":"claude-opus-4-5-202"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[187,187],"snippet":"\"detail\": \"claude-opus-4-1-20250805\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-","rule":"model_string_anthropic","detail":"claude-opus-4-1-20250805"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[155,155],"snippet":": \"Model name (e.g. 'gpt-4o', 'claude-3-5-sonnet') -- node_exec_id TEXT Linked node execution UUID -- llm_call_count\", \"rule\": \"","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[157,157],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-a14c-4d19-a567-653","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[217,217],"snippet":"\"detail\": \"gpt-5-2025-08-07\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-a14c-4d1","rule":"model_string_openai","detail":"gpt-5-2025-08-07"}],"meta":{"models":{}}},"logging_hooks":{"signal":"logging_hooks","fired":true,"strength":1,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[68,68],"snippet":"evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase=","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[69,69],"snippet":"t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[70,70],"snippet":"= \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[6,6],"snippet":"lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[8,8],"snippet":"ck.clauses) { console.log(` ${c.id} → ${c.principle}`); } } } main().catch((e) => { console.error(e); process.exit(1); });","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[8,8],"snippet":"st-ai-rmf-1.0\"); console.log(`EU clauses: ${eu.clauses.length}`); console.log(`NIST clauses: ${nist.clauses.length}`); const allClau","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[9,9],"snippet":"lauses.length}`); console.log(`NIST clauses: ${nist.clauses.length}`); const allClauses = [...eu.clauses, ...nist.clauses]; const byP","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[20,20],"snippet":"] ?? 0) + 1; } console.log(\"\\nBy principle:\"); for (const p of ALL_PRINCIPLES) { console.log(` ${p.padEnd(22)} ${byPrinciple[p]","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[22,22],"snippet":"L_PRINCIPLES) { console.log(` ${p.padEnd(22)} ${byPrinciple[p] ?? 0}`); } console.log(\"\\nBy metric:\"); for (const [m, n] of Obje","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[25,25],"snippet":"[p] ?? 0}`); } console.log(\"\\nBy metric:\"); for (const [m, n] of Object.entries(byMetric)) { console.log(` ${m.padEnd(16)} ${n}`","rule":"log_at_tool_boundary"},{"file":"src/app/api/waitlist/route.ts","lines":[53,53],"snippet":"f storage is off. console.log(\"[waitlist]\", JSON.stringify(entry)); return NextResponse.json({ ok: true }); }","rule":"log_at_tool_boundary"},{"file":"src/app/preview/_report-mock.ts","lines":[149,149],"snippet":"Token: string) {\\n logger.info({\\n event: \"login.success\",\\n user, // <-- includes email + name + IP\\n sessionToken,","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[118,118],"snippet":"\": \"he(projectDir); console.log(\\\"Hacker Bob update cache cleared.\\\"); return; } usage(); process.exit(1); } main(process.argv.sli\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[127,127],"snippet":"ppet\": \"ndoff, })); console.log(JSON.stringify({ ok: true, message: \\\"post-report evidence run accepted\\\" })); process.exit(0); } con\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[136,136],"snippet":"\": \"cess.exit(2); } console.log(JSON.stringify({ ok: true, message: finalization.reason })); process.exit(0); } if (require.main === modu\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[145,145],"snippet":"et\": \"y.targetAbs); console.log(\\\"\\\"); if (summary.adapters.length === 1 && summary.adapters[0] === \\\"claude\\\") { console.log(\\\"Upd\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[145,145],"snippet":"] === \\\"claude\\\") { console.log(\\\"Upd\", \"rule\": \"log_at_tool_boundary\" }, { \"file\": \"bin/hacker-","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[444,444],"snippet":"difflib import json import logging import os import platform import subprocess import sys from pathlib import Path import openai import ty\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[453,453],"snippet":"\"ations import json import logging import os from pathlib import Path from typing import Any, List, Optional, Union import backoff import\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[507,507],"snippet":"transcripts. \\\"\\\"\\\" import logging import re from typing import Dict, Tuple from regex import regex from gpt_engineer.core.diff import AD\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[516,516],"snippet":"ode changes. \\\"\\\"\\\" import logging from collections import Counter from typing import List RETAIN = \\\"retain\\\" ADD = \\\"add\\\" REMOVE = \\\"remo","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[525,525],"snippet":"rt base64 import io import logging import math from dataclasses import dataclass from typing import List, Union import tiktoken from lang\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[462,462],"snippet":"ippet\": \"odel_name) logger.debug(f\\\"Using model {self.model_name}\\\") def start(self, system: str, user: Any, *, step_name: str) -> List[M\",","rule":"log_at_tool_boundary"}]},"oversight_hooks":{"signal":"oversight_hooks","fired":true,"strength":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[342,342],"snippet":"ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr","rule":"kill_switch"},{"file":"src/app/design-exploration/_data.ts","lines":[26,26],"snippet":", hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[350,350],"snippet":"ppet\": \"rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\\\"-\\\"): return False if token\", \"","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[351,351],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \".claude/hooks/session-read-guard.sh\", \"lines\": [","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[359,359],"snippet":"\": \"(blocked) raise SystemExit(0) command = tool_input.get(\\\"command\\\", \\\"\\\") if command: check_bash_command(command) raise SystemExit(0)\",","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[359,359],"snippet":"mand(command) raise SystemExit(0)\", \"rule\": \"kill_switch\" }, { \"file\": \".claude/hooks/session-re","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[360,360],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \".claude/hooks/session-read-guard.sh\", \"lines\": [","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[162,162],"snippet":"import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[171,171],"snippet":"import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[198,198],"snippet":"chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[207,207],"snippet":"a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\"","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[234,234],"snippet":"a import AIMessage, HumanMessage, SystemMessage from gpt_engineer.core.ai import AI from gpt_engine\", \"rule\": \"langchain_import\"","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1547,1547],"snippet":"\"rule\": \"kill_switch_present\", \"matched\": 0, \"weight\": 0.7 }, { \"rule\": \"graceful_s","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[2211,2211],"snippet":"\"rule\": \"kill_switch_present\", \"matched\": 0, \"weight\": 0.6 }, { \"rule\": \"feature_fl","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[647,647],"snippet":"# CancelledError or SystemExit log_metadata.warning( f\\\"Interruption error on node execution {node_exec.n\", \"rule\": \"kill_switch","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[648,648],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \"autogpt_platform/backend/backend/util/process.py\",","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[656,656],"snippet":"f not isinstance(e, SystemExit) else None, ) # Send error to Sentry before cleanup if not isinstance(e,\", \"rule\": \"kill_switch\"","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[657,657],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \"autogpt_platform/backend/backend/util/process.py\",","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[665,665],"snippet":"(KeyboardInterrupt, SystemExit)): try: from backend.util.metrics import sentry_capture_error\", \"rule\": \"kill_switch\" }","rule":"kill_switch"}]},"eval_artefacts":{"signal":"eval_artefacts","fired":false,"strength":0,"evidence":[]},"governance_docs":{"signal":"governance_docs","fired":true,"strength":0.7612359947967775,"evidence":[{"file":".agent/docs/README.md","rule":"governance_doc_present"},{"file":"LICENSE","rule":"governance_doc_present"},{"file":"PRIVACY.md","rule":"governance_doc_present"},{"file":"README.md","rule":"governance_doc_present"},{"file":"RISK_REGISTER.md","rule":"governance_doc_present"},{"file":"SECURITY.md","rule":"governance_doc_present"},{"file":"contracts/README.md","rule":"governance_doc_present"},{"file":"regulations/README.md","rule":"governance_doc_present"}]},"cybersec_hooks":{"signal":"cybersec_hooks","fired":true,"strength":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1127,1127],"snippet":"ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr","rule":"rate_limit_usage"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[344,344],"snippet":"(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1121,1121],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1124,1124],"snippet":"Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1135,1135],"snippet":"Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1143,1143],"snippet":"hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to","rule":"prompt_injection_defence"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[264,264],"snippet":"0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0.","rule":"rate_limit_usage"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[260,260],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -","rule":"prompt_injection_defence"},{"file":"src/app/preview/_report-mock.ts","lines":[341,341],"snippet":"entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\",","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[483,483],"snippet":", reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[485,485],"snippet":"id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k","rule":"rate_limit_usage"},{"file":"src/config.ts","lines":[38,38],"snippet":"ing | undefined = process.env.GITHUB_API_TOKEN || process.env.GITHUB_TOKEN || undefined; // ---------------------------------------------","rule":"secrets_loaded_from_env"},{"file":"src/config.ts","lines":[38,38],"snippet":"GITHUB_API_TOKEN || process.env.GITHUB_TOKEN || undefined; // -----------------------------------------------------------------------------","rule":"secrets_loaded_from_env"},{"file":"src/config.ts","lines":[46,46],"snippet":"tring | undefined = process.env.ANTHROPIC_API_KEY; // ----------------------------------------------------------------------------- // Stor","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\",","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"nst sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\", \"rule\": \"rate_limit_usage\" }, {","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[492,492],"snippet":"\"rule\": \"rate_limit_usage\" }, { \"file\": \".claude/hooks/bounty-statusline.js\", \"lines\"","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[500,500],"snippet":"nst sevenDay = data.rate_limits?.seven_day?.used_percentage; const worst = Math.max(fiveHr || 0, sevenDay || 0); if (worst >= 80) ra\",","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[501,501],"snippet":"\"rule\": \"rate_limit_usage\" }, { \"file\": \"mcp/lib/evm-source.js\", \"lines\": [","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[2355,2355],"snippet":"\"rule\": \"prompt_injection_defences\", \"matched\": 0, \"weight\": 0.4 }, { \"rule\": \"rate","rule":"prompt_injection_defence"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[2764,2764],"snippet":"\"rule\": \"prompt_injection_defences\", \"matched\": 0, \"weight\": 0.4 }, { \"rule\": \"adve","rule":"prompt_injection_defence"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[509,509],"snippet":"t\": \"const apiKey = process.env.BOB_ETHERSCAN_API_KEY || null; const etherscan = await fetchFromEtherscanV2(numericChainId, lower, apiKe\",","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[518,518],"snippet":"\"capsolver_api_key: process.env.CAPSOLVER_API_KEY || null, proxy: args.proxy || process.env.BOUNTY_PROXY || null, timeout_ms: args.t\",","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[572,572],"snippet":"\": \"romium`); } if (process.env.CAPSOLVER_API_KEY) { console.log(\\\" OK: CAPSOLVER_API_KEY is set\\\"); } else { console.log(\\\" NOT SE\",","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[581,581],"snippet":"\": \"abled\\\"); } if (process.env.CAPSOLVER_API_KEY) { addCheck(checks, \\\"ok\\\", \\\"optional_capsolver\\\", \\\"CAPSOLVER_API_KEY is set\\\"); } else\"","rule":"secrets_loaded_from_env"}]},"provenance_hooks":{"signal":"provenance_hooks","fired":true,"strength":0.9446911344070372,"evidence":[{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"},{"file":".agent/docs/llm-judge-policy.md","lines":[78,78],"snippet":"` | 50(2) | **1** | C2PA / watermark library imports | | `art-50/p3-emotion-biometric-disclosure` | 50(3) | **1** | Deterministic disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/pipeline-design.md","lines":[75,75],"snippet":"ovenance_hooks` | C2PA, watermarking, content labelling | Article 50(2) synthetic content disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[63,63],"snippet":"o/text) | C | C2PA / watermarking libraries; metadata writers; output post-processing. | | 50(3) | Emotion-recognition / biometri","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[175,175],"snippet":"ntent> | Drives the C2PA / watermarking signal expectations for clause 50(2). | 2026-05-17 | | 10 | *AI Act Service Desk* + FAQs — <https://","rule":"c2pa_or_watermark"},{"file":".agent/docs/roadmap.md","lines":[341,341],"snippet":"Output provenance | C2PA / watermark library imported and applied | | **6** | Continual re-rating | V1.9 reproducibility — score recomputabl","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1367,1367],"snippet":"ic: - rule: c2pa_or_watermark_library_imported weight: 0.5 description: | Code imports a content-pro","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1370,1370],"snippet":"provenance library: c2pa, opencv c2pa bindings, invisible-watermark, stable-signature, synthid. - rule: provenance_metad","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1370,1370],"snippet":"brary: c2pa, opencv c2pa bindings, invisible-watermark, stable-signature, synthid. - rule: provenance_metadata_written_t","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1371,1371],"snippet":"bindings, invisible-watermark, stable-signature, synthid. - rule: provenance_metadata_written_to_outputs weight:","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1371,1371],"snippet":"nvisible-watermark, stable-signature, synthid. - rule: provenance_metadata_written_to_outputs weight: 0.5 descri","rule":"c2pa_or_watermark"},{"file":"regulations/schema.md","lines":[103,103],"snippet":"provenance_hooks` | C2PA, watermarking, content provenance | | `data_io` | Network calls, file I/O, scrapers | | `pii_signals` | PII pattern","rule":"c2pa_or_watermark"},{"file":"src/app/preview/_report-mock.ts","lines":[172,172],"snippet":"/provenance hooks (`c2pa`, `provenance`, `aiGenerated`, `synthid`) — none fire. The response handler ships raw model output through `res.jso","rule":"c2pa_or_watermark"},{"file":"src/app/preview/_report-mock.ts","lines":[172,172],"snippet":"e`, `aiGenerated`, `synthid`) — none fire. The response handler ships raw model output through `res.json(...)` with no wrapper.\", ar","rule":"c2pa_or_watermark"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1915,1915],"snippet":"\"rule\": \"c2pa_or_watermark_library_imported\", \"matched\": 0, \"weight\": 0.5 }, { \"rul","rule":"c2pa_or_watermark"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[3545,3545],"snippet":"\"rule\": \"c2pa_or_watermark_library_imported\", \"matched\": 0, \"weight\": 0.5 }, { \"rul","rule":"c2pa_or_watermark"},{"file":"src/pipeline/checkers/rules.ts","lines":[724,724],"snippet":"ing, }; }, c2pa_or_watermark_library_imported: (ctx) => fromSignal(pickSig(ctx, \"provenance_hooks\")), provenance_metadata_wr","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[184,184],"snippet":"if (lower.includes(\"c2pa\") || lower.includes(\"invisible-watermark\") || lower.includes(\"synthid\")) { acc.provenance_hooks.push({ file, ru","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[184,184],"snippet":"|| lower.includes(\"invisible-watermark\") || lower.includes(\"synthid\")) { acc.provenance_hooks.push({ file, rule: \"manifest_provenance_d","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[184,184],"snippet":"|| lower.includes(\"synthid\")) { acc.provenance_hooks.push({ file, rule: \"manifest_provenance_dep\" }); } if (lower.includes(\"expres","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[311,311],"snippet":"ance_hooks\", rule: \"c2pa_or_watermark\", pattern: /\\b(?:c2pa|invisible[_-]?watermark|stable[_-]?signature|synthid|watermark_image|watermark_t","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[311,311],"snippet":"rk\", pattern: /\\b(?:c2pa|invisible[_-]?watermark|stable[_-]?signature|synthid|watermark_image|watermark_text)/gi }, // ----- pii_signals","rule":"c2pa_or_watermark"}]},"data_io":{"signal":"data_io","fired":true,"strength":1,"evidence":[{"file":"package-lock.json","lines":[3913,3913],"snippet":"\"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4","rule":"scraping_pattern"},{"file":"package-lock.json","lines":[3923,3923],"snippet":"}, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":","rule":"scraping_pattern"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[229,229],"snippet":"cts scraping loops (requests.get / fetch / playwright in iteration) targeting image content combined with face-detection","rule":"http_external_io"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[229,229],"snippet":"uests.get / fetch / playwright in iteration) targeting image content combined with face-detection calls (mediapipe,","rule":"scraping_pattern"},{"file":"src/app/_components/audit-panel.tsx","lines":[94,94],"snippet":"const res = await fetch(`/api/audit/${state.auditId}`); if (!res.ok) return; const next = (await res.json()) as PipelineSt","rule":"http_external_io"},{"file":"src/app/_components/audit-panel.tsx","lines":[109,109],"snippet":"const res = await fetch(\"/api/audit/run\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/_components/intake-form.tsx","lines":[58,58],"snippet":"celled = false; fetch(\"/api/regulations\") .then((r) => r.json()) .then((d: { regulations: RegulationSummary[] }) => {","rule":"http_external_io"},{"file":"src/app/_components/intake-form.tsx","lines":[87,87],"snippet":"const res = await fetch(\"/api/resolve\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" }, b","rule":"http_external_io"},{"file":"src/app/_components/live-audit-panel.tsx","lines":[325,325],"snippet":"const res = await fetch(\"/api/audit/stream\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/_components/live-audit-panel.tsx","lines":[906,906],"snippet":"{ try { await fetch(\"/api/audit/publish\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" }, body: J","rule":"http_external_io"},{"file":"src/app/_components/private-repo-connect.tsx","lines":[38,38],"snippet":"const res = await fetch(\"/api/auth/github/device\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/_components/private-repo-connect.tsx","lines":[83,83],"snippet":"const res = await fetch(\"/api/auth/github/poll\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/api/auth/github/device/route.ts","lines":[27,27],"snippet":"const res = await fetch(\"https://github.com/login/device/code\", { method: \"POST\", headers: { Accept: \"application/json\",","rule":"http_external_io"},{"file":"src/app/api/auth/github/poll/route.ts","lines":[55,55],"snippet":"const res = await fetch(\"https://github.com/login/oauth/access_token\", { method: \"POST\", headers: { Accept: \"application/jso","rule":"http_external_io"},{"file":"src/app/audit/[auditId]/_live-status.tsx","lines":[38,38],"snippet":"const res = await fetch(`/api/audit/${state.auditId}`); if (!res.ok) return; const next = (await res.json()) as State;","rule":"http_external_io"},{"file":"src/app/audit/[auditId]/complete/_attestation-form.tsx","lines":[116,116],"snippet":"const res = await fetch(`/api/audit/${auditId}/attestation`, { method: \"POST\", headers: { \"Content-Type\": \"application/jso","rule":"http_external_io"},{"file":"src/app/r/[owner]/[repo]/page.tsx","lines":[40,40],"snippet":"const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, { headers: { Accept: \"application/vnd.github+json\" },","rule":"http_external_io"},{"file":"src/components/audit/audit-start-picker.tsx","lines":[39,39],"snippet":"celled = false; fetch(\"/api/regulations\") .then((r) => r.json()) .then((d: { regulations: RegulationSummary[] }) => {","rule":"http_external_io"},{"file":"src/components/audit/live-audit-dashboard.tsx","lines":[85,85],"snippet":"const res = await fetch(\"/api/audit/stream\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" }, bo","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[612,612],"snippet":"\"createResp = await fetch(\\\"https://api.capsolver.com/createTask\\\", { method: \\\"POST\\\", headers: { \\\"Content-Type\\\": \\\"application/json\\\" },","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[621,621],"snippet":"st pollResp = await fetch(\\\"https://api.capsolver.com/getTaskResult\\\", { method: \\\"POST\\\", headers: { \\\"Content-Type\\\": \\\"application/j\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[630,630],"snippet":"\"const resp = await fetch(url, { method: \\\"GET\\\", headers: { Accept: \\\"application/json\\\", \\\"User-Agent\\\": \\\"Mozilla/5.0 (compatible; h\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[639,639],"snippet":"\"const resp = await fetch(url, { method: \\\"GET\\\", headers: { Accept: \\\"application/json\\\", \\\"User-Agent\\\": \\\"Mozilla/5.0 (compatible; h\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[648,648],"snippet":"\"const resp = await fetch(url, { method: \\\"POST\\\", headers: { \\\"Content-Type\\\": \\\"application/json\\\", Accept: \\\"application/json\\\", \\\"Use\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[796,796],"snippet":"\"\\\"\\\"\\\" response = requests.post(url, json=extra_arguments) return response if __name__ == \\\"__main__\\\": URL_BASE = \\\"http://127.0.0\",","rule":"http_external_io"}]},"pii_signals":{"signal":"pii_signals","fired":true,"strength":1,"evidence":[{"file":".agent/design-system/version.json","lines":[13,13],"snippet":"ates (landing page, email, social)\", \"Tone-of-voice matrix by context (product UI, marketing, docs, support)\" ] }, {","rule":"pii_keywords"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[290,290],"snippet":"description: \"Code redacts or hashes PII before logging or sending to external models\" - rule: privacy_documentation weig","rule":"pii_redaction_present"},{"file":"src/app/api/waitlist/route.ts","lines":[17,17],"snippet":"00 }); } const email = typeof body === \"object\" && body !== null && \"email\" in body ? (body as { email: unknown }).email","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[18,18],"snippet":"& body !== null && \"email\" in body ? (body as { email: unknown }).email : null; const auditRef = typeof body === \"object\"","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[19,19],"snippet":"? (body as { email: unknown }).email : null; const auditRef = typeof body === \"object\" && body !== null && \"audit_ref\" in","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[19,19],"snippet":"{ email: unknown }).email : null; const auditRef = typeof body === \"object\" && body !== null && \"audit_ref\" in body ? (bod","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[26,26],"snippet":"null; if (typeof email !== \"string\" || !EMAIL_RE.test(email)) { return NextResponse.json({ error: \"Provide a valid email.\" }, { statu","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[137,137],"snippet":"include the user's email and a partial token in structured log output.\", reasoning: \"The login handler logs the entire `user` objec","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[149,149],"snippet":"// <-- includes email + name + IP\\n sessionToken, // <-- token persisted to log sink for 30d\\n });\\n}', }, ],","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[239,239],"snippet":"ainers`, or contact email.\", reasoning: \"ISO 42001 §A.3.2 requires a designated AI accountability owner. We checked package.json, CO","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[352,352],"snippet":"es) => {\\n const { email, password } = req.body;\\n const user = await users.verify(email, password);\\n if (!user) return res.status(401).","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[352,352],"snippet":"await users.verify(email, password);\\n if (!user) return res.status(401).end();\\n const token = await issueSession(user);\\n return res.j","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[697,697],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 43, 43 ], \"snippet\": \"domainResp =","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[706,706],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 56, 56 ], \"snippet\": \"createResp =","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[715,715],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 64, 64 ], \"snippet\": \"t tokenResp","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[724,724],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 78, 78 ], \"snippet\": \"const resp =","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[733,733],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 110, 110 ], \"snippet\": \"const resp","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[817,817],"snippet":"p \\\"$SCRIPT_DIR/mcp/redaction.js\\\" \\\"$TARGET_ABS/mcp/\\\" cp \\\"$SCRIPT_DIR/mcp/lib/\\\"*.js \\\"$TARGET_ABS/mcp/lib/\\\" rm -rf \\\"$TARGET_ABS/mcp/li","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[826,826],"snippet":"t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\\\"foot\\\"><span\", \"rule\": \"","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[835,835],"snippet":"h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\\\"code-card\\\"> <div\", \"rule\": \"pii_red","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[844,844],"snippet":"n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\\\"slide\\\" data-title=\\\"Egress\\\"> <\", \"r","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[853,853],"snippet":"b collects bounded, redacted evidence packs for final reportable findings.</p> <div class=\\\"pill-row\\\"> <span class=\\\"pil\", \"rul","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[728,728],"snippet":"\"snippet\": \"strip() email = input(\\\"What's your email? \\\").strip() url = \\\"https://neyguovvcjxfzhqpkicj.supabase.co/functions/v1/a\",","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[728,728],"snippet":"input(\\\"What's your email? \\\").strip() url = \\\"https://neyguovvcjxfzhqpkicj.supabase.co/functions/v1/a\", \"rule\": \"pii_keywords\"","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[737,737],"snippet":"input(\\\"What's your email? \\\").strip() url = \\\"https://neyguovvcjxfzhqpkicj.supabase.co/functions/v1/addEmailToWaitlist\\\"\", \"rul","rule":"pii_keywords"}]},"bio_health_signals":{"signal":"bio_health_signals","fired":true,"strength":0.7380392160057028,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1568,1568],"snippet":"ars to 3 years*\\\\n- Patient outcomes improved across `87%` of pilot programs\\\\n\\\\n> AI is not replacing doctors — it's augmenting their capa","rule":"health_terms"},{"file":"src/pipeline/run.ts","lines":[369,369],"snippet":"_signals: \"Health / clinical data\", employment_signals: \"Employment / HR\", bio_metric_signals: \"Biometrics\", education_signals:","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"ms\", pattern: /\\b(?:patient|diagnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"tern: /\\b(?:patient|diagnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, //","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"?:patient|diagnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, // ----- empl","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"gnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, // ----- employment_signal","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"escription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, // ----- employment_signals -----","rule":"health_terms"}]},"employment_signals":{"signal":"employment_signals","fired":true,"strength":0.9021090020413225,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ppet\": \"OMMANDS for candidate in tokens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employme","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employment_terms\" }, {","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1010,1010],"snippet":"\"snippet\": \"1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break for path_candidate in candidate_paths(candidate):\", \"rule","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1010,1010],"snippet":"in candidate_paths(candidate):\", \"rule\": \"employment_terms\" }, { \"file\": \".claude/hooks/session","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1019,1019],"snippet":"\"in candidate_paths(candidate): blocked = check_file(path_candidate, block_session_dirs=block_session_dirs)\", \"rule\": \"employmen","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[824,824],"snippet":"e is that, for each candidate check match to the next line etc (recursively) start_ind = list(pot_start_lines.keys())[\", \"rule\":","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[966,966],"snippet":"t a conversation to resume. \\\"\\\"\\\" ) # Check if conversations directory exists if not os.path.exists(conversations_dir):\", \"rule","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[975,975],"snippet":"st conversations to resume\\\", \\\"type\\\": bool, }, { \\\"name\\\": \\\"server\\\", \\\"help_text\\\": \\\"start op\", \"rule\": \"employment_terms\"","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1584,1584],"snippet":"tart claude using --resume SESSION_ID (or --continue) to restore context # approve → auto-approve safe dialogs, press Enter on numbered-op\",","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1593,1593],"snippet":"e still busy before resume, sending anyway\\\" # Resume the exact session so the agent retains full context — no need to re-send objective\",","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1593,1593],"snippet":"sending anyway\\\" # Resume the exact session so the agent retains full context — no need to re-send objective\", \"rule\": \"employm","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1602,1602],"snippet":"\"ending anyway\\\" # Resume the exact session so the agent retains full context — no need to re-send objective if [ -n \\\"$session_id\\\" ]; the","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1611,1611],"snippet":"_path}' && claude --resume '${session_id}' --permission-mode bypassPermissions\\\" Enter else tmux send-keys -t \\\"$window\\\" \\\"cd '${worktree\",","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"ms\", pattern: /\\b(?:resume|curriculum_vitae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interv","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"ttern: /\\b(?:resume|curriculum_vitae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_sco","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"iculum_vitae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_score)\\b/gi }, // -----","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"ae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_score)\\b/gi }, // ----- bio_metric","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_score)\\b/gi }, // ----- bio_metric_signals -","rule":"employment_terms"}]},"bio_metric_signals":{"signal":"bio_metric_signals","fired":true,"strength":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[32,32],"snippet":"\" description: \"Biometric ID, categorisation, emotion recognition\" - signal: critical_infra_signals category: \"2\" description:","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[62,62],"snippet":"otion recognition / biometric categorisation\" - signal: agent_framework # any interactive AI is in scope paragraph: \"50(1)\"","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[231,231],"snippet":"calls (mediapipe, face_recognition, dlib, opencv haar cascade). score_mapping: { pass_default: 4, fail_on_match: 0 } remediation_h","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[262,262],"snippet":"eu-ai-act/art-5/1g-biometric-categorisation clause_id_bytes: 0x0C57 article: \"5(1)(g)\" title: \"Biometric categorisation by prot","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[265,265],"snippet":"(1)(g)\" title: \"Biometric categorisation by protected attributes\" principle: fairness subject: [provider, deployer] classifi","rule":"biometric_terms"},{"file":"src/app/docs/methodology/page.tsx","lines":[29,29],"snippet":"ks, eval_artefacts, biometric, employment, content_generation, and so on. Each match contributes evidence to one or more signals.\", outp","rule":"biometric_terms"},{"file":"src/app/docs/rating/page.tsx","lines":[139,139],"snippet":"one (e.g. real-time biometric ID in public spaces: deployment context required). Surfaced to the human reviewer separate","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1233,1233],"snippet":"\"system Chrome (TLS fingerprint, fonts, WebGL match) // 3. Headed mode — avoids headless signals // 4. ignoreDefaultArgs: ['--enable-aut\",","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1242,1242],"snippet":"-index.js\\\"); const FINGERPRINT = `bobpriortest${crypto.randomBytes(6).toString(\\\"hex\\\")}`; function uniqueDomain(prefix = \\\"bob-priors-test","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1251,1251],"snippet":"ppet\": \", title: `${FINGERPRINT} IDOR on user profile endpoint`, description: `${FINGERPRINT} broken object level authorization`,\",","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1251,1251],"snippet":"t`, description: `${FINGERPRINT} broken object level authorization`,\", \"rule\": \"biometric_terms\" }, {","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1260,1260],"snippet":"\": \"description: `${FINGERPRINT} broken object level authorization`, severity: \\\"high\\\", attack_class: \\\"idor\\\", endpoin\", \"rule","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1048,1048],"snippet":"\"eu-ai-act/art-5/1g-biometric-categorisation\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"5(1)(g)\", \"title\": \"Biomet","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1051,1051],"snippet":")\", \"title\": \"Biometric categorisation by protected attributes\", \"verdict\": \"pass\", \"score\": 4, \"rawScore\": 0,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1073,1073],"snippet":": \"Real-time remote biometric identification in public spaces\", \"verdict\": \"external\", \"score\": null, \"rawScore\": null,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1892,1892],"snippet":"t/art-50/p3-emotion-biometric-disclosure\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"50(3)\", \"title\": \"Emotion reco","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1895,1895],"snippet":"otion recognition / biometric categorisation disclosure\", \"verdict\": \"n/a\", \"score\": null, \"rawScore\": null, \"eviden","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1100,1100],"snippet":"\"Annex III §1 (Biometric ID, categorisation, emotion recognition) — signal \\\"bio_metric_signals\\\" fired with strength 0.40\", \"Ann","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1245,1245],"snippet":"\"eu-ai-act/art-5/1g-biometric-categorisation\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"5(1)(g)\", \"title\": \"Biomet","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1248,1248],"snippet":")\", \"title\": \"Biometric categorisation by protected attributes\", \"verdict\": \"pass\", \"score\": 4, \"rawScore\": 0,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1270,1270],"snippet":": \"Real-time remote biometric identification in public spaces\", \"verdict\": \"external\", \"score\": null, \"rawScore\": null,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1932,1932],"snippet":"t/art-50/p3-emotion-biometric-disclosure\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"50(3)\", \"title\": \"Emotion reco","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1816,1816],"snippet":"et\": \"@property def voice_id(self): voice_id_map = { Voice.LILY: \\\"pFZP5JQG7iQjIQuC4Bku\\\", Voice.DANIEL: \\\"onwK\", \"rule\": \"biome","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1825,1825],"snippet":"\": input_data.voice.voice_id, \\\"hasEnhancedGeneration\\\": True, \\\"generationPreset\\\": input_data.generation_prese\", \"rule\": \"biom","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1834,1834],"snippet":"\": input_data.voice.voice_id, \\\"selectedAvatar\\\": \\\"https://cdn.revid.ai/avatars/young-woman.mp4\\\", \\\"selectedAva\", \"rule\": \"bio","rule":"biometric_terms"}]},"education_signals":{"signal":"education_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"ms\", pattern: /\\b(?:student_grade|admissions_decision|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"/\\b(?:student_grade|admissions_decision|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // -----","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"admissions_decision|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // ----- law_enforcement_sig","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"ion|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // ----- law_enforcement_signals ----- { s","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"oring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // ----- law_enforcement_signals ----- { signal: \"law_en","rule":"education_terms"}]},"law_enforcement_signals":{"signal":"law_enforcement_signals","fired":true,"strength":0.7612359947967775,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[199,199],"snippet":"crime-likelihood / recidivism / \"risk to commit X\" scores when the input contains only person profile data (no obje","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"names like `crime_risk`, `recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pa","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pass_default: 4, fail_on_match: 0 }","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ms\", pattern: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migr","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"n: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signa","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals -----","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals ----- { signal: \"migration","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals ----- { signal: \"migration_signals\", rule:","rule":"law_enf_terms"}]},"migration_signals":{"signal":"migration_signals","fired":true,"strength":0.7112605001534575,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[50,50],"snippet":"iption: \"Migration, asylum, border control management\" - signal: justice_signals category: \"8\" description: \"Administration of jus","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"ms\", pattern: /\\b(?:visa_application|asylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal:","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"(?:visa_application|asylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"_application|asylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals\", rule","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"ylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals\", rule: \"justice_term","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"trol|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals\", rule: \"justice_terms\", pattern: /\\","rule":"migration_terms"}]},"justice_signals":{"signal":"justice_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"ms\", pattern: /\\b(?:legal_ruling|verdict_predict|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_serv","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"/\\b(?:legal_ruling|verdict_predict|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"ing|verdict_predict|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals ----- { signal","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"t|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals ----- { signal: \"essential_servi","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals ----- { signal: \"essential_services_signals\", rule:","rule":"justice_terms"}]},"essential_services_signals":{"signal":"essential_services_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"ms\", pattern: /\\b(?:credit_score|loan_decision|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_sign","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"/\\b(?:credit_score|loan_decision|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- {","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"score|loan_decision|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- { signal: \"crit","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"n|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- { signal: \"critical_infra_signals","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- { signal: \"critical_infra_signals\", rule: \"infra_term","rule":"essential_terms"}]},"critical_infra_signals":{"signal":"critical_infra_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"ms\", pattern: /\\b(?:scada|industrial_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"attern: /\\b(?:scada|industrial_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_genera","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"|industrial_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_generation_signals -----","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_generation_signals ----- { signal:","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"rid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_generation_signals ----- { signal: \"content_genera","rule":"infra_terms"}]},"content_generation_signals":{"signal":"content_generation_signals","fired":true,"strength":0.8704365036222725,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1038,1038],"snippet":"01 supports OpenAI, ElevenLabs, and Coqui (Local) TTS providers # {OpenAI: \\\"openai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpr","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1038,1038],"snippet":"OpenAI: \\\"openai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.t\", \"rule\": \"content_gen_pattern\" },","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1038,1038],"snippet":"ai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.t\", \"rule\": \"content_gen_pattern\" }, {","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1047,1047],"snippet":"OpenAI: \\\"openai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.tts = \\\"openai\\\" # Connect your 01 to a language model interpr","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1047,1047],"snippet":"ai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.tts = \\\"openai\\\" # Connect your 01 to a language model interpreter.\",","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1933,1933],"snippet":"ield( description=\\\"ElevenLabs voice ID\\\", default=\\\"21m00Tcm4TlvDq8ikWAM\\\",\", \"rule\": \"biometric_terms\" },","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1942,1942],"snippet":"narration audio via ElevenLabs API.\\\"\\\"\\\" client =\", \"rule\": \"biometric_terms\" }, { \"file\": \"aut","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[2084,2084],"snippet":": \"( \\\"/submissions/generate_image\\\", summary=\\\"Generate submission image\\\", tags=[\\\"store\\\", \\\"private\\\"], dependencies=[Security(auto\",","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[2093,2093],"snippet":"user)], ) async def generate_image( graph_id: str, user_id: str = Security(autogpt_libs.auth.get_user_id), ) -> ImageURLResponse:\",","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[2102,2102],"snippet":"\": \"e}\\\") async def generate_image(self, input_data: Input, credentials: APIKeyCredentials): try: # Handle style-based p\", \"rule","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"rn\", pattern: /\\b(?:generate_image|stable[_-]?diffusion|dall-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"]?diffusion|dall-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"|dall-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice_clone)\\b/g","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice_clone)\\b/gi },","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"s|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice_clone)\\b/gi }, // ----- emotion_recogniti","rule":"content_gen_pattern"}]},"emotion_recognition_signals":{"signal":"emotion_recognition_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"ms\", pattern: /\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ---","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"ion|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_io\", rule: \"http","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_io\", rule: \"http_external_io\", patt","rule":"emotion_terms"}]}}},"scope":{"regulationIds":["eu-ai-act-2024-08","nist-ai-rmf-1.0","iso-42001-2023","gdpr-2016"],"notes":["Auditing against packs: eu-ai-act-2024-08, nist-ai-rmf-1.0, iso-42001-2023, gdpr-2016"]},"map":{"classification":"high","annexIiiCategories":["1","2","3","4","5","6","7","8"],"art50Triggers":["50(2)","50(3)","50(1)"],"drivingSignals":[{"signal":"bio_metric_signals","category":"1"},{"signal":"critical_infra_signals","category":"2"},{"signal":"education_signals","category":"3"},{"signal":"employment_signals","category":"4"},{"signal":"essential_services_signals","category":"5"},{"signal":"law_enforcement_signals","category":"6"},{"signal":"migration_signals","category":"7"},{"signal":"justice_signals","category":"8"}],"rationale":["Classified HIGH-RISK based on 8 Annex III signal(s).","Annex III §1 (Biometric ID, categorisation, emotion recognition) — signal \"bio_metric_signals\" fired with strength 1.00","Annex III §2 (Management and operation of critical infrastructure) — signal \"critical_infra_signals\" fired with strength 0.68","Annex III §3 (Education and vocational training (admissions, scoring, monitoring)) — signal \"education_signals\" fired with strength 0.68","Annex III §4 (Employment, workers management, access to self-employment) — signal \"employment_signals\" fired with strength 0.90","Annex III §5 (Access to and enjoyment of essential private and public services) — signal \"essential_services_signals\" fired with strength 0.68","Annex III §6 (Law enforcement) — signal \"law_enforcement_signals\" fired with strength 0.76","Annex III §7 (Migration, asylum, border control management) — signal \"migration_signals\" fired with strength 0.71","Annex III §8 (Administration of justice and democratic processes) — signal \"justice_signals\" fired with strength 0.68","Art 50 50(2) (AI-generated synthetic content) — signal \"content_generation_signals\" fired","Art 50 50(3) (Emotion recognition / biometric categorisation) — signal \"emotion_recognition_signals\" fired","Art 50 50(1) (Interaction with natural persons) — signal \"agent_framework\" fired"]},"checks":[{"clauseId":"eu-ai-act/art-5/1a-subliminal","regulationId":"eu-ai-act-2024-08","article":"5(1)(a)","title":"Subliminal techniques distorting behaviour","principle":"transparency","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_manipulative_prompt_patterns","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1b-vulnerability","regulationId":"eu-ai-act-2024-08","article":"5(1)(b)","title":"Exploiting vulnerabilities (age, disability, socio-economic)","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_protected_attribute_targeting","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1c-social-scoring","regulationId":"eu-ai-act-2024-08","article":"5(1)(c)","title":"Social scoring leading to detrimental treatment","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_scoring_with_persistent_user_state","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1d-predictive-policing","regulationId":"eu-ai-act-2024-08","article":"5(1)(d)","title":"Predictive policing solely from profiling","principle":"fairness","verdict":"fail","score":0,"rawScore":0.7612359947967775,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[199,199],"snippet":"crime-likelihood / recidivism / \"risk to commit X\" scores when the input contains only person profile data (no obje","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"names like `crime_risk`, `recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pa","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pass_default: 4, fail_on_match: 0 }","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ms\", pattern: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migr","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"n: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signa","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals -----","rule":"law_enf_terms"}],"rules":[{"rule":"detect_crime_risk_scoring_from_profile","matched":0.7612359947967775,"weight":1}],"rationale":"Composite raw score 0.76 (1/1 rules matched).","confidence":0.7887640052032225,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1e-facial-scraping","regulationId":"eu-ai-act-2024-08","article":"5(1)(e)","title":"Untargeted facial image scraping for face databases","principle":"privacy","verdict":"fail","score":0,"rawScore":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[32,32],"snippet":"\" description: \"Biometric ID, categorisation, emotion recognition\" - signal: critical_infra_signals category: \"2\" description:","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[62,62],"snippet":"otion recognition / biometric categorisation\" - signal: agent_framework # any interactive AI is in scope paragraph: \"50(1)\"","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[231,231],"snippet":"calls (mediapipe, face_recognition, dlib, opencv haar cascade). score_mapping: { pass_default: 4, fail_on_match: 0 } remediation_h","rule":"biometric_terms"},{"file":"package-lock.json","lines":[3913,3913],"snippet":"\"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4","rule":"scraping_pattern"},{"file":"package-lock.json","lines":[3923,3923],"snippet":"}, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":","rule":"scraping_pattern"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[229,229],"snippet":"uests.get / fetch / playwright in iteration) targeting image content combined with face-detection calls (mediapipe,","rule":"scraping_pattern"}],"rules":[{"rule":"detect_face_image_scraping","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu","regulationId":"eu-ai-act-2024-08","article":"5(1)(f)","title":"Emotion recognition in workplace and education","principle":"privacy","verdict":"fail","score":0,"rawScore":1,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"ms\", pattern: /\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ---","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_","rule":"emotion_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ppet\": \"OMMANDS for candidate in tokens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employme","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employment_terms\" }, {","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1010,1010],"snippet":"\"snippet\": \"1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break for path_candidate in candidate_paths(candidate):\", \"rule","rule":"employment_terms"}],"rules":[{"rule":"detect_emotion_recognition_in_workplace_education","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1g-biometric-categorisation","regulationId":"eu-ai-act-2024-08","article":"5(1)(g)","title":"Biometric categorisation by protected attributes","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_biometric_categorisation_by_protected_attrs","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","regulationId":"eu-ai-act-2024-08","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","principle":"privacy","verdict":"external","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-9/risk-management","regulationId":"eu-ai-act-2024-08","article":"9","title":"Risk management system established, implemented, documented","principle":"safety","verdict":"partial","score":2,"rawScore":0.55,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"SECURITY.md","rule":"presence_of_threat_model"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.4},{"rule":"presence_of_threat_model","matched":0.5,"weight":0.3},{"rule":"ci_eval_gates","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.55 (2/3 rules matched). Supporting docs may exist outside the repo.","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-10/data-governance","regulationId":"eu-ai-act-2024-08","article":"10","title":"Data and data governance practices documented","principle":"privacy","verdict":"fail","score":0,"rawScore":0.1,"evidence":[{"file":"package-lock.json","lines":[3913,3913],"snippet":"\"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4","rule":"scraping_pattern"},{"file":"package-lock.json","lines":[3923,3923],"snippet":"}, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":","rule":"scraping_pattern"}],"rules":[{"rule":"presence_of_data_card","matched":0,"weight":0.5},{"rule":"data_loading_code_quality","matched":0.4,"weight":0.25},{"rule":"bias_evaluation_present","matched":0,"weight":0.25}],"rationale":"Composite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.75,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-11/technical-documentation","regulationId":"eu-ai-act-2024-08","article":"11","title":"Technical documentation drawn up before placing on market","principle":"auditability","verdict":"fail","score":1,"rawScore":0.15,"evidence":[{"file":"README.md","rule":"readme_quality","detail":"2 required sections present"}],"rules":[{"rule":"presence_of_model_card","matched":0,"weight":0.5},{"rule":"readme_quality","matched":0.5,"weight":0.3},{"rule":"architecture_docs","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.15 (1/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.8,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-12/p1-automatic-logs","regulationId":"eu-ai-act-2024-08","article":"12(1)","title":"Automatic recording of events over the lifetime","principle":"auditability","verdict":"partial","score":2,"rawScore":0.5800000000000001,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[68,68],"snippet":"evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase=","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[69,69],"snippet":"t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[70,70],"snippet":"= \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[6,6],"snippet":"lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"}],"rules":[{"rule":"structured_logging_imported","matched":0,"weight":0.3},{"rule":"logging_at_tool_call_boundaries","matched":1,"weight":0.5},{"rule":"logging_persistent_sink","matched":0.4,"weight":0.2}],"rationale":"Composite raw score 0.58 (1/3 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-12/p2-traceability","regulationId":"eu-ai-act-2024-08","article":"12(2)","title":"Logging ensures traceability appropriate to risk","principle":"auditability","verdict":"pass","score":3,"rawScore":0.675,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[68,68],"snippet":"evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase=","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[69,69],"snippet":"t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[70,70],"snippet":"= \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[6,6],"snippet":"lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"}],"rules":[{"rule":"logs_include_input_output_pairs","matched":1,"weight":0.5},{"rule":"logs_include_model_identity","matched":0.7,"weight":0.25},{"rule":"logs_include_request_id","matched":0,"weight":0.25}],"rationale":"Composite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.975,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-13/deployer-instructions","regulationId":"eu-ai-act-2024-08","article":"13","title":"Transparent operation and instructions for use","principle":"transparency","verdict":"fail","score":1,"rawScore":0.25,"evidence":[{"file":"README.md","rule":"readme_quality","detail":"2 required sections present"},{"file":"README.md","rule":"output_interpretation_guidance"},{"file":"README.md","rule":"limitations_section_present"}],"rules":[{"rule":"presence_of_deployer_instructions","matched":0.5,"weight":0.5},{"rule":"output_interpretation_guidance","matched":0,"weight":0.3},{"rule":"limitations_section_present","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p1-oversight-measures","regulationId":"eu-ai-act-2024-08","article":"14(1)","title":"Effective human oversight designed and built-in","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[162,162],"snippet":"import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[171,171],"snippet":"import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[198,198],"snippet":"chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[207,207],"snippet":"a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\"","rule":"human_in_loop"}],"rules":[{"rule":"human_in_loop_hooks_present","matched":1,"weight":0.5},{"rule":"oversight_ui_present","matched":0,"weight":0.3},{"rule":"tool_calls_have_dry_run","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.50 (1/3 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-14/p4d-stop-button","regulationId":"eu-ai-act-2024-08","article":"14(4)(d)","title":"Interrupt / stop function reachable by overseer","principle":"human-oversight","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[342,342],"snippet":"ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr","rule":"kill_switch"},{"file":"src/app/design-exploration/_data.ts","lines":[26,26],"snippet":", hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },","rule":"kill_switch"}],"rules":[{"rule":"kill_switch_present","matched":1,"weight":0.7},{"rule":"graceful_shutdown_handler","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.70 (1/2 rules matched).","confidence":0.9,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-14/p4e-override","regulationId":"eu-ai-act-2024-08","article":"14(4)(e)","title":"Ability to override / reverse the system's output","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.6,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"}],"rules":[{"rule":"override_path_present","matched":1,"weight":0.6},{"rule":"decisions_are_addressable","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.60 (1/2 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-15/p1-accuracy","regulationId":"eu-ai-act-2024-08","article":"15(1)","title":"Appropriate level of accuracy declared and tested","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p4-robustness","regulationId":"eu-ai-act-2024-08","article":"15(4)","title":"Resilience to errors, faults, inconsistencies","principle":"safety","verdict":"fail","score":1,"rawScore":0.16000000000000003,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"nippet\": \"import os from langchain.callbacks.streaming_stdout import StreamingStdOutCallbackHandler from langchain_openai import ChatOpenAI\"","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"dOutCallbackHandler from langchain_openai import ChatOpenAI\", \"rule\": \"langchain_import\" }, { \"f","rule":"langchain_import"}],"rules":[{"rule":"error_handling_at_tool_boundaries","matched":0.4,"weight":0.4},{"rule":"retry_logic","matched":0,"weight":0.3},{"rule":"fallback_behaviour","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.16 (0/3 rules matched).","confidence":0.81,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p5-cybersecurity","regulationId":"eu-ai-act-2024-08","article":"15(5)","title":"Cybersecurity measures appropriate to circumstances","principle":"security-governance","verdict":"pass","score":3,"rawScore":0.8,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[344,344],"snippet":"(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1121,1121],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1124,1124],"snippet":"Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1135,1135],"snippet":"Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1143,1143],"snippet":"hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to","rule":"prompt_injection_defence"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[260,260],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1127,1127],"snippet":"ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr","rule":"rate_limit_usage"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[264,264],"snippet":"0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0.","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[341,341],"snippet":"entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\",","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[483,483],"snippet":", reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[485,485],"snippet":"id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\",","rule":"rate_limit_usage"}],"rules":[{"rule":"prompt_injection_defences","matched":1,"weight":0.4},{"rule":"rate_limiting","matched":1,"weight":0.2},{"rule":"secrets_not_in_prompts","matched":1,"weight":0.2},{"rule":"adversarial_eval_present","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.80 (3/4 rules matched).","confidence":0.8999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-26/p6-keep-logs","regulationId":"eu-ai-act-2024-08","article":"26(6)","title":"Deployer log-retention capability supported","principle":"accountability","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"}],"rules":[{"rule":"logs_externally_exportable","matched":0.5,"weight":1}],"rationale":"Composite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"eu-ai-act/art-50/p1-ai-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(1)","title":"Users informed they are interacting with an AI","principle":"transparency","verdict":"fail","score":1,"rawScore":0.2,"evidence":[{"file":"README.md","rule":"ai_disclosure_in_user_facing_strings"}],"rules":[{"rule":"ai_disclosure_in_user_facing_strings","matched":0,"weight":0.6},{"rule":"persona_not_human_impersonating","matched":0.5,"weight":0.4}],"rationale":"Composite raw score 0.20 (1/2 rules matched).","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p2-synthetic-content","regulationId":"eu-ai-act-2024-08","article":"50(2)","title":"AI-generated content marked as such, machine-readable","principle":"transparency","verdict":"pass","score":3,"rawScore":0.8223455672035186,"evidence":[{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"},{"file":".agent/docs/llm-judge-policy.md","lines":[78,78],"snippet":"` | 50(2) | **1** | C2PA / watermark library imports | | `art-50/p3-emotion-biometric-disclosure` | 50(3) | **1** | Deterministic disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/pipeline-design.md","lines":[75,75],"snippet":"ovenance_hooks` | C2PA, watermarking, content labelling | Article 50(2) synthetic content disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[63,63],"snippet":"o/text) | C | C2PA / watermarking libraries; metadata writers; output post-processing. | | 50(3) | Emotion-recognition / biometri","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[175,175],"snippet":"ntent> | Drives the C2PA / watermarking signal expectations for clause 50(2). | 2026-05-17 | | 10 | *AI Act Service Desk* + FAQs — <https://","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"}],"rules":[{"rule":"c2pa_or_watermark_library_imported","matched":0.9446911344070372,"weight":0.5},{"rule":"provenance_metadata_written_to_outputs","matched":0.7,"weight":0.5}],"rationale":"Composite raw score 0.82 (2/2 rules matched).","confidence":0.7776544327964814,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(3)","title":"Emotion recognition / biometric categorisation disclosure","principle":"transparency","verdict":"fail","score":0,"rawScore":0,"evidence":[{"file":"README.md","rule":"emotion_or_biometric_disclosure_string"}],"rules":[{"rule":"emotion_or_biometric_disclosure_string","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p4-deepfake-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(4)","title":"Deepfake content labelled as artificially generated","principle":"transparency","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"}],"rules":[{"rule":"deepfake_label_on_outputs","matched":0.7,"weight":1}],"rationale":"Composite raw score 0.70 (1/1 rules matched).","confidence":0.8500000000000001,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"nist-ai-rmf/govern-1.4","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.4","title":"Risk management process documented and accountable","principle":"accountability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"RISK_REGISTER.md","rule":"risk_owner_assignment"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.6},{"rule":"risk_owner_assignment","matched":1,"weight":0.4}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/govern-1.5","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.5","title":"Ongoing monitoring and periodic review of risk management","principle":"accountability","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"ci_eval_gates","matched":0,"weight":0.5},{"rule":"drift_monitoring_present","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/map-1.1","regulationId":"nist-ai-rmf-1.0","article":"MAP 1.1","title":"Context of use established and understood","principle":"auditability","verdict":"fail","score":1,"rawScore":0.3,"evidence":[{"file":"README.md","rule":"readme_quality","detail":"2 required sections present"},{"file":"README.md","rule":"output_interpretation_guidance"}],"rules":[{"rule":"intended_use_documented","matched":0.5,"weight":0.6},{"rule":"deployment_context_documented","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"nist-ai-rmf/map-3.4","regulationId":"nist-ai-rmf-1.0","article":"MAP 3.4","title":"Risks and benefits to people identified","principle":"safety","verdict":"pass","score":3,"rawScore":0.8,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"SECURITY.md","rule":"presence_of_threat_model"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.6},{"rule":"presence_of_threat_model","matched":0.5,"weight":0.4}],"rationale":"Composite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.3","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.3","title":"AI system performance evaluated and documented","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.7","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.7","title":"Security and resilience evaluated","principle":"security-governance","verdict":"partial","score":2,"rawScore":0.6000000000000001,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[344,344],"snippet":"(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1121,1121],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1124,1124],"snippet":"Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1135,1135],"snippet":"Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1143,1143],"snippet":"hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to","rule":"prompt_injection_defence"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[260,260],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1127,1127],"snippet":"ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr","rule":"rate_limit_usage"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[264,264],"snippet":"0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0.","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[341,341],"snippet":"entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\",","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[483,483],"snippet":", reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[485,485],"snippet":"id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\",","rule":"rate_limit_usage"}],"rules":[{"rule":"prompt_injection_defences","matched":1,"weight":0.4},{"rule":"adversarial_eval_present","matched":0,"weight":0.4},{"rule":"rate_limiting","matched":1,"weight":0.2}],"rationale":"Composite raw score 0.60 (2/3 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"nist-ai-rmf/measure-2.8","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.8","title":"Privacy risk of the AI system evaluated","principle":"privacy","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[290,290],"snippet":"description: \"Code redacts or hashes PII before logging or sending to external models\" - rule: privacy_documentation weig","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[817,817],"snippet":"p \\\"$SCRIPT_DIR/mcp/redaction.js\\\" \\\"$TARGET_ABS/mcp/\\\" cp \\\"$SCRIPT_DIR/mcp/lib/\\\"*.js \\\"$TARGET_ABS/mcp/lib/\\\" rm -rf \\\"$TARGET_ABS/mcp/li","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[826,826],"snippet":"t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\\\"foot\\\"><span\", \"rule\": \"","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[835,835],"snippet":"h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\\\"code-card\\\"> <div\", \"rule\": \"pii_red","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[844,844],"snippet":"n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\\\"slide\\\" data-title=\\\"Egress\\\"> <\", \"r","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[853,853],"snippet":"b collects bounded, redacted evidence packs for final reportable findings.</p> <div class=\\\"pill-row\\\"> <span class=\\\"pil\", \"rul","rule":"pii_redaction_present"},{"file":"PRIVACY.md","rule":"privacy_documentation"}],"rules":[{"rule":"pii_redaction_present","matched":1,"weight":0.5},{"rule":"privacy_documentation","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched).","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.11","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.11","title":"Fairness and bias evaluated","principle":"fairness","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/manage-2.3","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 2.3","title":"Mechanisms to supersede or deactivate AI systems","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.6,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[342,342],"snippet":"ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr","rule":"kill_switch"},{"file":"src/app/design-exploration/_data.ts","lines":[26,26],"snippet":", hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },","rule":"kill_switch"}],"rules":[{"rule":"kill_switch_present","matched":1,"weight":0.6},{"rule":"feature_flag_for_disable","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.60 (1/2 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"nist-ai-rmf/manage-4.1","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 4.1","title":"Post-deployment monitoring, appeal and override, change management","principle":"auditability","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"package.json","rule":"versioning_visible"}],"rules":[{"rule":"feedback_capture_present","matched":0,"weight":0.3},{"rule":"override_path_present","matched":1,"weight":0.3},{"rule":"structured_logging_imported","matched":0,"weight":0.2},{"rule":"versioning_visible","matched":1,"weight":0.2}],"rationale":"Composite raw score 0.50 (2/4 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-5.1-leadership","regulationId":"iso-42001-2023","article":"5.1","title":"Leadership and commitment for AI management","principle":"accountability","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":"AI_POLICY.md","rule":"presence_of_ai_policy"}],"rules":[{"rule":"presence_of_ai_policy","matched":1,"weight":0.7},{"rule":"leadership_signoff_evidence","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.70 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-5.3-roles","regulationId":"iso-42001-2023","article":"5.3","title":"Roles, responsibilities and authorities","principle":"accountability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"CODEOWNERS","rule":"presence_of_raci_or_owners"}],"rules":[{"rule":"presence_of_raci_or_owners","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-6.1-risk-assessment","regulationId":"iso-42001-2023","article":"6.1","title":"AI risk assessment process","principle":"safety","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"RISK_REGISTER.md","rule":"risk_assessment_methodology_documented"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.6},{"rule":"risk_assessment_methodology_documented","matched":1,"weight":0.4}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-7.5-documented-information","regulationId":"iso-42001-2023","article":"7.5","title":"Documented information for the AI management system","principle":"auditability","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":"README.md","rule":"presence_of_versioned_docs"},{"file":"CHANGELOG.md","rule":"docs_changelog_present"}],"rules":[{"rule":"presence_of_versioned_docs","matched":0.4,"weight":0.5},{"rule":"docs_changelog_present","matched":1,"weight":0.5}],"rationale":"Composite raw score 0.70 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-8.1-operational-planning","regulationId":"iso-42001-2023","article":"8.1","title":"Operational planning and control","principle":"safety","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"RUNBOOK.md","rule":"presence_of_runbook"}],"rules":[{"rule":"presence_of_runbook","matched":1,"weight":0.5},{"rule":"presence_of_ci_workflows","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-9.1-monitoring","regulationId":"iso-42001-2023","article":"9.1","title":"Monitoring, measurement, analysis and evaluation","principle":"auditability","verdict":"fail","score":1,"rawScore":0.25,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"structured_logging_present"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"structured_logging_present"}],"rules":[{"rule":"presence_of_eval_suite","matched":0,"weight":0.5},{"rule":"structured_logging_present","matched":0.5,"weight":0.5}],"rationale":"Composite raw score 0.25 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.85,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/annex-a5-internal-org","regulationId":"iso-42001-2023","article":"A.5","title":"Internal organization controls","principle":"accountability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"CODEOWNERS","rule":"presence_of_codeowners"}],"rules":[{"rule":"presence_of_codeowners","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/annex-a7-resources","regulationId":"iso-42001-2023","article":"A.7","title":"Resources for AI systems","principle":"security-governance","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"SECURITY.md","rule":"presence_of_security_policy"},{"file":"package-lock.json","rule":"dependency_pinning"}],"rules":[{"rule":"presence_of_security_policy","matched":1,"weight":0.5},{"rule":"dependency_pinning","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-5-principles","regulationId":"gdpr-2016","article":"5","title":"Principles relating to processing of personal data","principle":"transparency","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"PRIVACY.md","rule":"presence_of_privacy_policy"},{"file":"PRIVACY.md","rule":"purpose_limitation_documented"},{"file":"README.md","rule":"purpose_limitation_documented"}],"rules":[{"rule":"presence_of_privacy_policy","matched":1,"weight":0.5},{"rule":"purpose_limitation_documented","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-22-automated-decisions","regulationId":"gdpr-2016","article":"22","title":"Automated individual decision-making, including profiling","principle":"human-oversight","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_review_path_present"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[162,162],"snippet":"import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[171,171],"snippet":"import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[198,198],"snippet":"chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[207,207],"snippet":"a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\"","rule":"human_review_path_present"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"appeal_or_override_mechanism"}],"rules":[{"rule":"human_review_path_present","matched":1,"weight":0.6},{"rule":"appeal_or_override_mechanism","matched":1,"weight":0.4}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-25-by-design","regulationId":"gdpr-2016","article":"25","title":"Data protection by design and by default","principle":"privacy","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"src/pipeline/anchor.ts","lines":[149,149],"snippet":"crypto.createHash(\"sha256\")","rule":"pseudonymisation_or_anonymisation"},{"file":"src/pipeline/loader.ts","lines":[416,416],"snippet":"crypto.createHash(\"sha256\")","rule":"pseudonymisation_or_anonymisation"},{"file":"src/pipeline/stages/recon.ts","lines":[315,315],"snippet":"redact","rule":"pseudonymisation_or_anonymisation"},{"file":"src/pipeline/stages/report.ts","lines":[64,64],"snippet":"crypto.createHash(\"sha256\")","rule":"pseudonymisation_or_anonymisation"},{"file":"PRIVACY.md","rule":"default_minimal_data_collection"},{"file":"README.md","rule":"default_minimal_data_collection"}],"rules":[{"rule":"pseudonymisation_or_anonymisation","matched":1,"weight":0.5},{"rule":"default_minimal_data_collection","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-30-records","regulationId":"gdpr-2016","article":"30","title":"Records of processing activities","principle":"auditability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"PROCESSING_REGISTER.md","rule":"presence_of_processing_register"}],"rules":[{"rule":"presence_of_processing_register","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-32-security","regulationId":"gdpr-2016","article":"32","title":"Security of processing","principle":"security-governance","verdict":"pass","score":3,"rawScore":0.8,"evidence":[{"file":"scripts/seed-audit.ts","lines":[60,60],"snippet":"https://github.com/${owner}/${repo}`,","rule":"encryption_at_rest_or_transit"},{"file":"src/app/a/[chain]/[id]/_agent-audit.tsx","lines":[87,87],"snippet":"https://github.com/owner/repo","rule":"encryption_at_rest_or_transit"},{"file":"src/app/api/audit/run/route.ts","lines":[38,38],"snippet":"https://github.com/${body.source.owner}/${body.source.repo}`,","rule":"encryption_at_rest_or_transit"},{"file":"src/app/api/audit/stream/route.ts","lines":[54,54],"snippet":"https://github.com/${body.source.owner}/${body.source.repo}`,","rule":"encryption_at_rest_or_transit"},{"file":"next.config.ts","rule":"encryption_at_rest_or_transit"},{"file":"src/pipeline/checkers/rules.ts","lines":[928,928],"snippet":"@login_required","rule":"access_control_enforcement"}],"rules":[{"rule":"encryption_at_rest_or_transit","matched":1,"weight":0.5},{"rule":"access_control_enforcement","matched":0.6,"weight":0.5}],"rationale":"Composite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-35-dpia","regulationId":"gdpr-2016","article":"35","title":"Data protection impact assessment (DPIA)","principle":"safety","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"DPIA.md","rule":"presence_of_dpia"}],"rules":[{"rule":"presence_of_dpia","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"}],"grade":{"overallScore":2.466666666666667,"perRegulation":[{"regulationId":"eu-ai-act-2024-08","scoreAvg":1.9565217391304348,"passCount":9,"partialCount":5,"failCount":9,"externalCount":1,"naCount":1},{"regulationId":"nist-ai-rmf-1.0","scoreAvg":2.25,"passCount":3,"partialCount":3,"failCount":2,"externalCount":0,"naCount":2},{"regulationId":"iso-42001-2023","scoreAvg":3.125,"passCount":6,"partialCount":1,"failCount":1,"externalCount":0,"naCount":0},{"regulationId":"gdpr-2016","scoreAvg":3.8333333333333335,"passCount":6,"partialCount":0,"failCount":0,"externalCount":0,"naCount":0}]},"bundleHash":"e0d08dd8c6d71e5ad051a4bdad94450fa553b43ca7fbd0cb3b4fc6ce44be24c0","checkerVersion":"v0.1.0","regulationsVersions":{"eu-ai-act-2024-08":"ee8568c60676d1c60c00393077dc7b9753628a16bb96049d6caa384b93516239","nist-ai-rmf-1.0":"b36616651114a74e212e4416e72f3d320d3ea46e1c93d7d3919cd44b5f71f762","iso-42001-2023":"3855f297eea17980b71d32e9d8c9f113c153c68e07b01fd442392fba4567755d","gdpr-2016":"a650813378c93140abcbda864a7248289096abec98d57667cb0c0e2cba1bfe3f"},"startedAt":"2026-05-20T19:32:57.388Z","completedAt":"2026-05-20T19:33:29.797Z","durationMs":32409,"externalControls":[{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","note":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external."}]},"attestationAnswers":{"eu-ai-act/art-9/risk-management":{"status":"Done","updatedAt":"2026-05-20T19:34:45.678Z","answers":{"art-9.q1":{"pid":"art-9.q1","answer":"Yes","elaboration":"test","updatedAt":"2026-05-20T19:34:45.678Z"},"art-9.q2":{"pid":"art-9.q2","answer":"Yes","updatedAt":"2026-05-20T19:34:45.678Z"},"art-9.q3":{"pid":"art-9.q3","answer":"aa","updatedAt":"2026-05-20T19:34:45.678Z"}}}}}