{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"AiAuditor","informationUri":"https://github.com/drhus/ai-auditor","version":"v0.1.0","rules":[{"id":"eu-ai-act-2024-08/1e-facial-scraping","name":"eu-ai-act-2024-08/1e-facial-scraping","shortDescription":{"text":"Untargeted facial image scraping for face databases"},"fullDescription":{"text":"EU AI Act, Art 5(1)(e) — Untargeted facial image scraping for face databases"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-5(1)(e)","privacy"],"regulation":"EU AI Act","article":"5(1)(e)","principle":"privacy"}},{"id":"eu-ai-act-2024-08/risk-management","name":"eu-ai-act-2024-08/risk-management","shortDescription":{"text":"Risk management system established, implemented, documented"},"fullDescription":{"text":"EU AI Act, Art 9 — Risk management system established, implemented, documented"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-9","safety"],"regulation":"EU AI Act","article":"9","principle":"safety"}},{"id":"eu-ai-act-2024-08/data-governance","name":"eu-ai-act-2024-08/data-governance","shortDescription":{"text":"Data and data governance practices documented"},"fullDescription":{"text":"EU AI Act, Art 10 — Data and data governance practices documented"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-10","privacy"],"regulation":"EU AI Act","article":"10","principle":"privacy"}},{"id":"eu-ai-act-2024-08/technical-documentation","name":"eu-ai-act-2024-08/technical-documentation","shortDescription":{"text":"Technical documentation drawn up before placing on market"},"fullDescription":{"text":"EU AI Act, Art 11 — Technical documentation drawn up before placing on market"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-11","auditability"],"regulation":"EU AI Act","article":"11","principle":"auditability"}},{"id":"eu-ai-act-2024-08/p1-automatic-logs","name":"eu-ai-act-2024-08/p1-automatic-logs","shortDescription":{"text":"Automatic recording of events over the lifetime"},"fullDescription":{"text":"EU AI Act, Art 12(1) — Automatic recording of events over the lifetime"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-12(1)","auditability"],"regulation":"EU AI Act","article":"12(1)","principle":"auditability"}},{"id":"eu-ai-act-2024-08/p2-traceability","name":"eu-ai-act-2024-08/p2-traceability","shortDescription":{"text":"Logging ensures traceability appropriate to risk"},"fullDescription":{"text":"EU AI Act, Art 12(2) — Logging ensures traceability appropriate to risk"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-12(2)","auditability"],"regulation":"EU AI Act","article":"12(2)","principle":"auditability"}},{"id":"eu-ai-act-2024-08/deployer-instructions","name":"eu-ai-act-2024-08/deployer-instructions","shortDescription":{"text":"Transparent operation and instructions for use"},"fullDescription":{"text":"EU AI Act, Art 13 — Transparent operation and instructions for use"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-13","transparency"],"regulation":"EU AI Act","article":"13","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p4d-stop-button","name":"eu-ai-act-2024-08/p4d-stop-button","shortDescription":{"text":"Interrupt / stop function reachable by overseer"},"fullDescription":{"text":"EU AI Act, Art 14(4)(d) — Interrupt / stop function reachable by overseer"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(4)(d)","human-oversight"],"regulation":"EU AI Act","article":"14(4)(d)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p4e-override","name":"eu-ai-act-2024-08/p4e-override","shortDescription":{"text":"Ability to override / reverse the system's output"},"fullDescription":{"text":"EU AI Act, Art 14(4)(e) — Ability to override / reverse the system's output"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(4)(e)","human-oversight"],"regulation":"EU AI Act","article":"14(4)(e)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p1-accuracy","name":"eu-ai-act-2024-08/p1-accuracy","shortDescription":{"text":"Appropriate level of accuracy declared and tested"},"fullDescription":{"text":"EU AI Act, Art 15(1) — Appropriate level of accuracy declared and tested"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(1)","safety"],"regulation":"EU AI Act","article":"15(1)","principle":"safety"}},{"id":"eu-ai-act-2024-08/p4-robustness","name":"eu-ai-act-2024-08/p4-robustness","shortDescription":{"text":"Resilience to errors, faults, inconsistencies"},"fullDescription":{"text":"EU AI Act, Art 15(4) — Resilience to errors, faults, inconsistencies"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(4)","safety"],"regulation":"EU AI Act","article":"15(4)","principle":"safety"}},{"id":"eu-ai-act-2024-08/p5-cybersecurity","name":"eu-ai-act-2024-08/p5-cybersecurity","shortDescription":{"text":"Cybersecurity measures appropriate to circumstances"},"fullDescription":{"text":"EU AI Act, Art 15(5) — Cybersecurity measures appropriate to circumstances"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(5)","security-governance"],"regulation":"EU AI Act","article":"15(5)","principle":"security-governance"}},{"id":"eu-ai-act-2024-08/p6-keep-logs","name":"eu-ai-act-2024-08/p6-keep-logs","shortDescription":{"text":"Deployer log-retention capability supported"},"fullDescription":{"text":"EU AI Act, Art 26(6) — Deployer log-retention capability supported"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-26(6)","accountability"],"regulation":"EU AI Act","article":"26(6)","principle":"accountability"}},{"id":"eu-ai-act-2024-08/p1-ai-disclosure","name":"eu-ai-act-2024-08/p1-ai-disclosure","shortDescription":{"text":"Users informed they are interacting with an AI"},"fullDescription":{"text":"EU AI Act, Art 50(1) — Users informed they are interacting with an AI"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(1)","transparency"],"regulation":"EU AI Act","article":"50(1)","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","name":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","shortDescription":{"text":"Emotion recognition / biometric categorisation disclosure"},"fullDescription":{"text":"EU AI Act, Art 50(3) — Emotion recognition / biometric categorisation disclosure"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(3)","transparency"],"regulation":"EU AI Act","article":"50(3)","principle":"transparency"}},{"id":"nist-ai-rmf-1.0/govern-1.5","name":"nist-ai-rmf-1.0/govern-1.5","shortDescription":{"text":"Ongoing monitoring and periodic review of risk management"},"fullDescription":{"text":"NIST AI RMF, Art GOVERN 1.5 — Ongoing monitoring and periodic review of risk management"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-GOVERN 1.5","accountability"],"regulation":"NIST AI RMF","article":"GOVERN 1.5","principle":"accountability"}},{"id":"nist-ai-rmf-1.0/map-1.1","name":"nist-ai-rmf-1.0/map-1.1","shortDescription":{"text":"Context of use established and understood"},"fullDescription":{"text":"NIST AI RMF, Art MAP 1.1 — Context of use established and understood"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MAP 1.1","auditability"],"regulation":"NIST AI RMF","article":"MAP 1.1","principle":"auditability"}},{"id":"nist-ai-rmf-1.0/map-3.4","name":"nist-ai-rmf-1.0/map-3.4","shortDescription":{"text":"Risks and benefits to people identified"},"fullDescription":{"text":"NIST AI RMF, Art MAP 3.4 — Risks and benefits to people identified"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MAP 3.4","safety"],"regulation":"NIST AI RMF","article":"MAP 3.4","principle":"safety"}},{"id":"nist-ai-rmf-1.0/measure-2.3","name":"nist-ai-rmf-1.0/measure-2.3","shortDescription":{"text":"AI system performance evaluated and documented"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.3 — AI system performance evaluated and documented"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.3","safety"],"regulation":"NIST AI RMF","article":"MEASURE 2.3","principle":"safety"}},{"id":"nist-ai-rmf-1.0/measure-2.7","name":"nist-ai-rmf-1.0/measure-2.7","shortDescription":{"text":"Security and resilience evaluated"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.7 — Security and resilience evaluated"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.7","security-governance"],"regulation":"NIST AI RMF","article":"MEASURE 2.7","principle":"security-governance"}},{"id":"nist-ai-rmf-1.0/measure-2.8","name":"nist-ai-rmf-1.0/measure-2.8","shortDescription":{"text":"Privacy risk of the AI system evaluated"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.8 — Privacy risk of the AI system evaluated"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.8","privacy"],"regulation":"NIST AI RMF","article":"MEASURE 2.8","principle":"privacy"}},{"id":"nist-ai-rmf-1.0/manage-2.3","name":"nist-ai-rmf-1.0/manage-2.3","shortDescription":{"text":"Mechanisms to supersede or deactivate AI systems"},"fullDescription":{"text":"NIST AI RMF, Art MANAGE 2.3 — Mechanisms to supersede or deactivate AI systems"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MANAGE 2.3","human-oversight"],"regulation":"NIST AI RMF","article":"MANAGE 2.3","principle":"human-oversight"}},{"id":"nist-ai-rmf-1.0/manage-4.1","name":"nist-ai-rmf-1.0/manage-4.1","shortDescription":{"text":"Post-deployment monitoring, appeal and override, change management"},"fullDescription":{"text":"NIST AI RMF, Art MANAGE 4.1 — Post-deployment monitoring, appeal and override, change management"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MANAGE 4.1","auditability"],"regulation":"NIST AI RMF","article":"MANAGE 4.1","principle":"auditability"}},{"id":"gdpr-2016/art-22-automated-decisions","name":"gdpr-2016/art-22-automated-decisions","shortDescription":{"text":"Automated individual decision-making, including profiling"},"fullDescription":{"text":"GDPR, Art 22 — Automated individual decision-making, including profiling"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","gdpr-2016","article-22","human-oversight"],"regulation":"GDPR","article":"22","principle":"human-oversight"}},{"id":"gdpr-2016/art-25-by-design","name":"gdpr-2016/art-25-by-design","shortDescription":{"text":"Data protection by design and by default"},"fullDescription":{"text":"GDPR, Art 25 — Data protection by design and by default"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","gdpr-2016","article-25","privacy"],"regulation":"GDPR","article":"25","principle":"privacy"}},{"id":"gdpr-2016/art-32-security","name":"gdpr-2016/art-32-security","shortDescription":{"text":"Security of processing"},"fullDescription":{"text":"GDPR, Art 32 — Security of processing"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","gdpr-2016","article-32","security-governance"],"regulation":"GDPR","article":"32","principle":"security-governance"}},{"id":"iso-42001-2023/clause-5.3-roles","name":"iso-42001-2023/clause-5.3-roles","shortDescription":{"text":"Roles, responsibilities and authorities"},"fullDescription":{"text":"ISO/IEC 42001, Art 5.3 — Roles, responsibilities and authorities"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-5.3","accountability"],"regulation":"ISO/IEC 42001","article":"5.3","principle":"accountability"}},{"id":"iso-42001-2023/clause-7.5-documented-information","name":"iso-42001-2023/clause-7.5-documented-information","shortDescription":{"text":"Documented information for the AI management system"},"fullDescription":{"text":"ISO/IEC 42001, Art 7.5 — Documented information for the AI management system"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-7.5","auditability"],"regulation":"ISO/IEC 42001","article":"7.5","principle":"auditability"}},{"id":"iso-42001-2023/clause-8.1-operational-planning","name":"iso-42001-2023/clause-8.1-operational-planning","shortDescription":{"text":"Operational planning and control"},"fullDescription":{"text":"ISO/IEC 42001, Art 8.1 — Operational planning and control"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-8.1","safety"],"regulation":"ISO/IEC 42001","article":"8.1","principle":"safety"}},{"id":"iso-42001-2023/clause-9.1-monitoring","name":"iso-42001-2023/clause-9.1-monitoring","shortDescription":{"text":"Monitoring, measurement, analysis and evaluation"},"fullDescription":{"text":"ISO/IEC 42001, Art 9.1 — Monitoring, measurement, analysis and evaluation"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-9.1","auditability"],"regulation":"ISO/IEC 42001","article":"9.1","principle":"auditability"}},{"id":"iso-42001-2023/annex-a5-internal-org","name":"iso-42001-2023/annex-a5-internal-org","shortDescription":{"text":"Internal organization controls"},"fullDescription":{"text":"ISO/IEC 42001, Art A.5 — Internal organization controls"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-A.5","accountability"],"regulation":"ISO/IEC 42001","article":"A.5","principle":"accountability"}},{"id":"iso-42001-2023/annex-a7-resources","name":"iso-42001-2023/annex-a7-resources","shortDescription":{"text":"Resources for AI systems"},"fullDescription":{"text":"ISO/IEC 42001, Art A.7 — Resources for AI systems"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"note"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-A.7","security-governance"],"regulation":"ISO/IEC 42001","article":"A.7","principle":"security-governance"}}]}},"automationDetails":{"id":"aiauditor/aud_01KS3E6JAH8WNVWPSZ36C1"},"originalUriBaseIds":{"%SRCROOT%":{"uri":"https://github.com/vmihalis/hacker-bob/blob/945d55ae0a060e205b38044487c300af55a08702/"}},"versionControlProvenance":[{"repositoryUri":"https://github.com/vmihalis/hacker-bob","revisionId":"945d55ae0a060e205b38044487c300af55a08702","branch":"945d55ae0a060e205b38044487c300af55a08702"}],"results":[{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: system Chrome (TLS fingerprint, fonts, WebGL match) // 3. Headed mode — avoids headless signals // 4. ignoreDefaultArgs: ['--enable-aut"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/auto-signup.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":11,"endLine":11}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: -index.js\"); const FINGERPRINT = `bobpriortest${crypto.randomBytes(6).toString(\"hex\")}`; function uniqueDomain(prefix = \"bob-priors-test\")"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/priors-slice-brief.test.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":15,"endLine":15}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: , title: `${FINGERPRINT} IDOR on user profile endpoint`, description: `${FINGERPRINT} broken object level authorization`,"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"test/priors-slice-brief.test.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":48,"endLine":48}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/risk-management","level":"warning","message":{"text":"Risk management system established, implemented, documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"SECURITY.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.44999999999999996,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-9/risk-management"}},{"ruleId":"eu-ai-act-2024-08/risk-management","level":"warning","message":{"text":"Risk management system established, implemented, documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.44999999999999996,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-9/risk-management"}},{"ruleId":"eu-ai-act-2024-08/risk-management","level":"warning","message":{"text":"Risk management system established, implemented, documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/release.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.44999999999999996,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-9/risk-management"}},{"ruleId":"eu-ai-act-2024-08/data-governance","level":"error","message":{"text":"Data and data governance practices documented — verdict: FAIL (75% conf).\n\nComposite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: createResp = await fetch(\"https://api.capsolver.com/createTask\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/auto-signup.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":78,"endLine":78}}}],"properties":{"verdict":"fail","score":0,"confidence":0.75,"rawScore":0.1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-10/data-governance"}},{"ruleId":"eu-ai-act-2024-08/data-governance","level":"error","message":{"text":"Data and data governance practices documented — verdict: FAIL (75% conf).\n\nComposite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: st pollResp = await fetch(\"https://api.capsolver.com/getTaskResult\", { method: \"POST\", headers: { \"Content-Type\": \"application/j"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/auto-signup.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":93,"endLine":93}}}],"properties":{"verdict":"fail","score":0,"confidence":0.75,"rawScore":0.1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-10/data-governance"}},{"ruleId":"eu-ai-act-2024-08/technical-documentation","level":"error","message":{"text":"Technical documentation drawn up before placing on market — verdict: FAIL (100% conf).\n\nComposite raw score 0.35 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 2 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.35,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-11/technical-documentation"}},{"ruleId":"eu-ai-act-2024-08/technical-documentation","level":"error","message":{"text":"Technical documentation drawn up before placing on market — verdict: FAIL (100% conf).\n\nComposite raw score 0.35 (2/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/replay-prompts/00-baseline.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.35,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-11/technical-documentation"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: he(projectDir); console.log(\"Hacker Bob update cache cleared.\"); return; } usage(); process.exit(1); } main(process.argv.sli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bob-update.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: ndoff, })); console.log(JSON.stringify({ ok: true, message: \"post-report evidence run accepted\" })); process.exit(0); } con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":238,"endLine":238}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: cess.exit(2); } console.log(JSON.stringify({ ok: true, message: finalization.reason })); process.exit(0); } if (require.main === modu"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":247,"endLine":247}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: y.targetAbs); console.log(\"\"); if (summary.adapters.length === 1 && summary.adapters[0] === \"claude\") { console.log(\"Upd"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"bin/hacker-bob.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":87,"endLine":87}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: \"claude\") { console.log(\"Update complete. Fully restart Claude Code in this project before continuing.\"); } else { con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"bin/hacker-bob.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":89,"endLine":89}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: } else { console.log(\"Update complete. Restart the selected host adapter before continuing.\"); } } return; } i"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"bin/hacker-bob.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":91,"endLine":91}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: he(projectDir); console.log(\"Hacker Bob update cache cleared.\"); return; } usage(); process.exit(1); } main(process.argv.sli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bob-update.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"warning","message":{"text":"Automatic recording of events over the lifetime — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.58 (1/3 rules matched).\n\nEvidence: ndoff, })); console.log(JSON.stringify({ ok: true, message: \"post-report evidence run accepted\" })); process.exit(0); } con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":238,"endLine":238}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5800000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: he(projectDir); console.log(\"Hacker Bob update cache cleared.\"); return; } usage(); process.exit(1); } main(process.argv.sli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bob-update.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ndoff, })); console.log(JSON.stringify({ ok: true, message: \"post-report evidence run accepted\" })); process.exit(0); } con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":238,"endLine":238}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: cess.exit(2); } console.log(JSON.stringify({ ok: true, message: finalization.reason })); process.exit(0); } if (require.main === modu"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":247,"endLine":247}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: y.targetAbs); console.log(\"\"); if (summary.adapters.length === 1 && summary.adapters[0] === \"claude\") { console.log(\"Upd"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"bin/hacker-bob.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":87,"endLine":87}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: \"claude\") { console.log(\"Update complete. Fully restart Claude Code in this project before continuing.\"); } else { con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"bin/hacker-bob.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":89,"endLine":89}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: } else { console.log(\"Update complete. Restart the selected host adapter before continuing.\"); } } return; } i"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"bin/hacker-bob.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":91,"endLine":91}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: he(projectDir); console.log(\"Hacker Bob update cache cleared.\"); return; } usage(); process.exit(1); } main(process.argv.sli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bob-update.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"note","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PASS (98% conf).\n\nComposite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ndoff, })); console.log(JSON.stringify({ ok: true, message: \"post-report evidence run accepted\" })); process.exit(0); } con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":238,"endLine":238}}}],"properties":{"verdict":"pass","score":3,"confidence":0.975,"rawScore":0.675,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (90% conf).\n\nComposite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 2 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.25,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (90% conf).\n\nComposite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.25,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (90% conf).\n\nComposite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.25,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\"-\"): return False if token"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: (blocked) raise SystemExit(0) command = tool_input.get(\"command\", \"\") if command: check_bash_command(command) raise SystemExit(0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":208,"endLine":208}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: and(command) raise SystemExit(0) PY"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":214,"endLine":214}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: s.stderr) raise SystemExit(2) def extract_redirect_targets(command): \"\"\"Extract file paths from shell redirect operators and tee c"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":138,"endLine":138}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: ) raise SystemExit(0) # Bash tool command = tool_input.get(\"command\", \"\") if not command: raise SystemExit(0) # Quick gate"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"note","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched).\n\nEvidence: command: raise SystemExit(0) # Quick gate: skip if no write indicators has_redirects = re.search(r\">{1,2}\\s|tee\\s\", command) has_open_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":207,"endLine":207}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\"-\"): return False if token"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: (blocked) raise SystemExit(0) command = tool_input.get(\"command\", \"\") if command: check_bash_command(command) raise SystemExit(0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":208,"endLine":208}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: and(command) raise SystemExit(0) PY"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":214,"endLine":214}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: s.stderr) raise SystemExit(2) def extract_redirect_targets(command): \"\"\"Extract file paths from shell redirect operators and tee c"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":138,"endLine":138}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: ) raise SystemExit(0) # Bash tool command = tool_input.get(\"command\", \"\") if not command: raise SystemExit(0) # Quick gate"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: command: raise SystemExit(0) # Quick gate: skip if no write indicators has_redirects = re.search(r\">{1,2}\\s|tee\\s\", command) has_open_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":207,"endLine":207}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p1-accuracy","level":"warning","message":{"text":"Appropriate level of accuracy declared and tested — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"tests/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p1-accuracy"}},{"ruleId":"eu-ai-act-2024-08/p1-accuracy","level":"warning","message":{"text":"Appropriate level of accuracy declared and tested — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p1-accuracy"}},{"ruleId":"eu-ai-act-2024-08/p1-accuracy","level":"warning","message":{"text":"Appropriate level of accuracy declared and tested — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p1-accuracy"}},{"ruleId":"eu-ai-act-2024-08/p1-accuracy","level":"warning","message":{"text":"Appropriate level of accuracy declared and tested — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/release.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p1-accuracy"}},{"ruleId":"eu-ai-act-2024-08/p4-robustness","level":"error","message":{"text":"Resilience to errors, faults, inconsistencies — verdict: FAIL (81% conf).\n\nComposite raw score 0.16 (0/3 rules matched).\n\nEvidence: Anthropic SDK"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package.json","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81,"rawScore":0.16000000000000003,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-15/p4-robustness"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bounty-statusline.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":63,"endLine":63}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: nst sevenDay = data.rate_limits?.seven_day?.used_percentage; const worst = Math.max(fiveHr || 0, sevenDay || 0); if (worst >= 80) ra"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bounty-statusline.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: \"^5.2.1\", \"express-rate-limit\": \"^8.2.1\", \"hono\": \"^4.11.4\", \"jose\": \"^6.1.3\", \"json-schema-typed\": \"^8.0.2"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":211,"endLine":211}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: , \"node_modules/express-rate-limit\": { \"version\": \"8.4.1\", \"resolved\": \"https://registry.npmjs.org/express-rate-limit/-/expr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":687,"endLine":687}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: /registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.4.1.tgz\", \"integrity\": \"sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQ"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":689,"endLine":689}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: xpress-rate-limit/-/express-rate-limit-8.4.1.tgz\", \"integrity\": \"sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQCm+rFvLsBH6w4xcXWTcli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":689,"endLine":689}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: const apiKey = process.env.BOB_ETHERSCAN_API_KEY || null; const etherscan = await fetchFromEtherscanV2(numericChainId, lower, apiKe"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/evm-source.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":283,"endLine":283}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: capsolver_api_key: process.env.CAPSOLVER_API_KEY || null, proxy: args.proxy || process.env.BOUNTY_PROXY || null, timeout_ms: args.t"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/signup.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":284,"endLine":284}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: romium`); } if (process.env.CAPSOLVER_API_KEY) { console.log(\" OK: CAPSOLVER_API_KEY is set\"); } else { console.log(\" NOT SE"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/install.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":476,"endLine":476}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: abled\"); } if (process.env.CAPSOLVER_API_KEY) { addCheck(checks, \"ok\", \"optional_capsolver\", \"CAPSOLVER_API_KEY is set\"); } else"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/lifecycle.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":408,"endLine":408}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"error","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (2/4 rules matched).\n\nEvidence: } const apiKey = process.env.ANTHROPIC_API_KEY; if (!apiKey && !args[\"dry-run\"]) { console.error( \"error: ANTHROPIC_API_KEY e"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/replay-refusal.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":217,"endLine":217}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33266899936762,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p6-keep-logs","level":"warning","message":{"text":"Deployer log-retention capability supported — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: he(projectDir); console.log(\"Hacker Bob update cache cleared.\"); return; } usage(); process.exit(1); } main(process.argv.sli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bob-update.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-26/p6-keep-logs"}},{"ruleId":"eu-ai-act-2024-08/p6-keep-logs","level":"warning","message":{"text":"Deployer log-retention capability supported — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ndoff, })); console.log(JSON.stringify({ ok: true, message: \"post-report evidence run accepted\" })); process.exit(0); } con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":238,"endLine":238}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-26/p6-keep-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-ai-disclosure","level":"warning","message":{"text":"Users informed they are interacting with an AI — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-50/p1-ai-disclosure"}},{"ruleId":"eu-ai-act-2024-08/p1-ai-disclosure","level":"warning","message":{"text":"Users informed they are interacting with an AI — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/bench-prompts.sh","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-50/p1-ai-disclosure"}},{"ruleId":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","level":"error","message":{"text":"Emotion recognition / biometric categorisation disclosure — verdict: FAIL (55% conf).\n\nComposite raw score 0.00 (0/1 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":0,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure"}},{"ruleId":"nist-ai-rmf-1.0/govern-1.5","level":"warning","message":{"text":"Ongoing monitoring and periodic review of risk management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/govern-1.5"}},{"ruleId":"nist-ai-rmf-1.0/govern-1.5","level":"warning","message":{"text":"Ongoing monitoring and periodic review of risk management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/release.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/govern-1.5"}},{"ruleId":"nist-ai-rmf-1.0/map-1.1","level":"error","message":{"text":"Context of use established and understood — verdict: FAIL (90% conf).\n\nComposite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 2 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.3,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/map-1.1"}},{"ruleId":"nist-ai-rmf-1.0/map-1.1","level":"error","message":{"text":"Context of use established and understood — verdict: FAIL (90% conf).\n\nComposite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9,"rawScore":0.3,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/map-1.1"}},{"ruleId":"nist-ai-rmf-1.0/map-3.4","level":"error","message":{"text":"Risks and benefits to people identified — verdict: FAIL (80% conf).\n\nComposite raw score 0.20 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"SECURITY.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.7999999999999999,"rawScore":0.2,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/map-3.4"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.3","level":"warning","message":{"text":"AI system performance evaluated and documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"tests/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.3"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.3","level":"warning","message":{"text":"AI system performance evaluated and documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.3"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.3","level":"warning","message":{"text":"AI system performance evaluated and documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/ci.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.3"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.3","level":"warning","message":{"text":"AI system performance evaluated and documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.45 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/release.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.45,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.3"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"error","message":{"text":"Security and resilience evaluated — verdict: FAIL (82% conf).\n\nComposite raw score 0.17 (1/3 rules matched).\n\nEvidence: const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bounty-statusline.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":63,"endLine":63}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81633449968381,"rawScore":0.16633449968381,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"error","message":{"text":"Security and resilience evaluated — verdict: FAIL (82% conf).\n\nComposite raw score 0.17 (1/3 rules matched).\n\nEvidence: nst sevenDay = data.rate_limits?.seven_day?.used_percentage; const worst = Math.max(fiveHr || 0, sevenDay || 0); if (worst >= 80) ra"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bounty-statusline.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81633449968381,"rawScore":0.16633449968381,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"error","message":{"text":"Security and resilience evaluated — verdict: FAIL (82% conf).\n\nComposite raw score 0.17 (1/3 rules matched).\n\nEvidence: \"^5.2.1\", \"express-rate-limit\": \"^8.2.1\", \"hono\": \"^4.11.4\", \"jose\": \"^6.1.3\", \"json-schema-typed\": \"^8.0.2"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":211,"endLine":211}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81633449968381,"rawScore":0.16633449968381,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"error","message":{"text":"Security and resilience evaluated — verdict: FAIL (82% conf).\n\nComposite raw score 0.17 (1/3 rules matched).\n\nEvidence: , \"node_modules/express-rate-limit\": { \"version\": \"8.4.1\", \"resolved\": \"https://registry.npmjs.org/express-rate-limit/-/expr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":687,"endLine":687}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81633449968381,"rawScore":0.16633449968381,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"error","message":{"text":"Security and resilience evaluated — verdict: FAIL (82% conf).\n\nComposite raw score 0.17 (1/3 rules matched).\n\nEvidence: /registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.4.1.tgz\", \"integrity\": \"sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQ"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":689,"endLine":689}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81633449968381,"rawScore":0.16633449968381,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"error","message":{"text":"Security and resilience evaluated — verdict: FAIL (82% conf).\n\nComposite raw score 0.17 (1/3 rules matched).\n\nEvidence: xpress-rate-limit/-/express-rate-limit-8.4.1.tgz\", \"integrity\": \"sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQCm+rFvLsBH6w4xcXWTcli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"},"region":{"startLine":689,"endLine":689}}}],"properties":{"verdict":"fail","score":1,"confidence":0.81633449968381,"rawScore":0.16633449968381,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: cp \"$SCRIPT_DIR/mcp/redaction.js\" \"$TARGET_ABS/mcp/\" cp \"$SCRIPT_DIR/mcp/lib/\"*.js \"$TARGET_ABS/mcp/lib/\" rm -rf \"$TARGET_ABS/mcp/lib/to"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"dev-sync.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":95,"endLine":95}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\"foot\"><span"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/bob-architecture-event.html","uriBaseId":"%SRCROOT%"},"region":{"startLine":1196,"endLine":1196}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\"code-card\"> <div"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/bob-architecture-event.html","uriBaseId":"%SRCROOT%"},"region":{"startLine":1603,"endLine":1603}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\"slide\" data-title=\"Egress\"> <"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/bob-architecture-event.html","uriBaseId":"%SRCROOT%"},"region":{"startLine":1616,"endLine":1616}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: b collects bounded, redacted evidence packs for final reportable findings.</p> <div class=\"pill-row\"> <span class=\"pil"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/bob-architecture-event.html","uriBaseId":"%SRCROOT%"},"region":{"startLine":1858,"endLine":1858}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: <span class=\"pill\">redacted</span> <span class=\"pill\">bounded</span> <span class=\"pill\">per finding</span>"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/bob-architecture-event.html","uriBaseId":"%SRCROOT%"},"region":{"startLine":1860,"endLine":1860}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\"-\"): return False if token"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: (blocked) raise SystemExit(0) command = tool_input.get(\"command\", \"\") if command: check_bash_command(command) raise SystemExit(0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":208,"endLine":208}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: and(command) raise SystemExit(0) PY"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":214,"endLine":214}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: s.stderr) raise SystemExit(2) def extract_redirect_targets(command): \"\"\"Extract file paths from shell redirect operators and tee c"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":138,"endLine":138}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: ) raise SystemExit(0) # Bash tool command = tool_input.get(\"command\", \"\") if not command: raise SystemExit(0) # Quick gate"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (1/2 rules matched).\n\nEvidence: command: raise SystemExit(0) # Quick gate: skip if no write indicators has_redirects = re.search(r\">{1,2}\\s|tee\\s\", command) has_open_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":207,"endLine":207}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\"-\"): return False if token"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: (blocked) raise SystemExit(0) command = tool_input.get(\"command\", \"\") if command: check_bash_command(command) raise SystemExit(0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":208,"endLine":208}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: and(command) raise SystemExit(0) PY"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":214,"endLine":214}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: s.stderr) raise SystemExit(2) def extract_redirect_targets(command): \"\"\"Extract file paths from shell redirect operators and tee c"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":138,"endLine":138}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: ) raise SystemExit(0) # Bash tool command = tool_input.get(\"command\", \"\") if not command: raise SystemExit(0) # Quick gate"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched).\n\nEvidence: command: raise SystemExit(0) # Quick gate: skip if no write indicators has_redirects = re.search(r\">{1,2}\\s|tee\\s\", command) has_open_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":207,"endLine":207}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"warning","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/4 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package.json","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"warning","message":{"text":"Automated individual decision-making, including profiling — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\"-\"): return False if token"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"warning","message":{"text":"Automated individual decision-making, including profiling — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: (blocked) raise SystemExit(0) command = tool_input.get(\"command\", \"\") if command: check_bash_command(command) raise SystemExit(0)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":208,"endLine":208}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"warning","message":{"text":"Automated individual decision-making, including profiling — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: and(command) raise SystemExit(0) PY"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-read-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":214,"endLine":214}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"warning","message":{"text":"Automated individual decision-making, including profiling — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: s.stderr) raise SystemExit(2) def extract_redirect_targets(command): \"\"\"Extract file paths from shell redirect operators and tee c"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":138,"endLine":138}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"warning","message":{"text":"Automated individual decision-making, including profiling — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ) raise SystemExit(0) # Bash tool command = tool_input.get(\"command\", \"\") if not command: raise SystemExit(0) # Quick gate"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":202,"endLine":202}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"warning","message":{"text":"Automated individual decision-making, including profiling — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.40 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: command: raise SystemExit(0) # Quick gate: skip if no write indicators has_redirects = re.search(r\">{1,2}\\s|tee\\s\", command) has_open_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/session-write-guard.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":207,"endLine":207}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.4,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"note","message":{"text":"Data protection by design and by default — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: redaction"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/egress-profiles.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":5,"endLine":5}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"note","message":{"text":"Data protection by design and by default — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: Redaction"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/evidence.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":378,"endLine":378}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"note","message":{"text":"Data protection by design and by default — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: crypto.createHash(\"sha256\")"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/findings-index.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":37,"endLine":37}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"note","message":{"text":"Data protection by design and by default — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: crypto.createHash(\"sha256\")"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/findings.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":94,"endLine":94}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"note","message":{"text":"Data protection by design and by default — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://api.capsolver.com/createTask"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/auto-signup.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":78,"endLine":78}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://api.mainnet.aptoslabs.com/v1"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/aptos-rpc-pool.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":15,"endLine":15}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://${domain}/`))"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/auth.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":298,"endLine":298}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: require(\"crypto\")"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"mcp/lib/capability-eval-harness.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":6,"endLine":6}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"iso-42001-2023/clause-5.3-roles","level":"note","message":{"text":"Roles, responsibilities and authorities — verdict: PASS (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/CODEOWNERS","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"iso-42001/clause-5.3-roles"}},{"ruleId":"iso-42001-2023/clause-7.5-documented-information","level":"note","message":{"text":"Documented information for the AI management system — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"iso-42001/clause-7.5-documented-information"}},{"ruleId":"iso-42001-2023/clause-7.5-documented-information","level":"note","message":{"text":"Documented information for the AI management system — verdict: PASS (90% conf).\n\nComposite raw score 0.70 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/release.yml","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":3,"confidence":0.9,"rawScore":0.7,"verifyMethod":"skipped","clauseId":"iso-42001/clause-7.5-documented-information"}},{"ruleId":"iso-42001-2023/clause-8.1-operational-planning","level":"warning","message":{"text":"Operational planning and control — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-8.1-operational-planning"}},{"ruleId":"iso-42001-2023/clause-9.1-monitoring","level":"warning","message":{"text":"Monitoring, measurement, analysis and evaluation — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"tests/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-9.1-monitoring"}},{"ruleId":"iso-42001-2023/clause-9.1-monitoring","level":"warning","message":{"text":"Monitoring, measurement, analysis and evaluation — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: he(projectDir); console.log(\"Hacker Bob update cache cleared.\"); return; } usage(); process.exit(1); } main(process.argv.sli"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/bob-update.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-9.1-monitoring"}},{"ruleId":"iso-42001-2023/clause-9.1-monitoring","level":"warning","message":{"text":"Monitoring, measurement, analysis and evaluation — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ndoff, })); console.log(JSON.stringify({ ok: true, message: \"post-report evidence run accepted\" })); process.exit(0); } con"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".claude/hooks/hunter-subagent-stop.js","uriBaseId":"%SRCROOT%"},"region":{"startLine":238,"endLine":238}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-9.1-monitoring"}},{"ruleId":"iso-42001-2023/annex-a5-internal-org","level":"note","message":{"text":"Internal organization controls — verdict: PASS (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/CODEOWNERS","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"iso-42001/annex-a5-internal-org"}},{"ruleId":"iso-42001-2023/annex-a7-resources","level":"note","message":{"text":"Resources for AI systems — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"SECURITY.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"iso-42001/annex-a7-resources"}},{"ruleId":"iso-42001-2023/annex-a7-resources","level":"note","message":{"text":"Resources for AI systems — verdict: PASS (60% conf).\n\nComposite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"package-lock.json","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"pass","score":4,"confidence":0.6,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"iso-42001/annex-a7-resources"}}],"properties":{"auditId":"aud_01KS3E6JAH8WNVWPSZ36C1","bundleHash":"2c8fdda9d0067b798f5bb5ac7cd595938c03bf30d1a3271be1676e5e97f17443","durationMs":28823,"overallScore":1.8695652173913044,"regulationCoverage":["eu-ai-act-2024-08","nist-ai-rmf-1.0","gdpr-2016","iso-42001-2023"]}}]}