{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"AiAuditor","informationUri":"https://github.com/drhus/ai-auditor","version":"v0.1.0","rules":[{"id":"eu-ai-act-2024-08/1e-facial-scraping","name":"eu-ai-act-2024-08/1e-facial-scraping","shortDescription":{"text":"Untargeted facial image scraping for face databases"},"fullDescription":{"text":"EU AI Act, Art 5(1)(e) — Untargeted facial image scraping for face databases"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-5(1)(e)","privacy"],"regulation":"EU AI Act","article":"5(1)(e)","principle":"privacy"}},{"id":"eu-ai-act-2024-08/data-governance","name":"eu-ai-act-2024-08/data-governance","shortDescription":{"text":"Data and data governance practices documented"},"fullDescription":{"text":"EU AI Act, Art 10 — Data and data governance practices documented"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-10","privacy"],"regulation":"EU AI Act","article":"10","principle":"privacy"}},{"id":"eu-ai-act-2024-08/technical-documentation","name":"eu-ai-act-2024-08/technical-documentation","shortDescription":{"text":"Technical documentation drawn up before placing on market"},"fullDescription":{"text":"EU AI Act, Art 11 — Technical documentation drawn up before placing on market"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-11","auditability"],"regulation":"EU AI Act","article":"11","principle":"auditability"}},{"id":"eu-ai-act-2024-08/p1-automatic-logs","name":"eu-ai-act-2024-08/p1-automatic-logs","shortDescription":{"text":"Automatic recording of events over the lifetime"},"fullDescription":{"text":"EU AI Act, Art 12(1) — Automatic recording of events over the lifetime"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-12(1)","auditability"],"regulation":"EU AI Act","article":"12(1)","principle":"auditability"}},{"id":"eu-ai-act-2024-08/p2-traceability","name":"eu-ai-act-2024-08/p2-traceability","shortDescription":{"text":"Logging ensures traceability appropriate to risk"},"fullDescription":{"text":"EU AI Act, Art 12(2) — Logging ensures traceability appropriate to risk"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-12(2)","auditability"],"regulation":"EU AI Act","article":"12(2)","principle":"auditability"}},{"id":"eu-ai-act-2024-08/deployer-instructions","name":"eu-ai-act-2024-08/deployer-instructions","shortDescription":{"text":"Transparent operation and instructions for use"},"fullDescription":{"text":"EU AI Act, Art 13 — Transparent operation and instructions for use"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-13","transparency"],"regulation":"EU AI Act","article":"13","principle":"transparency"}},{"id":"eu-ai-act-2024-08/p4d-stop-button","name":"eu-ai-act-2024-08/p4d-stop-button","shortDescription":{"text":"Interrupt / stop function reachable by overseer"},"fullDescription":{"text":"EU AI Act, Art 14(4)(d) — Interrupt / stop function reachable by overseer"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(4)(d)","human-oversight"],"regulation":"EU AI Act","article":"14(4)(d)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p4e-override","name":"eu-ai-act-2024-08/p4e-override","shortDescription":{"text":"Ability to override / reverse the system's output"},"fullDescription":{"text":"EU AI Act, Art 14(4)(e) — Ability to override / reverse the system's output"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-14(4)(e)","human-oversight"],"regulation":"EU AI Act","article":"14(4)(e)","principle":"human-oversight"}},{"id":"eu-ai-act-2024-08/p1-accuracy","name":"eu-ai-act-2024-08/p1-accuracy","shortDescription":{"text":"Appropriate level of accuracy declared and tested"},"fullDescription":{"text":"EU AI Act, Art 15(1) — Appropriate level of accuracy declared and tested"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(1)","safety"],"regulation":"EU AI Act","article":"15(1)","principle":"safety"}},{"id":"eu-ai-act-2024-08/p5-cybersecurity","name":"eu-ai-act-2024-08/p5-cybersecurity","shortDescription":{"text":"Cybersecurity measures appropriate to circumstances"},"fullDescription":{"text":"EU AI Act, Art 15(5) — Cybersecurity measures appropriate to circumstances"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-15(5)","security-governance"],"regulation":"EU AI Act","article":"15(5)","principle":"security-governance"}},{"id":"eu-ai-act-2024-08/p6-keep-logs","name":"eu-ai-act-2024-08/p6-keep-logs","shortDescription":{"text":"Deployer log-retention capability supported"},"fullDescription":{"text":"EU AI Act, Art 26(6) — Deployer log-retention capability supported"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-26(6)","accountability"],"regulation":"EU AI Act","article":"26(6)","principle":"accountability"}},{"id":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","name":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","shortDescription":{"text":"Emotion recognition / biometric categorisation disclosure"},"fullDescription":{"text":"EU AI Act, Art 50(3) — Emotion recognition / biometric categorisation disclosure"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","eu-ai-act-2024-08","article-50(3)","transparency"],"regulation":"EU AI Act","article":"50(3)","principle":"transparency"}},{"id":"nist-ai-rmf-1.0/map-1.1","name":"nist-ai-rmf-1.0/map-1.1","shortDescription":{"text":"Context of use established and understood"},"fullDescription":{"text":"NIST AI RMF, Art MAP 1.1 — Context of use established and understood"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MAP 1.1","auditability"],"regulation":"NIST AI RMF","article":"MAP 1.1","principle":"auditability"}},{"id":"nist-ai-rmf-1.0/measure-2.3","name":"nist-ai-rmf-1.0/measure-2.3","shortDescription":{"text":"AI system performance evaluated and documented"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.3 — AI system performance evaluated and documented"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.3","safety"],"regulation":"NIST AI RMF","article":"MEASURE 2.3","principle":"safety"}},{"id":"nist-ai-rmf-1.0/measure-2.7","name":"nist-ai-rmf-1.0/measure-2.7","shortDescription":{"text":"Security and resilience evaluated"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.7 — Security and resilience evaluated"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.7","security-governance"],"regulation":"NIST AI RMF","article":"MEASURE 2.7","principle":"security-governance"}},{"id":"nist-ai-rmf-1.0/measure-2.8","name":"nist-ai-rmf-1.0/measure-2.8","shortDescription":{"text":"Privacy risk of the AI system evaluated"},"fullDescription":{"text":"NIST AI RMF, Art MEASURE 2.8 — Privacy risk of the AI system evaluated"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MEASURE 2.8","privacy"],"regulation":"NIST AI RMF","article":"MEASURE 2.8","principle":"privacy"}},{"id":"nist-ai-rmf-1.0/manage-2.3","name":"nist-ai-rmf-1.0/manage-2.3","shortDescription":{"text":"Mechanisms to supersede or deactivate AI systems"},"fullDescription":{"text":"NIST AI RMF, Art MANAGE 2.3 — Mechanisms to supersede or deactivate AI systems"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MANAGE 2.3","human-oversight"],"regulation":"NIST AI RMF","article":"MANAGE 2.3","principle":"human-oversight"}},{"id":"nist-ai-rmf-1.0/manage-4.1","name":"nist-ai-rmf-1.0/manage-4.1","shortDescription":{"text":"Post-deployment monitoring, appeal and override, change management"},"fullDescription":{"text":"NIST AI RMF, Art MANAGE 4.1 — Post-deployment monitoring, appeal and override, change management"},"helpUri":"https://www.nist.gov/itl/ai-risk-management-framework","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","nist-ai-rmf-1.0","article-MANAGE 4.1","auditability"],"regulation":"NIST AI RMF","article":"MANAGE 4.1","principle":"auditability"}},{"id":"gdpr-2016/art-22-automated-decisions","name":"gdpr-2016/art-22-automated-decisions","shortDescription":{"text":"Automated individual decision-making, including profiling"},"fullDescription":{"text":"GDPR, Art 22 — Automated individual decision-making, including profiling"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","gdpr-2016","article-22","human-oversight"],"regulation":"GDPR","article":"22","principle":"human-oversight"}},{"id":"gdpr-2016/art-25-by-design","name":"gdpr-2016/art-25-by-design","shortDescription":{"text":"Data protection by design and by default"},"fullDescription":{"text":"GDPR, Art 25 — Data protection by design and by default"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","gdpr-2016","article-25","privacy"],"regulation":"GDPR","article":"25","principle":"privacy"}},{"id":"gdpr-2016/art-32-security","name":"gdpr-2016/art-32-security","shortDescription":{"text":"Security of processing"},"fullDescription":{"text":"GDPR, Art 32 — Security of processing"},"helpUri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","gdpr-2016","article-32","security-governance"],"regulation":"GDPR","article":"32","principle":"security-governance"}},{"id":"iso-42001-2023/clause-7.5-documented-information","name":"iso-42001-2023/clause-7.5-documented-information","shortDescription":{"text":"Documented information for the AI management system"},"fullDescription":{"text":"ISO/IEC 42001, Art 7.5 — Documented information for the AI management system"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"error"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-7.5","auditability"],"regulation":"ISO/IEC 42001","article":"7.5","principle":"auditability"}},{"id":"iso-42001-2023/clause-9.1-monitoring","name":"iso-42001-2023/clause-9.1-monitoring","shortDescription":{"text":"Monitoring, measurement, analysis and evaluation"},"fullDescription":{"text":"ISO/IEC 42001, Art 9.1 — Monitoring, measurement, analysis and evaluation"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-9.1","auditability"],"regulation":"ISO/IEC 42001","article":"9.1","principle":"auditability"}},{"id":"iso-42001-2023/annex-a7-resources","name":"iso-42001-2023/annex-a7-resources","shortDescription":{"text":"Resources for AI systems"},"fullDescription":{"text":"ISO/IEC 42001, Art A.7 — Resources for AI systems"},"helpUri":"https://www.iso.org/standard/81230.html","defaultConfiguration":{"level":"warning"},"properties":{"tags":["ai-compliance","iso-42001-2023","article-A.7","security-governance"],"regulation":"ISO/IEC 42001","article":"A.7","principle":"security-governance"}}]}},"automationDetails":{"id":"aiauditor/aud_01KS3EG5ZWV15NN8HTGYJZ"},"originalUriBaseIds":{"%SRCROOT%":{"uri":"https://github.com/symbiotic-sh/core/blob/22fb7fb082334c5a9c9fc3116f9e9e6a399e96ce/"}},"versionControlProvenance":[{"repositoryUri":"https://github.com/symbiotic-sh/core","revisionId":"22fb7fb082334c5a9c9fc3116f9e9e6a399e96ce","branch":"22fb7fb082334c5a9c9fc3116f9e9e6a399e96ce"}],"results":[{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: /// Build system fingerprint. BuildSystem, /// CI configuration. CiConfig, /// Test-command wiring — docs referenced a sc"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/source_archeology/excavate.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":53,"endLine":53}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: ass 3: build-system fingerprint. for manifest in [ \"Cargo.toml\", \"package.json\", \"pyproject.toml\", \"go.m"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/source_archeology/excavate.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":136,"endLine":136}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: ize, /// Stable fingerprint of the agent identity for correlation/provenance. #[serde(default)] pub agent_fingerprint: String,"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-memory/src/tool_memory.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":33,"endLine":33}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: omium, Page } from 'playwright'; interface ScriptInput { domain: string; username: string; password: string; totp_code?: string; }"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/_generic.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":11,"endLine":11}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: { chromium } from 'playwright'; interface ScriptInput { domain: string; username: string; password: string; totp_code?: string; }"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/github.com.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":10,"endLine":10}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/1e-facial-scraping","level":"error","message":{"text":"Untargeted facial image scraping for face databases — verdict: FAIL (55% conf).\n\nComposite raw score 1.00 (1/1 rules matched).\n\nEvidence: omium, Page } from 'playwright'; interface ScriptInput { domain: string; username: string; password: string; totp_code?: string; }"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/google.com.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":15,"endLine":15}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-5/1e-facial-scraping"}},{"ruleId":"eu-ai-act-2024-08/data-governance","level":"error","message":{"text":"Data and data governance practices documented — verdict: FAIL (75% conf).\n\nComposite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: <p>Hello</p><script>fetch('/exfil?'+document.cookie)</script></body></html>"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/tests/fixtures/stage_a_fail/script_tag.html","uriBaseId":"%SRCROOT%"},"region":{"startLine":1,"endLine":1}}}],"properties":{"verdict":"fail","score":0,"confidence":0.75,"rawScore":0.1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-10/data-governance"}},{"ruleId":"eu-ai-act-2024-08/data-governance","level":"error","message":{"text":"Data and data governance practices documented — verdict: FAIL (75% conf).\n\nComposite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: end + Sync { fn fetch(&self, url: &Url) -> Result<FetchedContent>; } pub trait IntakeStore: Send + Sync { fn exists(&self, idempote"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-intake/src/lib.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":114,"endLine":114}}}],"properties":{"verdict":"fail","score":0,"confidence":0.75,"rawScore":0.1,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-10/data-governance"}},{"ruleId":"eu-ai-act-2024-08/technical-documentation","level":"error","message":{"text":"Technical documentation drawn up before placing on market — verdict: FAIL (73% conf).\n\nComposite raw score 0.07 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 1 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.725,"rawScore":0.075,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-11/technical-documentation"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"error","message":{"text":"Automatic recording of events over the lifetime — verdict: FAIL (99% conf).\n\nComposite raw score 0.34 (1/3 rules matched).\n\nEvidence: e server is ready console.log(`READY:${port}`); });"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/test-server/server.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":121,"endLine":121}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9902059991327963,"rawScore":0.34020599913279626,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"error","message":{"text":"Automatic recording of events over the lifetime — verdict: FAIL (99% conf).\n\nComposite raw score 0.34 (1/3 rules matched).\n\nEvidence: ::fs::write(&path, \"console.log('ok')\\n\").expect(\"write script\"); let mut reg = ScriptRegistry::empty(); reg.register(\"gith"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"services/credential-gateway/src/script_registry.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":353,"endLine":353}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9902059991327963,"rawScore":0.34020599913279626,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"error","message":{"text":"Automatic recording of events over the lifetime — verdict: FAIL (99% conf).\n\nComposite raw score 0.34 (1/3 rules matched).\n\nEvidence: e server is ready console.log(`READY:${port}`); });"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/test-server/server.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":121,"endLine":121}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9902059991327963,"rawScore":0.34020599913279626,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p1-automatic-logs","level":"error","message":{"text":"Automatic recording of events over the lifetime — verdict: FAIL (99% conf).\n\nComposite raw score 0.34 (1/3 rules matched).\n\nEvidence: ::fs::write(&path, \"console.log('ok')\\n\").expect(\"write script\"); let mut reg = ScriptRegistry::empty(); reg.register(\"gith"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"services/credential-gateway/src/script_registry.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":353,"endLine":353}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9902059991327963,"rawScore":0.34020599913279626,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p1-automatic-logs"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"warning","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.44 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: e server is ready console.log(`READY:${port}`); });"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/test-server/server.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":121,"endLine":121}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.43520599913279623,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"warning","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.44 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ::fs::write(&path, \"console.log('ok')\\n\").expect(\"write script\"); let mut reg = ScriptRegistry::empty(); reg.register(\"gith"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"services/credential-gateway/src/script_registry.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":353,"endLine":353}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.43520599913279623,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"warning","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.44 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: e server is ready console.log(`READY:${port}`); });"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/test-server/server.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":121,"endLine":121}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.43520599913279623,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/p2-traceability","level":"warning","message":{"text":"Logging ensures traceability appropriate to risk — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.44 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ::fs::write(&path, \"console.log('ok')\\n\").expect(\"write script\"); let mut reg = ScriptRegistry::empty(); reg.register(\"gith"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"services/credential-gateway/src/script_registry.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":353,"endLine":353}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.43520599913279623,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-12/p2-traceability"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (78% conf).\n\nComposite raw score 0.13 (0/3 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 1 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.775,"rawScore":0.125,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (78% conf).\n\nComposite raw score 0.13 (0/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.775,"rawScore":0.125,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/deployer-instructions","level":"error","message":{"text":"Transparent operation and instructions for use — verdict: FAIL (78% conf).\n\nComposite raw score 0.13 (0/3 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.775,"rawScore":0.125,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-13/deployer-instructions"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"warning","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PARTIAL (97% conf).\n\nComposite raw score 0.63 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":98,"endLine":98}}}],"properties":{"verdict":"partial","score":2,"confidence":0.97,"rawScore":0.63,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"warning","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PARTIAL (97% conf).\n\nComposite raw score 0.63 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in field.split('.'): if isinstance(value, dict): value = value.get(part)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":103,"endLine":103}}}],"properties":{"verdict":"partial","score":2,"confidence":0.97,"rawScore":0.63,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"warning","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PARTIAL (97% conf).\n\nComposite raw score 0.63 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":20,"endLine":20}}}],"properties":{"verdict":"partial","score":2,"confidence":0.97,"rawScore":0.63,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4d-stop-button","level":"warning","message":{"text":"Interrupt / stop function reachable by overseer — verdict: PARTIAL (97% conf).\n\nComposite raw score 0.63 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in sys.argv[1].split('.'): if isinstance(value, dict): value = value.get"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"partial","score":2,"confidence":0.97,"rawScore":0.63,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4d-stop-button"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":98,"endLine":98}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in field.split('.'): if isinstance(value, dict): value = value.get(part)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":103,"endLine":103}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":20,"endLine":20}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p4e-override","level":"warning","message":{"text":"Ability to override / reverse the system's output — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in sys.argv[1].split('.'): if isinstance(value, dict): value = value.get"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-14/p4e-override"}},{"ruleId":"eu-ai-act-2024-08/p1-accuracy","level":"warning","message":{"text":"Appropriate level of accuracy declared and tested — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.55 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"tests/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.55,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p1-accuracy"}},{"ruleId":"eu-ai-act-2024-08/p1-accuracy","level":"warning","message":{"text":"Appropriate level of accuracy declared and tested — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.55 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.55,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p1-accuracy"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: detection. //! //! Prompt-injection attacks often lean on **delimiter confusion** — nesting //! code fences, mixing Markdown and XML, stuff"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/delimiters.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":3,"endLine":3}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: //! Classic prompt-injection phrase + role-token detection. //! //! Rules here are deliberately conservative — every regex is review"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/injection_phrases.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":1,"endLine":1}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: \\b(developer\\s+mode|jailbreak|dan\\s+mode|sudo\\s+mode)\\b\")); static NEW_PERSONA: Lazy<Regex> = Lazy::new(|| ci(r\"\\byour\\s+(new|real|true"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/injection_phrases.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":81,"endLine":81}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: //! Prompt-injection heuristics used by Stage B. //! //! All heuristics return a `Vec<HeuristicHit>`. Stage B combines the h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/mod.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":1,"endLine":1}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: r the classic //! prompt-injection surface (\"ignore previous instructions\", role tokens, //! tool-call impersonation). //! - [`delimiter"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/mod.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":10,"endLine":10}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: n) + Stage B //! (prompt-injection heuristics) + scan cache ([`stages`], [`sanitize`], //! [`heuristics`], [`cache`]). //! - **T132 §04*"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/lib.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":10,"endLine":10}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: per /// design §7 (`RateLimited` / `Unavailable` → `SUSPICIOUS`). We intentionally /// keep this enum small and typed so the mapping is exha"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: limited: {0}\")] RateLimited(String), /// Model or runtime is temporarily unavailable (health check failing, /// circuit breaker"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":72,"endLine":72}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: rr(LlmGatewayError::RateLimited(\"quota exceeded\".into())), }; let err = gw .invoke_fast_tier(FastTierRequest {"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: r, LlmGatewayError::RateLimited(_))); } }"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":159,"endLine":159}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: //! //! - Gateway `RateLimited` / `Unavailable` → `SUSPICIOUS` fallback with a //! 5 min cache TTL (design §7). //! - Malformed model res"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/stages/stage_c.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p5-cybersecurity","level":"warning","message":{"text":"Cybersecurity measures appropriate to circumstances — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/4 rules matched).\n\nEvidence: LlmGatewayError::RateLimited(reason) => { format!(\"fast-tier gateway rate-limited: {reason}\") } LlmGatewayErr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/stages/stage_c.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":188,"endLine":188}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-15/p5-cybersecurity"}},{"ruleId":"eu-ai-act-2024-08/p6-keep-logs","level":"warning","message":{"text":"Deployer log-retention capability supported — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: e server is ready console.log(`READY:${port}`); });"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/test-server/server.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":121,"endLine":121}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-26/p6-keep-logs"}},{"ruleId":"eu-ai-act-2024-08/p6-keep-logs","level":"warning","message":{"text":"Deployer log-retention capability supported — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ::fs::write(&path, \"console.log('ok')\\n\").expect(\"write script\"); let mut reg = ScriptRegistry::empty(); reg.register(\"gith"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"services/credential-gateway/src/script_registry.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":353,"endLine":353}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"eu-ai-act/art-26/p6-keep-logs"}},{"ruleId":"eu-ai-act-2024-08/p3-emotion-biometric-disclosure","level":"error","message":{"text":"Emotion recognition / biometric categorisation disclosure — verdict: FAIL (55% conf).\n\nComposite raw score 0.00 (0/1 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":0,"confidence":0.55,"rawScore":0,"verifyMethod":"deterministic-only","clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure"}},{"ruleId":"nist-ai-rmf-1.0/map-1.1","level":"error","message":{"text":"Context of use established and understood — verdict: FAIL (75% conf).\n\nComposite raw score 0.15 (0/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: 1 required sections present"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.75,"rawScore":0.15,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/map-1.1"}},{"ruleId":"nist-ai-rmf-1.0/map-1.1","level":"error","message":{"text":"Context of use established and understood — verdict: FAIL (75% conf).\n\nComposite raw score 0.15 (0/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.75,"rawScore":0.15,"verifyMethod":"deterministic-only","clauseId":"nist-ai-rmf/map-1.1"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.3","level":"warning","message":{"text":"AI system performance evaluated and documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.55 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"tests/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.55,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.3"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.3","level":"warning","message":{"text":"AI system performance evaluated and documented — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.55 (2/3 rules matched)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.55,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.3"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: detection. //! //! Prompt-injection attacks often lean on **delimiter confusion** — nesting //! code fences, mixing Markdown and XML, stuff"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/delimiters.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":3,"endLine":3}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: //! Classic prompt-injection phrase + role-token detection. //! //! Rules here are deliberately conservative — every regex is review"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/injection_phrases.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":1,"endLine":1}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: \\b(developer\\s+mode|jailbreak|dan\\s+mode|sudo\\s+mode)\\b\")); static NEW_PERSONA: Lazy<Regex> = Lazy::new(|| ci(r\"\\byour\\s+(new|real|true"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/injection_phrases.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":81,"endLine":81}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: //! Prompt-injection heuristics used by Stage B. //! //! All heuristics return a `Vec<HeuristicHit>`. Stage B combines the h"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/mod.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":1,"endLine":1}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: r the classic //! prompt-injection surface (\"ignore previous instructions\", role tokens, //! tool-call impersonation). //! - [`delimiter"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/heuristics/mod.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":10,"endLine":10}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: n) + Stage B //! (prompt-injection heuristics) + scan cache ([`stages`], [`sanitize`], //! [`heuristics`], [`cache`]). //! - **T132 §04*"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/lib.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":10,"endLine":10}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: per /// design §7 (`RateLimited` / `Unavailable` → `SUSPICIOUS`). We intentionally /// keep this enum small and typed so the mapping is exha"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":64,"endLine":64}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: limited: {0}\")] RateLimited(String), /// Model or runtime is temporarily unavailable (health check failing, /// circuit breaker"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":72,"endLine":72}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: rr(LlmGatewayError::RateLimited(\"quota exceeded\".into())), }; let err = gw .invoke_fast_tier(FastTierRequest {"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":150,"endLine":150}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: r, LlmGatewayError::RateLimited(_))); } }"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/llm_gateway.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":159,"endLine":159}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: //! //! - Gateway `RateLimited` / `Unavailable` → `SUSPICIOUS` fallback with a //! 5 min cache TTL (design §7). //! - Malformed model res"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/stages/stage_c.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.7","level":"warning","message":{"text":"Security and resilience evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.60 (2/3 rules matched).\n\nEvidence: LlmGatewayError::RateLimited(reason) => { format!(\"fast-tier gateway rate-limited: {reason}\") } LlmGatewayErr"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-firewall/src/stages/stage_c.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":188,"endLine":188}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.6000000000000001,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.7"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: symbiotic_context::redact_pii; /// Maximum number of iterations before the loop terminates. const MAX_ITERATIONS: usize = 10; /// Maximum"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/executor.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":18,"endLine":18}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: /// Whether to redact PII from the agent's final output before returning. /// Defaults to `true`. Set to `false` for debugging or t"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/executor.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":79,"endLine":79}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: scenarios. pub redact_output: bool, } impl Default for AgentExecConfig { fn default() -> Self { Self { system_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/executor.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":81,"endLine":81}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: : None, redact_output: true, } } } /// Conditionally apply PII redaction to an execution result's output. fn maybe_"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/executor.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":93,"endLine":93}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: itionally apply PII redaction to an execution result's output. fn maybe_redact(mut result: ExecutionResult, redact: bool) -> ExecutionResult"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/executor.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":98,"endLine":98}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/measure-2.8","level":"warning","message":{"text":"Privacy risk of the AI system evaluated — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched).\n\nEvidence: name)), redact_output: true, }; let goal = &phase.description; let tool_refs: Vec<&dyn Tool> = self.too"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/pipeline/backend_native.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":42,"endLine":42}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/measure-2.8"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":98,"endLine":98}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in field.split('.'): if isinstance(value, dict): value = value.get(part)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":103,"endLine":103}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":20,"endLine":20}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-2.3","level":"warning","message":{"text":"Mechanisms to supersede or deactivate AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.54 (1/2 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in sys.argv[1].split('.'): if isinstance(value, dict): value = value.get"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.54,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-2.3"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"error","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (1/4 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":98,"endLine":98}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"error","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (1/4 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in field.split('.'): if isinstance(value, dict): value = value.get(part)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":103,"endLine":103}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"error","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (1/4 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":20,"endLine":20}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"nist-ai-rmf-1.0/manage-4.1","level":"error","message":{"text":"Post-deployment monitoring, appeal and override, change management — verdict: FAIL (100% conf).\n\nComposite raw score 0.33 (1/4 rules matched).\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in sys.argv[1].split('.'): if isinstance(value, dict): value = value.get"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"fail","score":1,"confidence":1,"rawScore":0.33,"verifyMethod":"skipped","clauseId":"nist-ai-rmf/manage-4.1"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"error","message":{"text":"Automated individual decision-making, including profiling — verdict: FAIL (96% conf).\n\nComposite raw score 0.36 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":98,"endLine":98}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9600000000000001,"rawScore":0.36000000000000004,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"error","message":{"text":"Automated individual decision-making, including profiling — verdict: FAIL (96% conf).\n\nComposite raw score 0.36 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in field.split('.'): if isinstance(value, dict): value = value.get(part)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/live-readiness.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":103,"endLine":103}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9600000000000001,"rawScore":0.36000000000000004,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"error","message":{"text":"Automated individual decision-making, including profiling — verdict: FAIL (96% conf).\n\nComposite raw score 0.36 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: print(\"\") raise SystemExit(0) try: data = json.loads(payload) except Exception: print(\"\") raise SystemExit(0) value = data f"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":20,"endLine":20}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9600000000000001,"rawScore":0.36000000000000004,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-22-automated-decisions","level":"error","message":{"text":"Automated individual decision-making, including profiling — verdict: FAIL (96% conf).\n\nComposite raw score 0.36 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: print(\"\") raise SystemExit(0) value = data for part in sys.argv[1].split('.'): if isinstance(value, dict): value = value.get"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/smoke-mvp.sh","uriBaseId":"%SRCROOT%"},"region":{"startLine":25,"endLine":25}}}],"properties":{"verdict":"fail","score":1,"confidence":0.9600000000000001,"rawScore":0.36000000000000004,"verifyMethod":"skipped","clauseId":"gdpr/art-22-automated-decisions"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"warning","message":{"text":"Data protection by design and by default — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: redact"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/executor.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":79,"endLine":79}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"warning","message":{"text":"Data protection by design and by default — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: redacted"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-context/src/firewall.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":76,"endLine":76}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"warning","message":{"text":"Data protection by design and by default — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: redaction"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-context/src/lib.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":9,"endLine":9}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-25-by-design","level":"warning","message":{"text":"Data protection by design and by default — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: redaction"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-context/src/redaction.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":5,"endLine":5}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-25-by-design"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://example.com"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/builtin_tools.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":1349,"endLine":1349}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://ollama.ai/download"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/llm_runtime.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":284,"endLine":284}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://gw.example/v1"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/source_archeology/contract.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":213,"endLine":213}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"gdpr-2016/art-32-security","level":"warning","message":{"text":"Security of processing — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: https://example.com/flux.git"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"crates/symbiotic-agents/src/source_archeology/scaffold_templates.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":164,"endLine":164}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"gdpr/art-32-security"}},{"ruleId":"iso-42001-2023/clause-7.5-documented-information","level":"error","message":{"text":"Documented information for the AI management system — verdict: FAIL (80% conf).\n\nComposite raw score 0.20 (0/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"fail","score":1,"confidence":0.7999999999999999,"rawScore":0.2,"verifyMethod":"deterministic-only","clauseId":"iso-42001/clause-7.5-documented-information"}},{"ruleId":"iso-42001-2023/clause-9.1-monitoring","level":"warning","message":{"text":"Monitoring, measurement, analysis and evaluation — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"tests/","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-9.1-monitoring"}},{"ruleId":"iso-42001-2023/clause-9.1-monitoring","level":"warning","message":{"text":"Monitoring, measurement, analysis and evaluation — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: e server is ready console.log(`READY:${port}`); });"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/auth/test-server/server.ts","uriBaseId":"%SRCROOT%"},"region":{"startLine":121,"endLine":121}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-9.1-monitoring"}},{"ruleId":"iso-42001-2023/clause-9.1-monitoring","level":"warning","message":{"text":"Monitoring, measurement, analysis and evaluation — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (2/2 rules matched). Supporting docs may exist outside the repo.\n\nEvidence: ::fs::write(&path, \"console.log('ok')\\n\").expect(\"write script\"); let mut reg = ScriptRegistry::empty(); reg.register(\"gith"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"services/credential-gateway/src/script_registry.rs","uriBaseId":"%SRCROOT%"},"region":{"startLine":353,"endLine":353}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/clause-9.1-monitoring"}},{"ruleId":"iso-42001-2023/annex-a7-resources","level":"warning","message":{"text":"Resources for AI systems — verdict: PARTIAL (100% conf).\n\nComposite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"Cargo.lock","uriBaseId":"%SRCROOT%"}}}],"properties":{"verdict":"partial","score":2,"confidence":1,"rawScore":0.5,"verifyMethod":"skipped","clauseId":"iso-42001/annex-a7-resources"}}],"properties":{"auditId":"aud_01KS3EG5ZWV15NN8HTGYJZ","bundleHash":"d8eeb73f4f12a19dc2acab548f63144aafa20e3ed48cbabd9c7824ad2ed4f969","durationMs":30179,"overallScore":1.2127659574468086,"regulationCoverage":["eu-ai-act-2024-08","nist-ai-rmf-1.0","gdpr-2016","iso-42001-2023"]}}]}