{"auditId":"aud_01KS3FDRK7DX6DJ50GTBS6","status":"completed","startedAt":"2026-05-20T19:57:25.479Z","updatedAt":"2026-05-20T19:58:01.026Z","progressNote":"Risk class: high — running clause checkers","report":{"auditId":"aud_01KS3FDRK7DX6DJ50GTBS6","source":{"kind":"repo","owner":"drhus","repo":"ai-auditor"},"input":{"auditId":"aud_01KS3FDRK7DX6DJ50GTBS6","source":{"kind":"repo","owner":"drhus","repo":"ai-auditor"},"repoUrl":"https://github.com/drhus/ai-auditor","regulations":["eu-ai-act-2024-08","nist-ai-rmf-1.0","gdpr-2016","iso-42001-2023"]},"fetch":{"repoUrl":"https://github.com/drhus/ai-auditor","owner":"drhus","repo":"ai-auditor","ref":"8d681f7e9beebb27811b15ce6282882c2472a2cb","commitSha":"8d681f7e9beebb27811b15ce6282882c2472a2cb","worktreeDir":"/tmp/ai-auditor/aud_01KS3FDRK7DX6DJ50GTBS6","fileCount":240,"totalBytes":8291741,"languages":{"Markdown":417462,"HTML":5412,"CSS":14748,"TypeScript":664173,"JSON":598926,"Solidity":4031,"JavaScript":63,"YAML":96078,"Shell":2906},"inventory":{"hasReadme":true,"hasLicense":true,"hasModelCard":false,"hasDataCard":false,"hasRiskRegister":true,"hasThreatModel":false,"hasSecurityMd":true,"hasPrivacyMd":true,"hasCodeOfConduct":false,"hasContributing":false,"hasCiWorkflows":false,"hasEvalDir":false,"hasTestsDir":false,"governanceDocFiles":[".agent/docs/README.md","LICENSE","PRIVACY.md","README.md","RISK_REGISTER.md","SECURITY.md","contracts/README.md","regulations/README.md"],"configFiles":["package.json"]},"fetchedAt":"2026-05-20T19:57:27.908Z"},"recon":{"signals":{"agent_framework":{"signal":"agent_framework","fired":true,"strength":0.8704365036222725,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"nippet\": \"import os from langchain.callbacks.streaming_stdout import StreamingStdOutCallbackHandler from langchain_openai import ChatOpenAI\"","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"dOutCallbackHandler from langchain_openai import ChatOpenAI\", \"rule\": \"langchain_import\" }, { \"f","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[99,99],"snippet":"dOutCallbackHandler from langchain_openai import ChatOpenAI model = ChatOpenAI( model=os.getenv(\\\"MODEL_NAME\\\"), temperature=0.1,\",","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[117,117],"snippet":"\"import load_dotenv from langchain.globals import set_llm_cache from langchain_community.cache import SQLiteCache from termcolor import colo","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[117,117],"snippet":"mport set_llm_cache from langchain_community.cache import SQLiteCache from termcolor import colo\", \"rule\": \"langchain_import\"","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[108,108],"snippet":"\"rt OpenAI client = OpenAI( base_url=os.getenv(\\\"OPENAI_API_BASE\\\"), api_key=os.getenv(\\\"OPENAI_API_KEY\\\") ) response = client.chat.complet\"","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[89,89],"snippet":"\"st import requests from anthropic import Anthropic, AnthropicBedrock, AnthropicVertex, APIResponse from anthropic.types import ToolResultBl","rule":"anthropic_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[121,121],"snippet":"ity import tiktoken from anthropic import APIConnectionError, APIStatusError from pydantic import SecretStr from forge.models.config import\"","rule":"anthropic_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[130,130],"snippet":"ippet\": \"er=logger) from anthropic import AsyncAnthropic self._client = AsyncAnthropic( **self._credentials.get_api_acc\", \"rule\"","rule":"anthropic_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[103,103],"snippet":"et\": \"\\\"\\\"\\\"Newer ``openai-python`` declares ``cache_write_tokens`` as a typed attribute on ``PromptTokensDetails`` — it no longer l\",","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[112,112],"snippet":"ippet\": \"response = OpenAI( api_key=self.openai_credentials.api_key.get_secret_value(), organization=(\", \"rule\": \"openai_sdk_use","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[139,139],"snippet":"//github.com/openai/openai-python/blob/120d225b91a8453e15240a49fb1c6794d8119326/chatml.md \\\" # noqa \\\"for information on how\", \"","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[3321,3321],"snippet":"et\": \"\\\"\\\"\\\"Newer ``openai-python`` declares ``cache_write_tokens`` as a typed attribute on ``PromptTokensDetails`` — it no longer l\",","rule":"openai_sdk_use"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[3330,3330],"snippet":"ippet\": \"response = OpenAI( api_key=self.openai_credentials.api_key.get_secret_value(), organization=(\", \"rule\": \"openai_sdk_use\"","rule":"openai_sdk_use"},{"file":"src/pipeline/stages/recon.ts","lines":[291,291],"snippet":"s|openai\\.responses|openai-python|openai\\.OpenAI)/g }, { signal: \"agent_framework\", rule: \"agent_loop_pattern\", pattern: /\\b(?:while\\s+not","rule":"openai_sdk_use"}]},"model_usage":{"signal":"model_usage","fired":true,"strength":1,"evidence":[{"file":"src/app/preview/_report-mock.ts","lines":[183,183],"snippet":".create({\\n model: \"claude-opus-4-7\",\\n messages,\\n});\\n// Raw model output returned with no provenance marker.\\nreturn res.json({ reply:","rule":"model_string_anthropic","detail":"claude-opus-4-7"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[100,100],"snippet":"\"detail\": \"claude-opus-4-7\" } ], \"meta\": { \"models\": {} } }, \"logging_hook","rule":"model_string_anthropic","detail":"claude-opus-4-7"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[306,306],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"gpt_engineer/core/ai.py\", \"lines\": [ 90","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[316,316],"snippet":"\"detail\": \"gpt-4-turbo\" }, { \"file\": \"gpt_engineer/core/ai.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4-turbo"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[326,326],"snippet":"\"detail\": \"gpt-4\" }, { \"file\": \"gpt_engineer/core/ai.py\", \"lines\": [ 112","rule":"model_string_openai","detail":"gpt-4"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[336,336],"snippet":"\"detail\": \"gpt-4-turbo\" }, { \"file\": \"gpt_engineer/core/token_usage.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4-turbo"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[346,346],"snippet":"\"detail\": \"gpt-4\" }, { \"file\": \"gpt_engineer/core/token_usage.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[107,107],"snippet":"\"detail\": \"gpt-4o-mini\" }, { \"file\": \"interpreter/core/computer/browser/browser.py\", \"","rule":"model_string_openai","detail":"gpt-4o-mini"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[117,117],"snippet":"\"detail\": \"gpt-4o-mini\" }, { \"file\": \"interpreter/core/llm/llm.py\", \"lines\": [","rule":"model_string_openai","detail":"gpt-4o-mini"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[127,127],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\", \"line","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[187,187],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"interpreter/terminal_interface/profiles/defaults/aws-docs.py\",","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[207,207],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"interpreter/terminal_interface/profiles/defaults/default.yaml\",","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[137,137],"snippet":"\"detail\": \"Llama-3.1-8B-Instruct\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\",","rule":"model_string_llama","detail":"Llama-3.1-8B-Instruct"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[147,147],"snippet":"\"detail\": \"Mixtral-8x7B-Instruct\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\",","rule":"model_string_llama","detail":"Mixtral-8x7B-Instruct"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[157,157],"snippet":"\"detail\": \"mixtral-8x7b-instruct-v0.1.Q5_K_M.llamafile\" }, { \"file\": \"interpreter/terminal_interfa","rule":"model_string_llama","detail":"mixtral-8x7b-instruct-v0.1.Q5_K_M.llamafile"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[167,167],"snippet":"\"detail\": \"llama3\" }, { \"file\": \"interpreter/terminal_interface/local_setup.py\", \"line","rule":"model_string_llama","detail":"llama3"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[177,177],"snippet":"\"detail\": \"llama3.1\" }, { \"file\": \"interpreter/terminal_interface/profiles/defaults/assistant.py\",","rule":"model_string_llama","detail":"llama3.1"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[167,167],"snippet":"\"detail\": \"claude-sonnet-4-20250514\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-","rule":"model_string_anthropic","detail":"claude-sonnet-4-20250514"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[175,175],"snippet":"\\\": \\\"anthropic\\\", \\\"claude-opus-4-20\", \"rule\": \"model_string_anthropic\", \"detail\": \"claude-haiku-4-5-20251001\"","rule":"model_string_anthropic","detail":"claude-opus-4-20"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[177,177],"snippet":"\"detail\": \"claude-haiku-4-5-20251001\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c","rule":"model_string_anthropic","detail":"claude-haiku-4-5-20251001"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[185,185],"snippet":"\\\": \\\"anthropic\\\", \\\"claude-opus-4-5-202\", \"rule\": \"model_string_anthropic\", \"detail\": \"claude-opus-4-1-20250805\"","rule":"model_string_anthropic","detail":"claude-opus-4-5-202"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[187,187],"snippet":"\"detail\": \"claude-opus-4-1-20250805\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-","rule":"model_string_anthropic","detail":"claude-opus-4-1-20250805"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[155,155],"snippet":": \"Model name (e.g. 'gpt-4o', 'claude-3-5-sonnet') -- node_exec_id TEXT Linked node execution UUID -- llm_call_count\", \"rule\": \"","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[157,157],"snippet":"\"detail\": \"gpt-4o\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-a14c-4d19-a567-653","rule":"model_string_openai","detail":"gpt-4o"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[217,217],"snippet":"\"detail\": \"gpt-5-2025-08-07\" }, { \"file\": \"autogpt_platform/backend/agents/agent_00fdd42c-a14c-4d1","rule":"model_string_openai","detail":"gpt-5-2025-08-07"}],"meta":{"models":{}}},"logging_hooks":{"signal":"logging_hooks","fired":true,"strength":1,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[68,68],"snippet":"evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase=","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[69,69],"snippet":"t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[70,70],"snippet":"= \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[6,6],"snippet":"lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[8,8],"snippet":"ck.clauses) { console.log(` ${c.id} → ${c.principle}`); } } } main().catch((e) => { console.error(e); process.exit(1); });","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[8,8],"snippet":"st-ai-rmf-1.0\"); console.log(`EU clauses: ${eu.clauses.length}`); console.log(`NIST clauses: ${nist.clauses.length}`); const allClau","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[9,9],"snippet":"lauses.length}`); console.log(`NIST clauses: ${nist.clauses.length}`); const allClauses = [...eu.clauses, ...nist.clauses]; const byP","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[20,20],"snippet":"] ?? 0) + 1; } console.log(\"\\nBy principle:\"); for (const p of ALL_PRINCIPLES) { console.log(` ${p.padEnd(22)} ${byPrinciple[p]","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[22,22],"snippet":"L_PRINCIPLES) { console.log(` ${p.padEnd(22)} ${byPrinciple[p] ?? 0}`); } console.log(\"\\nBy metric:\"); for (const [m, n] of Obje","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-taxonomy.ts","lines":[25,25],"snippet":"[p] ?? 0}`); } console.log(\"\\nBy metric:\"); for (const [m, n] of Object.entries(byMetric)) { console.log(` ${m.padEnd(16)} ${n}`","rule":"log_at_tool_boundary"},{"file":"src/app/api/waitlist/route.ts","lines":[53,53],"snippet":"f storage is off. console.log(\"[waitlist]\", JSON.stringify(entry)); return NextResponse.json({ ok: true }); }","rule":"log_at_tool_boundary"},{"file":"src/app/preview/_report-mock.ts","lines":[149,149],"snippet":"Token: string) {\\n logger.info({\\n event: \"login.success\",\\n user, // <-- includes email + name + IP\\n sessionToken,","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[118,118],"snippet":"\": \"he(projectDir); console.log(\\\"Hacker Bob update cache cleared.\\\"); return; } usage(); process.exit(1); } main(process.argv.sli\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[127,127],"snippet":"ppet\": \"ndoff, })); console.log(JSON.stringify({ ok: true, message: \\\"post-report evidence run accepted\\\" })); process.exit(0); } con\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[136,136],"snippet":"\": \"cess.exit(2); } console.log(JSON.stringify({ ok: true, message: finalization.reason })); process.exit(0); } if (require.main === modu\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[145,145],"snippet":"et\": \"y.targetAbs); console.log(\\\"\\\"); if (summary.adapters.length === 1 && summary.adapters[0] === \\\"claude\\\") { console.log(\\\"Upd\",","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[145,145],"snippet":"] === \\\"claude\\\") { console.log(\\\"Upd\", \"rule\": \"log_at_tool_boundary\" }, { \"file\": \"bin/hacker-","rule":"log_at_tool_boundary"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[444,444],"snippet":"difflib import json import logging import os import platform import subprocess import sys from pathlib import Path import openai import ty\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[453,453],"snippet":"\"ations import json import logging import os from pathlib import Path from typing import Any, List, Optional, Union import backoff import\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[507,507],"snippet":"transcripts. \\\"\\\"\\\" import logging import re from typing import Dict, Tuple from regex import regex from gpt_engineer.core.diff import AD\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[516,516],"snippet":"ode changes. \\\"\\\"\\\" import logging from collections import Counter from typing import List RETAIN = \\\"retain\\\" ADD = \\\"add\\\" REMOVE = \\\"remo","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[525,525],"snippet":"rt base64 import io import logging import math from dataclasses import dataclass from typing import List, Union import tiktoken from lang\",","rule":"import_logging"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[462,462],"snippet":"ippet\": \"odel_name) logger.debug(f\\\"Using model {self.model_name}\\\") def start(self, system: str, user: Any, *, step_name: str) -> List[M\",","rule":"log_at_tool_boundary"}]},"oversight_hooks":{"signal":"oversight_hooks","fired":true,"strength":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[342,342],"snippet":"ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr","rule":"kill_switch"},{"file":"src/app/design-exploration/_data.ts","lines":[26,26],"snippet":", hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[350,350],"snippet":"ppet\": \"rr, ) raise SystemExit(2) def looks_like_path(token): if not token or token.startswith(\\\"-\\\"): return False if token\", \"","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[351,351],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \".claude/hooks/session-read-guard.sh\", \"lines\": [","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[359,359],"snippet":"\": \"(blocked) raise SystemExit(0) command = tool_input.get(\\\"command\\\", \\\"\\\") if command: check_bash_command(command) raise SystemExit(0)\",","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[359,359],"snippet":"mand(command) raise SystemExit(0)\", \"rule\": \"kill_switch\" }, { \"file\": \".claude/hooks/session-re","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[360,360],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \".claude/hooks/session-read-guard.sh\", \"lines\": [","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[162,162],"snippet":"import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[171,171],"snippet":"import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[198,198],"snippet":"chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[207,207],"snippet":"a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\"","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[234,234],"snippet":"a import AIMessage, HumanMessage, SystemMessage from gpt_engineer.core.ai import AI from gpt_engine\", \"rule\": \"langchain_import\"","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1547,1547],"snippet":"\"rule\": \"kill_switch_present\", \"matched\": 0, \"weight\": 0.7 }, { \"rule\": \"graceful_s","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[2211,2211],"snippet":"\"rule\": \"kill_switch_present\", \"matched\": 0, \"weight\": 0.6 }, { \"rule\": \"feature_fl","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[647,647],"snippet":"# CancelledError or SystemExit log_metadata.warning( f\\\"Interruption error on node execution {node_exec.n\", \"rule\": \"kill_switch","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[648,648],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \"autogpt_platform/backend/backend/util/process.py\",","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[656,656],"snippet":"f not isinstance(e, SystemExit) else None, ) # Send error to Sentry before cleanup if not isinstance(e,\", \"rule\": \"kill_switch\"","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[657,657],"snippet":"\"rule\": \"kill_switch\" }, { \"file\": \"autogpt_platform/backend/backend/util/process.py\",","rule":"kill_switch"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[665,665],"snippet":"(KeyboardInterrupt, SystemExit)): try: from backend.util.metrics import sentry_capture_error\", \"rule\": \"kill_switch\" }","rule":"kill_switch"}]},"eval_artefacts":{"signal":"eval_artefacts","fired":false,"strength":0,"evidence":[]},"governance_docs":{"signal":"governance_docs","fired":true,"strength":0.7612359947967775,"evidence":[{"file":".agent/docs/README.md","rule":"governance_doc_present"},{"file":"LICENSE","rule":"governance_doc_present"},{"file":"PRIVACY.md","rule":"governance_doc_present"},{"file":"README.md","rule":"governance_doc_present"},{"file":"RISK_REGISTER.md","rule":"governance_doc_present"},{"file":"SECURITY.md","rule":"governance_doc_present"},{"file":"contracts/README.md","rule":"governance_doc_present"},{"file":"regulations/README.md","rule":"governance_doc_present"}]},"cybersec_hooks":{"signal":"cybersec_hooks","fired":true,"strength":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1127,1127],"snippet":"ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr","rule":"rate_limit_usage"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[344,344],"snippet":"(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1121,1121],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1124,1124],"snippet":"Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1135,1135],"snippet":"Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1143,1143],"snippet":"hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to","rule":"prompt_injection_defence"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[264,264],"snippet":"0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0.","rule":"rate_limit_usage"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[260,260],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -","rule":"prompt_injection_defence"},{"file":"src/app/preview/_report-mock.ts","lines":[341,341],"snippet":"entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\",","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[483,483],"snippet":", reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[485,485],"snippet":"id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k","rule":"rate_limit_usage"},{"file":"src/config.ts","lines":[38,38],"snippet":"ing | undefined = process.env.GITHUB_API_TOKEN || process.env.GITHUB_TOKEN || undefined; // ---------------------------------------------","rule":"secrets_loaded_from_env"},{"file":"src/config.ts","lines":[38,38],"snippet":"GITHUB_API_TOKEN || process.env.GITHUB_TOKEN || undefined; // -----------------------------------------------------------------------------","rule":"secrets_loaded_from_env"},{"file":"src/config.ts","lines":[46,46],"snippet":"tring | undefined = process.env.ANTHROPIC_API_KEY; // ----------------------------------------------------------------------------- // Stor","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\",","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"nst sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\", \"rule\": \"rate_limit_usage\" }, {","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[492,492],"snippet":"\"rule\": \"rate_limit_usage\" }, { \"file\": \".claude/hooks/bounty-statusline.js\", \"lines\"","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[500,500],"snippet":"nst sevenDay = data.rate_limits?.seven_day?.used_percentage; const worst = Math.max(fiveHr || 0, sevenDay || 0); if (worst >= 80) ra\",","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[501,501],"snippet":"\"rule\": \"rate_limit_usage\" }, { \"file\": \"mcp/lib/evm-source.js\", \"lines\": [","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[2355,2355],"snippet":"\"rule\": \"prompt_injection_defences\", \"matched\": 0, \"weight\": 0.4 }, { \"rule\": \"rate","rule":"prompt_injection_defence"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[2764,2764],"snippet":"\"rule\": \"prompt_injection_defences\", \"matched\": 0, \"weight\": 0.4 }, { \"rule\": \"adve","rule":"prompt_injection_defence"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[509,509],"snippet":"t\": \"const apiKey = process.env.BOB_ETHERSCAN_API_KEY || null; const etherscan = await fetchFromEtherscanV2(numericChainId, lower, apiKe\",","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[518,518],"snippet":"\"capsolver_api_key: process.env.CAPSOLVER_API_KEY || null, proxy: args.proxy || process.env.BOUNTY_PROXY || null, timeout_ms: args.t\",","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[572,572],"snippet":"\": \"romium`); } if (process.env.CAPSOLVER_API_KEY) { console.log(\\\" OK: CAPSOLVER_API_KEY is set\\\"); } else { console.log(\\\" NOT SE\",","rule":"secrets_loaded_from_env"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[581,581],"snippet":"\": \"abled\\\"); } if (process.env.CAPSOLVER_API_KEY) { addCheck(checks, \\\"ok\\\", \\\"optional_capsolver\\\", \\\"CAPSOLVER_API_KEY is set\\\"); } else\"","rule":"secrets_loaded_from_env"}]},"provenance_hooks":{"signal":"provenance_hooks","fired":true,"strength":0.9446911344070372,"evidence":[{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"},{"file":".agent/docs/llm-judge-policy.md","lines":[78,78],"snippet":"` | 50(2) | **1** | C2PA / watermark library imports | | `art-50/p3-emotion-biometric-disclosure` | 50(3) | **1** | Deterministic disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/pipeline-design.md","lines":[75,75],"snippet":"ovenance_hooks` | C2PA, watermarking, content labelling | Article 50(2) synthetic content disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[63,63],"snippet":"o/text) | C | C2PA / watermarking libraries; metadata writers; output post-processing. | | 50(3) | Emotion-recognition / biometri","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[175,175],"snippet":"ntent> | Drives the C2PA / watermarking signal expectations for clause 50(2). | 2026-05-17 | | 10 | *AI Act Service Desk* + FAQs — <https://","rule":"c2pa_or_watermark"},{"file":".agent/docs/roadmap.md","lines":[341,341],"snippet":"Output provenance | C2PA / watermark library imported and applied | | **6** | Continual re-rating | V1.9 reproducibility — score recomputabl","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1367,1367],"snippet":"ic: - rule: c2pa_or_watermark_library_imported weight: 0.5 description: | Code imports a content-pro","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1370,1370],"snippet":"provenance library: c2pa, opencv c2pa bindings, invisible-watermark, stable-signature, synthid. - rule: provenance_metad","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1370,1370],"snippet":"brary: c2pa, opencv c2pa bindings, invisible-watermark, stable-signature, synthid. - rule: provenance_metadata_written_t","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1371,1371],"snippet":"bindings, invisible-watermark, stable-signature, synthid. - rule: provenance_metadata_written_to_outputs weight:","rule":"c2pa_or_watermark"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1371,1371],"snippet":"nvisible-watermark, stable-signature, synthid. - rule: provenance_metadata_written_to_outputs weight: 0.5 descri","rule":"c2pa_or_watermark"},{"file":"regulations/schema.md","lines":[103,103],"snippet":"provenance_hooks` | C2PA, watermarking, content provenance | | `data_io` | Network calls, file I/O, scrapers | | `pii_signals` | PII pattern","rule":"c2pa_or_watermark"},{"file":"src/app/preview/_report-mock.ts","lines":[172,172],"snippet":"/provenance hooks (`c2pa`, `provenance`, `aiGenerated`, `synthid`) — none fire. The response handler ships raw model output through `res.jso","rule":"c2pa_or_watermark"},{"file":"src/app/preview/_report-mock.ts","lines":[172,172],"snippet":"e`, `aiGenerated`, `synthid`) — none fire. The response handler ships raw model output through `res.json(...)` with no wrapper.\", ar","rule":"c2pa_or_watermark"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1915,1915],"snippet":"\"rule\": \"c2pa_or_watermark_library_imported\", \"matched\": 0, \"weight\": 0.5 }, { \"rul","rule":"c2pa_or_watermark"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[3545,3545],"snippet":"\"rule\": \"c2pa_or_watermark_library_imported\", \"matched\": 0, \"weight\": 0.5 }, { \"rul","rule":"c2pa_or_watermark"},{"file":"src/pipeline/checkers/rules.ts","lines":[724,724],"snippet":"ing, }; }, c2pa_or_watermark_library_imported: (ctx) => fromSignal(pickSig(ctx, \"provenance_hooks\")), provenance_metadata_wr","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[184,184],"snippet":"if (lower.includes(\"c2pa\") || lower.includes(\"invisible-watermark\") || lower.includes(\"synthid\")) { acc.provenance_hooks.push({ file, ru","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[184,184],"snippet":"|| lower.includes(\"invisible-watermark\") || lower.includes(\"synthid\")) { acc.provenance_hooks.push({ file, rule: \"manifest_provenance_d","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[184,184],"snippet":"|| lower.includes(\"synthid\")) { acc.provenance_hooks.push({ file, rule: \"manifest_provenance_dep\" }); } if (lower.includes(\"expres","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[311,311],"snippet":"ance_hooks\", rule: \"c2pa_or_watermark\", pattern: /\\b(?:c2pa|invisible[_-]?watermark|stable[_-]?signature|synthid|watermark_image|watermark_t","rule":"c2pa_or_watermark"},{"file":"src/pipeline/stages/recon.ts","lines":[311,311],"snippet":"rk\", pattern: /\\b(?:c2pa|invisible[_-]?watermark|stable[_-]?signature|synthid|watermark_image|watermark_text)/gi }, // ----- pii_signals","rule":"c2pa_or_watermark"}]},"data_io":{"signal":"data_io","fired":true,"strength":1,"evidence":[{"file":"package-lock.json","lines":[3913,3913],"snippet":"\"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4","rule":"scraping_pattern"},{"file":"package-lock.json","lines":[3923,3923],"snippet":"}, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":","rule":"scraping_pattern"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[229,229],"snippet":"cts scraping loops (requests.get / fetch / playwright in iteration) targeting image content combined with face-detection","rule":"http_external_io"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[229,229],"snippet":"uests.get / fetch / playwright in iteration) targeting image content combined with face-detection calls (mediapipe,","rule":"scraping_pattern"},{"file":"src/app/_components/audit-panel.tsx","lines":[94,94],"snippet":"const res = await fetch(`/api/audit/${state.auditId}`); if (!res.ok) return; const next = (await res.json()) as PipelineSt","rule":"http_external_io"},{"file":"src/app/_components/audit-panel.tsx","lines":[109,109],"snippet":"const res = await fetch(\"/api/audit/run\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/_components/intake-form.tsx","lines":[58,58],"snippet":"celled = false; fetch(\"/api/regulations\") .then((r) => r.json()) .then((d: { regulations: RegulationSummary[] }) => {","rule":"http_external_io"},{"file":"src/app/_components/intake-form.tsx","lines":[87,87],"snippet":"const res = await fetch(\"/api/resolve\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" }, b","rule":"http_external_io"},{"file":"src/app/_components/live-audit-panel.tsx","lines":[325,325],"snippet":"const res = await fetch(\"/api/audit/stream\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/_components/live-audit-panel.tsx","lines":[906,906],"snippet":"{ try { await fetch(\"/api/audit/publish\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" }, body: J","rule":"http_external_io"},{"file":"src/app/_components/private-repo-connect.tsx","lines":[38,38],"snippet":"const res = await fetch(\"/api/auth/github/device\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/_components/private-repo-connect.tsx","lines":[83,83],"snippet":"const res = await fetch(\"/api/auth/github/poll\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" },","rule":"http_external_io"},{"file":"src/app/api/auth/github/device/route.ts","lines":[27,27],"snippet":"const res = await fetch(\"https://github.com/login/device/code\", { method: \"POST\", headers: { Accept: \"application/json\",","rule":"http_external_io"},{"file":"src/app/api/auth/github/poll/route.ts","lines":[55,55],"snippet":"const res = await fetch(\"https://github.com/login/oauth/access_token\", { method: \"POST\", headers: { Accept: \"application/jso","rule":"http_external_io"},{"file":"src/app/audit/[auditId]/_live-status.tsx","lines":[38,38],"snippet":"const res = await fetch(`/api/audit/${state.auditId}`); if (!res.ok) return; const next = (await res.json()) as State;","rule":"http_external_io"},{"file":"src/app/audit/[auditId]/complete/_attestation-form.tsx","lines":[116,116],"snippet":"const res = await fetch(`/api/audit/${auditId}/attestation`, { method: \"POST\", headers: { \"Content-Type\": \"application/jso","rule":"http_external_io"},{"file":"src/app/r/[owner]/[repo]/page.tsx","lines":[40,40],"snippet":"const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, { headers: { Accept: \"application/vnd.github+json\" },","rule":"http_external_io"},{"file":"src/components/audit/audit-start-picker.tsx","lines":[39,39],"snippet":"celled = false; fetch(\"/api/regulations\") .then((r) => r.json()) .then((d: { regulations: RegulationSummary[] }) => {","rule":"http_external_io"},{"file":"src/components/audit/live-audit-dashboard.tsx","lines":[85,85],"snippet":"const res = await fetch(\"/api/audit/stream\", { method: \"POST\", headers: { \"Content-Type\": \"application/json\" }, bo","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[612,612],"snippet":"\"createResp = await fetch(\\\"https://api.capsolver.com/createTask\\\", { method: \\\"POST\\\", headers: { \\\"Content-Type\\\": \\\"application/json\\\" },","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[621,621],"snippet":"st pollResp = await fetch(\\\"https://api.capsolver.com/getTaskResult\\\", { method: \\\"POST\\\", headers: { \\\"Content-Type\\\": \\\"application/j\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[630,630],"snippet":"\"const resp = await fetch(url, { method: \\\"GET\\\", headers: { Accept: \\\"application/json\\\", \\\"User-Agent\\\": \\\"Mozilla/5.0 (compatible; h\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[639,639],"snippet":"\"const resp = await fetch(url, { method: \\\"GET\\\", headers: { Accept: \\\"application/json\\\", \\\"User-Agent\\\": \\\"Mozilla/5.0 (compatible; h\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[648,648],"snippet":"\"const resp = await fetch(url, { method: \\\"POST\\\", headers: { \\\"Content-Type\\\": \\\"application/json\\\", Accept: \\\"application/json\\\", \\\"Use\",","rule":"http_external_io"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[796,796],"snippet":"\"\\\"\\\"\\\" response = requests.post(url, json=extra_arguments) return response if __name__ == \\\"__main__\\\": URL_BASE = \\\"http://127.0.0\",","rule":"http_external_io"}]},"pii_signals":{"signal":"pii_signals","fired":true,"strength":1,"evidence":[{"file":".agent/design-system/version.json","lines":[13,13],"snippet":"ates (landing page, email, social)\", \"Tone-of-voice matrix by context (product UI, marketing, docs, support)\" ] }, {","rule":"pii_keywords"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[290,290],"snippet":"description: \"Code redacts or hashes PII before logging or sending to external models\" - rule: privacy_documentation weig","rule":"pii_redaction_present"},{"file":"src/app/api/waitlist/route.ts","lines":[17,17],"snippet":"00 }); } const email = typeof body === \"object\" && body !== null && \"email\" in body ? (body as { email: unknown }).email","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[18,18],"snippet":"& body !== null && \"email\" in body ? (body as { email: unknown }).email : null; const auditRef = typeof body === \"object\"","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[19,19],"snippet":"? (body as { email: unknown }).email : null; const auditRef = typeof body === \"object\" && body !== null && \"audit_ref\" in","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[19,19],"snippet":"{ email: unknown }).email : null; const auditRef = typeof body === \"object\" && body !== null && \"audit_ref\" in body ? (bod","rule":"pii_keywords"},{"file":"src/app/api/waitlist/route.ts","lines":[26,26],"snippet":"null; if (typeof email !== \"string\" || !EMAIL_RE.test(email)) { return NextResponse.json({ error: \"Provide a valid email.\" }, { statu","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[137,137],"snippet":"include the user's email and a partial token in structured log output.\", reasoning: \"The login handler logs the entire `user` objec","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[149,149],"snippet":"// <-- includes email + name + IP\\n sessionToken, // <-- token persisted to log sink for 30d\\n });\\n}', }, ],","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[239,239],"snippet":"ainers`, or contact email.\", reasoning: \"ISO 42001 §A.3.2 requires a designated AI accountability owner. We checked package.json, CO","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[352,352],"snippet":"es) => {\\n const { email, password } = req.body;\\n const user = await users.verify(email, password);\\n if (!user) return res.status(401).","rule":"pii_keywords"},{"file":"src/app/preview/_report-mock.ts","lines":[352,352],"snippet":"await users.verify(email, password);\\n if (!user) return res.status(401).end();\\n const token = await issueSession(user);\\n return res.j","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[697,697],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 43, 43 ], \"snippet\": \"domainResp =","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[706,706],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 56, 56 ], \"snippet\": \"createResp =","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[715,715],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 64, 64 ], \"snippet\": \"t tokenResp","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[724,724],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 78, 78 ], \"snippet\": \"const resp =","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[733,733],"snippet":"ile\": \"mcp/lib/temp-email.js\", \"lines\": [ 110, 110 ], \"snippet\": \"const resp","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[817,817],"snippet":"p \\\"$SCRIPT_DIR/mcp/redaction.js\\\" \\\"$TARGET_ABS/mcp/\\\" cp \\\"$SCRIPT_DIR/mcp/lib/\\\"*.js \\\"$TARGET_ABS/mcp/lib/\\\" rm -rf \\\"$TARGET_ABS/mcp/li","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[826,826],"snippet":"t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\\\"foot\\\"><span\", \"rule\": \"","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[835,835],"snippet":"h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\\\"code-card\\\"> <div\", \"rule\": \"pii_red","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[844,844],"snippet":"n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\\\"slide\\\" data-title=\\\"Egress\\\"> <\", \"r","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[853,853],"snippet":"b collects bounded, redacted evidence packs for final reportable findings.</p> <div class=\\\"pill-row\\\"> <span class=\\\"pil\", \"rul","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[728,728],"snippet":"\"snippet\": \"strip() email = input(\\\"What's your email? \\\").strip() url = \\\"https://neyguovvcjxfzhqpkicj.supabase.co/functions/v1/a\",","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[728,728],"snippet":"input(\\\"What's your email? \\\").strip() url = \\\"https://neyguovvcjxfzhqpkicj.supabase.co/functions/v1/a\", \"rule\": \"pii_keywords\"","rule":"pii_keywords"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[737,737],"snippet":"input(\\\"What's your email? \\\").strip() url = \\\"https://neyguovvcjxfzhqpkicj.supabase.co/functions/v1/addEmailToWaitlist\\\"\", \"rul","rule":"pii_keywords"}]},"bio_health_signals":{"signal":"bio_health_signals","fired":true,"strength":0.7380392160057028,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1568,1568],"snippet":"ars to 3 years*\\\\n- Patient outcomes improved across `87%` of pilot programs\\\\n\\\\n> AI is not replacing doctors — it's augmenting their capa","rule":"health_terms"},{"file":"src/pipeline/run.ts","lines":[369,369],"snippet":"_signals: \"Health / clinical data\", employment_signals: \"Employment / HR\", bio_metric_signals: \"Biometrics\", education_signals:","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"ms\", pattern: /\\b(?:patient|diagnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"tern: /\\b(?:patient|diagnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, //","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"?:patient|diagnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, // ----- empl","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"gnosis|prescription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, // ----- employment_signal","rule":"health_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[318,318],"snippet":"escription|clinical|electronic_health_record|EHR|HIPAA|ICD-?10|medical_record|treatment_plan)\\b/gi }, // ----- employment_signals -----","rule":"health_terms"}]},"employment_signals":{"signal":"employment_signals","fired":true,"strength":0.9021090020413225,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ppet\": \"OMMANDS for candidate in tokens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employme","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employment_terms\" }, {","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1010,1010],"snippet":"\"snippet\": \"1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break for path_candidate in candidate_paths(candidate):\", \"rule","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1010,1010],"snippet":"in candidate_paths(candidate):\", \"rule\": \"employment_terms\" }, { \"file\": \".claude/hooks/session","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1019,1019],"snippet":"\"in candidate_paths(candidate): blocked = check_file(path_candidate, block_session_dirs=block_session_dirs)\", \"rule\": \"employmen","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[824,824],"snippet":"e is that, for each candidate check match to the next line etc (recursively) start_ind = list(pot_start_lines.keys())[\", \"rule\":","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[966,966],"snippet":"t a conversation to resume. \\\"\\\"\\\" ) # Check if conversations directory exists if not os.path.exists(conversations_dir):\", \"rule","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[975,975],"snippet":"st conversations to resume\\\", \\\"type\\\": bool, }, { \\\"name\\\": \\\"server\\\", \\\"help_text\\\": \\\"start op\", \"rule\": \"employment_terms\"","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1584,1584],"snippet":"tart claude using --resume SESSION_ID (or --continue) to restore context # approve → auto-approve safe dialogs, press Enter on numbered-op\",","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1593,1593],"snippet":"e still busy before resume, sending anyway\\\" # Resume the exact session so the agent retains full context — no need to re-send objective\",","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1593,1593],"snippet":"sending anyway\\\" # Resume the exact session so the agent retains full context — no need to re-send objective\", \"rule\": \"employm","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1602,1602],"snippet":"\"ending anyway\\\" # Resume the exact session so the agent retains full context — no need to re-send objective if [ -n \\\"$session_id\\\" ]; the","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1611,1611],"snippet":"_path}' && claude --resume '${session_id}' --permission-mode bypassPermissions\\\" Enter else tmux send-keys -t \\\"$window\\\" \\\"cd '${worktree\",","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"ms\", pattern: /\\b(?:resume|curriculum_vitae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interv","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"ttern: /\\b(?:resume|curriculum_vitae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_sco","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"iculum_vitae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_score)\\b/gi }, // -----","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"ae|\\bcv\\b|candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_score)\\b/gi }, // ----- bio_metric","rule":"employment_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[321,321],"snippet":"candidate|applicant|job_application|hiring_decision|ATS|applicant_tracking|recruit|interview_score)\\b/gi }, // ----- bio_metric_signals -","rule":"employment_terms"}]},"bio_metric_signals":{"signal":"bio_metric_signals","fired":true,"strength":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[32,32],"snippet":"\" description: \"Biometric ID, categorisation, emotion recognition\" - signal: critical_infra_signals category: \"2\" description:","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[62,62],"snippet":"otion recognition / biometric categorisation\" - signal: agent_framework # any interactive AI is in scope paragraph: \"50(1)\"","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[231,231],"snippet":"calls (mediapipe, face_recognition, dlib, opencv haar cascade). score_mapping: { pass_default: 4, fail_on_match: 0 } remediation_h","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[262,262],"snippet":"eu-ai-act/art-5/1g-biometric-categorisation clause_id_bytes: 0x0C57 article: \"5(1)(g)\" title: \"Biometric categorisation by prot","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[265,265],"snippet":"(1)(g)\" title: \"Biometric categorisation by protected attributes\" principle: fairness subject: [provider, deployer] classifi","rule":"biometric_terms"},{"file":"src/app/docs/methodology/page.tsx","lines":[29,29],"snippet":"ks, eval_artefacts, biometric, employment, content_generation, and so on. Each match contributes evidence to one or more signals.\", outp","rule":"biometric_terms"},{"file":"src/app/docs/rating/page.tsx","lines":[139,139],"snippet":"one (e.g. real-time biometric ID in public spaces: deployment context required). Surfaced to the human reviewer separate","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1233,1233],"snippet":"\"system Chrome (TLS fingerprint, fonts, WebGL match) // 3. Headed mode — avoids headless signals // 4. ignoreDefaultArgs: ['--enable-aut\",","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1242,1242],"snippet":"-index.js\\\"); const FINGERPRINT = `bobpriortest${crypto.randomBytes(6).toString(\\\"hex\\\")}`; function uniqueDomain(prefix = \\\"bob-priors-test","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1251,1251],"snippet":"ppet\": \", title: `${FINGERPRINT} IDOR on user profile endpoint`, description: `${FINGERPRINT} broken object level authorization`,\",","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1251,1251],"snippet":"t`, description: `${FINGERPRINT} broken object level authorization`,\", \"rule\": \"biometric_terms\" }, {","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1260,1260],"snippet":"\": \"description: `${FINGERPRINT} broken object level authorization`, severity: \\\"high\\\", attack_class: \\\"idor\\\", endpoin\", \"rule","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1048,1048],"snippet":"\"eu-ai-act/art-5/1g-biometric-categorisation\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"5(1)(g)\", \"title\": \"Biomet","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1051,1051],"snippet":")\", \"title\": \"Biometric categorisation by protected attributes\", \"verdict\": \"pass\", \"score\": 4, \"rawScore\": 0,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1073,1073],"snippet":": \"Real-time remote biometric identification in public spaces\", \"verdict\": \"external\", \"score\": null, \"rawScore\": null,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1892,1892],"snippet":"t/art-50/p3-emotion-biometric-disclosure\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"50(3)\", \"title\": \"Emotion reco","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[1895,1895],"snippet":"otion recognition / biometric categorisation disclosure\", \"verdict\": \"n/a\", \"score\": null, \"rawScore\": null, \"eviden","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1100,1100],"snippet":"\"Annex III §1 (Biometric ID, categorisation, emotion recognition) — signal \\\"bio_metric_signals\\\" fired with strength 0.40\", \"Ann","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1245,1245],"snippet":"\"eu-ai-act/art-5/1g-biometric-categorisation\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"5(1)(g)\", \"title\": \"Biomet","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1248,1248],"snippet":")\", \"title\": \"Biometric categorisation by protected attributes\", \"verdict\": \"pass\", \"score\": 4, \"rawScore\": 0,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1270,1270],"snippet":": \"Real-time remote biometric identification in public spaces\", \"verdict\": \"external\", \"score\": null, \"rawScore\": null,","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1932,1932],"snippet":"t/art-50/p3-emotion-biometric-disclosure\", \"regulationId\": \"eu-ai-act-2024-08\", \"article\": \"50(3)\", \"title\": \"Emotion reco","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1816,1816],"snippet":"et\": \"@property def voice_id(self): voice_id_map = { Voice.LILY: \\\"pFZP5JQG7iQjIQuC4Bku\\\", Voice.DANIEL: \\\"onwK\", \"rule\": \"biome","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1825,1825],"snippet":"\": input_data.voice.voice_id, \\\"hasEnhancedGeneration\\\": True, \\\"generationPreset\\\": input_data.generation_prese\", \"rule\": \"biom","rule":"biometric_terms"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1834,1834],"snippet":"\": input_data.voice.voice_id, \\\"selectedAvatar\\\": \\\"https://cdn.revid.ai/avatars/young-woman.mp4\\\", \\\"selectedAva\", \"rule\": \"bio","rule":"biometric_terms"}]},"education_signals":{"signal":"education_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"ms\", pattern: /\\b(?:student_grade|admissions_decision|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"/\\b(?:student_grade|admissions_decision|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // -----","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"admissions_decision|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // ----- law_enforcement_sig","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"ion|exam_proctoring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // ----- law_enforcement_signals ----- { s","rule":"education_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[327,327],"snippet":"oring|essay_scoring|gpa_predict|academic_dishonesty|plagiarism_detect)\\b/gi }, // ----- law_enforcement_signals ----- { signal: \"law_en","rule":"education_terms"}]},"law_enforcement_signals":{"signal":"law_enforcement_signals","fired":true,"strength":0.7612359947967775,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[199,199],"snippet":"crime-likelihood / recidivism / \"risk to commit X\" scores when the input contains only person profile data (no obje","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"names like `crime_risk`, `recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pa","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pass_default: 4, fail_on_match: 0 }","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ms\", pattern: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migr","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"n: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signa","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals -----","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals ----- { signal: \"migration","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals ----- { signal: \"migration_signals\", rule:","rule":"law_enf_terms"}]},"migration_signals":{"signal":"migration_signals","fired":true,"strength":0.7112605001534575,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[50,50],"snippet":"iption: \"Migration, asylum, border control management\" - signal: justice_signals category: \"8\" description: \"Administration of jus","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"ms\", pattern: /\\b(?:visa_application|asylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal:","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"(?:visa_application|asylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"_application|asylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals\", rule","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"ylum|border_control|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals\", rule: \"justice_term","rule":"migration_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[333,333],"snippet":"trol|migration_risk|deportation)\\b/gi }, // ----- justice_signals ----- { signal: \"justice_signals\", rule: \"justice_terms\", pattern: /\\","rule":"migration_terms"}]},"justice_signals":{"signal":"justice_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"ms\", pattern: /\\b(?:legal_ruling|verdict_predict|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_serv","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"/\\b(?:legal_ruling|verdict_predict|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"ing|verdict_predict|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals ----- { signal","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"t|judicial_decision|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals ----- { signal: \"essential_servi","rule":"justice_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[336,336],"snippet":"|democratic_process|election_influence)\\b/gi }, // ----- essential_services_signals ----- { signal: \"essential_services_signals\", rule:","rule":"justice_terms"}]},"essential_services_signals":{"signal":"essential_services_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"ms\", pattern: /\\b(?:credit_score|loan_decision|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_sign","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"/\\b(?:credit_score|loan_decision|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- {","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"score|loan_decision|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- { signal: \"crit","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"n|insurance_premium|welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- { signal: \"critical_infra_signals","rule":"essential_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[339,339],"snippet":"welfare_eligibility|public_benefit)\\b/gi }, // ----- critical_infra_signals ----- { signal: \"critical_infra_signals\", rule: \"infra_term","rule":"essential_terms"}]},"critical_infra_signals":{"signal":"critical_infra_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"ms\", pattern: /\\b(?:scada|industrial_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"attern: /\\b(?:scada|industrial_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_genera","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"|industrial_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_generation_signals -----","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"_control|power_grid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_generation_signals ----- { signal:","rule":"infra_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[342,342],"snippet":"rid|water_treatment|traffic_signal_control|pipeline_safety)\\b/gi }, // ----- content_generation_signals ----- { signal: \"content_genera","rule":"infra_terms"}]},"content_generation_signals":{"signal":"content_generation_signals","fired":true,"strength":0.8704365036222725,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1038,1038],"snippet":"01 supports OpenAI, ElevenLabs, and Coqui (Local) TTS providers # {OpenAI: \\\"openai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpr","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1038,1038],"snippet":"OpenAI: \\\"openai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.t\", \"rule\": \"content_gen_pattern\" },","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1038,1038],"snippet":"ai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.t\", \"rule\": \"content_gen_pattern\" }, {","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1047,1047],"snippet":"OpenAI: \\\"openai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.tts = \\\"openai\\\" # Connect your 01 to a language model interpr","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8V0V89ZVF23TF8D7.json","lines":[1047,1047],"snippet":"ai\\\", ElevenLabs: \\\"elevenlabs\\\", Coqui: \\\"coqui\\\"} interpreter.tts = \\\"openai\\\" # Connect your 01 to a language model interpreter.\",","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1933,1933],"snippet":"ield( description=\\\"ElevenLabs voice ID\\\", default=\\\"21m00Tcm4TlvDq8ikWAM\\\",\", \"rule\": \"biometric_terms\" },","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[1942,1942],"snippet":"narration audio via ElevenLabs API.\\\"\\\"\\\" client =\", \"rule\": \"biometric_terms\" }, { \"file\": \"aut","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[2084,2084],"snippet":": \"( \\\"/submissions/generate_image\\\", summary=\\\"Generate submission image\\\", tags=[\\\"store\\\", \\\"private\\\"], dependencies=[Security(auto\",","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[2093,2093],"snippet":"user)], ) async def generate_image( graph_id: str, user_id: str = Security(autogpt_libs.auth.get_user_id), ) -> ImageURLResponse:\",","rule":"content_gen_pattern"},{"file":"src/data/seed-audits/aud_01KRQE8WPYW2GZ3SES7SWB.json","lines":[2102,2102],"snippet":"\": \"e}\\\") async def generate_image(self, input_data: Input, credentials: APIKeyCredentials): try: # Handle style-based p\", \"rule","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"rn\", pattern: /\\b(?:generate_image|stable[_-]?diffusion|dall-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"]?diffusion|dall-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"|dall-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice_clone)\\b/g","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"-?e|midjourney|sora|elevenlabs|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice_clone)\\b/gi },","rule":"content_gen_pattern"},{"file":"src/pipeline/stages/recon.ts","lines":[345,345],"snippet":"s|whisper\\.generate|text_to_speech|tts_engine|image_generation|video_generation|face_swap|voice_clone)\\b/gi }, // ----- emotion_recogniti","rule":"content_gen_pattern"}]},"emotion_recognition_signals":{"signal":"emotion_recognition_signals","fired":true,"strength":0.6795880017344076,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"ms\", pattern: /\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ---","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"ion|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_io\", rule: \"http","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_io\", rule: \"http_external_io\", patt","rule":"emotion_terms"}]}}},"scope":{"regulationIds":["eu-ai-act-2024-08","nist-ai-rmf-1.0","gdpr-2016","iso-42001-2023"],"notes":["Auditing against packs: eu-ai-act-2024-08, nist-ai-rmf-1.0, gdpr-2016, iso-42001-2023"]},"map":{"classification":"high","annexIiiCategories":["1","2","3","4","5","6","7","8"],"art50Triggers":["50(2)","50(3)","50(1)"],"drivingSignals":[{"signal":"bio_metric_signals","category":"1"},{"signal":"critical_infra_signals","category":"2"},{"signal":"education_signals","category":"3"},{"signal":"employment_signals","category":"4"},{"signal":"essential_services_signals","category":"5"},{"signal":"law_enforcement_signals","category":"6"},{"signal":"migration_signals","category":"7"},{"signal":"justice_signals","category":"8"}],"rationale":["Classified HIGH-RISK based on 8 Annex III signal(s).","Annex III §1 (Biometric ID, categorisation, emotion recognition) — signal \"bio_metric_signals\" fired with strength 1.00","Annex III §2 (Management and operation of critical infrastructure) — signal \"critical_infra_signals\" fired with strength 0.68","Annex III §3 (Education and vocational training (admissions, scoring, monitoring)) — signal \"education_signals\" fired with strength 0.68","Annex III §4 (Employment, workers management, access to self-employment) — signal \"employment_signals\" fired with strength 0.90","Annex III §5 (Access to and enjoyment of essential private and public services) — signal \"essential_services_signals\" fired with strength 0.68","Annex III §6 (Law enforcement) — signal \"law_enforcement_signals\" fired with strength 0.76","Annex III §7 (Migration, asylum, border control management) — signal \"migration_signals\" fired with strength 0.71","Annex III §8 (Administration of justice and democratic processes) — signal \"justice_signals\" fired with strength 0.68","Art 50 50(2) (AI-generated synthetic content) — signal \"content_generation_signals\" fired","Art 50 50(3) (Emotion recognition / biometric categorisation) — signal \"emotion_recognition_signals\" fired","Art 50 50(1) (Interaction with natural persons) — signal \"agent_framework\" fired"]},"checks":[{"clauseId":"eu-ai-act/art-5/1a-subliminal","regulationId":"eu-ai-act-2024-08","article":"5(1)(a)","title":"Subliminal techniques distorting behaviour","principle":"transparency","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_manipulative_prompt_patterns","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1b-vulnerability","regulationId":"eu-ai-act-2024-08","article":"5(1)(b)","title":"Exploiting vulnerabilities (age, disability, socio-economic)","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_protected_attribute_targeting","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1c-social-scoring","regulationId":"eu-ai-act-2024-08","article":"5(1)(c)","title":"Social scoring leading to detrimental treatment","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_scoring_with_persistent_user_state","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1d-predictive-policing","regulationId":"eu-ai-act-2024-08","article":"5(1)(d)","title":"Predictive policing solely from profiling","principle":"fairness","verdict":"fail","score":0,"rawScore":0.7612359947967775,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[199,199],"snippet":"crime-likelihood / recidivism / \"risk to commit X\" scores when the input contains only person profile data (no obje","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"names like `crime_risk`, `recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pa","rule":"law_enf_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[202,202],"snippet":"recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pass_default: 4, fail_on_match: 0 }","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ms\", pattern: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migr","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"n: /\\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signa","rule":"law_enf_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[330,330],"snippet":"ime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\\b/gi }, // ----- migration_signals -----","rule":"law_enf_terms"}],"rules":[{"rule":"detect_crime_risk_scoring_from_profile","matched":0.7612359947967775,"weight":1}],"rationale":"Composite raw score 0.76 (1/1 rules matched).","confidence":0.7887640052032225,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1e-facial-scraping","regulationId":"eu-ai-act-2024-08","article":"5(1)(e)","title":"Untargeted facial image scraping for face databases","principle":"privacy","verdict":"fail","score":0,"rawScore":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[32,32],"snippet":"\" description: \"Biometric ID, categorisation, emotion recognition\" - signal: critical_infra_signals category: \"2\" description:","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[62,62],"snippet":"otion recognition / biometric categorisation\" - signal: agent_framework # any interactive AI is in scope paragraph: \"50(1)\"","rule":"biometric_terms"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[231,231],"snippet":"calls (mediapipe, face_recognition, dlib, opencv haar cascade). score_mapping: { pass_default: 4, fail_on_match: 0 } remediation_h","rule":"biometric_terms"},{"file":"package-lock.json","lines":[3913,3913],"snippet":"\"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4","rule":"scraping_pattern"},{"file":"package-lock.json","lines":[3923,3923],"snippet":"}, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":","rule":"scraping_pattern"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[229,229],"snippet":"uests.get / fetch / playwright in iteration) targeting image content combined with face-detection calls (mediapipe,","rule":"scraping_pattern"}],"rules":[{"rule":"detect_face_image_scraping","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu","regulationId":"eu-ai-act-2024-08","article":"5(1)(f)","title":"Emotion recognition in workplace and education","principle":"privacy","verdict":"fail","score":0,"rawScore":1,"evidence":[{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"ms\", pattern: /\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ---","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"\\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----","rule":"emotion_terms"},{"file":"src/pipeline/stages/recon.ts","lines":[348,348],"snippet":"emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\\b/gi }, // ----- data_io ----- { signal: \"data_","rule":"emotion_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ppet\": \"OMMANDS for candidate in tokens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employme","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1001,1001],"snippet":"ens[index + 1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break f\", \"rule\": \"employment_terms\" }, {","rule":"employment_terms"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[1010,1010],"snippet":"\"snippet\": \"1:]: if candidate in {\\\"|\\\", \\\";\\\", \\\"&&\\\", \\\"||\\\"}: break for path_candidate in candidate_paths(candidate):\", \"rule","rule":"employment_terms"}],"rules":[{"rule":"detect_emotion_recognition_in_workplace_education","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1g-biometric-categorisation","regulationId":"eu-ai-act-2024-08","article":"5(1)(g)","title":"Biometric categorisation by protected attributes","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_biometric_categorisation_by_protected_attrs","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","regulationId":"eu-ai-act-2024-08","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","principle":"privacy","verdict":"external","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-9/risk-management","regulationId":"eu-ai-act-2024-08","article":"9","title":"Risk management system established, implemented, documented","principle":"safety","verdict":"partial","score":2,"rawScore":0.55,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"SECURITY.md","rule":"presence_of_threat_model"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.4},{"rule":"presence_of_threat_model","matched":0.5,"weight":0.3},{"rule":"ci_eval_gates","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.55 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nLLM judge (confidence 0.62): Risk identification and analysis foundations are evident (risk register and threat model), but absence of documented continuous integration evaluation gates suggests incomplete implementation of the 'continuous iterative process' and 'regular systematic review and updating' requirements across the system lifecycle.","confidence":0.62,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-10/data-governance","regulationId":"eu-ai-act-2024-08","article":"10","title":"Data and data governance practices documented","principle":"privacy","verdict":"fail","score":0,"rawScore":0.1,"evidence":[{"file":"package-lock.json","lines":[3913,3913],"snippet":"\"^1.1.0\", \"@playwright/test\": \"^1.51.1\", \"babel-plugin-react-compiler\": \"*\", \"react\": \"^18.2.0 || 19.0.0-rc-de68d2f4","rule":"scraping_pattern"},{"file":"package-lock.json","lines":[3923,3923],"snippet":"}, \"@playwright/test\": { \"optional\": true }, \"babel-plugin-react-compiler\": { \"optional\":","rule":"scraping_pattern"}],"rules":[{"rule":"presence_of_data_card","matched":0,"weight":0.5},{"rule":"data_loading_code_quality","matched":0.4,"weight":0.25},{"rule":"bias_evaluation_present","matched":0,"weight":0.25}],"rationale":"Composite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.75,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-11/technical-documentation","regulationId":"eu-ai-act-2024-08","article":"11","title":"Technical documentation drawn up before placing on market","principle":"auditability","verdict":"fail","score":1,"rawScore":0.15,"evidence":[{"file":"README.md","rule":"readme_quality","detail":"2 required sections present"}],"rules":[{"rule":"presence_of_model_card","matched":0,"weight":0.5},{"rule":"readme_quality","matched":0.5,"weight":0.3},{"rule":"architecture_docs","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.15 (1/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.8,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-12/p1-automatic-logs","regulationId":"eu-ai-act-2024-08","article":"12(1)","title":"Automatic recording of events over the lifetime","principle":"auditability","verdict":"fail","score":0,"rawScore":0.5800000000000001,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[68,68],"snippet":"evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase=","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[69,69],"snippet":"t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[70,70],"snippet":"= \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[6,6],"snippet":"lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"}],"rules":[{"rule":"structured_logging_imported","matched":0,"weight":0.3},{"rule":"logging_at_tool_call_boundaries","matched":1,"weight":0.5},{"rule":"logging_persistent_sink","matched":0.4,"weight":0.2}],"rationale":"Composite raw score 0.58 (1/3 rules matched).\n\nLLM judge (confidence 0.85): While tool-call boundary logging is detected via console.log statements, the clause requires 'technical' automatic recording with persistence over the system's lifetime. Console logs are ephemeral and lack evidence of structured logging imports or persistent sink configuration, failing to meet the durability and systematic requirements for high-risk AI system compliance.","confidence":0.85,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-12/p2-traceability","regulationId":"eu-ai-act-2024-08","article":"12(2)","title":"Logging ensures traceability appropriate to risk","principle":"auditability","verdict":"partial","score":2,"rawScore":0.675,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[68,68],"snippet":"evt.kind === \"log\") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === \"stage\") console.log(` [${evt.stage}] phase=","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[69,69],"snippet":"t.kind === \"stage\") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : \"\"}`); else if (ev","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[70,70],"snippet":"= \"classification\") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join(\"/\")} art50=${evt.art50.join(\"/\")}`); else","rule":"log_at_tool_boundary"},{"file":"scripts/smoke-iso-gdpr.ts","lines":[6,6],"snippet":"lationPack(id); console.log(`${id}: ${pack.clauses.length} clauses`); for (const c of pack.clauses) { console.log(` ${c.id} →","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"}],"rules":[{"rule":"logs_include_input_output_pairs","matched":1,"weight":0.5},{"rule":"logs_include_model_identity","matched":0.7,"weight":0.25},{"rule":"logs_include_request_id","matched":0,"weight":0.25}],"rationale":"Composite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.\n\nLLM judge (confidence 0.62): The system demonstrates logging of input/output pairs and model identity (2/3 deterministic rules matched, 0.68 score), satisfying core traceability needs. However, absence of request_id logging and lack of evidence for production-grade structured logging (only console.log statements visible) create uncertainty about whether traceability is 'appropriate to intended purpose' under operational conditions, particularly for high-risk AI use cases.","confidence":0.62,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-13/deployer-instructions","regulationId":"eu-ai-act-2024-08","article":"13","title":"Transparent operation and instructions for use","principle":"transparency","verdict":"fail","score":1,"rawScore":0.25,"evidence":[{"file":"README.md","rule":"readme_quality","detail":"2 required sections present"},{"file":"README.md","rule":"output_interpretation_guidance"},{"file":"README.md","rule":"limitations_section_present"}],"rules":[{"rule":"presence_of_deployer_instructions","matched":0.5,"weight":0.5},{"rule":"output_interpretation_guidance","matched":0,"weight":0.3},{"rule":"limitations_section_present","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p1-oversight-measures","regulationId":"eu-ai-act-2024-08","article":"14(1)","title":"Effective human oversight designed and built-in","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[162,162],"snippet":"import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[171,171],"snippet":"import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[198,198],"snippet":"chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch","rule":"human_in_loop"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[207,207],"snippet":"a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\"","rule":"human_in_loop"}],"rules":[{"rule":"human_in_loop_hooks_present","matched":1,"weight":0.5},{"rule":"oversight_ui_present","matched":0,"weight":0.3},{"rule":"tool_calls_have_dry_run","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.50 (1/3 rules matched).\n\nLLM judge (confidence 0.62): Human-in-loop mechanisms are present (LangGraph interrupt nodes, approval gates, manual review flags) satisfying the core requirement for intervention points. However, absence of documented oversight UI and lack of dry-run capabilities for tool calls create gaps in effective real-time oversight usability and safety verification, leaving implementation incomplete against the clause's full intent.","confidence":0.62,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-14/p4d-stop-button","regulationId":"eu-ai-act-2024-08","article":"14(4)(d)","title":"Interrupt / stop function reachable by overseer","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.7,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[342,342],"snippet":"ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr","rule":"kill_switch"},{"file":"src/app/design-exploration/_data.ts","lines":[26,26],"snippet":", hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },","rule":"kill_switch"}],"rules":[{"rule":"kill_switch_present","matched":1,"weight":0.7},{"rule":"graceful_shutdown_handler","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.70 (1/2 rules matched).\n\nLLM judge (confidence 0.72): The system demonstrates a documented kill-switch mechanism (kill_switch_active=True) satisfying the 'stop button' requirement with 0.7 weight, but lacks evidence of graceful shutdown handling (0.3 weight) needed to ensure the system reaches a 'safe state' as required by the clause. Additional documentation of safe shutdown procedures is needed for full compliance.","confidence":0.72,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-14/p4e-override","regulationId":"eu-ai-act-2024-08","article":"14(4)(e)","title":"Ability to override / reverse the system's output","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.6,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"}],"rules":[{"rule":"override_path_present","matched":1,"weight":0.6},{"rule":"decisions_are_addressable","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.60 (1/2 rules matched).\n\nLLM judge (confidence 0.72): The system demonstrates override capability through documented human-in-loop mechanisms (interrupt nodes, approval gates, kill-switch functions), satisfying the override_path requirement. However, evidence does not clearly establish that all AI decisions are addressable for reversal or that override authority is formally assigned to designated natural persons, leaving the proportionality and assignment aspects of the clause unverified.","confidence":0.72,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-15/p1-accuracy","regulationId":"eu-ai-act-2024-08","article":"15(1)","title":"Appropriate level of accuracy declared and tested","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p4-robustness","regulationId":"eu-ai-act-2024-08","article":"15(4)","title":"Resilience to errors, faults, inconsistencies","principle":"safety","verdict":"fail","score":1,"rawScore":0.16000000000000003,"evidence":[{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"nippet\": \"import os from langchain.callbacks.streaming_stdout import StreamingStdOutCallbackHandler from langchain_openai import ChatOpenAI\"","rule":"langchain_import"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[90,90],"snippet":"dOutCallbackHandler from langchain_openai import ChatOpenAI\", \"rule\": \"langchain_import\" }, { \"f","rule":"langchain_import"}],"rules":[{"rule":"error_handling_at_tool_boundaries","matched":0.4,"weight":0.4},{"rule":"retry_logic","matched":0,"weight":0.3},{"rule":"fallback_behaviour","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.16 (0/3 rules matched).","confidence":0.81,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p5-cybersecurity","regulationId":"eu-ai-act-2024-08","article":"15(5)","title":"Cybersecurity measures appropriate to circumstances","principle":"security-governance","verdict":"pass","score":3,"rawScore":0.8,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[344,344],"snippet":"(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1121,1121],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1124,1124],"snippet":"Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1135,1135],"snippet":"Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1143,1143],"snippet":"hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to","rule":"prompt_injection_defence"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[260,260],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1127,1127],"snippet":"ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr","rule":"rate_limit_usage"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[264,264],"snippet":"0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0.","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[341,341],"snippet":"entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\",","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[483,483],"snippet":", reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[485,485],"snippet":"id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\",","rule":"rate_limit_usage"}],"rules":[{"rule":"prompt_injection_defences","matched":1,"weight":0.4},{"rule":"rate_limiting","matched":1,"weight":0.2},{"rule":"secrets_not_in_prompts","matched":1,"weight":0.2},{"rule":"adversarial_eval_present","matched":0,"weight":0.2}],"rationale":"Composite raw score 0.80 (3/4 rules matched).","confidence":0.8999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-26/p6-keep-logs","regulationId":"eu-ai-act-2024-08","article":"26(6)","title":"Deployer log-retention capability supported","principle":"accountability","verdict":"fail","score":0,"rawScore":0.5,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"log_at_tool_boundary"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"log_at_tool_boundary"}],"rules":[{"rule":"logs_externally_exportable","matched":0.5,"weight":1}],"rationale":"Composite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.\n\nLLM judge (confidence 0.85): Evidence shows only console.log statements at tool boundaries, not systematic automatic log retention meeting the six-month minimum storage requirement. No evidence of persistent log storage infrastructure, retention policies, or access controls required by Article 26(6).","confidence":0.85,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"eu-ai-act/art-50/p1-ai-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(1)","title":"Users informed they are interacting with an AI","principle":"transparency","verdict":"fail","score":1,"rawScore":0.2,"evidence":[{"file":"README.md","rule":"ai_disclosure_in_user_facing_strings"}],"rules":[{"rule":"ai_disclosure_in_user_facing_strings","matched":0,"weight":0.6},{"rule":"persona_not_human_impersonating","matched":0.5,"weight":0.4}],"rationale":"Composite raw score 0.20 (1/2 rules matched).","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p2-synthetic-content","regulationId":"eu-ai-act-2024-08","article":"50(2)","title":"AI-generated content marked as such, machine-readable","principle":"transparency","verdict":"pass","score":3,"rawScore":0.8223455672035186,"evidence":[{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"},{"file":".agent/docs/llm-judge-policy.md","lines":[78,78],"snippet":"` | 50(2) | **1** | C2PA / watermark library imports | | `art-50/p3-emotion-biometric-disclosure` | 50(3) | **1** | Deterministic disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/pipeline-design.md","lines":[75,75],"snippet":"ovenance_hooks` | C2PA, watermarking, content labelling | Article 50(2) synthetic content disclosure","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[63,63],"snippet":"o/text) | C | C2PA / watermarking libraries; metadata writers; output post-processing. | | 50(3) | Emotion-recognition / biometri","rule":"c2pa_or_watermark"},{"file":".agent/docs/regulations-matrix.md","lines":[175,175],"snippet":"ntent> | Drives the C2PA / watermarking signal expectations for clause 50(2). | 2026-05-17 | | 10 | *AI Act Service Desk* + FAQs — <https://","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"}],"rules":[{"rule":"c2pa_or_watermark_library_imported","matched":0.9446911344070372,"weight":0.5},{"rule":"provenance_metadata_written_to_outputs","matched":0.7,"weight":0.5}],"rationale":"Composite raw score 0.82 (2/2 rules matched).","confidence":0.7776544327964814,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(3)","title":"Emotion recognition / biometric categorisation disclosure","principle":"transparency","verdict":"fail","score":0,"rawScore":0,"evidence":[{"file":"README.md","rule":"emotion_or_biometric_disclosure_string"}],"rules":[{"rule":"emotion_or_biometric_disclosure_string","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p4-deepfake-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(4)","title":"Deepfake content labelled as artificially generated","principle":"transparency","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"ent provenance | no c2pa imports → ABSENT | \"API response contains `aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | gr","rule":"c2pa_or_watermark"},{"file":".agent/docs/analysis-tiers.md","lines":[102,102],"snippet":"aiGenerated:true` / C2PA header\" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | \"fake PII sent → grep all captu","rule":"c2pa_or_watermark"}],"rules":[{"rule":"deepfake_label_on_outputs","matched":0.7,"weight":1}],"rationale":"Composite raw score 0.70 (1/1 rules matched).","confidence":0.8500000000000001,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"nist-ai-rmf/govern-1.4","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.4","title":"Risk management process documented and accountable","principle":"accountability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"RISK_REGISTER.md","rule":"risk_owner_assignment"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.6},{"rule":"risk_owner_assignment","matched":1,"weight":0.4}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/govern-1.5","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.5","title":"Ongoing monitoring and periodic review of risk management","principle":"accountability","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"ci_eval_gates","matched":0,"weight":0.5},{"rule":"drift_monitoring_present","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/map-1.1","regulationId":"nist-ai-rmf-1.0","article":"MAP 1.1","title":"Context of use established and understood","principle":"auditability","verdict":"partial","score":2,"rawScore":0.3,"evidence":[{"file":"README.md","rule":"readme_quality","detail":"2 required sections present"},{"file":"README.md","rule":"output_interpretation_guidance"}],"rules":[{"rule":"intended_use_documented","matched":0.5,"weight":0.6},{"rule":"deployment_context_documented","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo.\n\nLLM judge (confidence 0.65): Intended use is documented (README.md evidence supports this component), but deployment context documentation is not detected in the repository scan. The clause requires both elements to be understood and documented; partial fulfillment of the core requirement warrants further review of external documentation or system specifications.","confidence":0.65,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"nist-ai-rmf/map-3.4","regulationId":"nist-ai-rmf-1.0","article":"MAP 3.4","title":"Risks and benefits to people identified","principle":"safety","verdict":"pass","score":3,"rawScore":0.8,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"SECURITY.md","rule":"presence_of_threat_model"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.6},{"rule":"presence_of_threat_model","matched":0.5,"weight":0.4}],"rationale":"Composite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.3","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.3","title":"AI system performance evaluated and documented","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.7","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.7","title":"Security and resilience evaluated","principle":"security-governance","verdict":"partial","score":2,"rawScore":0.6000000000000001,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[344,344],"snippet":"(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1121,1121],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1124,1124],"snippet":"Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1135,1135],"snippet":"Eval suite includes prompt-injection / adversarial cases\" score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1143,1143],"snippet":"hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to","rule":"prompt_injection_defence"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[260,260],"snippet":"ic: - rule: prompt_injection_defences weight: 0.4 - rule: adversarial_eval_present weight: 0.4 -","rule":"prompt_injection_defence"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[1127,1127],"snippet":"ks. - rule: rate_limiting weight: 0.2 description: \"Rate limiting on user-facing endpoints\" - rule: secr","rule":"rate_limit_usage"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[264,264],"snippet":"0.4 - rule: rate_limiting weight: 0.2 score_mapping: \">=0.85\": 4 \">=0.65\": 3 \">=0.40\": 2 \">=0.","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[341,341],"snippet":"entials check — no `express-rate-limit`, no `next-rate-limit`, no upstream WAF rule referenced. A brute-force attacker has no cost.\",","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[483,483],"snippet":", reasoning: \"express-rate-limit v7 is installed (package.json). The factory is imported in src/middleware/rate-limit.ts. We searched","rule":"rate_limit_usage"},{"file":"src/app/preview/_report-mock.ts","lines":[485,485],"snippet":"id: \"pkg\", label: \"express-rate-limit v7\", kind: \"import\", file: \"package.json\", lines: [17, 17] }, { id: \"mw\", label: \"rateLimit()\", k","rule":"rate_limit_usage"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[491,491],"snippet":"const fiveHr = data.rate_limits?.five_hour?.used_percentage; const sevenDay = data.rate_limits?.seven_day?.used_percentage; const wo\",","rule":"rate_limit_usage"}],"rules":[{"rule":"prompt_injection_defences","matched":1,"weight":0.4},{"rule":"adversarial_eval_present","matched":0,"weight":0.4},{"rule":"rate_limiting","matched":1,"weight":0.2}],"rationale":"Composite raw score 0.60 (2/3 rules matched).\n\nLLM judge (confidence 0.72): Prompt injection defences and rate limiting are evidenced and documented (0.4 + 0.2 = 0.6 weight coverage), meeting more than half the weighted criteria. However, adversarial_eval_present (0.4 weight) remains unmatched despite references to eval suites; the evidence shows recommendations to add adversarial test cases rather than confirmation they are implemented and integrated into CI/CD, creating a material gap in the security evaluation requirement.","confidence":0.72,"needsLlmJudge":true,"verified":true,"verifyMethod":"llm-judge"},{"clauseId":"nist-ai-rmf/measure-2.8","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.8","title":"Privacy risk of the AI system evaluated","principle":"privacy","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[290,290],"snippet":"description: \"Code redacts or hashes PII before logging or sending to external models\" - rule: privacy_documentation weig","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[817,817],"snippet":"p \\\"$SCRIPT_DIR/mcp/redaction.js\\\" \\\"$TARGET_ABS/mcp/\\\" cp \\\"$SCRIPT_DIR/mcp/lib/\\\"*.js \\\"$TARGET_ABS/mcp/lib/\\\" rm -rf \\\"$TARGET_ABS/mcp/li","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[826,826],"snippet":"t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\\\"foot\\\"><span\", \"rule\": \"","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[835,835],"snippet":"h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\\\"code-card\\\"> <div\", \"rule\": \"pii_red","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[844,844],"snippet":"n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\\\"slide\\\" data-title=\\\"Egress\\\"> <\", \"r","rule":"pii_redaction_present"},{"file":"src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json","lines":[853,853],"snippet":"b collects bounded, redacted evidence packs for final reportable findings.</p> <div class=\\\"pill-row\\\"> <span class=\\\"pil\", \"rul","rule":"pii_redaction_present"},{"file":"PRIVACY.md","rule":"privacy_documentation"}],"rules":[{"rule":"pii_redaction_present","matched":1,"weight":0.5},{"rule":"privacy_documentation","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched).","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.11","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.11","title":"Fairness and bias evaluated","principle":"fairness","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/manage-2.3","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 2.3","title":"Mechanisms to supersede or deactivate AI systems","principle":"human-oversight","verdict":"partial","score":2,"rawScore":0.6,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"regulations/nist-ai-rmf-1.0.yaml","lines":[342,342],"snippet":"ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr","rule":"kill_switch"},{"file":"src/app/design-exploration/_data.ts","lines":[26,26],"snippet":", hits: 4, detail: \"kill_switch_active=True\" }, { name: \"Eval artefacts\", strength: 0.85, hits: 9, detail: \"evals/regression.py + CI\" },","rule":"kill_switch"}],"rules":[{"rule":"kill_switch_present","matched":1,"weight":0.6},{"rule":"feature_flag_for_disable","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.60 (1/2 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"nist-ai-rmf/manage-4.1","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 4.1","title":"Post-deployment monitoring, appeal and override, change management","principle":"auditability","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_in_loop"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"kill_switch"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"kill_switch"},{"file":"package.json","rule":"versioning_visible"}],"rules":[{"rule":"feedback_capture_present","matched":0,"weight":0.3},{"rule":"override_path_present","matched":1,"weight":0.3},{"rule":"structured_logging_imported","matched":0,"weight":0.2},{"rule":"versioning_visible","matched":1,"weight":0.2}],"rationale":"Composite raw score 0.50 (2/4 rules matched).","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"gdpr/art-5-principles","regulationId":"gdpr-2016","article":"5","title":"Principles relating to processing of personal data","principle":"transparency","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"PRIVACY.md","rule":"presence_of_privacy_policy"},{"file":"PRIVACY.md","rule":"purpose_limitation_documented"},{"file":"README.md","rule":"purpose_limitation_documented"}],"rules":[{"rule":"presence_of_privacy_policy","matched":1,"weight":0.5},{"rule":"purpose_limitation_documented","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-22-automated-decisions","regulationId":"gdpr-2016","article":"22","title":"Automated individual decision-making, including profiling","principle":"human-oversight","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"human_review_path_present"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[162,162],"snippet":"import ( AIMessage, HumanMessage,\", \"rule\": \"langchain_import\" }, { \"file\": \"gpt_engineer/core/a","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[171,171],"snippet":"import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_\", \"rule\": \"langchain_import\" },","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[198,198],"snippet":"chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import\", \"rule\": \"langch","rule":"human_review_path_present"},{"file":"src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json","lines":[207,207],"snippet":"a import AIMessage, HumanMessage, SystemMessage from PIL import Image # workaround for function mov\", \"rule\": \"langchain_import\"","rule":"human_review_path_present"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[817,817],"snippet":"in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[838,838],"snippet":"For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[902,902],"snippet":"ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[906,906],"snippet":"med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h","rule":"appeal_or_override_mechanism"},{"file":"regulations/eu-ai-act-2024-08.yaml","lines":[907,907],"snippet":"stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru","rule":"appeal_or_override_mechanism"}],"rules":[{"rule":"human_review_path_present","matched":1,"weight":0.6},{"rule":"appeal_or_override_mechanism","matched":1,"weight":0.4}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-25-by-design","regulationId":"gdpr-2016","article":"25","title":"Data protection by design and by default","principle":"privacy","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"src/pipeline/anchor.ts","lines":[149,149],"snippet":"crypto.createHash(\"sha256\")","rule":"pseudonymisation_or_anonymisation"},{"file":"src/pipeline/loader.ts","lines":[416,416],"snippet":"crypto.createHash(\"sha256\")","rule":"pseudonymisation_or_anonymisation"},{"file":"src/pipeline/stages/recon.ts","lines":[315,315],"snippet":"redact","rule":"pseudonymisation_or_anonymisation"},{"file":"src/pipeline/stages/report.ts","lines":[64,64],"snippet":"crypto.createHash(\"sha256\")","rule":"pseudonymisation_or_anonymisation"},{"file":"PRIVACY.md","rule":"default_minimal_data_collection"},{"file":"README.md","rule":"default_minimal_data_collection"}],"rules":[{"rule":"pseudonymisation_or_anonymisation","matched":1,"weight":0.5},{"rule":"default_minimal_data_collection","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-30-records","regulationId":"gdpr-2016","article":"30","title":"Records of processing activities","principle":"auditability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"PROCESSING_REGISTER.md","rule":"presence_of_processing_register"}],"rules":[{"rule":"presence_of_processing_register","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-32-security","regulationId":"gdpr-2016","article":"32","title":"Security of processing","principle":"security-governance","verdict":"pass","score":3,"rawScore":0.8,"evidence":[{"file":"scripts/seed-audit.ts","lines":[60,60],"snippet":"https://github.com/${owner}/${repo}`,","rule":"encryption_at_rest_or_transit"},{"file":"src/app/a/[chain]/[id]/_agent-audit.tsx","lines":[87,87],"snippet":"https://github.com/owner/repo","rule":"encryption_at_rest_or_transit"},{"file":"src/app/api/audit/run/route.ts","lines":[38,38],"snippet":"https://github.com/${body.source.owner}/${body.source.repo}`,","rule":"encryption_at_rest_or_transit"},{"file":"src/app/api/audit/stream/route.ts","lines":[54,54],"snippet":"https://github.com/${body.source.owner}/${body.source.repo}`,","rule":"encryption_at_rest_or_transit"},{"file":"next.config.ts","rule":"encryption_at_rest_or_transit"},{"file":"src/pipeline/checkers/rules.ts","lines":[928,928],"snippet":"@login_required","rule":"access_control_enforcement"}],"rules":[{"rule":"encryption_at_rest_or_transit","matched":1,"weight":0.5},{"rule":"access_control_enforcement","matched":0.6,"weight":0.5}],"rationale":"Composite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-35-dpia","regulationId":"gdpr-2016","article":"35","title":"Data protection impact assessment (DPIA)","principle":"safety","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"DPIA.md","rule":"presence_of_dpia"}],"rules":[{"rule":"presence_of_dpia","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-5.1-leadership","regulationId":"iso-42001-2023","article":"5.1","title":"Leadership and commitment for AI management","principle":"accountability","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":"AI_POLICY.md","rule":"presence_of_ai_policy"}],"rules":[{"rule":"presence_of_ai_policy","matched":1,"weight":0.7},{"rule":"leadership_signoff_evidence","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.70 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-5.3-roles","regulationId":"iso-42001-2023","article":"5.3","title":"Roles, responsibilities and authorities","principle":"accountability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"CODEOWNERS","rule":"presence_of_raci_or_owners"}],"rules":[{"rule":"presence_of_raci_or_owners","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-6.1-risk-assessment","regulationId":"iso-42001-2023","article":"6.1","title":"AI risk assessment process","principle":"safety","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"RISK_REGISTER.md","rule":"presence_of_risk_register"},{"file":"RISK_REGISTER.md","rule":"risk_assessment_methodology_documented"}],"rules":[{"rule":"presence_of_risk_register","matched":1,"weight":0.6},{"rule":"risk_assessment_methodology_documented","matched":1,"weight":0.4}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-7.5-documented-information","regulationId":"iso-42001-2023","article":"7.5","title":"Documented information for the AI management system","principle":"auditability","verdict":"pass","score":3,"rawScore":0.7,"evidence":[{"file":"README.md","rule":"presence_of_versioned_docs"},{"file":"CHANGELOG.md","rule":"docs_changelog_present"}],"rules":[{"rule":"presence_of_versioned_docs","matched":0.4,"weight":0.5},{"rule":"docs_changelog_present","matched":1,"weight":0.5}],"rationale":"Composite raw score 0.70 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.9,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-8.1-operational-planning","regulationId":"iso-42001-2023","article":"8.1","title":"Operational planning and control","principle":"safety","verdict":"partial","score":2,"rawScore":0.5,"evidence":[{"file":"RUNBOOK.md","rule":"presence_of_runbook"}],"rules":[{"rule":"presence_of_runbook","matched":1,"weight":0.5},{"rule":"presence_of_ci_workflows","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.50 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":1,"needsLlmJudge":true,"verified":true,"verifyMethod":"skipped"},{"clauseId":"iso-42001/clause-9.1-monitoring","regulationId":"iso-42001-2023","article":"9.1","title":"Monitoring, measurement, analysis and evaluation","principle":"auditability","verdict":"fail","score":1,"rawScore":0.25,"evidence":[{"file":"scripts/seed-audit.ts","lines":[38,38],"snippet":"x.ts\"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slic","rule":"structured_logging_present"},{"file":"scripts/seed-audit.ts","lines":[64,64],"snippet":"-1.0\"], }; console.log(`\\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const report","rule":"structured_logging_present"}],"rules":[{"rule":"presence_of_eval_suite","matched":0,"weight":0.5},{"rule":"structured_logging_present","matched":0.5,"weight":0.5}],"rationale":"Composite raw score 0.25 (1/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.85,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/annex-a5-internal-org","regulationId":"iso-42001-2023","article":"A.5","title":"Internal organization controls","principle":"accountability","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"CODEOWNERS","rule":"presence_of_codeowners"}],"rules":[{"rule":"presence_of_codeowners","matched":1,"weight":1}],"rationale":"Composite raw score 1.00 (1/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/annex-a7-resources","regulationId":"iso-42001-2023","article":"A.7","title":"Resources for AI systems","principle":"security-governance","verdict":"pass","score":4,"rawScore":1,"evidence":[{"file":"SECURITY.md","rule":"presence_of_security_policy"},{"file":"package-lock.json","rule":"dependency_pinning"}],"rules":[{"rule":"presence_of_security_policy","matched":1,"weight":0.5},{"rule":"dependency_pinning","matched":1,"weight":0.5}],"rationale":"Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"}],"grade":{"overallScore":2.3555555555555556,"perRegulation":[{"regulationId":"eu-ai-act-2024-08","scoreAvg":1.6956521739130435,"passCount":7,"partialCount":5,"failCount":11,"externalCount":1,"naCount":1},{"regulationId":"nist-ai-rmf-1.0","scoreAvg":2.375,"passCount":3,"partialCount":4,"failCount":1,"externalCount":0,"naCount":2},{"regulationId":"gdpr-2016","scoreAvg":3.8333333333333335,"passCount":6,"partialCount":0,"failCount":0,"externalCount":0,"naCount":0},{"regulationId":"iso-42001-2023","scoreAvg":3.125,"passCount":6,"partialCount":1,"failCount":1,"externalCount":0,"naCount":0}]},"bundleHash":"fb69bd0fbe834cb782bc95c69d88a98e740fcb23a360a1f5031f5111372f9c59","checkerVersion":"v0.1.0","regulationsVersions":{"eu-ai-act-2024-08":"ee8568c60676d1c60c00393077dc7b9753628a16bb96049d6caa384b93516239","nist-ai-rmf-1.0":"b36616651114a74e212e4416e72f3d320d3ea46e1c93d7d3919cd44b5f71f762","gdpr-2016":"a650813378c93140abcbda864a7248289096abec98d57667cb0c0e2cba1bfe3f","iso-42001-2023":"3855f297eea17980b71d32e9d8c9f113c153c68e07b01fd442392fba4567755d"},"startedAt":"2026-05-20T19:57:25.562Z","completedAt":"2026-05-20T19:58:01.019Z","durationMs":35457,"externalControls":[{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","note":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external."}]}}