lex-governance 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 872e980260f49400124a887b0a30dc0acb5a763440d17b20afc7c837a1e0ce4d
-  data.tar.gz: d6912d4151a41cac307e1e828733306b7ea1f32d85c126b13f2b8b5ac2fe4cb7
+  metadata.gz: 6ae04ddeb792bd593f11c4b121cf778a1b6fb14b9827de61aca08d88363f3cb8
+  data.tar.gz: 1c9c72455e758c50f9bdc00995a32d9bb2c7a18d1140f2203020467b08c91b1b
 SHA512:
-  metadata.gz: 7c6bf0e53ee3d3b6de474c5c3ff4f5d4d0dfc41dfa2ccf288af43e94056937ba4d4202426caf6ad24a8258fef0a330ef96e13f1b4db2935e82f367b9d03d4e0f
-  data.tar.gz: a62fda0ef8c6434646bed44760708f28bc8826c92a3e0a4572b2a68693c5ceac23defcd3b4f43b529ccb2050eb44a67ec8a65d9f0cfb16172ff5f347810ff66d
+  metadata.gz: 6cf0a327af81329db2a4f8255c0ac4fdbcdccbfab56ef9803eb70ea14880bedd8bb99f1161381eeed56345ed9b9c6fcd81e3c2e77c92971dabf0e32a8da6bb56
+  data.tar.gz: 1f2834223f2a83f382e89684afbdffae40f913e36d174f55ef3596feade744f842fa62716ff544da6eb88ad4e9575143a83da85a7deae9865eb0b0aeb9db30cb

data/Gemfile

@@ -7,4 +7,8 @@ gemspec
 gem 'rspec', '~> 3.13'
 gem 'rubocop', '~> 1.75', require: false
 
-gem 'legion-gaia', path: '../../legion-gaia'
+if File.directory?(File.expand_path('../../legion-gaia', __dir__))
+  gem 'legion-gaia', path: '../../legion-gaia'
+else
+  gem 'legion-gaia'
+end

data/lex-governance.gemspec

@@ -25,5 +25,4 @@ Gem::Specification.new do |spec|
     Dir.glob('{lib,spec}/**/*') + %w[lex-governance.gemspec Gemfile]
   end
   spec.require_paths = ['lib']
-  spec.add_development_dependency 'legion-gaia'
 end

data/lib/legion/extensions/governance/actors/shadow_ai_scan.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Governance
+      module Actors
+        class ShadowAiScan < Legion::Extensions::Actors::Every
+          def runner_class = Runners::ShadowAi
+          def runner_function = 'full_scan'
+          def time = 86_400
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/governance/runners/shadow_ai.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Governance
+      module Runners
+        module ShadowAi
+          def scan_unregistered_extensions(**)
+            installed = Bundler.load.specs.select { |s| s.name.start_with?('lex-') }.map(&:name)
+            registered = registered_extension_names
+
+            unregistered = installed - registered
+            { installed: installed.size, registered: registered.size, unregistered: unregistered }
+          rescue StandardError => e
+            { installed: 0, registered: 0, unregistered: [], error: e.message }
+          end
+
+          def check_llm_bypass_indicators(**)
+            indicators = []
+            indicators << :direct_openai_key if ENV.key?('OPENAI_API_KEY') && !provider_enabled?(:openai)
+            indicators << :direct_anthropic_key if ENV.key?('ANTHROPIC_API_KEY') && !provider_enabled?(:anthropic)
+            { indicators: indicators, bypassed: !indicators.empty? }
+          end
+
+          def check_airb_compliance(**)
+            return { checked: 0, source: :unavailable } unless defined?(Legion::Data::Model::DigitalWorker)
+
+            workers = Legion::Data::Model::DigitalWorker.where(lifecycle_state: 'active').all
+            non_compliant = workers.select do |w|
+              risk = w.respond_to?(:risk_tier) ? w.risk_tier : nil
+              %w[high critical].include?(risk) && w.respond_to?(:airb_status) && w.airb_status != 'approved'
+            end
+
+            { checked: workers.size, compliant: workers.size - non_compliant.size,
+              non_compliant: non_compliant.map(&:worker_id) }
+          rescue StandardError => e
+            { checked: 0, error: e.message }
+          end
+
+          def full_scan(**)
+            extensions = scan_unregistered_extensions
+            bypass = check_llm_bypass_indicators
+            compliance = check_airb_compliance
+
+            has_issues = extensions[:unregistered]&.any? || bypass[:bypassed] || compliance[:non_compliant]&.any?
+            emit_shadow_event(extensions, bypass, compliance) if has_issues
+
+            { extensions: extensions, bypass: bypass, compliance: compliance, issues_found: has_issues }
+          end
+
+          private
+
+          def registered_extension_names
+            return [] unless defined?(Legion::Data) && Legion::Data.respond_to?(:connection)
+
+            conn = Legion::Data.connection
+            return [] unless conn&.table_exists?(:extension_registry)
+
+            conn[:extension_registry].select_map(:gem_name)
+          rescue StandardError
+            []
+          end
+
+          def provider_enabled?(provider)
+            llm = Legion::Settings[:llm]
+            return false unless llm.is_a?(Hash)
+
+            providers = llm[:providers]
+            return false unless providers.is_a?(Hash)
+
+            providers.dig(provider, :enabled) == true
+          rescue StandardError
+            false
+          end
+
+          def emit_shadow_event(extensions, bypass, compliance)
+            return unless defined?(Legion::Events)
+
+            Legion::Events.emit('governance.shadow_ai_detected', {
+                                  unregistered:  extensions[:unregistered],
+                                  bypass:        bypass[:indicators],
+                                  non_compliant: compliance[:non_compliant]
+                                })
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/governance/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module Governance
-      VERSION = '0.1.1'
+      VERSION = '0.2.0'
     end
   end
 end

data/lib/legion/extensions/governance.rb

@@ -4,6 +4,8 @@ require 'legion/extensions/governance/version'
 require 'legion/extensions/governance/helpers/layers'
 require 'legion/extensions/governance/helpers/proposal'
 require 'legion/extensions/governance/runners/governance'
+require 'legion/extensions/governance/runners/shadow_ai'
+require 'legion/extensions/governance/actors/shadow_ai_scan'
 
 module Legion
   module Extensions

data/spec/legion/extensions/governance/runners/shadow_ai_spec.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Legion::Extensions::Governance::Runners::ShadowAi do
+  let(:host) { Object.new.extend(described_class) }
+
+  describe '#check_llm_bypass_indicators' do
+    it 'detects direct API key when provider not enabled' do
+      allow(ENV).to receive(:key?).and_call_original
+      allow(ENV).to receive(:key?).with('OPENAI_API_KEY').and_return(true)
+      allow(ENV).to receive(:key?).with('ANTHROPIC_API_KEY').and_return(false)
+      allow(Legion::Settings).to receive(:[]).with(:llm).and_return(
+        { providers: { openai: { enabled: false } } }
+      )
+      result = host.check_llm_bypass_indicators
+      expect(result[:bypassed]).to be true
+      expect(result[:indicators]).to include(:direct_openai_key)
+    end
+
+    it 'returns clean when no bypass indicators' do
+      allow(ENV).to receive(:key?).with('OPENAI_API_KEY').and_return(false)
+      allow(ENV).to receive(:key?).with('ANTHROPIC_API_KEY').and_return(false)
+      result = host.check_llm_bypass_indicators
+      expect(result[:bypassed]).to be false
+      expect(result[:indicators]).to be_empty
+    end
+
+    it 'does not flag when provider is enabled' do
+      allow(ENV).to receive(:key?).and_call_original
+      allow(ENV).to receive(:key?).with('OPENAI_API_KEY').and_return(true)
+      allow(ENV).to receive(:key?).with('ANTHROPIC_API_KEY').and_return(false)
+      allow(Legion::Settings).to receive(:[]).with(:llm).and_return(
+        { providers: { openai: { enabled: true } } }
+      )
+      result = host.check_llm_bypass_indicators
+      expect(result[:bypassed]).to be false
+    end
+  end
+
+  describe '#check_airb_compliance' do
+    it 'returns unavailable when data model not loaded' do
+      result = host.check_airb_compliance
+      expect(result[:source]).to eq(:unavailable)
+    end
+  end
+
+  describe '#full_scan' do
+    it 'returns combined results' do
+      allow(host).to receive(:scan_unregistered_extensions).and_return(
+        { installed: 5, registered: 5, unregistered: [] }
+      )
+      allow(host).to receive(:check_llm_bypass_indicators).and_return(
+        { indicators: [], bypassed: false }
+      )
+      allow(host).to receive(:check_airb_compliance).and_return(
+        { checked: 0, source: :unavailable }
+      )
+
+      result = host.full_scan
+      expect(result[:issues_found]).to be_falsey
+      expect(result[:extensions][:installed]).to eq(5)
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -9,8 +9,34 @@ module Legion
     def self.warn(_msg); end
     def self.error(_msg); end
   end
+
+  module Extensions
+    module Actors
+      class Every; end # rubocop:disable Lint/EmptyClass
+    end
+  end
+
+  module Settings
+    @store = {}
+
+    class << self
+      def [](key)
+        @store[key.to_sym] ||= {}
+      end
+
+      def reset!
+        @store = {}
+      end
+    end
+  end
+
+  module Events
+    def self.emit(_name, _payload); end
+  end
 end
 
+$LOADED_FEATURES << 'legion/extensions/actors/every'
+
 require 'legion/extensions/governance'
 
 RSpec.configure do |config|

metadata

@@ -1,28 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lex-governance
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Esity
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: legion-gaia
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+dependencies: []
 description: Four-layer distributed governance protocol for brain-modeled agentic
   AI
 email:
@@ -34,17 +20,20 @@ files:
 - Gemfile
 - lex-governance.gemspec
 - lib/legion/extensions/governance.rb
+- lib/legion/extensions/governance/actors/shadow_ai_scan.rb
 - lib/legion/extensions/governance/actors/vote_timeout.rb
 - lib/legion/extensions/governance/client.rb
 - lib/legion/extensions/governance/helpers/layers.rb
 - lib/legion/extensions/governance/helpers/proposal.rb
 - lib/legion/extensions/governance/runners/governance.rb
+- lib/legion/extensions/governance/runners/shadow_ai.rb
 - lib/legion/extensions/governance/version.rb
 - spec/legion/extensions/governance/actors/vote_timeout_spec.rb
 - spec/legion/extensions/governance/client_spec.rb
 - spec/legion/extensions/governance/helpers/layers_spec.rb
 - spec/legion/extensions/governance/helpers/proposal_spec.rb
 - spec/legion/extensions/governance/runners/governance_spec.rb
+- spec/legion/extensions/governance/runners/shadow_ai_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/LegionIO/lex-governance
 licenses: