@complior/engine 0.9.0

package/.well-known/ai-compliance.json

@@ -0,0 +1,16 @@
+{
+  "version": "1.0",
+  "scanner": "complior/1.0.0",
+  "scannedAt": "[SCAN_DATE]",
+  "organization": "[TO BE SET]",
+  "ai_systems": [
+    {
+      "name": "[TO BE SET]",
+      "provider": "[TO BE SET]",
+      "risk_level": "[TO BE SET]",
+      "compliance_score": 0
+    }
+  ],
+  "jurisdiction": "EU",
+  "regulation": "EU AI Act (Regulation (EU) 2024/1689)"
+}

package/COMPLIANCE.md

@@ -0,0 +1,64 @@
+# Compliance Report
+
+> Generated by Complior v1.0.0 on 2026-03-15T18:52:53.383Z
+
+## Score
+
+| Metric | Value |
+|--------|-------|
+| Total Score | **22.18%** |
+| Zone | red |
+| Checks | 93 total, 56 passed, 36 failed |
+
+## Findings Summary
+
+| Check ID | Severity | Message |
+|----------|----------|---------|
+| l3-banned-emotion-recognition | critical | Art. 5 REVIEW: "emotion-recognition" detected — Emotion recognition. Prohibited under Art. 5(1)(f) when: Infers emotions in workplace or educational settings, except for medical or safety purposes. Verify: Is this used to detect emotions of employees or students? (Medical/safety use is exempt) |
+| cross-permission-passport-mismatch | critical | 14 undeclared permission(s) with unwrapped LLM calls — compounding governance failure per Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
+| art5-screening | high | No art. 5 screening document found (Art. 5) |
+| technical-documentation | high | No technical documentation found (Art. 11) |
+| declaration-of-conformity | high | No declaration of conformity found (Art. 47) |
+| risk-management | high | No risk management documentation found (Art. 9) |
+| ai-literacy | medium | No AI literacy policy or training documentation found (Art. 4) |
+| incident-report | medium | No incident report template found (Art. 73) |
+| monitoring-policy | medium | No monitoring policy found (Art. 26) |
+| data-governance | medium | No data governance documentation found (Art. 10) |
+| qms | medium | No quality management system found (Art. 17) |
+| instructions-for-use | medium | No instructions for use found (Art. 13) |
+| l4-bare-llm | medium | WARNING: Anthropic bare API call in src/chat/anthropic.ts:8 — eu-ai-act-OBL-015 Art. 50(1) |
+| l4-bare-llm | medium | WARNING: OpenAI bare API call in src/chat/handler.ts:11 — eu-ai-act-OBL-015 Art. 50(1) |
+| l4-security-risk | medium | WARNING: Unsafe eval() with user input in src/screening/hr-filter.ts:16 — eu-ai-act-OBL-008 Art. 15(4) |
+| l4-security-risk | medium | WARNING: Unsafe eval() with user input in src/security/unsafe-eval.ts:11 — eu-ai-act-OBL-008 Art. 15(4) |
+| l4-security-risk | medium | WARNING: Unsafe pickle deserialization in src/security/unsafe-pickle.py:14 — eu-ai-act-OBL-008 Art. 15(4) |
+| cross-banned-with-wrapper | medium | Prohibited package detected but compliance controls (disclosure, oversight, kill-switch) are present. Review whether usage falls under an Art. 5 exception. |
+| cross-logging-no-retention | medium | AI logging implemented in code but no log retention configuration found. Art. 12 requires log retention >= 180 days. |
+| l3-missing-bias-testing | low | AI SDKs detected but no bias testing library found. Consider adding fairlearn, aif360, or aequitas. |
+| l3-log-retention | low | docker-compose.yml: Logging configured but no retention policy found. Ensure >= 180 days retention (Art. 12). |
+| cross-kill-switch-no-test | low | AI kill switch pattern found in code but no automated tests detected for it. Safety mechanisms should be tested. |
+
+## Top Issues
+
+1. **[CRITICAL]** l3-banned-emotion-recognition: Art. 5 REVIEW: "emotion-recognition" detected — Emotion recognition. Prohibited under Art. 5(1)(f) when: Infers emotions in workplace or educational settings, except for medical or safety purposes. Verify: Is this used to detect emotions of employees or students? (Medical/safety use is exempt)
+2. **[CRITICAL]** cross-permission-passport-mismatch: 14 undeclared permission(s) with unwrapped LLM calls — compounding governance failure per Art. 26(4)
+3. **[HIGH]** undeclared-permission: Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4)
+4. **[HIGH]** undeclared-permission: Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4)
+5. **[HIGH]** undeclared-permission: Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4)
+
+---
+
+![Compliance Badge](.complior/badge.svg)

package/data/data-integrity.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Smoke tests for extracted JSON data files.
+ * Validates structure and constraints to catch data corruption early.
+ */
+import { describe, it, expect } from 'vitest';
+import limits from './scanner/limits.json' with { type: 'json' };
+import pricing from './llm/model-pricing.json' with { type: 'json' };
+import routing from './llm/model-routing.json' with { type: 'json' };
+import confidence from './scanner/confidence-params.json' with { type: 'json' };
+import checkIds from './scanner/check-id-categories.json' with { type: 'json' };
+import evalMappings from './eval/eval-mappings.json' with { type: 'json' };
+import riskProfile from './onboarding/risk-profile.json' with { type: 'json' };
+
+const OBL_ID_RE = /^OBL-\d{3}$/;
+
+describe('data integrity', () => {
+  it('scanner/limits.json has positive limits', () => {
+    expect(limits.max_files).toBeGreaterThan(0);
+    expect(limits.max_file_size_bytes).toBeGreaterThan(0);
+  });
+
+  it('llm/model-pricing.json has positive input/output for all models', () => {
+    const models = Object.entries(pricing.models);
+    expect(models.length).toBeGreaterThanOrEqual(10);
+    for (const [name, p] of models) {
+      expect(p.input, `${name} input`).toBeGreaterThan(0);
+      expect(p.output, `${name} output`).toBeGreaterThan(0);
+    }
+  });
+
+  it('llm/model-routing.json covers all task types for every provider', () => {
+    const taskTypes = Object.keys(routing.task_reasons);
+    expect(taskTypes.length).toBeGreaterThanOrEqual(6);
+    for (const [provider, tasks] of Object.entries(routing.model_map)) {
+      for (const tt of taskTypes) {
+        expect((tasks as Record<string, string>)[tt], `${provider}.${tt}`).toBeTruthy();
+      }
+    }
+  });
+
+  it('scanner/confidence-params.json has all 5 layers and 5 multipliers', () => {
+    expect(Object.keys(confidence.layer_weights)).toEqual(['L1', 'L2', 'L3', 'L4', 'L5']);
+    expect(Object.keys(confidence.score_multipliers)).toEqual([
+      'PASS', 'LIKELY_PASS', 'UNCERTAIN', 'LIKELY_FAIL', 'FAIL',
+    ]);
+  });
+
+  it('scanner/check-id-categories.json has non-empty mapping', () => {
+    const entries = Object.entries(checkIds.mapping);
+    expect(entries.length).toBeGreaterThanOrEqual(70);
+    for (const [id, cat] of entries) {
+      expect(cat, `category for ${id}`).toBeTruthy();
+    }
+  });
+
+  it('eval/eval-mappings.json has valid priority/article/fine/timeline entries', () => {
+    expect(Object.keys(evalMappings.priority_order)).toEqual(['critical', 'high', 'medium', 'low']);
+    expect(Object.keys(evalMappings.category_articles).length).toBeGreaterThanOrEqual(10);
+    expect(Object.keys(evalMappings.priority_timeline)).toEqual(['critical', 'high', 'medium', 'low']);
+  });
+
+  it('onboarding/risk-profile.json has valid OBL-IDs', () => {
+    for (const id of riskProfile.base_obligations) {
+      expect(id, `base ${id}`).toMatch(OBL_ID_RE);
+    }
+    for (const id of riskProfile.high_risk_extra_obligations) {
+      expect(id, `extra ${id}`).toMatch(OBL_ID_RE);
+    }
+    for (const [domain, ids] of Object.entries(riskProfile.domain_obligations)) {
+      for (const id of ids) {
+        expect(id, `${domain} ${id}`).toMatch(OBL_ID_RE);
+      }
+    }
+  });
+});

package/data/eval/eval-mappings.json

@@ -0,0 +1,33 @@
+{
+  "priority_order": {
+    "critical": 0,
+    "high": 1,
+    "medium": 2,
+    "low": 3
+  },
+  "category_articles": {
+    "transparency": "Art.50",
+    "oversight": "Art.14",
+    "explanation": "Art.13",
+    "bias": "Art.10",
+    "accuracy": "Art.15",
+    "robustness": "Art.15",
+    "prohibited": "Art.5",
+    "logging": "Art.12",
+    "risk-awareness": "Art.9",
+    "gpai": "Art.52",
+    "industry": "Art.6"
+  },
+  "category_fines": {
+    "transparency": "up to 35M EUR",
+    "prohibited": "up to 35M EUR or 7% worldwide turnover",
+    "bias": "up to 35M EUR",
+    "oversight": "up to 15M EUR"
+  },
+  "priority_timeline": {
+    "critical": "this week",
+    "high": "next week",
+    "medium": "this month",
+    "low": "backlog"
+  }
+}

package/data/llm/model-pricing.json

@@ -0,0 +1,15 @@
+{
+  "models": {
+    "claude-opus-4": { "input": 15.0, "output": 75.0 },
+    "claude-sonnet-4": { "input": 3.0, "output": 15.0 },
+    "claude-sonnet-4-20250514": { "input": 3.0, "output": 15.0 },
+    "claude-haiku-4": { "input": 0.80, "output": 4.0 },
+    "gpt-4o": { "input": 2.50, "output": 10.0 },
+    "gpt-4o-mini": { "input": 0.15, "output": 0.60 },
+    "o1": { "input": 15.0, "output": 60.0 },
+    "gemini-2.0-flash": { "input": 0.10, "output": 0.40 },
+    "gemini-2.0-pro": { "input": 1.25, "output": 5.0 },
+    "mistral-large": { "input": 2.0, "output": 6.0 },
+    "mistral-small": { "input": 0.20, "output": 0.60 }
+  }
+}

package/data/llm/model-routing.json

@@ -0,0 +1,36 @@
+{
+  "model_map": {
+    "openai": {
+      "qa": "gpt-4o-mini",
+      "code": "gpt-4o",
+      "report": "gpt-4o",
+      "classify": "gpt-4o-mini",
+      "chat": "gpt-4o",
+      "document-generation": "gpt-4o"
+    },
+    "anthropic": {
+      "qa": "claude-haiku-4-5-20251001",
+      "code": "claude-sonnet-4-5-20250929",
+      "report": "claude-sonnet-4-5-20250929",
+      "classify": "claude-haiku-4-5-20251001",
+      "chat": "claude-sonnet-4-5-20250929",
+      "document-generation": "claude-sonnet-4-5-20250929"
+    },
+    "openrouter": {
+      "qa": "anthropic/claude-haiku-4.5",
+      "code": "anthropic/claude-sonnet-4.5",
+      "report": "anthropic/claude-sonnet-4.5",
+      "classify": "anthropic/claude-haiku-4.5",
+      "chat": "anthropic/claude-sonnet-4.5",
+      "document-generation": "anthropic/claude-sonnet-4.5"
+    }
+  },
+  "task_reasons": {
+    "qa": "Fast, cheap model for simple Q&A",
+    "code": "Balanced model for code generation",
+    "report": "Powerful model for detailed reports",
+    "classify": "Fast model for classification tasks",
+    "chat": "Balanced model for interactive chat",
+    "document-generation": "Powerful model for detailed document creation"
+  }
+}

package/data/onboarding/risk-profile.json

@@ -0,0 +1,17 @@
+{
+  "high_risk_domains": ["healthcare", "finance", "hr", "education", "law_enforcement", "justice"],
+  "domain_obligations": {
+    "healthcare": ["OBL-070", "OBL-071", "OBL-072"],
+    "finance": ["OBL-073", "OBL-074", "OBL-075", "OBL-076"],
+    "hr": ["OBL-064", "OBL-065", "OBL-066"],
+    "education": ["OBL-067", "OBL-068", "OBL-069"],
+    "content": ["OBL-089", "OBL-090"],
+    "customer_service": ["OBL-091"]
+  },
+  "base_obligations": [
+    "OBL-001", "OBL-002", "OBL-003", "OBL-004", "OBL-005",
+    "OBL-006", "OBL-007", "OBL-008", "OBL-009", "OBL-010",
+    "OBL-011", "OBL-012", "OBL-013", "OBL-014", "OBL-015"
+  ],
+  "high_risk_extra_obligations": ["OBL-016", "OBL-017", "OBL-018", "OBL-019", "OBL-020"]
+}

package/data/regulations/eu-ai-act/README.md

@@ -0,0 +1,245 @@
+# EU AI Act Compliance Framework — README
+
+> **Version:** 4.0-full-coverage
+> **Дата:** 2026-02-18
+> **Закон:** EU AI Act (Regulation (EU) 2024/1689)
+> **Покрытие:** ~95% actionable obligations
+> **Next review:** 2026-03-01
+
+---
+
+## Что это
+
+11 файлов, 421 KB — полная машиночитаемая база знаний по EU AI Act для платформы Complior.ai.
+
+Обработаны: 34 статьи закона, 5 Annexes (II, III, IV, XI, XII), Codes of Practice (по декабрь 2025), Commission Guidelines (февраль 2025). Obligations decomposed по 13 industry domains.
+
+Это **data layer**, не документация. Загружается в engine и используется scanner'ом, fixer'ом, scoring engine, onboarding wizard, SEO generator и knowledge loader.
+
+---
+
+## Числа
+
+| Метрика | Значение |
+|---------|----------|
+| Obligations (обязательств) | **108** |
+| — critical severity | 37 |
+| — high severity | 57 |
+| — medium severity | 12 |
+| — low severity | 2 |
+| — applies to provider | 48 |
+| — applies to deployer | 17 |
+| — applies to both | 43 |
+| — CLI-checkable (scanner может проверить) | 85 (79%) |
+| — SDK feature needed | 33 (31%) |
+| — document template needed | 40 (37%) |
+| — has what_not_to_do (антипаттерны) | **108 (100%)** |
+| Tech specs for scanner | **89** |
+| — CLI coverage | **85/85 (100%)** |
+| Scoring categories (base) | 8 |
+| Scoring categories (domain) | 13 |
+| Risk levels | 5 |
+| Classification questions | 8 |
+| Roles defined | 8 |
+| Key definitions | 20 |
+| Applicability tree questions | 7 |
+| Cross-regulation mappings | 8 |
+| Timeline events (2024–2030) | 18 |
+| Localization terms × 7 languages | 8 × 7 = 56 |
+| Document templates (audit-ready) | 8 |
+| Marketing assets | 7 |
+| Industry domains covered | **13** |
+
+---
+
+## Структура файлов
+
+```
+complior/engine/data/regulations/eu-ai-act/
+│
+├── README.md                        ← этот файл
+│
+│   ── ЯДРО (engine загружает при старте) ──
+├── obligations.json                 ← 108 обязательств (191 KB)
+├── technical-requirements.json       ← 89 tech specs для scanner (111 KB)
+├── scoring.json                     ← алгоритм скоринга (14 KB)
+├── regulation-meta.json             ← метаданные + роли + риски (34 KB)
+│
+│   ── ВСПОМОГАТЕЛЬНЫЕ ──
+├── applicability-tree.json           ← decision tree Quick Check (9 KB)
+├── cross-mapping.json               ← маппинг на другие законы (8 KB)
+├── timeline.json                    ← 18 дедлайнов 2024–2030 (9 KB)
+├── localization.json                ← термины на 7 языках (7 KB)
+│
+│   ── ДОКУМЕНТЫ И КОНТЕНТ ──
+├── templates-part1.md               ← шаблоны 1–2: AI Literacy + Art. 5 Screening (14 KB)
+├── templates-part2.md               ← шаблоны 3–8: FRIA, Worker, TechDoc, Incident, CE, Monitoring (12 KB)
+└── marketing-content.md             ← Quick Check, Penalty Calc, Blog, FAQ, LinkedIn, SEO pages (12 KB)
+```
+
+При переименовании убрать `-v3-production` суффикс.
+
+---
+
+## 13 Industry Domains
+
+Каждое domain obligation содержит специфику для отрасли: какие запрещённые практики актуальны, какие bias-тесты нужны, какие смежные законы пересекаются.
+
+| # | Domain | Obl | Annex | Ключевая специфика |
+|---|--------|-----|-------|-------------------|
+| 1 | **HR / Employment** | 3 | III.4 | Recruitment bias, workplace emotion recognition PROHIBITED (Art. 5(1)(f)), works council notification (DE/NL/AT), GDPR employee data |
+| 2 | **Finance / Credit / Insurance** | 4 | III.5 | Credit scoring FRIA mandatory (Art. 27), insurance pricing fairness, proxy discrimination, MiFID II intersection |
+| 3 | **Healthcare / Medical** | 3 | II+III | Dual AI Act + MDR conformity, clinical validation, health advice disclaimers, GDPR Art. 9, demographic accuracy |
+| 4 | **Education** | 3 | III.3 | Admissions bias, proctoring emotion recognition PROHIBITED, tutoring minors protection |
+| 5 | **Law Enforcement** | 2 | III.6 | Real-time biometric ID PROHIBITED (Art. 5(1)(h)), predictive policing bias, maximum penalties (€35M) |
+| 6 | **Justice / Legal** | 2 | III.8 | Advisory-only judicial AI, highest explainability, legal practice client disclosure |
+| 7 | **Migration / Border** | 2 | III.7 | Refugee Convention intersection, asylum human review, AFSJ extended deadline (2030) |
+| 8 | **Critical Infrastructure** | 1 | III.2 | Failsafe mechanisms, NIS2 intersection, redundancy, public safety at scale |
+| 9 | **Biometric** | 1 | III.1 | 4 Art. 5 prohibitions, double human verification (Art. 14(5)), GDPR Art. 9 special category |
+| 10 | **Content Generation** | 2 | Art.50 | C2PA machine-readable marking, deepfake visible labeling, watermark robustness |
+| 11 | **Customer Service** | 1 | Art.50 | Chatbot AI disclosure, human escalation option |
+| 12 | **Marketing / Advertising** | 1 | Art.5 | AI manipulation = prohibited (max penalty), user opt-out, DSA intersection |
+| 13 | **Transport / Autonomous** | 1 | II+III | Fail-safe behavior, type-approval dual framework, diverse condition testing |
+
+Plus **82 generic (cross-domain) obligations** applying to all AI systems regardless of industry.
+
+---
+
+## Что означает каждый файл
+
+### 1. obligations.json — ЯДРО (191 KB, 108 obligations)
+
+Каждое обязательство: 27 полей. Ключевые:
+
+- `obligation_id` — уникальный ID (`eu-ai-act-OBL-HR-001`)
+- `applies_to_role` — `deployer` / `provider` / `both`
+- `applies_to_risk_level` — фильтр по уровню риска
+- `what_to_do` — конкретные действия (5–8 пунктов)
+- `what_not_to_do` — антипаттерны (3–5 пунктов)
+- `evidence_required` — что показать аудитору
+- `cli_check_possible` — может ли scanner проверить в коде
+- `severity` — critical / high / medium / low
+- `automation_approach` — как scanner автоматизирует (конкретные файлы и паттерны)
+
+### 2. technical-requirements.json — SCANNER DATA (111 KB, 89 specs)
+
+100% coverage всех CLI-checkable obligations. Каждый spec:
+
+- `positive_signals` — паттерны кода = compliance
+- `negative_signals` — паттерны кода = нарушение
+- `warning_message` — сообщение разработчику
+- `fix_suggestion` — как исправить
+- `severity` — error / warning / info
+
+### 3. scoring.json — COMPLIANCE SCORE (14 KB)
+
+8 base categories (always applied) + 13 domain categories (applied when company operates in domain). Critical cap: any critical = 0% → total max 40%. Thresholds: Red 0–49%, Yellow 50–79%, Green 80–100%. Certificate: 85% + all criticals 100%.
+
+### 4. regulation-meta.json — LAW METADATA (34 KB)
+
+ID, name, jurisdiction, 6 enforcement dates, penalties, 20 definitions, 8 roles, 5 risk levels, 8 classification questions.
+
+### 5. applicability-tree.json — QUICK CHECK (9 KB)
+
+7 questions: does EU AI Act apply to this company? Results: applies / does-not-apply / partially-applies.
+
+### 6. cross-mapping.json — MULTI-JURISDICTION (8 KB)
+
+8 cross-regulation mappings + strictest_rule_wins_matrix. Framework — fills when new jurisdictions processed.
+
+### 7. timeline.json — DEADLINES (9 KB)
+
+18 dates (2024–2030). Amendments. Codes of Practice. 7 monitoring URLs.
+
+### 8. localization.json — 7 LANGUAGES (7 KB)
+
+8 terms in DE, FR, ES, IT, NL, PT, PL. Cultural notes per market.
+
+### 9–10. templates — 8 AUDIT-READY DOCUMENTS (26 KB)
+
+Templates 1–2 (AI Literacy + Art. 5 Screening) **already required since Feb 2025**. Templates 3–8 (FRIA, Worker Notification, Tech Documentation, Incident Report, Declaration, Monitoring Policy) due Aug 2026.
+
+### 11. marketing-content.md — 7 MARKETING ASSETS (12 KB)
+
+Quick Check tool, Penalty Calculator, Blog outline, Comparison table, FAQ, LinkedIn post, Programmatic SEO template.
+
+---
+
+## Как файлы связаны
+
+```
+regulation-meta.json
+    ├── roles ──────── filter obligations by role
+    ├── risk_levels ── filter by risk level
+    └── questions ──── onboarding quiz
+            │
+            ▼
+obligations.json (108)
+    ├── cli_check=true ──► technical-requirements.json (89) ──► SCANNER
+    ├── sdk_needed=true ──► SDK middleware
+    ├── template_needed=true ──► templates-*.md ──► FIXER
+    ├── severity + category ──► scoring.json ──► SCORE
+    ├── cross_mapping ──► cross-mapping.json ──► STRICTEST RULE WINS
+    ├── deadline ──► timeline.json ──► COUNTDOWN
+    └── what_to_do + what_not_to_do ──► FINDINGS + FIX ACTIONS
+
+applicability-tree.json ──► Quick Check
+localization.json ──► UI labels (7 languages)
+marketing-content.md ──► Website SEO + blog + tools
+```
+
+---
+
+## Использование по компонентам
+
+| Component | Files used | How |
+|-----------|-----------|-----|
+| **Scanner** | obligations.json + technical-requirements.json | Load CLI-checkable obligations → match positive/negative signals → output findings |
+| **Fixer** | obligations.json + templates-*.md | what_to_do actions → generate documents + code fixes |
+| **Score Calculator** | scoring.json + obligations.json | Map results to categories → weighted score → threshold |
+| **Onboarding** | applicability-tree.json + regulation-meta.json | Quick Check → risk classification → role → personalized obligation list |
+| **SEO Generator** | marketing-content.md + obligations.json | Programmatic pages, per-obligation pages, FAQ, comparisons |
+| **Knowledge Loader** | obligations.json + timeline.json + regulation-meta.json | On-demand context for LLM agents |
+
+---
+
+## Добавление новой юрисдикции
+
+1. Use same 12-stage prompt + text of new law
+2. Receive 11 files → `engine/data/regulations/[jurisdiction-id]/`
+3. Fill `cross_regulation_mapping` per obligation
+4. Strictest-rule-wins engine picks stricter requirement automatically
+
+| # | Jurisdiction | Status |
+|---|-------------|--------|
+| 1 | EU AI Act | ✅ Done |
+| 2 | Colorado SB 205 | ⏳ Next |
+| 3 | NYC LL 144 | 📋 Planned |
+| 4 | California SB 1001 | 📋 Planned |
+| 5 | WCAG 2.2 AA (EAA) | 📋 Planned |
+| 6 | EU Cyber Resilience Act | 📋 Planned |
+
+---
+
+## Что осталось
+
+| Item | Priority |
+|------|----------|
+| Colorado SB 205 processing | P0 |
+| Templates 9–15 (Inventory, Model Card, Copyright, Data Gov, Corrective, Training Summary, Checklist) | P1 |
+| GPAI Code of Practice decomposition | P1 |
+| Commission guidelines on high-risk classification (expected Feb 2026) | P0 |
+| Content marking Code of Practice update | P1 |
+| National authority directory per Member State | P1 |
+| Harmonised standards (CEN/CENELEC, expected 2027) | P2 |
+
+---
+
+## Version history
+
+| Version | Date | Obligations | Tech specs | Change |
+|---------|------|------------|-----------|--------|
+| 1.0 | 2026-02-17 | 25 | 6 | Initial framework |
+| 2.0 | 2026-02-17 | 64 | 14 | Sub-decomposition |
+| 3.0 | 2026-02-17 | 69 | 53 | Deployer expansion, 100% CLI coverage, what_not_to_do |
+| **4.0** | **2026-02-18** | **108** | **89** | **13 domains, ~95% law coverage, full production** |