@complior/engine 0.9.0

package/src/domain/certification/test-runner.ts

@@ -0,0 +1,289 @@
+/**
+ * Adversarial Test Runner — Art.9(6)-(8) testing, Art.15(4) robustness.
+ *
+ * Sends adversarial prompts to the configured LLM (system under test),
+ * evaluates responses deterministically via pattern matching.
+ * The LLM is the subject, NOT the evaluator.
+ */
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import type { EvaluationResult } from './adversarial/evaluators.js';
+import type { EvidenceStore } from '../scanner/evidence-store.js';
+import type { AuditStore } from '../audit/audit-trail.js';
+
+import { createEvidence } from '../scanner/evidence.js';
+import { PROMPT_INJECTION_SCENARIOS } from './adversarial/prompt-injection.js';
+import { BIAS_TEST_PAIRS } from './adversarial/bias-tests.js';
+import { SAFETY_BOUNDARY_SCENARIOS } from './adversarial/safety-boundary.js';
+
+// ── Constants ────────────────────────────────────────────────────
+
+export const ADVERSARIAL_OBLIGATIONS = ['OBL-003c', 'OBL-009b'] as const;
+
+/** Max chars to store for bias pair prompt/response previews. */
+const BIAS_PROMPT_PREVIEW_LEN = 100;
+const BIAS_RESPONSE_PREVIEW_LEN = 500;
+
+// ── Types ────────────────────────────────────────────────────────
+
+export type TestCategory = 'prompt_injection' | 'bias_detection' | 'safety_boundary';
+export type TestVerdict = 'pass' | 'fail' | 'inconclusive';
+
+export interface TestScenario {
+  readonly id: string;
+  readonly category: TestCategory;
+  readonly name: string;
+  readonly description: string;
+  readonly articleRef: string;
+  readonly prompt: string;
+  readonly systemPrompt?: string;
+  readonly evaluate: (response: string) => EvaluationResult;
+}
+
+export interface BiasTestPair {
+  readonly id: string;
+  readonly category: 'bias_detection';
+  readonly name: string;
+  readonly description: string;
+  readonly articleRef: string;
+  readonly promptA: string;
+  readonly promptB: string;
+  readonly characteristicA: string;
+  readonly characteristicB: string;
+  readonly systemPrompt?: string;
+  readonly evaluate: (responseA: string, responseB: string) => EvaluationResult;
+}
+
+export interface TestResult {
+  readonly scenarioId: string;
+  readonly category: TestCategory;
+  readonly name: string;
+  readonly verdict: TestVerdict;
+  readonly confidence: number;
+  readonly prompt: string;
+  readonly response: string;
+  readonly matchedPatterns: readonly string[];
+  readonly reasoning: string;
+  readonly durationMs: number;
+  readonly articleRef: string;
+}
+
+export interface CategorySummary {
+  readonly total: number;
+  readonly passed: number;
+  readonly failed: number;
+  readonly inconclusive: number;
+  readonly score: number;
+}
+
+export interface AdversarialReport {
+  readonly agentName: string;
+  readonly timestamp: string;
+  readonly duration: number;
+  readonly categories: Record<TestCategory, CategorySummary>;
+  readonly results: readonly TestResult[];
+  readonly overallScore: number;
+  readonly passCount: number;
+  readonly failCount: number;
+  readonly inconclusiveCount: number;
+  readonly totalTests: number;
+  readonly obligationRefs: readonly string[];
+}
+
+export interface TestRunnerDeps {
+  readonly callLlm: (prompt: string, systemPrompt?: string) => Promise<string>;
+  readonly evidenceStore?: EvidenceStore;
+  readonly auditStore?: AuditStore;
+  readonly getProjectPath: () => string;
+}
+
+// ── Pure helpers ─────────────────────────────────────────────────
+
+/** Format current timestamp for safe use in filenames. */
+const fileTimestamp = (): string => new Date().toISOString().replace(/[:.]/g, '-');
+
+interface VerdictCounts {
+  readonly total: number;
+  readonly passed: number;
+  readonly failed: number;
+  readonly inconclusive: number;
+}
+
+/** Count verdicts in a result set, optionally filtered by category. */
+const countVerdicts = (results: readonly TestResult[], category?: TestCategory): VerdictCounts => {
+  const filtered = category ? results.filter(r => r.category === category) : results;
+  let passed = 0, failed = 0, inconclusive = 0;
+  for (const r of filtered) {
+    if (r.verdict === 'pass') passed++;
+    else if (r.verdict === 'fail') failed++;
+    else inconclusive++;
+  }
+  return { total: filtered.length, passed, failed, inconclusive };
+};
+
+const toCategorySummary = (counts: VerdictCounts): CategorySummary => ({
+  ...counts,
+  score: counts.total > 0 ? Math.round((counts.passed / counts.total) * 100) : 0,
+});
+
+type ScenarioMeta = Pick<TestScenario, 'id' | 'category' | 'name' | 'articleRef'>;
+
+/** Build a TestResult from scenario metadata + evaluation + timing. */
+const toTestResult = (
+  meta: ScenarioMeta,
+  evaluation: EvaluationResult,
+  prompt: string,
+  response: string,
+  durationMs: number,
+): TestResult => ({
+  scenarioId: meta.id,
+  category: meta.category,
+  name: meta.name,
+  verdict: evaluation.verdict,
+  confidence: evaluation.confidence,
+  prompt,
+  response,
+  matchedPatterns: evaluation.matchedPatterns,
+  reasoning: evaluation.reasoning,
+  durationMs,
+  articleRef: meta.articleRef,
+});
+
+/** Build the final report from collected results. Pure function. */
+export const buildReport = (
+  agentName: string,
+  results: readonly TestResult[],
+  duration: number,
+): AdversarialReport => {
+  const overall = countVerdicts(results);
+
+  return {
+    agentName,
+    timestamp: new Date().toISOString(),
+    duration,
+    categories: {
+      prompt_injection: toCategorySummary(countVerdicts(results, 'prompt_injection')),
+      bias_detection: toCategorySummary(countVerdicts(results, 'bias_detection')),
+      safety_boundary: toCategorySummary(countVerdicts(results, 'safety_boundary')),
+    },
+    results,
+    overallScore: overall.total > 0 ? Math.round((overall.passed / overall.total) * 100) : 0,
+    passCount: overall.passed,
+    failCount: overall.failed,
+    inconclusiveCount: overall.inconclusive,
+    totalTests: overall.total,
+    obligationRefs: ADVERSARIAL_OBLIGATIONS,
+  };
+};
+
+// ── I/O helpers (separated from domain logic) ────────────────────
+
+const saveReport = async (report: AdversarialReport, projectPath: string): Promise<void> => {
+  const reportsDir = join(projectPath, '.complior', 'reports');
+  await mkdir(reportsDir, { recursive: true });
+  const path = join(reportsDir, `adversarial-${report.agentName}-${fileTimestamp()}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2));
+};
+
+const recordEvidence = async (
+  results: readonly TestResult[],
+  evidenceStore: EvidenceStore,
+): Promise<void> => {
+  const items = results.map(r =>
+    createEvidence(
+      `adversarial-${r.scenarioId}`,
+      'adversarial',
+      'adversarial-test',
+      { snippet: `${r.verdict}: ${r.reasoning}` },
+    ),
+  );
+  await evidenceStore.append(items, `adversarial-${fileTimestamp()}`);
+};
+
+const recordAudit = async (
+  report: AdversarialReport,
+  auditStore: AuditStore,
+): Promise<void> => {
+  await auditStore.append('adversarial.completed', {
+    totalTests: report.totalTests,
+    passCount: report.passCount,
+    failCount: report.failCount,
+    inconclusiveCount: report.inconclusiveCount,
+    overallScore: report.overallScore,
+    categories: Object.fromEntries(
+      Object.entries(report.categories).map(([k, v]) => [k, v.score]),
+    ),
+  }, report.agentName);
+};
+
+// ── Factory ──────────────────────────────────────────────────────
+
+export const createTestRunner = (deps: TestRunnerDeps) => {
+  const { callLlm, evidenceStore, auditStore, getProjectPath } = deps;
+
+  /** Call LLM with error isolation — never throws. */
+  const callLlmSafely = async (prompt: string, systemPrompt?: string): Promise<string> => {
+    try {
+      return await callLlm(prompt, systemPrompt);
+    } catch (err) {
+      return `[ERROR] LLM call failed: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  };
+
+  const runScenario = async (scenario: TestScenario): Promise<TestResult> => {
+    const start = Date.now();
+    const response = await callLlmSafely(scenario.prompt, scenario.systemPrompt);
+    const evaluation = scenario.evaluate(response);
+    return toTestResult(scenario, evaluation, scenario.prompt, response, Date.now() - start);
+  };
+
+  const runBiasPair = async (pair: BiasTestPair): Promise<TestResult> => {
+    const start = Date.now();
+    const responseA = await callLlmSafely(pair.promptA, pair.systemPrompt);
+    const responseB = await callLlmSafely(pair.promptB, pair.systemPrompt);
+    const evaluation = pair.evaluate(responseA, responseB);
+
+    const prompt = `A: ${pair.promptA.slice(0, BIAS_PROMPT_PREVIEW_LEN)}... | B: ${pair.promptB.slice(0, BIAS_PROMPT_PREVIEW_LEN)}...`;
+    const response = `A: ${responseA.slice(0, BIAS_RESPONSE_PREVIEW_LEN)} | B: ${responseB.slice(0, BIAS_RESPONSE_PREVIEW_LEN)}`;
+    return toTestResult(pair, evaluation, prompt, response, Date.now() - start);
+  };
+
+  const runAdversarialTests = async (
+    agentName: string,
+    categories?: readonly TestCategory[],
+  ): Promise<AdversarialReport> => {
+    const startTime = Date.now();
+    const results: TestResult[] = [];
+    const selected = categories ?? (['prompt_injection', 'bias_detection', 'safety_boundary'] as const);
+
+    // Sequential execution to avoid rate limits
+    if (selected.includes('prompt_injection')) {
+      for (const scenario of PROMPT_INJECTION_SCENARIOS) {
+        results.push(await runScenario(scenario));
+      }
+    }
+    if (selected.includes('bias_detection')) {
+      for (const pair of BIAS_TEST_PAIRS) {
+        results.push(await runBiasPair(pair));
+      }
+    }
+    if (selected.includes('safety_boundary')) {
+      for (const scenario of SAFETY_BOUNDARY_SCENARIOS) {
+        results.push(await runScenario(scenario));
+      }
+    }
+
+    const report = buildReport(agentName, results, Date.now() - startTime);
+
+    // I/O: persist results (fire-and-forget-safe; errors logged, not thrown)
+    await saveReport(report, getProjectPath());
+    if (evidenceStore) await recordEvidence(results, evidenceStore);
+    if (auditStore) await recordAudit(report, auditStore);
+
+    return Object.freeze(report);
+  };
+
+  return Object.freeze({ runAdversarialTests });
+};

package/src/domain/cost/cost-estimator.test.ts

@@ -0,0 +1,187 @@
+import { describe, it, expect } from 'vitest';
+import { computeCostEstimate } from './cost-estimator.js';
+
+describe('computeCostEstimate', () => {
+  it('returns zero costs when no issues', () => {
+    const result = computeCostEstimate({
+      findings: [],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 150,
+    });
+    expect(result.totalCost).toBe(0);
+    expect(result.remediationCost).toBe(0);
+    expect(result.documentationCost).toBe(0);
+    expect(result.roi).toBe(0);
+    expect(result.currency).toBe('EUR');
+  });
+
+  it('calculates remediation cost by severity', () => {
+    const result = computeCostEstimate({
+      findings: [
+        { severity: 'critical', checkId: 'c1', status: 'fail' },
+        { severity: 'high', checkId: 'h1', status: 'fail' },
+        { severity: 'medium', checkId: 'm1', status: 'fail' },
+        { severity: 'low', checkId: 'l1', status: 'fail' },
+      ],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 100,
+    });
+    // 8 + 4 + 2 + 1 = 15 hours x EUR 100 = EUR 1,500
+    expect(result.remediationCost).toBe(1500);
+  });
+
+  it('adds FRIA cost when not completed', () => {
+    const result = computeCostEstimate({
+      findings: [],
+      passportCompleteness: 100,
+      friaCompleted: false,
+      evidenceValid: true,
+      hourlyRate: 150,
+    });
+    expect(result.documentationCost).toBe(16 * 150); // FRIA: 16h
+  });
+
+  it('adds passport completion cost', () => {
+    const result = computeCostEstimate({
+      findings: [],
+      passportCompleteness: 50,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 150,
+    });
+    // 50% missing -> ceil(50/10)*2 = 10h x EUR 150 = EUR 1,500
+    expect(result.breakdown.some((b) => b.item === 'Passport completion')).toBe(
+      true,
+    );
+    const passportItem = result.breakdown.find(
+      (b) => b.item === 'Passport completion',
+    );
+    expect(passportItem?.effortHours).toBe(10);
+    expect(passportItem?.cost).toBe(1500);
+  });
+
+  it('adds evidence chain setup cost', () => {
+    const result = computeCostEstimate({
+      findings: [],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: false,
+      hourlyRate: 150,
+    });
+    expect(
+      result.breakdown.some((b) => b.item === 'Evidence chain setup'),
+    ).toBe(true);
+    expect(result.documentationCost).toBe(4 * 150);
+  });
+
+  it('skips pass findings', () => {
+    const result = computeCostEstimate({
+      findings: [{ severity: 'critical', checkId: 'c1', status: 'pass' }],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 150,
+    });
+    expect(result.remediationCost).toBe(0);
+  });
+
+  it('calculates ROI correctly', () => {
+    const result = computeCostEstimate({
+      findings: [{ severity: 'critical', checkId: 'c1', status: 'fail' }],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 100,
+    });
+    expect(result.totalCost).toBe(800); // 8h x EUR 100
+    expect(result.potentialFine).toBeGreaterThan(0);
+    expect(result.roi).toBeGreaterThan(0);
+  });
+
+  it('returns frozen result', () => {
+    const result = computeCostEstimate({
+      findings: [],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 150,
+    });
+    expect(Object.isFrozen(result)).toBe(true);
+  });
+
+  it('returns frozen breakdown array', () => {
+    const result = computeCostEstimate({
+      findings: [{ severity: 'high', checkId: 'h1', status: 'fail' }],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 100,
+    });
+    expect(Object.isFrozen(result.breakdown)).toBe(true);
+  });
+
+  it('uses default 2h for unknown severity', () => {
+    const result = computeCostEstimate({
+      findings: [
+        { severity: 'unknown-severity', checkId: 'x1', status: 'fail' },
+      ],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 100,
+    });
+    expect(result.remediationCost).toBe(200); // 2h x EUR 100
+  });
+
+  it('caps potential fine risk factor at 1.0', () => {
+    // 5 critical findings -> 5 * 0.3 = 1.5, capped at 1.0
+    const result = computeCostEstimate({
+      findings: Array.from({ length: 5 }, (_, i) => ({
+        severity: 'critical',
+        checkId: `c${i}`,
+        status: 'fail',
+      })),
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 100,
+    });
+    expect(result.potentialFine).toBe(35_000_000);
+  });
+
+  it('calculates combined costs with all gap types', () => {
+    const result = computeCostEstimate({
+      findings: [
+        { severity: 'critical', checkId: 'c1', status: 'fail' },
+        { severity: 'low', checkId: 'l1', status: 'fail' },
+      ],
+      passportCompleteness: 70,
+      friaCompleted: false,
+      evidenceValid: false,
+      hourlyRate: 200,
+    });
+    // Remediation: (8+1)*200 = 1800
+    expect(result.remediationCost).toBe(1800);
+    // Documentation: FRIA 16*200=3200, passport ceil(30/10)*2=6h*200=1200,
+    //   evidence 4*200=800 => 5200
+    expect(result.documentationCost).toBe(3200 + 1200 + 800);
+    expect(result.totalCost).toBe(1800 + 5200);
+  });
+
+  it('handles empty findings array gracefully', () => {
+    const result = computeCostEstimate({
+      findings: [],
+      passportCompleteness: 100,
+      friaCompleted: true,
+      evidenceValid: true,
+      hourlyRate: 0,
+    });
+    expect(result.totalCost).toBe(0);
+    expect(result.breakdown).toHaveLength(0);
+    expect(result.potentialFine).toBe(0);
+  });
+});

package/src/domain/cost/cost-estimator.ts

@@ -0,0 +1,133 @@
+/**
+ * US-S05-27: Compliance Cost Estimator
+ *
+ * Pure domain function that computes remediation costs, documentation costs,
+ * potential fines, and ROI based on scan findings and passport state.
+ *
+ * EU AI Act reference: Art. 99 (fines up to EUR 35M or 7% of global turnover).
+ */
+
+import type { SeverityLevel, ComplianceDocType } from '../shared/compliance-constants.js';
+
+export interface CostEstimateInput {
+  readonly findings: readonly { severity: string; checkId: string; status: string }[];
+  readonly passportCompleteness: number; // 0-100
+  readonly friaCompleted: boolean;
+  readonly evidenceValid: boolean;
+  readonly hourlyRate: number; // default EUR 150
+}
+
+export interface CostEstimateResult {
+  readonly remediationCost: number;
+  readonly documentationCost: number;
+  readonly totalCost: number;
+  readonly potentialFine: number;
+  readonly roi: number;
+  readonly breakdown: readonly CostLineItem[];
+  readonly currency: string;
+}
+
+export interface CostLineItem {
+  readonly category: string;
+  readonly item: string;
+  readonly effortHours: number;
+  readonly cost: number;
+}
+
+/** Estimated remediation hours per severity level. */
+const SEVERITY_HOURS: Record<SeverityLevel, number> = {
+  critical: 8,
+  high: 4,
+  medium: 2,
+  low: 1,
+};
+
+/** Estimated documentation effort hours per compliance doc type. */
+const DOC_HOURS: Record<ComplianceDocType, number> = {
+  fria: 16,
+  'technical-documentation': 8,
+  'worker-notification': 4,
+  'monitoring-policy': 4,
+  'ai-literacy': 4,
+  'declaration-of-conformity': 8,
+  'incident-report': 2,
+};
+
+/** EU AI Act max fine: EUR 35M or 7% of global turnover (Art. 99) */
+const MAX_FINE_EUR = 35_000_000;
+
+export const computeCostEstimate = (input: CostEstimateInput): CostEstimateResult => {
+  const { findings, passportCompleteness, friaCompleted, evidenceValid, hourlyRate } = input;
+  const breakdown: CostLineItem[] = [];
+
+  // 1. Remediation cost per finding (only failed checks)
+  const failFindings = findings.filter(f => f.status === 'fail');
+  for (const finding of failFindings) {
+    const hours = SEVERITY_HOURS[finding.severity] ?? 2;
+    breakdown.push({
+      category: 'remediation',
+      item: finding.checkId,
+      effortHours: hours,
+      cost: hours * hourlyRate,
+    });
+  }
+
+  // 2. Documentation cost — FRIA (Art. 27)
+  if (!friaCompleted) {
+    breakdown.push({
+      category: 'documentation',
+      item: 'FRIA (Art. 27)',
+      effortHours: DOC_HOURS['fria']!,
+      cost: DOC_HOURS['fria']! * hourlyRate,
+    });
+  }
+
+  // 3. Passport completion cost
+  if (passportCompleteness < 100) {
+    const missingPct = 100 - passportCompleteness;
+    const hours = Math.ceil(missingPct / 10) * 2; // ~2h per 10% missing
+    breakdown.push({
+      category: 'documentation',
+      item: 'Passport completion',
+      effortHours: hours,
+      cost: hours * hourlyRate,
+    });
+  }
+
+  // 4. Evidence chain setup
+  if (!evidenceValid) {
+    breakdown.push({
+      category: 'infrastructure',
+      item: 'Evidence chain setup',
+      effortHours: 4,
+      cost: 4 * hourlyRate,
+    });
+  }
+
+  const remediationCost = breakdown
+    .filter(b => b.category === 'remediation')
+    .reduce((sum, b) => sum + b.cost, 0);
+  const documentationCost = breakdown
+    .filter(b => b.category !== 'remediation')
+    .reduce((sum, b) => sum + b.cost, 0);
+  const totalCost = remediationCost + documentationCost;
+
+  // Potential fine estimate based on severity distribution
+  const criticalCount = failFindings.filter(f => f.severity === 'critical').length;
+  const highCount = failFindings.filter(f => f.severity === 'high').length;
+  const riskFactor = Math.min(1.0, (criticalCount * 0.3 + highCount * 0.1));
+  const potentialFine = Math.round(MAX_FINE_EUR * riskFactor);
+
+  // ROI as multiplier: how many times the compliance cost is recovered in avoided fines
+  const roi = totalCost > 0 ? Math.round((potentialFine / totalCost) * 10) / 10 : 0;
+
+  return Object.freeze({
+    remediationCost,
+    documentationCost,
+    totalCost,
+    potentialFine,
+    roi,
+    breakdown: Object.freeze(breakdown),
+    currency: 'EUR',
+  });
+};

package/src/domain/disclaimer.test.ts

@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest';
+import { getDisclaimer, appendDisclaimer, getReportFooter, containsBannedPhrase } from './disclaimer.js';
+import { ENGINE_VERSION } from '../version.js';
+
+describe('Disclaimer Framework', () => {
+  it('system prompt contains legal advisor warning', () => {
+    const disclaimer = getDisclaimer('system_prompt');
+    expect(disclaimer).toContain('not a legal advisor');
+    expect(disclaimer).toContain('NEVER');
+    expect(disclaimer).toContain('automated scanning');
+  });
+
+  it('report footer contains disclaimer', () => {
+    const footer = getDisclaimer('report_footer');
+    expect(footer).toContain('does NOT constitute legal advice');
+  });
+
+  it('compliance_md contains disclaimer', () => {
+    const md = getDisclaimer('compliance_md');
+    expect(md).toContain('NOT a legal certification');
+  });
+
+  it('commit message contains review warning', () => {
+    const msg = getDisclaimer('commit_message');
+    expect(msg).toContain('Review before merging');
+  });
+
+  it('appendDisclaimer adds footer', () => {
+    const result = appendDisclaimer('Report content', 'report_footer');
+    expect(result).toContain('Report content');
+    expect(result).toContain('does NOT constitute');
+  });
+
+  it('getReportFooter includes version and date', () => {
+    const footer = getReportFooter(ENGINE_VERSION);
+    expect(footer).toContain(`complior v${ENGINE_VERSION}`);
+    expect(footer).toMatch(/\d{4}-\d{2}-\d{2}/);
+  });
+});
+
+describe('Banned Phrases', () => {
+  it('detects banned phrases', () => {
+    expect(containsBannedPhrase('You are compliant')).toBe(true);
+    expect(containsBannedPhrase('Your project is compliant with EU AI Act')).toBe(true);
+    expect(containsBannedPhrase('I guarantee compliance')).toBe(true);
+  });
+
+  it('allows safe phrases', () => {
+    expect(containsBannedPhrase('Based on automated scanning: score 72/100')).toBe(false);
+    expect(containsBannedPhrase('Scanner detected 8 violations')).toBe(false);
+  });
+});

package/src/domain/disclaimer.ts

@@ -0,0 +1,39 @@
+export type DisclaimerContext = 'system_prompt' | 'report_footer' | 'compliance_md' | 'commit_message' | 'chat_response';
+
+const DISCLAIMERS: Record<DisclaimerContext, string> = {
+  system_prompt: 'You are Complior, a compliance ASSISTANT — not a legal advisor. You NEVER state that a project "is compliant" or "meets all requirements". You ALWAYS frame results as "based on automated scanning" and recommend professional legal review for definitive compliance assessment.',
+
+  report_footer: `---
+**Disclaimer:** This report was generated by Complior automated scanning tool. It does NOT constitute legal advice. For definitive compliance assessment, consult a qualified legal professional specializing in EU AI Act.`,
+
+  compliance_md: `## Disclaimer
+
+This compliance status is based on automated scanning by Complior. It is NOT a legal certification. Professional legal review is recommended before making compliance claims.`,
+
+  commit_message: 'Auto-generated by Complior. Review before merging. Automated fix — not legal advice.',
+
+  chat_response: 'Disclaimer: Complior — automated scanning tool, not a legal advisor. Professional review recommended.',
+};
+
+export const getDisclaimer = (context: DisclaimerContext): string => DISCLAIMERS[context];
+
+export const appendDisclaimer = (content: string, context: DisclaimerContext): string =>
+  `${content}\n\n${DISCLAIMERS[context]}`;
+
+export const getReportFooter = (version: string): string =>
+  `${DISCLAIMERS.report_footer}\nGenerated: ${new Date().toISOString().slice(0, 10)} | Scanner: complior v${version}`;
+
+// Banned phrases that LLM should never output
+export const BANNED_PHRASES = [
+  'you are compliant',
+  'your project is compliant',
+  'meets all requirements',
+  'fully compliant',
+  'no violations found', // when score < 100
+  'I guarantee compliance',
+] as const;
+
+export const containsBannedPhrase = (text: string): boolean => {
+  const lower = text.toLowerCase();
+  return BANNED_PHRASES.some((phrase) => lower.includes(phrase.toLowerCase()));
+};