@complior/engine 0.9.0

package/src/domain/fixer/strategies/disclosure.ts

@@ -0,0 +1,69 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const disclosureStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'ai-disclosure') return null;
+
+  const fw = context.framework.toLowerCase();
+
+  if (fw.includes('next') || fw.includes('react')) {
+    const componentPath = 'src/components/AIDisclosure.tsx';
+    const content = `export const AIDisclosure = () => (
+  <div role="status" aria-label="AI Disclosure" className="ai-disclosure">
+    <p>This service uses artificial intelligence. Responses are AI-generated and may contain errors.</p>
+  </div>
+);
+`;
+    const action: FixAction = {
+      type: 'create',
+      path: componentPath,
+      content,
+      description: 'Create AIDisclosure React component',
+    };
+    return {
+      obligationId: finding.obligationId ?? 'eu-ai-act-OBL-015',
+      checkId: finding.checkId,
+      article: finding.articleReference ?? 'Art. 50(1)',
+      fixType: 'code_injection',
+      framework: context.framework,
+      actions: [action],
+      diff: generateCreateDiff(componentPath, content),
+      scoreImpact: 7,
+      commitMessage: 'fix: add AI disclosure component (Art. 50.1) -- via Complior',
+      description: 'Add visible AI disclosure notice for users interacting with AI system',
+    };
+  }
+
+  // Express / Fastify / Hono / generic server
+  const middlewarePath = 'src/middleware/ai-disclosure.ts';
+  const content = `// AI Disclosure Middleware (EU AI Act, Art. 50.1)
+// Adds transparency headers to all AI-related responses
+
+export const aiDisclosureMiddleware = (req: unknown, res: { setHeader: (k: string, v: string) => void }, next: () => void) => {
+  res.setHeader('X-AI-Disclosure', 'This service uses artificial intelligence');
+  res.setHeader('X-AI-Provider', 'See /api/ai-disclosure for details');
+  next();
+};
+
+export const AI_DISCLOSURE_TEXT = 'This service uses artificial intelligence. Responses are AI-generated and may contain errors.';
+`;
+  const action: FixAction = {
+    type: 'create',
+    path: middlewarePath,
+    content,
+    description: 'Create AI disclosure middleware with transparency headers',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-015',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 50(1)',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(middlewarePath, content),
+    scoreImpact: 7,
+    commitMessage: 'fix: add AI disclosure middleware (Art. 50.1) -- via Complior',
+    description: 'Add AI disclosure middleware with transparency headers',
+  };
+};

package/src/domain/fixer/strategies/doc-code-sync.ts

@@ -0,0 +1,53 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+import { ENGINE_VERSION } from '../../../version.js';
+
+// --- Strategy: Doc-Code Sync (Art. 11) ---
+
+export const docCodeSyncStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'cross-doc-code-mismatch') return null;
+
+  const filePath = 'complior-doc-sync-report.md';
+  const content = `# Documentation-Code Sync Report
+
+Generated by Complior v${ENGINE_VERSION}
+
+## Mismatch Detected
+
+${finding.message || 'Documentation does not match the current codebase implementation.'}
+
+## Checklist
+
+- [ ] Review flagged documentation sections
+- [ ] Update technical documentation to match current implementation
+- [ ] Verify API documentation reflects actual endpoints and parameters
+- [ ] Check that architecture diagrams are up to date
+- [ ] Run \`complior scan\` to verify documentation coverage
+
+## Auto-generate Missing Docs
+
+\`\`\`bash
+complior docs generate --missing
+\`\`\`
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create documentation-code sync report',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-005',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 11',
+    fixType: 'template_generation',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add doc-code sync report (Art. 11) -- via Complior',
+    description: 'Create report documenting mismatches between code and documentation',
+  };
+};

package/src/domain/fixer/strategies/documentation.ts

@@ -0,0 +1,59 @@
+import type { FixStrategy, FixAction, TemplateMapping } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+import { TEMPLATE_REGISTRY } from '../../../data/template-registry.js';
+
+// --- Template mapping: derived from TEMPLATE_REGISTRY (single source of truth) ---
+
+const TEMPLATE_MAP: readonly TemplateMapping[] = TEMPLATE_REGISTRY.map((e) => ({
+  obligationId: e.obligationId,
+  article: e.article,
+  templateFile: e.templateFile,
+  outputFile: e.outputFile,
+  description: e.description,
+}));
+
+/** CheckIds for which the documentation strategy should generate template fixes. */
+const DOCUMENT_CHECK_IDS = new Set(
+  TEMPLATE_REGISTRY.map((e) => e.docType)
+    .concat(TEMPLATE_REGISTRY.map((e) => `l2-${e.docType}`))
+    .concat(['ai-literacy', 'l2-ai-literacy', 'gpai-transparency', 'gpai-systemic-risk']),
+);
+
+export const documentationStrategy: FixStrategy = (finding, context) => {
+  // Only generate documents for document-presence checks, not permission/pattern checks
+  if (!DOCUMENT_CHECK_IDS.has(finding.checkId)) return null;
+
+  const oblId = finding.obligationId;
+  if (!oblId) return null;
+
+  const mapping = TEMPLATE_MAP.find((m) => m.obligationId === oblId);
+  if (!mapping) return null;
+
+  // For L1 (presence) findings: skip if file already exists
+  // For L2 (structure/quality) findings: only fix scaffold/none — never overwrite draft/reviewed docs
+  const isL2 = finding.checkId.startsWith('l2-');
+  if (isL2 && !context.useAi && (finding.docQuality === 'draft' || finding.docQuality === 'reviewed')) return null;
+  if (!isL2 && context.existingFiles.some((f) => f.endsWith(mapping.outputFile))) return null;
+
+  const action: FixAction = {
+    type: 'create',
+    path: mapping.outputFile,
+    content: `[TEMPLATE:${mapping.templateFile}]`,
+    description: `Generate ${mapping.description} from template`,
+  };
+
+  return {
+    obligationId: oblId,
+    checkId: finding.checkId,
+    article: mapping.article,
+    fixType: isL2 && context.useAi ? 'ai_enrichment' : 'template_generation',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(mapping.outputFile, `# ${mapping.description}\n\n[Generated from template: ${mapping.templateFile}]`),
+    scoreImpact: 8,
+    commitMessage: `fix: generate ${mapping.description} (${mapping.article}) -- via Complior`,
+    description: `Generate ${mapping.description} from compliance template`,
+  };
+};
+
+export const getTemplateMap = (): readonly TemplateMapping[] => TEMPLATE_MAP;

package/src/domain/fixer/strategies/error-handler.ts

@@ -0,0 +1,63 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const errorHandlerStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l4-security-risk' && finding.checkId !== 'l4-ast-missing-error-handling') return null;
+
+  const filePath = 'src/middleware/ai-error-handler.ts';
+  const content = `// AI Error Handler (EU AI Act, Art. 15.4)
+// Compliance-aware error handling for AI operations
+
+export interface AIErrorLog {
+  readonly timestamp: string;
+  readonly operation: string;
+  readonly error: string;
+  readonly severity: 'low' | 'medium' | 'high' | 'critical';
+  readonly aiSystemId?: string;
+}
+
+const errorLog: AIErrorLog[] = [];
+
+export const withAIErrorHandling = async <T>(
+  operation: string,
+  fn: () => Promise<T>,
+  fallback: T,
+): Promise<T> => {
+  try {
+    return await fn();
+  } catch (err) {
+    const entry: AIErrorLog = {
+      timestamp: new Date().toISOString(),
+      operation,
+      error: err instanceof Error ? err.message : String(err),
+      severity: 'high',
+    };
+    errorLog.push(entry);
+    console.error(\`[AI-ERROR] \${operation}: \${entry.error}\`);
+    return fallback;
+  }
+};
+
+export const getErrorLog = (): readonly AIErrorLog[] => [...errorLog];
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create AI error handler with compliance logging',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-008',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 15(4)',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add AI error handler (Art. 15.4) -- via Complior',
+    description: 'Add compliance-aware error handling with incident logging',
+  };
+};

package/src/domain/fixer/strategies/hitl-gate.ts

@@ -0,0 +1,67 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+// --- Strategy: HITL Gate / Conformity Assessment (Art. 19) ---
+
+export const hitlGateStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l4-conformity-assessment') return null;
+
+  const filePath = 'src/compliance/conformity-checklist.ts';
+  const content = `// Conformity Assessment Checklist (EU AI Act, Art. 19)
+// Pre-deployment verification for high-risk AI systems
+
+export type ConformityStatus = 'pending' | 'passed' | 'failed' | 'waived';
+
+export interface ChecklistItem {
+  readonly id: string;
+  readonly category: string;
+  readonly requirement: string;
+  status: ConformityStatus;
+  signedOffBy?: string;
+  signedOffAt?: string;
+}
+
+export const CONFORMITY_CHECKLIST: ChecklistItem[] = [
+  { id: 'CA-01', category: 'Risk Assessment', requirement: 'Risk management system established (Art. 9)', status: 'pending' },
+  { id: 'CA-02', category: 'Data Governance', requirement: 'Training data quality verified (Art. 10)', status: 'pending' },
+  { id: 'CA-03', category: 'Documentation', requirement: 'Technical documentation complete (Art. 11)', status: 'pending' },
+  { id: 'CA-04', category: 'Logging', requirement: 'Automatic logging enabled (Art. 12)', status: 'pending' },
+  { id: 'CA-05', category: 'Transparency', requirement: 'User instructions provided (Art. 13)', status: 'pending' },
+  { id: 'CA-06', category: 'Human Oversight', requirement: 'Human oversight measures in place (Art. 14)', status: 'pending' },
+  { id: 'CA-07', category: 'Accuracy', requirement: 'Accuracy and robustness tested (Art. 15)', status: 'pending' },
+  { id: 'CA-08', category: 'Sign-off', requirement: 'Authorized representative sign-off', status: 'pending' },
+];
+
+export const signOff = (id: string, by: string): boolean => {
+  const item = CONFORMITY_CHECKLIST.find((c) => c.id === id);
+  if (!item) return false;
+  item.status = 'passed';
+  item.signedOffBy = by;
+  item.signedOffAt = new Date().toISOString();
+  return true;
+};
+
+export const isConformityComplete = (): boolean =>
+  CONFORMITY_CHECKLIST.every((c) => c.status === 'passed' || c.status === 'waived');
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create conformity assessment checklist for pre-deployment verification',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-011',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 19',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add conformity assessment checklist (Art. 19) -- via Complior',
+    description: 'Add pre-deployment conformity assessment checklist for high-risk AI systems',
+  };
+};

package/src/domain/fixer/strategies/index.ts

@@ -0,0 +1,61 @@
+/**
+ * Strategy registry — chain-of-responsibility pattern.
+ * Order matters: specific strategies first, documentationStrategy as catch-all last.
+ */
+import type { Finding } from '../../../types/common.types.js';
+import type { FixContext, FixPlan } from '../types.js';
+
+import { permissionGuardStrategy } from './permission-guard.js';
+import { killSwitchStrategy } from './kill-switch.js';
+import { killSwitchTestStrategy } from './kill-switch-test.js';
+import { errorHandlerStrategy } from './error-handler.js';
+import { hitlGateStrategy } from './hitl-gate.js';
+import { dataGovernanceStrategy } from './data-governance.js';
+import { secretRotationStrategy } from './secret-rotation.js';
+import { banditFixStrategy } from './bandit-fix.js';
+import { cveUpgradeStrategy } from './cve-upgrade.js';
+import { licenseFixStrategy } from './license-fix.js';
+import { ciComplianceStrategy } from './ci-compliance.js';
+import { biasTestingStrategy } from './bias-testing.js';
+import { docCodeSyncStrategy } from './doc-code-sync.js';
+import { disclosureStrategy } from './disclosure.js';
+import { contentMarkingStrategy } from './content-marking.js';
+import { loggingStrategy } from './logging.js';
+import { metadataStrategy } from './metadata.js';
+import { recordKeepingStrategy } from './record-keeping.js';
+import { logRetentionStrategy } from './log-retention.js';
+import { documentationStrategy, getTemplateMap } from './documentation.js';
+
+// NOTE: friaStrategy removed — documentationStrategy handles OBL-013 via template-registry
+const STRATEGIES = [
+  permissionGuardStrategy,
+  killSwitchStrategy,
+  killSwitchTestStrategy,
+  errorHandlerStrategy,
+  hitlGateStrategy,
+  dataGovernanceStrategy,
+  secretRotationStrategy,
+  banditFixStrategy,
+  cveUpgradeStrategy,
+  licenseFixStrategy,
+  ciComplianceStrategy,
+  biasTestingStrategy,
+  docCodeSyncStrategy,
+  disclosureStrategy,
+  contentMarkingStrategy,
+  loggingStrategy,
+  recordKeepingStrategy,
+  logRetentionStrategy,
+  metadataStrategy,
+  documentationStrategy,    // catch-all for obligation-based template fixes (incl. FRIA)
+] as const;
+
+export const findStrategy = (finding: Finding, context: FixContext): FixPlan | null => {
+  for (const strategy of STRATEGIES) {
+    const plan = strategy(finding, context);
+    if (plan !== null) return plan;
+  }
+  return null;
+};
+
+export { getTemplateMap };

package/src/domain/fixer/strategies/kill-switch-test.ts

@@ -0,0 +1,85 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const killSwitchTestStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'cross-kill-switch-no-test') return null;
+
+  const testPath = 'src/safety/kill-switch.test.ts';
+  const content = `// Kill Switch Tests (EU AI Act, Art. 14)
+// Verifies emergency shutdown capability for AI system
+import { describe, it, expect, afterEach } from 'vitest';
+import { isAiEnabled, emergencyShutdown, restoreService, withKillSwitch } from './kill-switch';
+
+const ENV_KEY = 'AI_KILL_SWITCH';
+
+describe('Kill Switch (Art. 14)', () => {
+  afterEach(() => {
+    delete process.env[ENV_KEY];
+  });
+
+  describe('isAiEnabled', () => {
+    it('returns true when env var is not set', () => {
+      expect(isAiEnabled()).toBe(true);
+    });
+
+    it('returns false when env var is "1"', () => {
+      process.env[ENV_KEY] = '1';
+      expect(isAiEnabled()).toBe(false);
+    });
+
+    it('returns false when env var is "true"', () => {
+      process.env[ENV_KEY] = 'true';
+      expect(isAiEnabled()).toBe(false);
+    });
+  });
+
+  describe('emergencyShutdown', () => {
+    it('disables AI system', () => {
+      emergencyShutdown('safety concern');
+      expect(isAiEnabled()).toBe(false);
+    });
+  });
+
+  describe('restoreService', () => {
+    it('re-enables AI system after shutdown', () => {
+      emergencyShutdown('test');
+      restoreService();
+      expect(isAiEnabled()).toBe(true);
+    });
+  });
+
+  describe('withKillSwitch', () => {
+    it('executes fn when AI is enabled', () => {
+      const result = withKillSwitch(() => 42, 0);
+      expect(result).toBe(42);
+    });
+
+    it('returns fallback when AI is disabled', () => {
+      emergencyShutdown('test');
+      const result = withKillSwitch(() => 42, 0);
+      expect(result).toBe(0);
+    });
+  });
+});
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: testPath,
+    content,
+    description: 'Create kill-switch test suite for safety verification',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-010',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 14',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(testPath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add kill-switch tests (Art. 14) -- via Complior',
+    description: 'Add automated tests for AI kill switch safety mechanism',
+  };
+};

package/src/domain/fixer/strategies/kill-switch.ts

@@ -0,0 +1,53 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const killSwitchStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l4-kill-switch') return null;
+
+  const filePath = 'src/safety/kill-switch.ts';
+  const content = `// AI Kill Switch (EU AI Act, Art. 14.4)
+// Emergency shutdown capability for AI system
+
+const AI_KILL_SWITCH_ENV = 'AI_KILL_SWITCH';
+
+export const isAiEnabled = (): boolean => {
+  const val = process.env[AI_KILL_SWITCH_ENV];
+  return val !== '1' && val !== 'true';
+};
+
+export const emergencyShutdown = (reason: string): void => {
+  process.env[AI_KILL_SWITCH_ENV] = '1';
+  console.error(\`[KILL-SWITCH] AI system disabled: \${reason}\`);
+};
+
+export const restoreService = (): void => {
+  delete process.env[AI_KILL_SWITCH_ENV];
+  console.info('[KILL-SWITCH] AI system re-enabled');
+};
+
+export const withKillSwitch = <T>(fn: () => T, fallback: T): T => {
+  if (!isAiEnabled()) return fallback;
+  return fn();
+};
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create AI kill switch for emergency shutdown',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-006',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 14(4)',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add AI kill switch (Art. 14.4) -- via Complior',
+    description: 'Add emergency kill switch to disable AI system immediately',
+  };
+};

package/src/domain/fixer/strategies/license-fix.ts

@@ -0,0 +1,57 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+import { ENGINE_VERSION } from '../../../version.js';
+
+// --- Strategy: License Fix (Art. 5) ---
+
+export const licenseFixStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l3-dep-license') return null;
+
+  const filePath = 'complior-license-review.md';
+  const content = `# License Compliance Review
+
+Generated by Complior v${ENGINE_VERSION}
+
+## Issue
+
+${finding.message || 'Dependency with incompatible or problematic license detected.'}
+
+## License Compatibility Matrix
+
+| License | Commercial Use | Modification | Distribution | Patent Grant |
+|---------|---------------|-------------|-------------|-------------|
+| MIT     | Yes           | Yes         | Yes         | No          |
+| Apache-2.0 | Yes       | Yes         | Yes         | Yes         |
+| GPL-3.0 | Copyleft      | Copyleft    | Copyleft    | Yes         |
+| AGPL-3.0 | Copyleft     | Copyleft    | Copyleft (network) | Yes  |
+| SSPL    | Restricted    | Copyleft    | Copyleft    | No          |
+
+## Action Items
+
+- [ ] Identify the problematic dependency and its license
+- [ ] Search for an alternative package with a compatible license
+- [ ] Run \`npx license-checker\` or \`pip-licenses\` for a full audit
+- [ ] Update dependency and verify license compatibility
+- [ ] Document license decision in compliance records
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create license compliance review document',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-002',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 5',
+    fixType: 'dependency_fix',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add license compliance review (Art. 5) -- via Complior',
+    description: 'Create license review document for dependency with problematic license',
+  };
+};

package/src/domain/fixer/strategies/log-retention.ts

@@ -0,0 +1,40 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const logRetentionStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'cross-logging-no-retention') return null;
+
+  const composePath = 'docker-compose.override.yml';
+  const content = `# Docker Compose Override — Log Retention (EU AI Act, Art. 12)
+# Generated by Complior: ensures container logs are retained >= 180 days.
+# Merge with your main docker-compose.yml via "docker compose up".
+
+services:
+  app:
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "60"
+        tag: "{{.Name}}/{{.ID}}"
+`;
+  const action: FixAction = {
+    type: 'create',
+    path: composePath,
+    content,
+    description: 'Create docker-compose.override.yml with log retention config',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-006',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 12',
+    fixType: 'config_fix',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(composePath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add docker-compose log retention override (Art. 12) -- via Complior',
+    description: 'Add docker-compose.override.yml with logging retention config for Art. 12 compliance',
+  };
+};

package/src/domain/fixer/strategies/logging.ts

@@ -0,0 +1,59 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const loggingStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'interaction-logging' && finding.checkId !== 'l4-logging') return null;
+
+  const loggerPath = 'src/logging/ai-interaction-logger.ts';
+  const content = `// AI Interaction Logger (EU AI Act, Art. 12)
+// Automatic logging of AI system interactions for traceability
+
+export interface AIInteractionLog {
+  readonly timestamp: string;
+  readonly sessionId: string;
+  readonly inputHash: string;
+  readonly outputHash: string;
+  readonly model: string;
+  readonly provider: string;
+  readonly durationMs: number;
+  readonly tokensUsed?: number;
+}
+
+const auditLog: AIInteractionLog[] = [];
+
+/** Log an AI interaction for compliance traceability (Art. 12). */
+export const logAiCall = (entry: Omit<AIInteractionLog, 'timestamp'>): void => {
+  auditLog.push({ ...entry, timestamp: new Date().toISOString() });
+};
+
+export const aiLogger = {
+  log: logAiCall,
+  getAll: (): readonly AIInteractionLog[] => [...auditLog],
+  clear: (): void => { auditLog.length = 0; },
+};
+
+// Legacy aliases
+export const logInteraction = logAiCall;
+export const getInteractionLogs = aiLogger.getAll;
+export const clearLogs = aiLogger.clear;
+`;
+  const action: FixAction = {
+    type: 'create',
+    path: loggerPath,
+    content,
+    description: 'Create AI interaction logger for traceability',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-007',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 12',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(loggerPath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add AI interaction logger (Art. 12) -- via Complior',
+    description: 'Add automatic logging of AI system interactions for traceability',
+  };
+};