@complior/engine 0.9.0

package/src/domain/fixer/strategies/metadata.ts

@@ -0,0 +1,45 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+import { ENGINE_VERSION } from '../../../version.js';
+
+export const metadataStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'compliance-metadata') return null;
+
+  const metadataPath = '.well-known/ai-compliance.json';
+  const content = JSON.stringify({
+    version: '1.0',
+    scanner: `complior/${ENGINE_VERSION}`,
+    scannedAt: '[SCAN_DATE]',
+    organization: '[PASSPORT:owner.team]',
+    ai_systems: [
+      {
+        name: '[PASSPORT:display_name]',
+        provider: '[PASSPORT:model.provider]',
+        risk_level: '[PASSPORT:risk_class]',
+        compliance_score: 0,
+      },
+    ],
+    jurisdiction: 'EU',
+    regulation: 'EU AI Act (Regulation (EU) 2024/1689)',
+  }, null, 2);
+
+  const action: FixAction = {
+    type: 'create',
+    path: metadataPath,
+    content,
+    description: 'Create machine-readable compliance metadata',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-021',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 50',
+    fixType: 'metadata_generation',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(metadataPath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add compliance metadata .well-known (Art. 50) -- via Complior',
+    description: 'Create machine-readable compliance metadata for programmatic verification',
+  };
+};

package/src/domain/fixer/strategies/permission-guard.ts

@@ -0,0 +1,84 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const permissionGuardStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l4-human-oversight') return null;
+
+  const filePath = 'src/middleware/human-approval-gate.ts';
+  const content = `// Human Approval Gate (EU AI Act, Art. 14)
+// Requires human approval for high-risk AI decisions
+
+export type RiskLevel = 'low' | 'medium' | 'high' | 'critical';
+
+export interface ApprovalRequest {
+  readonly id: string;
+  readonly action: string;
+  readonly riskLevel: RiskLevel;
+  readonly requestedAt: string;
+  readonly timeoutMs: number;
+}
+
+export interface ApprovalResult {
+  readonly approved: boolean;
+  readonly approvedBy?: string;
+  readonly approvedAt?: string;
+  readonly reason?: string;
+}
+
+const RISK_THRESHOLDS: Record<RiskLevel, boolean> = {
+  low: false,
+  medium: false,
+  high: true,
+  critical: true,
+};
+
+const pendingApprovals = new Map<string, ApprovalRequest>();
+
+export const requiresApproval = (riskLevel: RiskLevel): boolean =>
+  RISK_THRESHOLDS[riskLevel];
+
+export const requestApproval = (action: string, riskLevel: RiskLevel, timeoutMs = 300_000): ApprovalRequest => {
+  const request: ApprovalRequest = {
+    id: crypto.randomUUID(),
+    action,
+    riskLevel,
+    requestedAt: new Date().toISOString(),
+    timeoutMs,
+  };
+  pendingApprovals.set(request.id, request);
+  return request;
+};
+
+export const approveRequest = (id: string, approvedBy: string): ApprovalResult => {
+  const request = pendingApprovals.get(id);
+  if (!request) return { approved: false, reason: 'Request not found' };
+  pendingApprovals.delete(id);
+  return { approved: true, approvedBy, approvedAt: new Date().toISOString() };
+};
+
+export const rejectRequest = (id: string, reason: string): ApprovalResult => {
+  pendingApprovals.delete(id);
+  return { approved: false, reason };
+};
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create human approval gate for high-risk AI decisions',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-006',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 14',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add human approval gate (Art. 14) -- via Complior',
+    description: 'Add human-in-the-loop approval gate for high-risk AI decisions',
+  };
+};

package/src/domain/fixer/strategies/record-keeping.ts

@@ -0,0 +1,69 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const recordKeepingStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l4-record-keeping') return null;
+
+  const auditPath = 'src/compliance/audit-trail.ts';
+  const content = `// Audit Trail & Record Keeping (EU AI Act, Art. 12)
+// Persistent event logging for AI system compliance records
+
+export interface AuditTrailEntry {
+  readonly id: string;
+  readonly timestamp: string;
+  readonly eventType: 'decision' | 'input' | 'output' | 'error' | 'override';
+  readonly agentId: string;
+  readonly sessionId: string;
+  readonly payload: Record<string, unknown>;
+  readonly retentionDays: number;
+}
+
+const complianceRecord: AuditTrailEntry[] = [];
+
+/** Append an entry to the audit trail for compliance record keeping. */
+export const persistAudit = (entry: Omit<AuditTrailEntry, 'id' | 'timestamp'>): AuditTrailEntry => {
+  const full: AuditTrailEntry = {
+    ...entry,
+    id: crypto.randomUUID(),
+    timestamp: new Date().toISOString(),
+  };
+  complianceRecord.push(full);
+  return full;
+};
+
+/** Retrieve all audit trail entries (compliance records). */
+export const getAuditTrail = (): readonly AuditTrailEntry[] => [...complianceRecord];
+
+/** Apply log retention policy — remove entries older than retentionDays. */
+export const applyRetentionPolicy = (): number => {
+  const now = Date.now();
+  const before = complianceRecord.length;
+  const keep = complianceRecord.filter((e) => {
+    const age = (now - new Date(e.timestamp).getTime()) / (1000 * 60 * 60 * 24);
+    return age <= e.retentionDays;
+  });
+  complianceRecord.length = 0;
+  complianceRecord.push(...keep);
+  return before - complianceRecord.length;
+};
+`;
+  const action: FixAction = {
+    type: 'create',
+    path: auditPath,
+    content,
+    description: 'Create audit trail module for compliance record keeping',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-012',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 12',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(auditPath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add audit trail for record keeping (Art. 12) -- via Complior',
+    description: 'Add persistent audit trail for AI system compliance records',
+  };
+};

package/src/domain/fixer/strategies/secret-rotation.ts

@@ -0,0 +1,52 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+// --- Strategy: Secret Rotation (Art. 15.4) ---
+
+export const secretRotationStrategy: FixStrategy = (finding, context) => {
+  if (!finding.checkId.startsWith('l4-nhi-') || finding.checkId === 'l4-nhi-clean') return null;
+
+  // Extract secret type from checkId: l4-nhi-openai-key → OPENAI_API_KEY
+  const suffix = finding.checkId.replace('l4-nhi-', '').replace(/-/g, '_').toUpperCase();
+  const envVar = suffix.endsWith('_KEY') ? suffix : `${suffix}_KEY`;
+
+  const gitignoreContent = `# Secrets — never commit
+.env
+.env.*
+*.key
+*.pem
+*.p12
+`;
+
+  const envExampleContent = `# Replace with vault references or environment-specific values
+${envVar}=<replace-with-vault-reference>
+`;
+
+  const actions: FixAction[] = [
+    {
+      type: 'create',
+      path: '.gitignore',
+      content: gitignoreContent,
+      description: 'Add secret file patterns to .gitignore',
+    },
+    {
+      type: 'create',
+      path: '.env.example',
+      content: envExampleContent,
+      description: 'Create .env.example with placeholder secret references',
+    },
+  ];
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-008',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 15(4)',
+    fixType: 'config_fix',
+    framework: context.framework,
+    actions,
+    diff: generateCreateDiff('.gitignore', gitignoreContent) + '\n' + generateCreateDiff('.env.example', envExampleContent),
+    scoreImpact: 6,
+    commitMessage: `fix: add secret rotation scaffold for ${envVar} (Art. 15.4) -- via Complior`,
+    description: `Add .gitignore entries and .env.example for secret ${envVar}`,
+  };
+};

package/src/domain/fixer/strategies.test.ts

@@ -0,0 +1,341 @@
+import { describe, it, expect } from 'vitest';
+import type { Finding } from '../../types/common.types.js';
+import { findStrategy } from './strategies/index.js';
+import type { FixContext } from './types.js';
+
+// --- Helpers ---
+
+const makeContext = (overrides?: Partial<FixContext>): FixContext => ({
+  projectPath: '/test/project',
+  framework: 'generic',
+  existingFiles: [],
+  ...overrides,
+});
+
+const makeFinding = (overrides: Partial<Finding> & { checkId: string }): Finding => ({
+  type: 'fail',
+  message: 'Test finding',
+  severity: 'high',
+  ...overrides,
+});
+
+// --- Strategy tests ---
+
+describe('findStrategy', () => {
+  it('generates disclosure fix for ai-disclosure finding', () => {
+    const finding = makeFinding({
+      checkId: 'ai-disclosure',
+      obligationId: 'eu-ai-act-OBL-015',
+      articleReference: 'Art. 50(1)',
+    });
+
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.commitMessage).toContain('Art. 50.1');
+    expect(plan!.actions.length).toBeGreaterThan(0);
+    expect(plan!.diff).toBeTruthy();
+  });
+
+  it('generates React component for Next.js framework', () => {
+    const finding = makeFinding({ checkId: 'ai-disclosure' });
+    const plan = findStrategy(finding, makeContext({ framework: 'Next.js' }));
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].path).toContain('AIDisclosure.tsx');
+  });
+
+  it('generates middleware for Express framework', () => {
+    const finding = makeFinding({ checkId: 'ai-disclosure' });
+    const plan = findStrategy(finding, makeContext({ framework: 'Express' }));
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].path).toContain('middleware');
+  });
+
+  it('generates content marking fix', () => {
+    const finding = makeFinding({ checkId: 'content-marking' });
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('config_fix');
+    expect(plan!.actions[0].path).toContain('content-marking');
+  });
+
+  it('generates logging fix', () => {
+    const finding = makeFinding({ checkId: 'interaction-logging' });
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.actions[0].path).toContain('logger');
+  });
+
+  it('generates documentation fix from template map', () => {
+    const finding = makeFinding({
+      checkId: 'ai-literacy',
+      obligationId: 'eu-ai-act-OBL-001',
+    });
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('template_generation');
+    expect(plan!.actions[0].path).toContain('ai-literacy-policy.md');
+  });
+
+  it('generates metadata fix', () => {
+    const finding = makeFinding({ checkId: 'compliance-metadata' });
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('metadata_generation');
+    expect(plan!.actions[0].path).toContain('.well-known');
+  });
+
+  it('skips documentation fix when output file already exists', () => {
+    const finding = makeFinding({
+      checkId: 'ai-literacy',
+      obligationId: 'eu-ai-act-OBL-001',
+    });
+    const plan = findStrategy(finding, makeContext({
+      existingFiles: ['/test/docs/compliance/ai-literacy-policy.md'],
+    }));
+    expect(plan).toBeNull();
+  });
+
+  it('returns null for unknown checkId without obligationId', () => {
+    const finding = makeFinding({ checkId: 'unknown-check' });
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).toBeNull();
+  });
+});
+
+// --- New strategy tests (13 strategies + 2 variant tests) ---
+
+describe('new fix strategies', () => {
+  it('returns null for l4-bare-llm (info finding, no fix strategy)', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-bare-llm' }), makeContext());
+    expect(plan).toBeNull();
+  });
+
+  it('generates permission guard fix for l4-human-oversight', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-human-oversight' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(5);
+    expect(plan!.actions[0].path).toContain('human-approval-gate');
+  });
+
+  it('generates kill switch fix for l4-kill-switch', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-kill-switch' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(5);
+    expect(plan!.actions[0].path).toContain('kill-switch');
+  });
+
+  it('generates error handler fix for l4-security-risk', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-security-risk' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toContain('ai-error-handler');
+  });
+
+  it('generates HITL gate fix for l4-conformity-assessment', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-conformity-assessment' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(5);
+    expect(plan!.actions[0].path).toContain('conformity-checklist');
+  });
+
+  it('generates data governance fix for l4-data-governance', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-data-governance' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(5);
+    expect(plan!.actions[0].path).toContain('data-governance');
+  });
+
+  it('generates secret rotation fix for l4-nhi-openai-key', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-nhi-openai-key' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('config_fix');
+    expect(plan!.scoreImpact).toBe(6);
+    expect(plan!.actions).toHaveLength(2);
+    expect(plan!.actions[0].path).toBe('.gitignore');
+    expect(plan!.actions[1].path).toBe('.env.example');
+  });
+
+  it('skips secret rotation for l4-nhi-clean', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-nhi-clean' }), makeContext());
+    expect(plan).toBeNull();
+  });
+
+  it('generates bandit fix for ext-bandit-b301', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'ext-bandit-b301' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('template_generation');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toBe('complior-security-fixes.md');
+  });
+
+  it('generates CVE upgrade plan for l3-dep-vuln', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l3-dep-vuln', message: 'CVE-2024-1234 in lodash' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('dependency_fix');
+    expect(plan!.scoreImpact).toBe(5);
+    expect(plan!.actions[0].path).toBe('complior-upgrade-plan.md');
+  });
+
+  it('generates license fix for l3-dep-license', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l3-dep-license' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('dependency_fix');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toBe('complior-license-review.md');
+  });
+
+  it('generates CI compliance workflow for l3-ci-compliance', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l3-ci-compliance' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('config_fix');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toContain('compliance-check.yml');
+  });
+
+  it('generates bias testing config for l3-missing-bias-testing', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l3-missing-bias-testing' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('config_fix');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toBe('bias-testing.config.json');
+  });
+
+  it('generates doc-code sync report for cross-doc-code-mismatch', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'cross-doc-code-mismatch' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('template_generation');
+    expect(plan!.scoreImpact).toBe(5);
+    expect(plan!.actions[0].path).toBe('complior-doc-sync-report.md');
+  });
+});
+
+// FRIA fix via documentationStrategy (OBL-013 in template-registry)
+
+describe('FRIA template fix', () => {
+  const ctx = makeContext();
+
+  it('triggers on obligationId eu-ai-act-OBL-013', () => {
+    const finding = makeFinding({ checkId: 'fria', obligationId: 'eu-ai-act-OBL-013' });
+    const plan = findStrategy(finding, ctx);
+    expect(plan).not.toBeNull();
+    expect(plan!.article).toBe('Art. 27');
+    expect(plan!.fixType).toBe('template_generation');
+    expect(plan!.obligationId).toBe('eu-ai-act-OBL-013');
+  });
+
+  it('skips if output file already exists', () => {
+    const finding = makeFinding({ checkId: 'fria', obligationId: 'eu-ai-act-OBL-013' });
+    const ctxWithFria = makeContext({ existingFiles: ['docs/compliance/fria.md'] });
+    const plan = findStrategy(finding, ctxWithFria);
+    expect(plan).toBeNull();
+  });
+});
+
+describe('R2: kill-switch test strategy', () => {
+  it('generates test file for cross-kill-switch-no-test', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'cross-kill-switch-no-test' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toContain('kill-switch.test.ts');
+    expect(plan!.actions[0].type).toBe('create');
+  });
+
+  it('returns null for unrelated checkIds', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-kill-switch' }), makeContext());
+    // l4-kill-switch is handled by killSwitchStrategy, not killSwitchTestStrategy
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].path).not.toContain('kill-switch.test.ts');
+  });
+});
+
+describe('N2: log-retention strategy', () => {
+  it('generates docker-compose override for cross-logging-no-retention', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'cross-logging-no-retention' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('config_fix');
+    expect(plan!.scoreImpact).toBe(4);
+    expect(plan!.actions[0].path).toBe('docker-compose.override.yml');
+    expect(plan!.actions[0].content).toContain('max-size');
+    expect(plan!.actions[0].content).toContain('max-file');
+  });
+
+  it('returns null for unrelated checkIds', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-logging' }), makeContext());
+    expect(plan).not.toBeNull();
+    // l4-logging is handled by loggingStrategy, not logRetentionStrategy
+    expect(plan!.actions[0].path).not.toBe('docker-compose.override.yml');
+  });
+});
+
+describe('BUG-2b: L2 draft/reviewed with useAi', () => {
+  it('returns null for L2 reviewed docs without useAi', () => {
+    const finding = makeFinding({ checkId: 'l2-fria', obligationId: 'eu-ai-act-OBL-013', docQuality: 'reviewed' });
+    const plan = findStrategy(finding, makeContext());
+    expect(plan).toBeNull();
+  });
+
+  it('generates plan for L2 reviewed docs when useAi is true', () => {
+    const finding = makeFinding({ checkId: 'l2-fria', obligationId: 'eu-ai-act-OBL-013', docQuality: 'reviewed' });
+    const ctx = makeContext({ useAi: true });
+    const plan = findStrategy(finding, ctx);
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('ai_enrichment');
+  });
+
+  it('generates plan for L2 draft docs when useAi is true', () => {
+    const finding = makeFinding({ checkId: 'l2-fria', obligationId: 'eu-ai-act-OBL-013', docQuality: 'draft' });
+    const ctx = makeContext({ useAi: true });
+    const plan = findStrategy(finding, ctx);
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('ai_enrichment');
+  });
+
+  it('still returns template_generation for L1 findings with useAi', () => {
+    const finding = makeFinding({ checkId: 'fria', obligationId: 'eu-ai-act-OBL-013' });
+    const ctx = makeContext({ useAi: true });
+    const plan = findStrategy(finding, ctx);
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('template_generation');
+  });
+});
+
+describe('N5: L4 logging and record-keeping strategies', () => {
+  it('generates logging fix for l4-logging (not just interaction-logging)', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-logging' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.actions[0].path).toContain('logger');
+  });
+
+  it('logging scaffold includes L4-recognizable patterns (auditLog, logAiCall)', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-logging' }), makeContext());
+    expect(plan).not.toBeNull();
+    const content = plan!.actions[0].content ?? '';
+    expect(content).toContain('auditLog');
+    expect(content).toContain('logAiCall');
+    expect(content).toContain('aiLogger');
+  });
+
+  it('generates record-keeping fix for l4-record-keeping', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-record-keeping' }), makeContext());
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.actions[0].path).toContain('audit-trail');
+  });
+
+  it('record-keeping scaffold includes L4-recognizable patterns (persistAudit, complianceRecord)', () => {
+    const plan = findStrategy(makeFinding({ checkId: 'l4-record-keeping' }), makeContext());
+    expect(plan).not.toBeNull();
+    const content = plan!.actions[0].content ?? '';
+    expect(content).toContain('persistAudit');
+    expect(content).toContain('complianceRecord');
+  });
+});

package/src/domain/fixer/template-engine.test.ts

@@ -0,0 +1,64 @@
+import { describe, it, expect } from 'vitest';
+import { fillTemplate, getTemplateForObligation, getAvailableTemplates } from './template-engine.js';
+
+describe('fillTemplate', () => {
+  it('replaces [Company Name] placeholder', () => {
+    const template = 'Policy for [Company Name]';
+    const result = fillTemplate(template, { companyName: 'ACME Corp' });
+    expect(result).toBe('Policy for ACME Corp');
+  });
+
+  it('replaces multiple placeholders', () => {
+    const template = '[Company Name] — Version [X.Y] — [Date]';
+    const result = fillTemplate(template, {
+      companyName: 'TestCo',
+      version: '2.0',
+      date: '2026-01-15',
+    });
+    expect(result).toBe('TestCo — Version 2.0 — 2026-01-15');
+  });
+
+  it('uses defaults when no data provided', () => {
+    const template = 'Policy for [Company Name]';
+    const result = fillTemplate(template);
+    expect(result).toBe('Policy for [Company Name]');
+  });
+
+  it('replaces German placeholders', () => {
+    const template = 'Richtlinie für [Firmenname]';
+    const result = fillTemplate(template, { companyName: 'TestGmbH' });
+    expect(result).toBe('Richtlinie für TestGmbH');
+  });
+});
+
+describe('getTemplateForObligation', () => {
+  it('returns mapping for known obligation', () => {
+    const mapping = getTemplateForObligation('eu-ai-act-OBL-001');
+    expect(mapping).toBeDefined();
+    expect(mapping!.templateFile).toBe('ai-literacy.md');
+    expect(mapping!.article).toBe('Art. 4');
+  });
+
+  it('returns undefined for unknown obligation', () => {
+    const mapping = getTemplateForObligation('unknown-obl');
+    expect(mapping).toBeUndefined();
+  });
+});
+
+describe('getAvailableTemplates', () => {
+  it('returns all 14 templates', () => {
+    const templates = getAvailableTemplates();
+    expect(templates).toHaveLength(14);
+  });
+
+  it('each template has required fields', () => {
+    const templates = getAvailableTemplates();
+    for (const t of templates) {
+      expect(t.obligationId).toBeTruthy();
+      expect(t.article).toBeTruthy();
+      expect(t.templateFile).toBeTruthy();
+      expect(t.outputFile).toBeTruthy();
+      expect(t.description).toBeTruthy();
+    }
+  });
+});