@complior/engine 0.9.0

package/src/domain/scanner/checks/documentation.ts

@@ -0,0 +1,79 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+
+const CHECK_ID = 'documentation';
+const OBLIGATION_ID = 'eu-ai-act-OBL-019';
+
+const COMPLIANCE_DOC_PATTERNS: readonly RegExp[] = [
+  /^COMPLIANCE\.md$/i,
+  /^COMPLIANCE[-_]?DOCUMENTATION/i,
+  /^AI[-_]?COMPLIANCE/i,
+  /^EU[-_]?AI[-_]?ACT/i,
+];
+
+const COMPLIANCE_CONTENT_PATTERNS: readonly RegExp[] = [
+  /\bcompliance\b.*\bdocumentation\b/i,
+  /\beu ai act\b/i,
+  /\brisk assessment\b/i,
+  /\bcompliance report\b/i,
+  /\bregulatory compliance\b/i,
+  /\bai act\b.*\bcompliance\b/i,
+];
+
+const COMPLIOR_DIR = '.complior/';
+
+const isComplianceDocFile = (relativePath: string): boolean => {
+  const filename = relativePath.split('/').pop() ?? '';
+  return COMPLIANCE_DOC_PATTERNS.some((p) => p.test(filename));
+};
+
+const hasComplianceContent = (content: string): boolean =>
+  COMPLIANCE_CONTENT_PATTERNS.some((p) => p.test(content));
+
+export const checkDocumentation = (ctx: ScanContext): readonly CheckResult[] => {
+  for (const file of ctx.files) {
+    if (isComplianceDocFile(file.relativePath)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `Compliance documentation found: ${file.relativePath}`,
+      }];
+    }
+  }
+
+  const compliorFiles = ctx.files.filter((f) =>
+    f.relativePath.startsWith(COMPLIOR_DIR),
+  );
+
+  if (compliorFiles.length > 0) {
+    return [{
+      type: 'pass',
+      checkId: CHECK_ID,
+      message: `.complior/ directory found with compliance configuration`,
+    }];
+  }
+
+  const docsFiles = ctx.files.filter((f) =>
+    f.relativePath.startsWith('docs/') && f.extension === '.md',
+  );
+
+  for (const file of docsFiles) {
+    if (hasComplianceContent(file.content)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `Compliance content found in docs: ${file.relativePath}`,
+      }];
+    }
+  }
+
+  return [{
+    type: 'fail',
+    checkId: CHECK_ID,
+    message: 'No compliance documentation found',
+    severity: 'medium',
+    obligationId: OBLIGATION_ID,
+    articleReference: 'Art. 11',
+    fix: 'Create a COMPLIANCE.md or .complior/ directory documenting your AI Act compliance measures',
+  }];
+};

package/src/domain/scanner/checks/git-history.test.ts

@@ -0,0 +1,120 @@
+import { describe, it, expect } from 'vitest';
+import { gitHistoryToCheckResults } from './git-history.js';
+import type { GitHistoryResult } from './git-history.js';
+
+describe('gitHistoryToCheckResults', () => {
+  it('marks fresh documents as pass', () => {
+    const result: GitHistoryResult = {
+      fileHistories: [{
+        relativePath: 'docs/fria.md',
+        created: new Date(Date.now() - 30 * 86400000).toISOString(),
+        lastModified: new Date(Date.now() - 10 * 86400000).toISOString(),
+        commitCount: 5,
+        authors: ['Alice', 'Bob'],
+        daysSinceLastModified: 10,
+      }],
+      bulkCommits: [],
+    };
+
+    const checks = gitHistoryToCheckResults(result);
+    expect(checks.some((c) => c.type === 'pass' && c.checkId.includes('freshness'))).toBe(true);
+  });
+
+  it('warns about stale documents (>90 days)', () => {
+    const result: GitHistoryResult = {
+      fileHistories: [{
+        relativePath: 'docs/risk-management.md',
+        created: new Date(Date.now() - 200 * 86400000).toISOString(),
+        lastModified: new Date(Date.now() - 120 * 86400000).toISOString(),
+        commitCount: 2,
+        authors: ['Alice'],
+        daysSinceLastModified: 120,
+      }],
+      bulkCommits: [],
+    };
+
+    const checks = gitHistoryToCheckResults(result);
+    const stale = checks.find((c) => c.type === 'fail' && c.checkId.includes('freshness'));
+    expect(stale).toBeDefined();
+    expect(stale?.severity).toBe('low');
+  });
+
+  it('fails for very stale documents (>180 days)', () => {
+    const result: GitHistoryResult = {
+      fileHistories: [{
+        relativePath: 'docs/data-governance.md',
+        created: new Date(Date.now() - 365 * 86400000).toISOString(),
+        lastModified: new Date(Date.now() - 200 * 86400000).toISOString(),
+        commitCount: 1,
+        authors: ['Alice'],
+        daysSinceLastModified: 200,
+      }],
+      bulkCommits: [],
+    };
+
+    const checks = gitHistoryToCheckResults(result);
+    const stale = checks.find((c) => c.type === 'fail' && c.checkId.includes('freshness'));
+    expect(stale).toBeDefined();
+    expect(stale?.severity).toBe('medium');
+  });
+
+  it('warns about single-author risk documents', () => {
+    const result: GitHistoryResult = {
+      fileHistories: [{
+        relativePath: 'docs/fria.md',
+        created: new Date().toISOString(),
+        lastModified: new Date().toISOString(),
+        commitCount: 1,
+        authors: ['Alice'],
+        daysSinceLastModified: 5,
+      }],
+      bulkCommits: [],
+    };
+
+    const checks = gitHistoryToCheckResults(result);
+    const authorCheck = checks.find((c) => c.checkId.includes('author-diversity'));
+    expect(authorCheck).toBeDefined();
+    expect(authorCheck?.type).toBe('fail');
+  });
+
+  it('does not warn about single author for non-risk documents', () => {
+    const result: GitHistoryResult = {
+      fileHistories: [{
+        relativePath: 'docs/ai-literacy.md',
+        created: new Date().toISOString(),
+        lastModified: new Date().toISOString(),
+        commitCount: 1,
+        authors: ['Alice'],
+        daysSinceLastModified: 5,
+      }],
+      bulkCommits: [],
+    };
+
+    const checks = gitHistoryToCheckResults(result);
+    const authorCheck = checks.find((c) => c.checkId.includes('author-diversity'));
+    expect(authorCheck).toBeUndefined();
+  });
+
+  it('detects bulk compliance commits', () => {
+    const result: GitHistoryResult = {
+      fileHistories: [],
+      bulkCommits: [{
+        hash: 'abc1234567890',
+        docCount: 5,
+        date: '2026-03-01T10:00:00Z',
+      }],
+    };
+
+    const checks = gitHistoryToCheckResults(result);
+    const bulk = checks.find((c) => c.checkId === 'git-bulk-compliance');
+    expect(bulk).toBeDefined();
+    expect(bulk?.type).toBe('fail');
+    expect(bulk?.message).toContain('5 documents');
+  });
+
+  it('returns empty results for no histories', () => {
+    const result: GitHistoryResult = { fileHistories: [], bulkCommits: [] };
+    const checks = gitHistoryToCheckResults(result);
+    expect(checks).toEqual([]);
+  });
+});

package/src/domain/scanner/checks/git-history.ts

@@ -0,0 +1,163 @@
+import type { CheckResult } from '../../../types/common.types.js';
+
+export interface GitFileHistory {
+  readonly relativePath: string;
+  readonly created: string;        // ISO date of first commit
+  readonly lastModified: string;   // ISO date of last commit
+  readonly commitCount: number;
+  readonly authors: readonly string[];
+  readonly daysSinceLastModified: number;
+}
+
+export interface GitHistoryResult {
+  readonly fileHistories: readonly GitFileHistory[];
+  readonly bulkCommits: readonly { hash: string; docCount: number; date: string }[];
+}
+
+/** Port for git operations — keeps domain I/O-free (Clean Architecture). */
+export interface GitHistoryPort {
+  readonly isGitRepo: (projectPath: string) => boolean;
+  readonly listTrackedFiles: (projectPath: string) => readonly string[];
+  readonly getFileLog: (projectPath: string, filePath: string) => readonly { hash: string; date: string; author: string }[];
+}
+
+const COMPLIANCE_DOCS = [
+  'fria.md', 'risk-management.md', 'risk-assessment.md', 'data-governance.md',
+  'technical-documentation.md', 'tech-documentation.md', 'transparency-notice.md',
+  'human-oversight.md', 'incident-report.md', 'monitoring-plan.md', 'monitoring-policy.md',
+  'worker-notification.md', 'ai-literacy.md', 'art5-screening.md', 'model-card.md',
+  'declaration-of-conformity.md', 'declaration-conformity.md', 'qms.md',
+  'quality-management.md', 'instructions-for-use.md', 'data-quality.md',
+];
+
+const isComplianceDoc = (path: string): boolean => {
+  const filename = path.split('/').pop()?.toLowerCase() ?? '';
+  return COMPLIANCE_DOCS.some((doc) => filename === doc);
+};
+
+const daysBetween = (dateStr: string): number => {
+  const date = new Date(dateStr);
+  const now = new Date();
+  return Math.floor((now.getTime() - date.getTime()) / (1000 * 60 * 60 * 24));
+};
+
+/**
+ * Analyze git history for compliance documents.
+ * Pure domain function — receives git operations via port.
+ */
+export const analyzeGitHistory = (projectPath: string, git: GitHistoryPort): GitHistoryResult => {
+  if (!git.isGitRepo(projectPath)) {
+    return { fileHistories: [], bulkCommits: [] };
+  }
+
+  const trackedFiles = git.listTrackedFiles(projectPath);
+  const compliancePaths = trackedFiles.filter(isComplianceDoc);
+
+  const fileHistories: GitFileHistory[] = [];
+  const commitDocMap = new Map<string, { docs: string[]; date: string }>();
+
+  for (const filePath of compliancePaths) {
+    const commits = git.getFileLog(projectPath, filePath);
+    if (commits.length === 0) continue;
+
+    const authors = [...new Set(commits.map((c) => c.author))];
+    const lastModified = commits[0]?.date ?? '';
+    const created = commits[commits.length - 1]?.date ?? '';
+
+    fileHistories.push({
+      relativePath: filePath,
+      created,
+      lastModified,
+      commitCount: commits.length,
+      authors,
+      daysSinceLastModified: daysBetween(lastModified),
+    });
+
+    for (const commit of commits) {
+      const existing = commitDocMap.get(commit.hash);
+      if (existing) {
+        existing.docs.push(filePath);
+      } else {
+        commitDocMap.set(commit.hash, { docs: [filePath], date: commit.date });
+      }
+    }
+  }
+
+  const bulkCommits = [...commitDocMap.entries()]
+    .filter(([, v]) => v.docs.length > 3)
+    .map(([hash, v]) => ({ hash, docCount: v.docs.length, date: v.date }));
+
+  return { fileHistories, bulkCommits };
+};
+
+/**
+ * Convert git history analysis into scanner CheckResults.
+ */
+export const gitHistoryToCheckResults = (result: GitHistoryResult): readonly CheckResult[] => {
+  const checks: CheckResult[] = [];
+
+  for (const file of result.fileHistories) {
+    const docName = file.relativePath.split('/').pop() ?? file.relativePath;
+
+    // Freshness checks
+    if (file.daysSinceLastModified > 180) {
+      checks.push({
+        type: 'fail',
+        checkId: `git-freshness-${docName.replace(/\.md$/i, '')}`,
+        message: `${docName} not updated in ${file.daysSinceLastModified} days — may be outdated (Art. 9(2): "throughout the lifetime")`,
+        severity: 'medium',
+        obligationId: 'eu-ai-act-OBL-020',
+        articleReference: 'Art. 9(2)',
+        fix: `Review and update ${docName} — last modified ${file.lastModified.split('T')[0]}`,
+        file: file.relativePath,
+      });
+    } else if (file.daysSinceLastModified > 90) {
+      checks.push({
+        type: 'fail',
+        checkId: `git-freshness-${docName.replace(/\.md$/i, '')}`,
+        message: `${docName} not updated in ${file.daysSinceLastModified} days — consider reviewing`,
+        severity: 'low',
+        obligationId: 'eu-ai-act-OBL-020',
+        articleReference: 'Art. 9(2)',
+        fix: `Review ${docName} for accuracy — last modified ${file.lastModified.split('T')[0]}`,
+        file: file.relativePath,
+      });
+    } else {
+      checks.push({
+        type: 'pass',
+        checkId: `git-freshness-${docName.replace(/\.md$/i, '')}`,
+        message: `${docName} is fresh — last updated ${file.daysSinceLastModified}d ago (${file.commitCount} commits)`,
+      });
+    }
+
+    // Single-author warning for risk assessments and FRIAs
+    const isRiskDoc = /fria|risk/i.test(docName);
+    if (isRiskDoc && file.authors.length === 1) {
+      checks.push({
+        type: 'fail',
+        checkId: `git-author-diversity-${docName.replace(/\.md$/i, '')}`,
+        message: `${docName} has only 1 author (${file.authors[0]}) — multi-stakeholder review recommended`,
+        severity: 'info',
+        obligationId: 'eu-ai-act-OBL-013',
+        articleReference: 'Art. 27(1)',
+        fix: `Have additional stakeholders review and commit to ${docName}`,
+        file: file.relativePath,
+      });
+    }
+  }
+
+  // Bulk commit detection
+  for (const bulk of result.bulkCommits) {
+    checks.push({
+      type: 'fail',
+      checkId: 'git-bulk-compliance',
+      message: `Bulk compliance commit detected: ${bulk.docCount} documents in single commit ${bulk.hash.slice(0, 7)} (${bulk.date.split('T')[0]})`,
+      severity: 'low',
+      obligationId: 'eu-ai-act-OBL-020',
+      articleReference: 'Art. 9(2)',
+      fix: 'Compliance documents should be maintained incrementally, not created in bulk',
+    });
+  }
+
+  return checks;
+};

package/src/domain/scanner/checks/gpai-systemic-risk.test.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest';
+import { checkGpaiSystemicRisk } from './gpai-systemic-risk.js';
+import { createScanFile, createScanCtx } from '../../../test-helpers/factories.js';
+
+describe('checkGpaiSystemicRisk', () => {
+  it('returns skip when no GPAI indicators in codebase', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/app.ts', 'function main() { return "hello"; }'),
+      createScanFile('src/utils.ts', 'export const add = (a: number, b: number) => a + b;'),
+    ]);
+
+    const results = checkGpaiSystemicRisk(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('skip');
+  });
+
+  it('returns pass when dedicated systemic risk doc exists', () => {
+    const ctx = createScanCtx([
+      createScanFile('docs/GPAI-SYSTEMIC-RISK-ASSESSMENT.md', '# GPAI Systemic Risk Assessment\n\nContent here.'),
+      createScanFile('src/app.ts', 'function main() {}'),
+    ]);
+
+    const results = checkGpaiSystemicRisk(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].message).toContain('GPAI-SYSTEMIC-RISK-ASSESSMENT.md');
+  });
+
+  it('returns pass when md files contain systemic risk content', () => {
+    const ctx = createScanCtx([
+      createScanFile('docs/RISK-MANAGEMENT.md', '# Risk Management\n\nWe conduct adversarial testing on all model outputs.'),
+      createScanFile('src/app.ts', 'function main() {}'),
+    ]);
+
+    const results = checkGpaiSystemicRisk(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].message).toContain('systemic risk content found');
+  });
+
+  it('returns fail when code has LLM indicators without risk doc', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/model.ts', 'const model = "large language model"; // our provider uses LLM'),
+      createScanFile('docs/README.md', '# Project\n\nA simple tool.'),
+    ]);
+
+    const results = checkGpaiSystemicRisk(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    expect(results[0].severity).toBe('high');
+    expect(results[0].message).toContain('systemic risk indicators detected');
+  });
+
+  it('does NOT trigger on markdown docs describing the model', () => {
+    const ctx = createScanCtx([
+      createScanFile('docs/compliance/TECH-DOCUMENTATION.md',
+        '# Technical Documentation\n\n## General Description\nThis system uses a large language model provided by the vendor.\n\n## System Elements\nIntegration details.'),
+      createScanFile('src/app.ts', 'function main() { return "hello"; }'),
+    ]);
+
+    const results = checkGpaiSystemicRisk(ctx);
+
+    expect(results).toHaveLength(1);
+    // .md files excluded from indicator scan → no indicators in code → skip
+    expect(results[0].type).toBe('skip');
+  });
+
+  it('returns fail for FLOP threshold in code', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/config.ts', 'const COMPUTE_BUDGET = "10^25"; // FLOP threshold'),
+      createScanFile('docs/README.md', '# Project docs'),
+    ]);
+
+    const results = checkGpaiSystemicRisk(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    expect(results[0].severity).toBe('high');
+  });
+});

package/src/domain/scanner/checks/gpai-systemic-risk.ts

@@ -0,0 +1,98 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+
+const CHECK_ID = 'gpai-systemic-risk';
+const ARTICLE_REF = 'Art. 55';
+const OBLIGATION_ID = 'eu-ai-act-OBL-023';
+
+const DOC_PATTERNS: readonly RegExp[] = [
+  /^GPAI[-_]?SYSTEMIC[-_]?RISK/i,
+  /^SYSTEMIC[-_]?RISK[-_]?ASSESSMENT/i,
+  /^GPAI[-_]?RISK[-_]?ASSESSMENT/i,
+  /^MODEL[-_]?RISK[-_]?ASSESSMENT/i,
+];
+
+const CONTENT_PATTERNS: readonly RegExp[] = [
+  /\bsystemic risk\b/i,
+  /\badversarial testing\b/i,
+  /\bred teaming\b/i,
+  /\bincident monitoring\b.*\bgpai\b/i,
+  /\bgpai\b.*\bincident monitoring\b/i,
+  /\bmodel evaluation\b.*\bsafety\b/i,
+];
+
+/** Indicators that the project deals with GPAI models that may have systemic risk. */
+const SYSTEMIC_INDICATORS: readonly RegExp[] = [
+  /\b10\^25\b|\b1e25\b/i,                 // FLOP threshold (Art. 51)
+  /\bsystemic risk\b/i,
+  /\bfoundation model\b.*\blarge\b/i,
+  /\blarge language model\b/i,
+  /\bfrontier model\b/i,
+  /\bgeneral[-_ ]?purpose ai\b.*\bsystemic\b/i,
+];
+
+const isDocFile = (relativePath: string): boolean => {
+  const filename = relativePath.split('/').pop() ?? '';
+  return DOC_PATTERNS.some((p) => p.test(filename));
+};
+
+const hasContent = (content: string): boolean =>
+  CONTENT_PATTERNS.some((p) => p.test(content));
+
+const hasSystemicIndicators = (content: string): boolean =>
+  SYSTEMIC_INDICATORS.some((p) => p.test(content));
+
+export const checkGpaiSystemicRisk = (ctx: ScanContext): readonly CheckResult[] => {
+  // 1. Check for dedicated systemic risk doc file
+  for (const file of ctx.files) {
+    if (isDocFile(file.relativePath)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `GPAI systemic risk assessment found: ${file.relativePath} (${ARTICLE_REF})`,
+      }];
+    }
+  }
+
+  // 2. Check markdown files for systemic risk content
+  const docsFiles = ctx.files.filter((f) => f.extension === '.md');
+  for (const file of docsFiles) {
+    if (hasContent(file.content)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `GPAI systemic risk content found in: ${file.relativePath} (${ARTICLE_REF})`,
+      }];
+    }
+  }
+
+  // 3. Only flag if project has systemic risk indicators in code/config files.
+  // Compliance docs that merely describe a provider's model (e.g., "large language model")
+  // should not trigger systemic risk assessment requirements for deployers.
+  const codeFiles = ctx.files.filter((f) => f.extension !== '.md');
+  let indicatorsFound = false;
+  for (const file of codeFiles) {
+    if (hasSystemicIndicators(file.content)) {
+      indicatorsFound = true;
+      break;
+    }
+  }
+
+  if (indicatorsFound) {
+    return [{
+      type: 'fail',
+      checkId: CHECK_ID,
+      message: `GPAI systemic risk indicators detected without risk assessment (${ARTICLE_REF})`,
+      severity: 'high',
+      obligationId: OBLIGATION_ID,
+      articleReference: ARTICLE_REF,
+      fix: 'Create a GPAI-SYSTEMIC-RISK-ASSESSMENT.md with adversarial testing, incident monitoring, and cybersecurity measures',
+    }];
+  }
+
+  return [{
+    type: 'skip',
+    checkId: CHECK_ID,
+    reason: 'No GPAI systemic risk indicators detected',
+  }];
+};

package/src/domain/scanner/checks/gpai-transparency.ts

@@ -0,0 +1,94 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+
+const CHECK_ID = 'gpai-transparency';
+const ARTICLE_REF = 'Art. 51-53';
+const OBLIGATION_ID = 'eu-ai-act-OBL-022';
+
+const GPAI_DOC_PATTERNS: readonly RegExp[] = [
+  /^MODEL[-_]?CARD\.md$/i,
+  /^model[-_]?card\./i,
+  /^GPAI[-_]?DOCUMENTATION/i,
+  /^TRAINING[-_]?DATA[-_]?DOCUMENTATION/i,
+  /^MODEL[-_]?DOCUMENTATION/i,
+];
+
+const GPAI_CONTENT_PATTERNS: readonly RegExp[] = [
+  /\bmodel card\b/i,
+  /\btraining data\b.*\bdocumentation\b/i,
+  /\bgpai\b/i,
+  /\bgeneral[-_ ]?purpose ai\b/i,
+  /\bfoundation model\b/i,
+  /\bmodel transparency\b/i,
+];
+
+const GPAI_USAGE_PATTERNS: readonly RegExp[] = [
+  /\bfine[-_]?tun/i,
+  /\bmodel training\b/i,
+  /\btraining pipeline\b/i,
+  /\bmodel weights\b/i,
+  /\bpre[-_]?train/i,
+  /\btransformers\b/,
+  /\btorch\b/,
+  /\btensorflow\b/i,
+];
+
+const isGpaiDocFile = (relativePath: string): boolean => {
+  const filename = relativePath.split('/').pop() ?? '';
+  return GPAI_DOC_PATTERNS.some((p) => p.test(filename));
+};
+
+const hasGpaiContent = (content: string): boolean =>
+  GPAI_CONTENT_PATTERNS.some((p) => p.test(content));
+
+const hasGpaiUsage = (content: string): boolean =>
+  GPAI_USAGE_PATTERNS.some((p) => p.test(content));
+
+export const checkGpaiTransparency = (ctx: ScanContext): readonly CheckResult[] => {
+  for (const file of ctx.files) {
+    if (isGpaiDocFile(file.relativePath)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `GPAI documentation found: ${file.relativePath} (${ARTICLE_REF})`,
+      }];
+    }
+  }
+
+  const docsFiles = ctx.files.filter((f) => f.extension === '.md');
+  for (const file of docsFiles) {
+    if (hasGpaiContent(file.content)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `GPAI transparency content found in: ${file.relativePath} (${ARTICLE_REF})`,
+      }];
+    }
+  }
+
+  let gpaiUsageFound = false;
+  for (const file of ctx.files) {
+    if (hasGpaiUsage(file.content)) {
+      gpaiUsageFound = true;
+      break;
+    }
+  }
+
+  if (gpaiUsageFound) {
+    return [{
+      type: 'fail',
+      checkId: CHECK_ID,
+      message: `GPAI/model training code detected without transparency documentation (${ARTICLE_REF})`,
+      severity: 'high',
+      obligationId: OBLIGATION_ID,
+      articleReference: ARTICLE_REF,
+      fix: 'Create a MODEL_CARD.md with model capabilities, limitations, training data, and intended use',
+    }];
+  }
+
+  return [{
+    type: 'skip',
+    checkId: CHECK_ID,
+    reason: 'No GPAI/model training usage detected',
+  }];
+};

package/src/domain/scanner/checks/index.ts

@@ -0,0 +1,28 @@
+export { checkAiDisclosure } from './ai-disclosure.js';
+export { checkAiLiteracy } from './ai-literacy.js';
+export { checkBehavioralConstraints } from './behavioral-constraints.js';
+export { checkComplianceMetadata } from './compliance-metadata.js';
+export { checkContentMarking } from './content-marking.js';
+export { checkDocumentation } from './documentation.js';
+export { checkGpaiSystemicRisk } from './gpai-systemic-risk.js';
+export { checkGpaiTransparency } from './gpai-transparency.js';
+export { checkInteractionLogging } from './interaction-logging.js';
+export { checkPassportCompleteness } from './passport-completeness.js';
+export { checkPassportPresence } from './passport-presence.js';
+export { checkPermissions } from './permission-scanner.js';
+export { checkIndustryPatterns } from './industry/index.js';
+export { createPatternCheck } from './pattern-check-factory.js';
+export type { PatternCheckConfig } from './pattern-check-factory.js';
+export { createPresenceCheck, ALL_PRESENCE_CONFIGS } from './presence-check-factory.js';
+export { checkFriaPresence, checkArt5ScreeningPresence, checkTechnicalDocumentationPresence } from './presence-check-factory.js';
+export { checkIncidentReportPresence, checkDeclarationOfConformityPresence } from './presence-check-factory.js';
+export { checkMonitoringPolicyPresence, checkWorkerNotificationPresence } from './presence-check-factory.js';
+export { checkRiskManagementPresence, checkDataGovernancePresence } from './presence-check-factory.js';
+export { checkQmsPresence, checkInstructionsForUsePresence } from './presence-check-factory.js';
+export type { PresenceCheckConfig } from './presence-check-factory.js';
+export { runDepDeepScan, depScanToCheckResults } from './dep-deep-scan.js';
+export type { DepScanResult, KnownVulnerability } from './dep-deep-scan.js';
+export { analyzeGitHistory, gitHistoryToCheckResults } from './git-history.js';
+export type { GitFileHistory, GitHistoryPort, GitHistoryResult } from './git-history.js';
+export { runNhiScan, nhiToCheckResults } from './nhi-scanner.js';
+export type { NhiCheckResult } from './nhi-scanner.js';