@complior/engine 0.9.0

package/src/domain/scanner/checks/nhi-scanner.test.ts

@@ -0,0 +1,158 @@
+import { describe, it, expect } from 'vitest';
+import { runNhiScan, nhiToCheckResults } from './nhi-scanner.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+
+const makeCtx = (files: { relativePath: string; content: string }[]): ScanContext => ({
+  projectPath: '/test',
+  files: files.map(f => ({
+    path: `/test/${f.relativePath}`,
+    relativePath: f.relativePath,
+    content: f.content,
+    extension: f.relativePath.split('.').pop() ?? '',
+  })),
+});
+
+describe('runNhiScan', () => {
+  it('detects OpenAI key in source', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/config.ts',
+      content: 'const key = "sk-abcdefghijklmnopqrstuvwxyz123456";',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(1);
+    expect(results[0].category).toBe('api_key');
+    expect(results[0].file).toBe('src/config.ts');
+    expect(results[0].line).toBe(1);
+  });
+
+  it('detects multiple secrets in same file', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/config.ts',
+      content: 'const openai = "sk-abcdefghijklmnopqrstuvwxyz123456";\nconst aws = "AKIAIOSFODNN7EXAMPLE";',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(2);
+  });
+
+  it('skips test files', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/config.test.ts',
+      content: 'const key = "sk-abcdefghijklmnopqrstuvwxyz123456";',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(0);
+  });
+
+  it('skips .env.example files', () => {
+    const ctx = makeCtx([{
+      relativePath: '.env.example',
+      content: 'OPENAI_KEY=sk-abcdefghijklmnopqrstuvwxyz123456',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(0);
+  });
+
+  it('detects private key', () => {
+    const ctx = makeCtx([{
+      relativePath: 'certs/key.pem',
+      content: '-----BEGIN RSA PRIVATE KEY-----\nMIIBogIBAAJBALRiMLAH...',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(1);
+    expect(results[0].category).toBe('secret');
+  });
+
+  it('detects GCP service account', () => {
+    const ctx = makeCtx([{
+      relativePath: 'gcp-creds.json',
+      content: '{\n"type": "service_account",\n"project_id": "test"\n}',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(1);
+    expect(results[0].category).toBe('service_account');
+  });
+
+  it('detects JWT token', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/auth.ts',
+      content: 'const token = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc123def456";',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(1);
+    expect(results[0].category).toBe('token');
+  });
+
+  it('masks detected secrets', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/config.ts',
+      content: 'const key = "sk-abcdefghijklmnopqrstuvwxyz123456";',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results[0].match).not.toContain('abcdefghijklmnopqrstuvwxyz');
+    expect(results[0].match).toMatch(/^sk-a\.\.\.3456$/);
+  });
+
+  it('returns empty for clean codebase', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/app.ts',
+      content: 'const app = express();\napp.listen(3000);',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(0);
+  });
+
+  it('detects connection strings', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/db.ts',
+      content: 'const url = "mongodb://admin:secretpass@cluster.mongodb.net/db";',
+    }]);
+    const results = runNhiScan(ctx);
+    expect(results.length).toBe(1);
+    expect(results[0].category).toBe('secret');
+  });
+});
+
+describe('nhiToCheckResults', () => {
+  it('returns pass when no findings', () => {
+    const results = nhiToCheckResults([]);
+    expect(results.length).toBe(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].checkId).toBe('l4-nhi-clean');
+  });
+
+  it('converts findings to fail check results', () => {
+    const findings = [{
+      patternId: 'nhi-openai-key',
+      patternName: 'OpenAI API Key',
+      category: 'api_key' as const,
+      severity: 'critical' as const,
+      file: 'src/config.ts',
+      line: 5,
+      match: 'sk-a...3456',
+      description: 'OpenAI API key detected',
+    }];
+    const results = nhiToCheckResults(findings);
+    expect(results.length).toBe(1);
+    expect(results[0].type).toBe('fail');
+    expect(results[0].checkId).toBe('l4-nhi-api_key');
+    if (results[0].type === 'fail') {
+      expect(results[0].severity).toBe('critical');
+      expect(results[0].articleReference).toBe('Art. 15(4)');
+      expect(results[0].file).toBe('src/config.ts');
+      expect(results[0].line).toBe(5);
+    }
+  });
+
+  it('maps severity correctly', () => {
+    const makeFinding = (severity: 'critical' | 'high' | 'medium') => [{
+      patternId: 'test', patternName: 'Test', category: 'secret' as const,
+      severity, file: 'f.ts', line: 1, match: '***', description: 'test',
+    }];
+    const critical = nhiToCheckResults(makeFinding('critical'));
+    if (critical[0].type === 'fail') expect(critical[0].severity).toBe('critical');
+    const high = nhiToCheckResults(makeFinding('high'));
+    if (high[0].type === 'fail') expect(high[0].severity).toBe('high');
+    const medium = nhiToCheckResults(makeFinding('medium'));
+    if (medium[0].type === 'fail') expect(medium[0].severity).toBe('medium');
+  });
+});

package/src/domain/scanner/checks/nhi-scanner.ts

@@ -0,0 +1,78 @@
+import type { CheckResult, Severity } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+import { NHI_PATTERNS, shouldScanFile, type NhiCategory, type NhiPattern } from '../rules/nhi-patterns.js';
+
+export interface NhiCheckResult {
+  readonly patternId: string;
+  readonly patternName: string;
+  readonly category: NhiCategory;
+  readonly severity: 'critical' | 'high' | 'medium';
+  readonly file: string;
+  readonly line: number;
+  readonly match: string;
+  readonly description: string;
+}
+
+const scanLine = (line: string, lineNum: number, file: string, pattern: NhiPattern): NhiCheckResult | null => {
+  const match = pattern.pattern.exec(line);
+  if (!match) return null;
+  // Mask the matched value for security (show first 4 + last 4 chars)
+  const val = match[0];
+  const masked = val.length > 12
+    ? `${val.slice(0, 4)}...${val.slice(-4)}`
+    : '***';
+  return {
+    patternId: pattern.id,
+    patternName: pattern.name,
+    category: pattern.category,
+    severity: pattern.severity,
+    file,
+    line: lineNum,
+    match: masked,
+    description: pattern.description,
+  };
+};
+
+export const runNhiScan = (ctx: ScanContext): readonly NhiCheckResult[] => {
+  const results: NhiCheckResult[] = [];
+
+  for (const file of ctx.files) {
+    if (!shouldScanFile(file.relativePath)) continue;
+
+    const lines = file.content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const pattern of NHI_PATTERNS) {
+        const result = scanLine(line, i + 1, file.relativePath, pattern);
+        if (result) results.push(result);
+      }
+    }
+  }
+
+  return results;
+};
+
+const toSeverity = (s: string): Severity =>
+  (s === 'critical' || s === 'high' || s === 'medium') ? s : 'high';
+
+export const nhiToCheckResults = (results: readonly NhiCheckResult[]): readonly CheckResult[] => {
+  if (results.length === 0) {
+    return [{
+      type: 'pass',
+      checkId: 'l4-nhi-clean',
+      message: 'No non-human identity secrets detected in source code',
+    }];
+  }
+
+  return results.map((r): CheckResult => ({
+    type: 'fail',
+    checkId: `l4-nhi-${r.category}`,
+    message: `${r.description}: ${r.match} in ${r.file}:${r.line}`,
+    severity: toSeverity(r.severity),
+    obligationId: 'eu-ai-act-OBL-015',
+    articleReference: 'Art. 15(4)',
+    fix: 'Remove or externalize the secret from source code. Use environment variables or a secrets manager.',
+    file: r.file,
+    line: r.line,
+  }));
+};

package/src/domain/scanner/checks/passport-completeness.test.ts

@@ -0,0 +1,127 @@
+import { describe, it, expect } from 'vitest';
+import { checkPassportCompleteness } from './passport-completeness.js';
+import { createScanFile, createScanCtx } from '../../../test-helpers/factories.js';
+
+// All 27 required deep-path fields from OBLIGATION_FIELD_MAP must be present and non-empty.
+const fullManifest = JSON.stringify({
+  agent_id: 'uuid-123',
+  name: 'test-bot',
+  display_name: 'Test Bot',
+  version: '1.0.0',
+  description: 'A test bot',
+  type: 'assistant',
+  autonomy_level: 'L2',
+  autonomy_evidence: { human_approval_gates: 1, unsupervised_actions: 0, no_logging_actions: 0, auto_rated: true },
+  framework: 'openai',
+  model: { provider: 'openai', model_id: 'gpt-4', data_residency: 'us' },
+  owner: { team: 'eng', contact: 'eng@co.com', responsible_person: 'Jane' },
+  permissions: { tools: ['search'], denied: [] },
+  constraints: { human_approval_required: ['deploy'], prohibited_actions: ['social_scoring'] },
+  compliance: { eu_ai_act: { risk_class: 'limited' }, complior_score: 80, last_scan: '2026-03-01' },
+  disclosure: { user_facing: true, disclosure_text: 'AI system', ai_marking: { responses_marked: true, method: 'badge' } },
+  logging: { actions_logged: true, retention_days: 180 },
+  lifecycle: { status: 'active', next_review: '2026-06-01', review_frequency_days: 90 },
+  signature: { algorithm: 'ed25519', value: 'abc' },
+  source: { mode: 'auto', confidence: 0.9 },
+});
+
+describe('checkPassportCompleteness', () => {
+  it('passes for fully complete passport', () => {
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/test-bot-manifest.json', fullManifest),
+    ]);
+
+    const results = checkPassportCompleteness(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].message).toContain('100%');
+  });
+
+  it('fails for partially complete passport', () => {
+    const partial = JSON.stringify({
+      name: 'test-bot',
+      version: '1.0.0',
+      description: 'A test bot',
+      compliance: { eu_ai_act: { risk_class: 'limited' } },
+    });
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/test-bot-manifest.json', partial),
+    ]);
+
+    const results = checkPassportCompleteness(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    if (results[0].type === 'fail') {
+      expect(results[0].message).toMatch(/\d+%/);
+    }
+  });
+
+  it('fails with high severity for mostly empty passport', () => {
+    const minimal = JSON.stringify({
+      name: 'test-bot',
+      compliance: { eu_ai_act: { risk_class: 'high' } },
+    });
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/test-bot-manifest.json', minimal),
+    ]);
+
+    const results = checkPassportCompleteness(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    if (results[0].type === 'fail') {
+      expect(results[0].severity).toBe('high');
+    }
+  });
+
+  it('checks deep paths — empty owner object counts as unfilled', () => {
+    const emptyNested = JSON.stringify({
+      name: 'test-bot',
+      version: '1.0.0',
+      description: 'A test bot',
+      agent_id: 'uuid-123',
+      type: 'assistant',
+      framework: 'openai',
+      autonomy_level: 'L2',
+      model: {},           // empty — deep path model.provider not filled
+      owner: {},           // empty — deep path owner.team not filled
+      permissions: {},     // empty — deep path permissions.tools not filled
+      constraints: [],     // empty array
+      compliance: { eu_ai_act: { risk_class: 'limited' } },
+    });
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/test-bot-manifest.json', emptyNested),
+    ]);
+
+    const results = checkPassportCompleteness(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    // Deep-path checking: owner.team/contact/responsible_person, model.provider/model_id all empty
+    expect(results[0].message).toMatch(/\d+\/\d+ fields/);
+  });
+
+  it('requires oversight fields for high-risk passports', () => {
+    // A high-risk passport without oversight should have more missing fields
+    const highRiskNoOversight = JSON.stringify({
+      ...JSON.parse(fullManifest),
+      compliance: { eu_ai_act: { risk_class: 'high' }, complior_score: 80, last_scan: '2026-03-01' },
+    });
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/test-bot-manifest.json', highRiskNoOversight),
+    ]);
+
+    const results = checkPassportCompleteness(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    // Missing oversight.responsible_person and oversight.override_mechanism
+    expect(results[0].message).toMatch(/\d+\/\d+ fields/);
+  });
+
+  it('returns empty for no manifest files', () => {
+    const ctx = createScanCtx([
+      createScanFile('package.json', '{"dependencies":{"openai":"^4.0.0"}}'),
+    ]);
+
+    const results = checkPassportCompleteness(ctx);
+    expect(results).toHaveLength(0);
+  });
+});

package/src/domain/scanner/checks/passport-completeness.ts

@@ -0,0 +1,82 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+import { filterPassportManifests, extractRiskClass } from '../../passport/builder/manifest-files.js';
+import { OBLIGATION_FIELD_MAP, getFieldValue, isNonEmpty } from '../../passport/obligation-field-map.js';
+
+const CHECK_ID = 'passport-completeness';
+const ARTICLE_REF = 'Art. 26(4)';
+const OBLIGATION_ID = 'eu-ai-act-OBL-011';
+
+/** Deep-path fields required for all risk levels. */
+const BASE_FIELDS = OBLIGATION_FIELD_MAP.filter((m) => m.required).map((m) => m.field);
+
+/** Additional fields required for high-risk / prohibited passports. */
+const HIGH_RISK_EXTRA = ['oversight.responsible_person', 'oversight.override_mechanism'] as const;
+
+const countDeepFields = (manifest: Record<string, unknown>, fields: readonly string[]): number => {
+  let filled = 0;
+  for (const fieldPath of fields) {
+    const value = getFieldValue(manifest as never, fieldPath);
+    if (isNonEmpty(value)) {
+      filled++;
+    }
+  }
+  return filled;
+};
+
+export const checkPassportCompleteness = (ctx: ScanContext): readonly CheckResult[] => {
+  const passportFiles = filterPassportManifests(ctx.files);
+
+  if (passportFiles.length === 0) {
+    return [];
+  }
+
+  const results: CheckResult[] = [];
+
+  for (const file of passportFiles) {
+    try {
+      const manifest = JSON.parse(file.content) as Record<string, unknown>;
+      const risk = extractRiskClass(manifest);
+
+      const requiredFields = risk === 'high' || risk === 'prohibited'
+        ? [...BASE_FIELDS, ...HIGH_RISK_EXTRA]
+        : BASE_FIELDS;
+      const totalRequired = requiredFields.length;
+      const filled = countDeepFields(manifest, requiredFields);
+      const pct = Math.round((filled / totalRequired) * 100);
+      const name = (manifest.name as string) ?? file.relativePath;
+
+      if (pct >= 100) {
+        results.push({
+          type: 'pass',
+          checkId: CHECK_ID,
+          message: `Passport Completeness: ${pct}% (${filled}/${totalRequired} fields) — ${name}`,
+        });
+      } else {
+        results.push({
+          type: 'fail',
+          checkId: CHECK_ID,
+          message: `Passport Completeness: ${pct}% (${filled}/${totalRequired} fields) — ${name} (${ARTICLE_REF})`,
+          severity: pct < 50 ? 'high' : 'medium',
+          obligationId: OBLIGATION_ID,
+          articleReference: ARTICLE_REF,
+          fix: `Fill missing passport fields using \`complior agent init --force\` or manual edit`,
+          file: file.relativePath,
+        });
+      }
+    } catch {
+      results.push({
+        type: 'fail',
+        checkId: CHECK_ID,
+        message: `Invalid passport manifest: ${file.relativePath}`,
+        severity: 'high',
+        obligationId: OBLIGATION_ID,
+        articleReference: ARTICLE_REF,
+        fix: 'Regenerate passport with `complior agent init --force`',
+        file: file.relativePath,
+      });
+    }
+  }
+
+  return results;
+};

package/src/domain/scanner/checks/passport-presence.test.ts

@@ -0,0 +1,56 @@
+import { describe, it, expect } from 'vitest';
+import { checkPassportPresence } from './passport-presence.js';
+import { createScanFile, createScanCtx } from '../../../test-helpers/factories.js';
+
+describe('checkPassportPresence', () => {
+  it('passes when passport manifest found', () => {
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/my-bot-manifest.json', '{"name":"my-bot"}'),
+      createScanFile('package.json', '{"dependencies":{"openai":"^4.0.0"}}'),
+    ]);
+
+    const results = checkPassportPresence(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].message).toContain('Agent Passport found');
+  });
+
+  it('fails when AI SDK detected but no passport', () => {
+    const ctx = createScanCtx([
+      createScanFile('package.json', '{"dependencies":{"openai":"^4.0.0"}}'),
+      createScanFile('src/app.ts', 'const x = 1;'),
+    ]);
+
+    const results = checkPassportPresence(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    if (results[0].type === 'fail') {
+      expect(results[0].severity).toBe('high');
+      expect(results[0].fix).toContain('complior agent init');
+    }
+  });
+
+  it('skips when no AI SDK detected', () => {
+    const ctx = createScanCtx([
+      createScanFile('package.json', '{"dependencies":{"express":"^4.0.0"}}'),
+      createScanFile('src/app.ts', 'const x = 1;'),
+    ]);
+
+    const results = checkPassportPresence(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('skip');
+  });
+
+  it('detects multiple passport manifests', () => {
+    const ctx = createScanCtx([
+      createScanFile('.complior/agents/bot-a-manifest.json', '{"name":"bot-a"}'),
+      createScanFile('.complior/agents/bot-b-manifest.json', '{"name":"bot-b"}'),
+      createScanFile('package.json', '{"dependencies":{"openai":"^4.0.0"}}'),
+    ]);
+
+    const results = checkPassportPresence(ctx);
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].message).toContain('2 manifest(s)');
+  });
+});

package/src/domain/scanner/checks/passport-presence.ts

@@ -0,0 +1,78 @@
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+import { AI_SDK_PACKAGES } from '../rules/banned-packages-sdk.js';
+import { filterPassportManifests } from '../../passport/builder/manifest-files.js';
+
+const CHECK_ID = 'passport-presence';
+const ARTICLE_REF = 'Art. 26(4)';
+const OBLIGATION_ID = 'eu-ai-act-OBL-011';
+
+const hasAiSdk = (ctx: ScanContext): boolean => {
+  const pkgFile = ctx.files.find((f) => f.relativePath.endsWith('package.json'));
+  if (!pkgFile) return false;
+
+  try {
+    const pkg = JSON.parse(pkgFile.content) as Record<string, unknown>;
+    const deps = {
+      ...(pkg.dependencies as Record<string, string> | undefined),
+      ...(pkg.devDependencies as Record<string, string> | undefined),
+    };
+
+    return Object.keys(deps).some((name) => AI_SDK_PACKAGES.has(name));
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Count passport manifests — first check ctx.files (covers tests and configs that
+ * include .complior), then fall back to disk read (production: .complior is excluded
+ * from EXCLUDED_DIRS in file-collector).
+ */
+const countPassportManifests = (ctx: ScanContext): number => {
+  // 1. Check scanned files (works in tests and when .complior is explicitly included)
+  const fromCtx = filterPassportManifests(ctx.files).length;
+  if (fromCtx > 0) return fromCtx;
+
+  // 2. Fall back to disk read (production — .complior excluded from scanning)
+  try {
+    const agentsDir = join(ctx.projectPath, '.complior', 'agents');
+    return readdirSync(agentsDir).filter(f => f.endsWith('-manifest.json')).length;
+  } catch {
+    return 0;
+  }
+};
+
+export const checkPassportPresence = (ctx: ScanContext): readonly CheckResult[] => {
+  const manifestCount = countPassportManifests(ctx);
+
+  if (manifestCount > 0) {
+    return [{
+      type: 'pass',
+      checkId: CHECK_ID,
+      message: `Agent Passport found (${manifestCount} manifest(s)) — ${ARTICLE_REF}`,
+    }];
+  }
+
+  // Only fail if AI SDK is detected (no passport needed without AI)
+  if (hasAiSdk(ctx)) {
+    return [{
+      type: 'fail',
+      checkId: CHECK_ID,
+      message: `No Agent Passport found — AI SDK detected but no .complior/agents/*-manifest.json (${ARTICLE_REF})`,
+      severity: 'high',
+      obligationId: OBLIGATION_ID,
+      articleReference: ARTICLE_REF,
+      fix: 'Run `complior agent init` to generate an Agent Passport for your AI system',
+    }];
+  }
+
+  // No AI SDK → skip
+  return [{
+    type: 'skip',
+    checkId: CHECK_ID,
+    reason: 'No AI SDK detected — passport not required',
+  }];
+};

package/src/domain/scanner/checks/pattern-check-factory.ts

@@ -0,0 +1,70 @@
+/**
+ * Factory for dual-pattern scanner checks.
+ * Handles the common pattern: search files for "positive" indicators,
+ * search for "context" indicators, return pass/fail/skip.
+ *
+ * Used by: ai-disclosure (Art. 50.1), content-marking (Art. 50.2).
+ */
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext, FileInfo } from '../../../ports/scanner.port.js';
+
+export interface PatternCheckConfig {
+  readonly checkId: string;
+  readonly articleRef: string;
+  readonly obligationId: string;
+  readonly severity: 'critical' | 'high' | 'medium' | 'low';
+  /** Patterns that indicate compliance (e.g., disclosure text, watermarking). */
+  readonly positivePatterns: readonly RegExp[];
+  /** Patterns that indicate the feature IS used but compliance is missing (e.g., chat code, content generation). */
+  readonly contextPatterns: readonly RegExp[];
+  readonly passMessage: string;
+  readonly failMessage: string;
+  readonly skipReason: string;
+  readonly fix: string;
+  /** Optional file filter (e.g., only UI files). Defaults to all files. */
+  readonly fileFilter?: (file: FileInfo) => boolean;
+}
+
+export const createPatternCheck = (config: PatternCheckConfig) =>
+  (ctx: ScanContext): readonly CheckResult[] => {
+    const files = config.fileFilter ? ctx.files.filter(config.fileFilter) : ctx.files;
+
+    let positiveFound = false;
+    let contextFound = false;
+
+    for (const file of files) {
+      if (!positiveFound && config.positivePatterns.some((p) => p.test(file.content))) {
+        positiveFound = true;
+      }
+      if (!contextFound && config.contextPatterns.some((p) => p.test(file.content))) {
+        contextFound = true;
+      }
+      if (positiveFound) break;
+    }
+
+    if (positiveFound) {
+      return [{
+        type: 'pass',
+        checkId: config.checkId,
+        message: `${config.passMessage} (${config.articleRef})`,
+      }];
+    }
+
+    if (contextFound) {
+      return [{
+        type: 'fail',
+        checkId: config.checkId,
+        message: `${config.failMessage} (${config.articleRef})`,
+        severity: config.severity,
+        obligationId: config.obligationId,
+        articleReference: config.articleRef,
+        fix: config.fix,
+      }];
+    }
+
+    return [{
+      type: 'skip',
+      checkId: config.checkId,
+      reason: config.skipReason,
+    }];
+  };