@complior/engine 0.9.0

package/src/domain/scanner/checks/presence-check-factory.ts

@@ -0,0 +1,275 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+import type { CheckFunction } from '../../../ports/scanner.port.js';
+import { DOCUMENT_VALIDATORS } from '../validators.js';
+
+// --- Types ---
+
+export interface PresenceCheckConfig {
+  readonly checkId: string;
+  readonly articleRef: string;
+  readonly obligationId: string;
+  readonly severity: 'high' | 'medium';
+  readonly docLabel: string;
+  readonly contentPatterns: readonly RegExp[];
+  readonly fixMessage: string;
+}
+
+// --- Helpers ---
+
+const escapeRegex = (s: string): string =>
+  s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/**
+ * Map checkId → validator document name where they differ.
+ * Validators.ts uses short names; checkIds use full kebab names.
+ */
+const VALIDATOR_DOC_NAME: Record<string, string> = {
+  'technical-documentation': 'tech-documentation',
+  'declaration-of-conformity': 'declaration-conformity',
+};
+
+// --- Factory ---
+
+/**
+ * Creates an L1 presence check from config + validator data.
+ * File patterns come from DOCUMENT_VALIDATORS (single source of truth).
+ * Content patterns and generated-doc patterns are check-specific.
+ */
+export const createPresenceCheck = (config: PresenceCheckConfig): CheckFunction => {
+  const {
+    checkId, articleRef, obligationId, severity, docLabel, contentPatterns, fixMessage,
+  } = config;
+
+  // Derive file patterns from validators.ts (single source of truth)
+  const validatorName = VALIDATOR_DOC_NAME[checkId] ?? checkId;
+  const validator = DOCUMENT_VALIDATORS.find((v) => v.document === validatorName);
+  const filePatterns: readonly RegExp[] = validator
+    ? validator.file_patterns.map((p) => new RegExp(`^${escapeRegex(p)}$`, 'i'))
+    : [];
+
+  // Generated docs live in standard locations
+  const generatedPatterns: readonly RegExp[] = [
+    new RegExp(`^\\.complior/documents/.*${escapeRegex(checkId)}`, 'i'),
+    new RegExp(`^\\.complior/reports/.*${escapeRegex(checkId)}`, 'i'),
+    new RegExp(`^docs/compliance/${escapeRegex(checkId)}`, 'i'),
+  ];
+
+  return (ctx: ScanContext): readonly CheckResult[] => {
+    // Phase 1: exact filename match
+    for (const file of ctx.files) {
+      const filename = file.relativePath.split('/').pop() ?? '';
+      if (filePatterns.some((p) => p.test(filename))) {
+        return [{
+          type: 'pass',
+          checkId,
+          message: `${docLabel} found: ${file.relativePath} (${articleRef})`,
+        }];
+      }
+    }
+
+    // Phase 2: generated documents in .complior/ or docs/compliance/
+    for (const file of ctx.files) {
+      if (generatedPatterns.some((p) => p.test(file.relativePath))) {
+        return [{
+          type: 'pass',
+          checkId,
+          message: `Generated ${docLabel.toLowerCase()} found: ${file.relativePath} (${articleRef})`,
+        }];
+      }
+    }
+
+    // Phase 3: content keyword search in docs/
+    const docsFiles = ctx.files.filter((f) =>
+      f.relativePath.startsWith('docs/') && f.extension === '.md',
+    );
+
+    for (const file of docsFiles) {
+      if (contentPatterns.some((p) => p.test(file.content))) {
+        return [{
+          type: 'pass',
+          checkId,
+          message: `${docLabel} content found in docs: ${file.relativePath} (${articleRef})`,
+        }];
+      }
+    }
+
+    // No match — fail
+    return [{
+      type: 'fail',
+      checkId,
+      message: `No ${docLabel.toLowerCase()} found (${articleRef})`,
+      severity,
+      obligationId,
+      articleReference: articleRef,
+      fix: fixMessage,
+    }];
+  };
+};
+
+// --- Configs for all 7 EU AI Act document presence checks ---
+
+const PRESENCE_CONFIGS: readonly PresenceCheckConfig[] = [
+  {
+    checkId: 'fria',
+    articleRef: 'Art. 27',
+    obligationId: 'eu-ai-act-OBL-013',
+    severity: 'high',
+    docLabel: 'FRIA document',
+    contentPatterns: [
+      /\bfundamental rights impact assessment\b/i,
+      /\bfria\b/i,
+      /\bfundamental rights\b.*\bimpact\b/i,
+    ],
+    fixMessage: 'Create a FRIA.md document with fundamental rights impact assessment (Art. 27)',
+  },
+  {
+    checkId: 'art5-screening',
+    articleRef: 'Art. 5',
+    obligationId: 'eu-ai-act-OBL-002',
+    severity: 'high',
+    docLabel: 'Art. 5 screening document',
+    contentPatterns: [
+      /\bart\.?\s*5\b.*\bscreening\b/i,
+      /\bprohibited practices\b/i,
+      /\bprohibited ai\b/i,
+    ],
+    fixMessage: 'Create an ART5-SCREENING.md document screening for prohibited AI practices (Art. 5)',
+  },
+  {
+    checkId: 'technical-documentation',
+    articleRef: 'Art. 11',
+    obligationId: 'eu-ai-act-OBL-005',
+    severity: 'high',
+    docLabel: 'Technical documentation',
+    contentPatterns: [
+      /\btechnical documentation\b/i,
+      /\bsystem description\b.*\barchitecture\b/i,
+      /\bart\.?\s*11\b.*\bdocumentation\b/i,
+    ],
+    fixMessage: 'Create a TECHNICAL-DOCUMENTATION.md describing AI system architecture and data sources (Art. 11)',
+  },
+  {
+    checkId: 'incident-report',
+    articleRef: 'Art. 73',
+    obligationId: 'eu-ai-act-OBL-021',
+    severity: 'medium',
+    docLabel: 'Incident report template',
+    contentPatterns: [
+      /\bincident report\b/i,
+      /\bserious incident\b/i,
+      /\bincident.*\breporting\b/i,
+    ],
+    fixMessage: 'Create an INCIDENT-REPORT.md template for serious AI incident reporting (Art. 73)',
+  },
+  {
+    checkId: 'declaration-of-conformity',
+    articleRef: 'Art. 47',
+    obligationId: 'eu-ai-act-OBL-019',
+    severity: 'high',
+    docLabel: 'Declaration of conformity',
+    contentPatterns: [
+      /\bdeclaration of conformity\b/i,
+      /\bconformity assessment\b/i,
+      /\bart\.?\s*47\b/i,
+    ],
+    fixMessage: 'Create a DECLARATION-OF-CONFORMITY.md documenting EU conformity assessment (Art. 47)',
+  },
+  {
+    checkId: 'monitoring-policy',
+    articleRef: 'Art. 26',
+    obligationId: 'eu-ai-act-OBL-011',
+    severity: 'medium',
+    docLabel: 'Monitoring policy',
+    contentPatterns: [
+      /\bmonitoring policy\b/i,
+      /\bpost[-\s]?market monitoring\b/i,
+      /\bmonitoring scope\b/i,
+    ],
+    fixMessage: 'Create a MONITORING-POLICY.md for post-market AI system monitoring (Art. 26)',
+  },
+  {
+    checkId: 'worker-notification',
+    articleRef: 'Art. 26(7)',
+    obligationId: 'eu-ai-act-OBL-012',
+    severity: 'medium',
+    docLabel: 'Worker notification document',
+    contentPatterns: [
+      /\bworker notification\b/i,
+      /\bemployee.*\bai notification\b/i,
+      /\bworkers?\b.*\bnotif/i,
+    ],
+    fixMessage: 'Create a WORKER-NOTIFICATION.md documenting AI system notification to affected workers (Art. 26(7))',
+  },
+  {
+    checkId: 'risk-management',
+    articleRef: 'Art. 9',
+    obligationId: 'eu-ai-act-OBL-003',
+    severity: 'high',
+    docLabel: 'Risk management documentation',
+    contentPatterns: [
+      /\brisk management system\b/i,
+      /\brisk register\b/i,
+      /\brisk assessment\b.*\bai\b/i,
+      /\bknown risks\b.*\bmitigation\b/i,
+    ],
+    fixMessage: 'Create a RISK-MANAGEMENT.md with risk identification, misuse scenarios, and residual risk assessment (Art. 9)',
+  },
+  {
+    checkId: 'data-governance',
+    articleRef: 'Art. 10',
+    obligationId: 'eu-ai-act-OBL-004',
+    severity: 'medium',
+    docLabel: 'Data governance documentation',
+    contentPatterns: [
+      /\bdata governance\b/i,
+      /\bdata quality\b.*\bpolicy\b/i,
+      /\btraining data\b.*\bgovernance\b/i,
+      /\bbias\b.*\banalysis\b/i,
+    ],
+    fixMessage: 'Create a DATA-GOVERNANCE.md documenting data sources, quality metrics, and bias analysis (Art. 10)',
+  },
+  {
+    checkId: 'qms',
+    articleRef: 'Art. 17',
+    obligationId: 'eu-ai-act-OBL-010',
+    severity: 'medium',
+    docLabel: 'Quality management system',
+    contentPatterns: [
+      /\bquality management system\b/i,
+      /\bqms\b/i,
+      /\bquality management\b.*\bai\b/i,
+    ],
+    fixMessage: 'Create a QMS.md covering compliance strategy, design control, testing, and data management (Art. 17)',
+  },
+  {
+    checkId: 'instructions-for-use',
+    articleRef: 'Art. 13',
+    obligationId: 'eu-ai-act-OBL-007',
+    severity: 'medium',
+    docLabel: 'Instructions for use',
+    contentPatterns: [
+      /\binstructions for use\b/i,
+      /\bcapabilities\b.*\blimitations\b/i,
+      /\bintended purpose\b.*\bai\b/i,
+    ],
+    fixMessage: 'Create an INSTRUCTIONS-FOR-USE.md with capabilities, limitations, intended purpose, and human oversight instructions (Art. 13)',
+  },
+];
+
+// --- Exported check functions (one per document type) ---
+
+export const checkFriaPresence = createPresenceCheck(PRESENCE_CONFIGS[0]!);
+export const checkArt5ScreeningPresence = createPresenceCheck(PRESENCE_CONFIGS[1]!);
+export const checkTechnicalDocumentationPresence = createPresenceCheck(PRESENCE_CONFIGS[2]!);
+export const checkIncidentReportPresence = createPresenceCheck(PRESENCE_CONFIGS[3]!);
+export const checkDeclarationOfConformityPresence = createPresenceCheck(PRESENCE_CONFIGS[4]!);
+export const checkMonitoringPolicyPresence = createPresenceCheck(PRESENCE_CONFIGS[5]!);
+export const checkWorkerNotificationPresence = createPresenceCheck(PRESENCE_CONFIGS[6]!);
+export const checkRiskManagementPresence = createPresenceCheck(PRESENCE_CONFIGS[7]!);
+export const checkDataGovernancePresence = createPresenceCheck(PRESENCE_CONFIGS[8]!);
+export const checkQmsPresence = createPresenceCheck(PRESENCE_CONFIGS[9]!);
+export const checkInstructionsForUsePresence = createPresenceCheck(PRESENCE_CONFIGS[10]!);
+
+/** All presence check configs (useful for data-driven tests). */
+export const ALL_PRESENCE_CONFIGS = PRESENCE_CONFIGS;

package/src/domain/scanner/compliance-diff.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect } from 'vitest';
+import { computeComplianceDiff, formatDiffMarkdown } from './compliance-diff.js';
+import type { ScanResult, Finding } from '../../types/common.types.js';
+
+const createScanResult = (score: number, findings: Partial<Finding>[]): ScanResult => ({
+  score: { totalScore: score } as ScanResult['score'],
+  findings: findings.map((f) => ({
+    checkId: f.checkId ?? 'check-1',
+    type: f.type ?? 'fail',
+    message: f.message ?? 'test',
+    severity: f.severity ?? 'medium',
+    file: f.file,
+  })) as unknown as readonly Finding[],
+  projectPath: '/test',
+  scannedAt: '2026-03-01T00:00:00Z',
+  duration: 100,
+  filesScanned: 10,
+});
+
+describe('computeComplianceDiff', () => {
+  it('detects new findings', () => {
+    const before = createScanResult(70, [
+      { checkId: 'c1', message: 'old finding', type: 'fail' },
+    ]);
+    const after = createScanResult(65, [
+      { checkId: 'c1', message: 'old finding', type: 'fail' },
+      { checkId: 'c2', message: 'new finding', type: 'fail', severity: 'high' },
+    ]);
+
+    const diff = computeComplianceDiff(before, after);
+    expect(diff.newFindings).toHaveLength(1);
+    expect(diff.newFindings[0].checkId).toBe('c2');
+    expect(diff.newFindings[0].status).toBe('new');
+    expect(diff.resolvedFindings).toHaveLength(0);
+    expect(diff.unchangedCount).toBe(1);
+  });
+
+  it('detects resolved findings', () => {
+    const before = createScanResult(60, [
+      { checkId: 'c1', message: 'fixed', type: 'fail' },
+      { checkId: 'c2', message: 'still there', type: 'fail' },
+    ]);
+    const after = createScanResult(80, [
+      { checkId: 'c2', message: 'still there', type: 'fail' },
+    ]);
+
+    const diff = computeComplianceDiff(before, after);
+    expect(diff.resolvedFindings).toHaveLength(1);
+    expect(diff.resolvedFindings[0].checkId).toBe('c1');
+    expect(diff.resolvedFindings[0].status).toBe('resolved');
+    expect(diff.scoreDelta).toBe(20);
+  });
+
+  it('computes score delta correctly', () => {
+    const before = createScanResult(50, []);
+    const after = createScanResult(75, []);
+
+    const diff = computeComplianceDiff(before, after);
+    expect(diff.scoreBefore).toBe(50);
+    expect(diff.scoreAfter).toBe(75);
+    expect(diff.scoreDelta).toBe(25);
+    expect(diff.hasRegression).toBe(false);
+  });
+
+  it('detects regression when score drops', () => {
+    const before = createScanResult(80, []);
+    const after = createScanResult(60, [{ checkId: 'c1', message: 'bad', type: 'fail' }]);
+
+    const diff = computeComplianceDiff(before, after);
+    expect(diff.hasRegression).toBe(true);
+    expect(diff.scoreDelta).toBe(-20);
+  });
+
+  it('detects critical regression', () => {
+    const before = createScanResult(80, []);
+    const after = createScanResult(80, [
+      { checkId: 'c1', message: 'critical issue', type: 'fail', severity: 'critical' },
+    ]);
+
+    const diff = computeComplianceDiff(before, after);
+    expect(diff.hasCriticalNew).toBe(true);
+    expect(diff.hasRegression).toBe(true);
+  });
+
+  it('handles null before (first scan)', () => {
+    const after = createScanResult(65, [
+      { checkId: 'c1', message: 'finding', type: 'fail' },
+    ]);
+
+    const diff = computeComplianceDiff(null, after);
+    expect(diff.scoreBefore).toBe(0);
+    expect(diff.scoreAfter).toBe(65);
+    expect(diff.scoreDelta).toBe(65);
+    expect(diff.newFindings).toHaveLength(1);
+    expect(diff.resolvedFindings).toHaveLength(0);
+  });
+
+  it('filters findings to changed files', () => {
+    const before = createScanResult(70, [
+      { checkId: 'c1', message: 'in changed', file: 'src/app.ts', type: 'fail' },
+      { checkId: 'c2', message: 'not changed', file: 'src/util.ts', type: 'fail' },
+    ]);
+    const after = createScanResult(60, [
+      { checkId: 'c1', message: 'in changed', file: 'src/app.ts', type: 'fail' },
+      { checkId: 'c2', message: 'not changed', file: 'src/util.ts', type: 'fail' },
+      { checkId: 'c3', message: 'new in changed', file: 'src/app.ts', type: 'fail' },
+    ]);
+
+    const diff = computeComplianceDiff(before, after, ['src/app.ts']);
+    expect(diff.newFindings).toHaveLength(1);
+    expect(diff.newFindings[0].checkId).toBe('c3');
+    // c2 is not in changed files, so it's excluded from diff
+  });
+
+  it('returns frozen result', () => {
+    const diff = computeComplianceDiff(null, createScanResult(50, []));
+    expect(Object.isFrozen(diff)).toBe(true);
+  });
+
+  it('ignores pass findings', () => {
+    const before = createScanResult(70, [
+      { checkId: 'c1', message: 'pass', type: 'pass' },
+    ]);
+    const after = createScanResult(70, []);
+
+    const diff = computeComplianceDiff(before, after);
+    expect(diff.newFindings).toHaveLength(0);
+    expect(diff.resolvedFindings).toHaveLength(0);
+  });
+});
+
+describe('formatDiffMarkdown', () => {
+  it('generates markdown table', () => {
+    const diff = computeComplianceDiff(
+      createScanResult(60, [
+        { checkId: 'c1', message: 'resolved', type: 'fail' },
+      ]),
+      createScanResult(75, [
+        { checkId: 'c2', message: 'new issue', type: 'fail', severity: 'high' },
+      ]),
+    );
+
+    const md = formatDiffMarkdown(diff);
+    expect(md).toContain('## Compliance Diff');
+    expect(md).toContain('60%');
+    expect(md).toContain('75%');
+    expect(md).toContain('### New Findings');
+    expect(md).toContain('### Resolved Findings');
+    expect(md).toContain('c2');
+    expect(md).toContain('c1');
+  });
+
+  it('shows regression warning', () => {
+    const diff = computeComplianceDiff(
+      createScanResult(80, []),
+      createScanResult(60, [
+        { checkId: 'c1', message: 'critical', type: 'fail', severity: 'critical' },
+      ]),
+    );
+
+    const md = formatDiffMarkdown(diff);
+    expect(md).toContain('regression');
+    expect(md).toContain('CRITICAL');
+  });
+});

package/src/domain/scanner/compliance-diff.ts

@@ -0,0 +1,138 @@
+/**
+ * US-S05-34: Compliance Diff — compare two scan results to find delta.
+ * Pure function, no I/O.
+ */
+
+import type { ScanResult, Finding, Severity } from '../../types/common.types.js';
+
+export interface DiffFinding {
+  readonly checkId: string;
+  readonly message: string;
+  readonly severity: Severity;
+  readonly file?: string;
+  readonly status: 'new' | 'resolved';
+}
+
+export interface ComplianceDiff {
+  readonly scoreBefore: number;
+  readonly scoreAfter: number;
+  readonly scoreDelta: number;
+  readonly newFindings: readonly DiffFinding[];
+  readonly resolvedFindings: readonly DiffFinding[];
+  readonly unchangedCount: number;
+  readonly hasRegression: boolean;
+  readonly hasCriticalNew: boolean;
+}
+
+const findingKey = (f: Finding): string =>
+  `${f.checkId}::${f.file ?? ''}::${f.message}`;
+
+export const computeComplianceDiff = (
+  before: ScanResult | null,
+  after: ScanResult,
+  changedFiles?: readonly string[],
+): ComplianceDiff => {
+  const scoreBefore = Math.round(before?.score.totalScore ?? 0);
+  const scoreAfter = Math.round(after.score.totalScore);
+  const scoreDelta = scoreAfter - scoreBefore;
+
+  const beforeFails = (before?.findings ?? []).filter((f) => f.type === 'fail');
+  const afterFails = after.findings.filter((f) => f.type === 'fail');
+
+  // Filter to changed files if provided
+  const filterToChanged = (findings: readonly Finding[]): readonly Finding[] => {
+    if (!changedFiles || changedFiles.length === 0) return findings;
+    return findings.filter((f) => !f.file || changedFiles.some((cf) => f.file?.includes(cf)));
+  };
+
+  const filteredAfter = filterToChanged(afterFails);
+  const filteredBefore = filterToChanged(beforeFails);
+
+  const beforeKeys = new Set(filteredBefore.map(findingKey));
+  const afterKeys = new Set(filteredAfter.map(findingKey));
+
+  const newFindings: DiffFinding[] = filteredAfter
+    .filter((f) => !beforeKeys.has(findingKey(f)))
+    .map((f) => ({
+      checkId: f.checkId,
+      message: f.message,
+      severity: f.severity,
+      file: f.file,
+      status: 'new',
+    }));
+
+  const resolvedFindings: DiffFinding[] = filteredBefore
+    .filter((f) => !afterKeys.has(findingKey(f)))
+    .map((f) => ({
+      checkId: f.checkId,
+      message: f.message,
+      severity: f.severity,
+      file: f.file,
+      status: 'resolved',
+    }));
+
+  const unchangedCount = filteredAfter.filter((f) => beforeKeys.has(findingKey(f))).length;
+
+  const hasCriticalNew = newFindings.some((f) => f.severity === 'critical');
+  const hasRegression = scoreDelta < 0 || hasCriticalNew;
+
+  return Object.freeze({
+    scoreBefore,
+    scoreAfter,
+    scoreDelta,
+    newFindings,
+    resolvedFindings,
+    unchangedCount,
+    hasRegression,
+    hasCriticalNew,
+  });
+};
+
+export const formatDiffMarkdown = (diff: ComplianceDiff): string => {
+  const lines: string[] = [];
+
+  const icon = diff.scoreDelta > 0 ? '+' : diff.scoreDelta < 0 ? '-' : '=';
+  lines.push(`## Compliance Diff`);
+  lines.push('');
+  lines.push(`| Metric | Value |`);
+  lines.push(`|--------|-------|`);
+  lines.push(`| Score Before | ${diff.scoreBefore}% |`);
+  lines.push(`| Score After | ${diff.scoreAfter}% |`);
+  lines.push(`| Delta | ${icon}${Math.abs(diff.scoreDelta)}% |`);
+  lines.push(`| New Findings | ${diff.newFindings.length} |`);
+  lines.push(`| Resolved | ${diff.resolvedFindings.length} |`);
+  lines.push(`| Unchanged | ${diff.unchangedCount} |`);
+  lines.push('');
+
+  if (diff.newFindings.length > 0) {
+    lines.push('### New Findings');
+    lines.push('');
+    lines.push('| Severity | Check | File | Message |');
+    lines.push('|----------|-------|------|---------|');
+    for (const f of diff.newFindings) {
+      lines.push(`| ${f.severity} | ${f.checkId} | ${f.file ?? '-'} | ${f.message} |`);
+    }
+    lines.push('');
+  }
+
+  if (diff.resolvedFindings.length > 0) {
+    lines.push('### Resolved Findings');
+    lines.push('');
+    lines.push('| Severity | Check | File | Message |');
+    lines.push('|----------|-------|------|---------|');
+    for (const f of diff.resolvedFindings) {
+      lines.push(`| ${f.severity} | ${f.checkId} | ${f.file ?? '-'} | ${f.message} |`);
+    }
+    lines.push('');
+  }
+
+  if (diff.hasRegression) {
+    lines.push('> **Warning:** Compliance regression detected.');
+    if (diff.hasCriticalNew) {
+      lines.push('> New CRITICAL findings introduced.');
+    }
+    lines.push('');
+  }
+
+  return lines.join('\n');
+};