@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/sg-model-ai-gov.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Singapore PDPC Model AI Governance Framework + AI Verify Compliance Pack
+ *
+ * Regulation: PDPC Model AI Governance Framework (2nd Edition, 2020)
+ *             + AI Verify (open-source AI governance testing toolkit, IMDA, 2022)
+ *             + Companion Guides to the Model AI Governance Framework (2022)
+ *
+ * Jurisdiction: SG (Singapore)
+ * Regulators: IMDA (Infocomm Media Development Authority)
+ *             + PDPC (Personal Data Protection Commission)
+ *
+ * Alias: EN-09
+ *
+ * Status:
+ *   Voluntary framework, but referenced in PDPA enforcement actions and
+ *   increasingly expected in MAS-regulated financial services and government
+ *   procurement. AI Verify is the auditable testing artifact produced under
+ *   this framework. Singapore MAS also references the Model AI Governance
+ *   Framework in its Fairness, Ethics, Accountability and Transparency
+ *   (FEAT) principles.
+ *
+ * Key obligations:
+ *   1. Internal AI governance structure: board-level AI accountability,
+ *      designated AI risk owner, AI ethics committee or equivalent.
+ *   2. AI risk classification: apply PDPC Decision Matrix to classify each
+ *      AI deployment by probability of harm and severity of impact.
+ *   3. Human involvement level determination: each AI deployment classified
+ *      as one of four levels:
+ *        - Human-in-the-loop (HITL): human decision-making for every output
+ *        - Human-over-the-loop (HOTL): human monitoring with override ability
+ *        - Human-out-of-the-loop: AI autonomous but human-initiated
+ *        - Human-controlled: fully automated within pre-defined parameters
+ *   4. Explainability tier mapping: results must be explainable at a level
+ *      appropriate to the risk classification and human-involvement level.
+ *   5. Fairness testing: AI Verify toolkit conformance, covering performance
+ *      metrics (accuracy, precision, recall, F1), fairness metrics (demographic
+ *      parity, equalised odds, etc.), and robustness testing.
+ *   6. Stakeholder communication: disclosure to affected individuals and
+ *      relevant stakeholders about AI use, decisions, and limitations.
+ *
+ * AI Verify:
+ *   AI Verify is an AI governance testing toolkit developed by IMDA.
+ *   It produces a test report covering 9 AI ethics principles across
+ *   25 testable properties. The AI Verify test report is the auditable
+ *   artifact referenced by enterprise customers and regulators.
+ *
+ * Interaction with PDPA:
+ *   The Model AI Governance Framework sits above the PDPA. Where AI
+ *   decisions involve personal data, PDPA obligations (consent, purpose
+ *   limitation, data protection) also apply. Both packs may be active
+ *   simultaneously; PDPA governs data handling; this pack governs AI
+ *   governance structure and fairness testing.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+export declare const SG_MODEL_AI_GOV_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const SG_MODEL_AI_GOV_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+};
+//# sourceMappingURL=sg-model-ai-gov.d.ts.map

package/dist/packs/sg-model-ai-gov.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sg-model-ai-gov.d.ts","sourceRoot":"","sources":["../../src/packs/sg-model-ai-gov.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,eAAO,MAAM,oCAAoC,EAAE,mBAkElD,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAA;CA+P7F,CAAC"}

package/dist/packs/sg-model-ai-gov.js

@@ -0,0 +1,396 @@
+"use strict";
+/**
+ * Singapore PDPC Model AI Governance Framework + AI Verify Compliance Pack
+ *
+ * Regulation: PDPC Model AI Governance Framework (2nd Edition, 2020)
+ *             + AI Verify (open-source AI governance testing toolkit, IMDA, 2022)
+ *             + Companion Guides to the Model AI Governance Framework (2022)
+ *
+ * Jurisdiction: SG (Singapore)
+ * Regulators: IMDA (Infocomm Media Development Authority)
+ *             + PDPC (Personal Data Protection Commission)
+ *
+ * Alias: EN-09
+ *
+ * Status:
+ *   Voluntary framework, but referenced in PDPA enforcement actions and
+ *   increasingly expected in MAS-regulated financial services and government
+ *   procurement. AI Verify is the auditable testing artifact produced under
+ *   this framework. Singapore MAS also references the Model AI Governance
+ *   Framework in its Fairness, Ethics, Accountability and Transparency
+ *   (FEAT) principles.
+ *
+ * Key obligations:
+ *   1. Internal AI governance structure: board-level AI accountability,
+ *      designated AI risk owner, AI ethics committee or equivalent.
+ *   2. AI risk classification: apply PDPC Decision Matrix to classify each
+ *      AI deployment by probability of harm and severity of impact.
+ *   3. Human involvement level determination: each AI deployment classified
+ *      as one of four levels:
+ *        - Human-in-the-loop (HITL): human decision-making for every output
+ *        - Human-over-the-loop (HOTL): human monitoring with override ability
+ *        - Human-out-of-the-loop: AI autonomous but human-initiated
+ *        - Human-controlled: fully automated within pre-defined parameters
+ *   4. Explainability tier mapping: results must be explainable at a level
+ *      appropriate to the risk classification and human-involvement level.
+ *   5. Fairness testing: AI Verify toolkit conformance, covering performance
+ *      metrics (accuracy, precision, recall, F1), fairness metrics (demographic
+ *      parity, equalised odds, etc.), and robustness testing.
+ *   6. Stakeholder communication: disclosure to affected individuals and
+ *      relevant stakeholders about AI use, decisions, and limitations.
+ *
+ * AI Verify:
+ *   AI Verify is an AI governance testing toolkit developed by IMDA.
+ *   It produces a test report covering 9 AI ethics principles across
+ *   25 testable properties. The AI Verify test report is the auditable
+ *   artifact referenced by enterprise customers and regulators.
+ *
+ * Interaction with PDPA:
+ *   The Model AI Governance Framework sits above the PDPA. Where AI
+ *   decisions involve personal data, PDPA obligations (consent, purpose
+ *   limitation, data protection) also apply. Both packs may be active
+ *   simultaneously; PDPA governs data handling; this pack governs AI
+ *   governance structure and fairness testing.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SG_MODEL_AI_GOV_PACK = exports.SG_MODEL_AI_GOV_CATEGORY_CLASSIFIERS = void 0;
+exports.SG_MODEL_AI_GOV_CATEGORY_CLASSIFIERS = {
+    AI_DECISION_RECORD: {
+        references: ['PDPC Model AI Governance Framework 2nd Ed. Part 3 -- human-centric AI; Decision Matrix'],
+        classifier: (input) => {
+            if (/\b(?:ai\s+decision|algorithmic\s+decision|automated\s+decision\s+singapore|model\s+decision\s+record|ai\s+outcome\s+record)\b/i.test(input))
+                return true;
+            if (/\b(?:ai\s+classification\s+output|risk\s+classification\s+ai|pdpc\s+decision\s+matrix|ai\s+risk\s+tier)\b/i.test(input))
+                return true;
+            if (/\b(?:ai\s+recommendation\s+record|consequential\s+ai\s+output|automated\s+recommendation)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AI_EXPLAINABILITY_ARTIFACT: {
+        references: ['PDPC Model AI Governance Framework 2nd Ed. Section 2.4 -- explainability; AI Verify explainability tests'],
+        classifier: (input) => {
+            if (/\b(?:ai\s+explainability|model\s+explanation|ai\s+rationale|feature\s+importance|shap\s+value|lime\s+explanation)\b/i.test(input))
+                return true;
+            if (/\b(?:xai\s+report|explainable\s+ai\s+artifact|model\s+interpretability\s+report|ai\s+transparency\s+report)\b/i.test(input))
+                return true;
+            if (/\b(?:ai\s+verify\s+explainability|imda\s+explainability|accountability\s+artifact)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AI_FAIRNESS_TEST_RESULT: {
+        references: ['AI Verify Testing Toolkit -- fairness metrics; PDPC Model AI Governance Framework Section 2.4 -- fairness'],
+        classifier: (input) => {
+            if (/\b(?:ai\s+fairness\s+test|demographic\s+parity|equalised\s+odds|equalized\s+odds|disparate\s+impact\s+ratio\s+ai)\b/i.test(input))
+                return true;
+            if (/\b(?:ai\s+verify\s+test\s+report|ai\s+verify\s+fairness|imda\s+fairness\s+test|fairness\s+metric\s+report)\b/i.test(input))
+                return true;
+            if (/\b(?:bias\s+test\s+result\s+ai|model\s+bias\s+report|ai\s+bias\s+audit\s+singapore)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    HUMAN_OVERSIGHT_RECORD: {
+        references: ['PDPC Model AI Governance Framework 2nd Ed. Section 2.3 -- human involvement; 4-level framework'],
+        classifier: (input) => {
+            if (/\b(?:human.in.the.loop|human.over.the.loop|hitl\s+record|hotl\s+record|human\s+oversight\s+log)\b/i.test(input))
+                return true;
+            if (/\b(?:human\s+override\s+record|ai\s+human\s+review\s+log|human\s+involvement\s+level\s+singapore)\b/i.test(input))
+                return true;
+            if (/\b(?:human\s+controlled\s+ai\s+record|human\s+out\s+of\s+loop\s+record|oversight\s+intervention\s+log)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AI_STAKEHOLDER_COMMUNICATION: {
+        references: ['PDPC Model AI Governance Framework 2nd Ed. Section 2.5 -- stakeholder communication; Companion Guide'],
+        classifier: (input) => {
+            if (/\b(?:ai\s+disclosure\s+singapore|stakeholder\s+ai\s+communication|ai\s+use\s+notice\s+singapore|pdpc\s+ai\s+notice)\b/i.test(input))
+                return true;
+            if (/\b(?:ai\s+limitation\s+disclosure|ai\s+impact\s+communication|singapore\s+ai\s+transparency\s+notice)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['PDPA s.2 -- personal data; PDPC Model AI Governance Framework -- personal data in AI systems'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
+                return true;
+            // Singapore NRIC / FIN pattern
+            if (/\b[STFGM]\d{7}[A-Z]\b/.test(input))
+                return true;
+            if (/\b(?:nric|fin|singapore\s+national\s+id|personal\s+data\s+sg)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['PDPA s.24 -- protection obligation; PDPC AI Governance security requirements'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.SG_MODEL_AI_GOV_PACK = {
+    categoryClassifiers: exports.SG_MODEL_AI_GOV_CATEGORY_CLASSIFIERS,
+    id: 'sg-model-ai-gov',
+    aliases: ['EN-09'],
+    name: 'Singapore PDPC Model AI Governance Framework + AI Verify',
+    version: '1.0.0',
+    description: 'Singapore PDPC Model AI Governance Framework (2nd Edition, 2020) + AI Verify (IMDA open-source AI governance testing toolkit, 2022) + Companion Guides (2022). Voluntary framework increasingly referenced in PDPA enforcement, MAS FEAT, and government procurement. Key obligations: internal AI governance structure; PDPC Decision Matrix risk classification; four-level human involvement determination (human-in-the-loop, human-over-the-loop, human-out-of-the-loop, human-controlled); explainability tier mapping; AI Verify fairness testing (9 ethics principles, 25 testable properties); stakeholder communication disclosure. AI Verify test report is the auditable artifact. Pairs with PDPA for personal data handling obligations.',
+    authority: 'IMDA (Infocomm Media Development Authority) + PDPC (Personal Data Protection Commission)',
+    industries: ['technology', 'financial-services', 'healthcare', 'government', 'hr-employment', 'retail', 'logistics', 'education'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Internal AI governance structure enforcement; PDPC Decision Matrix risk classification gate; human involvement level determination and enforcement for each AI deployment',
+            reference: 'PDPC Model AI Governance Framework 2nd Ed. Section 2.1 -- internal governance; Section 2.3 -- operations management and human oversight; PDPC Decision Matrix',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify AI decision records, explainability artifacts, fairness test results, human oversight records, and stakeholder communications for appropriate handling and retention',
+            reference: 'PDPC Model AI Governance Framework Section 2.4 -- data management; PDPA s.2 -- personal data classification; AI Verify test data classification',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident audit log of AI decisions, human oversight interventions, AI Verify test results, and stakeholder communications; required for IMDA/PDPC review and enterprise customer audit',
+            reference: 'PDPC Model AI Governance Framework Section 2.6 -- stakeholder management and documentation; AI Verify report generation; PDPA s.11 -- accountability obligation',
+        },
+        {
+            name: 'agent-auth',
+            required: true,
+            reason: 'Access control for AI decision records, fairness test results, and explainability artifacts; ensures only authorised personnel access AI governance documentation',
+            reference: 'PDPA s.24 -- protection obligation; PDPC Model AI Governance Framework Section 2.1 -- governance structure; AI Verify test report access control',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'Personal data in AI systems encrypted at rest and in transit per PDPA protection obligation; AI Verify test data encrypted during processing',
+            reference: 'PDPA s.24 -- protection obligation; PDPC Advisory Guidelines -- encryption as a reasonable security arrangement; AI Verify security requirements',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Human-in-the-loop gate for high-risk AI decisions per PDPC Decision Matrix; human override workflow for HOTL deployments; AI Verify test pass evidence sign-off',
+            reference: 'PDPC Model AI Governance Framework Section 2.3 -- human oversight levels; PDPC Decision Matrix -- high probability/severity AI decisions require HITL; AI Verify conformance sign-off',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'AI Verify test pass evidence retention (5 years); AI governance structure documentation; PDPC Decision Matrix classification records; annual AI risk review documentation',
+            reference: 'AI Verify Framework -- 5-year test artifact retention; PDPC Model AI Governance Framework Section 2.6 -- documentation; PDPC accountability obligation',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'AI failure event root cause analysis workflow; bias detection breach triggers AI Verify re-test; AI Verify non-conformance escalation; PDPA breach notification events',
+            reference: 'PDPC Model AI Governance Framework Section 2.4 -- incident response; AI Verify non-conformance remediation; PDPA s.26D -- mandatory data breach notification (effective 2022)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Third-party AI vendor governance accountability; AI Verify conformance from vendors; PDPA data intermediary obligations for AI system suppliers',
+            reference: 'PDPC Model AI Governance Framework Section 2.2 -- responsible AI use across the organisation; PDPA s.4 -- data intermediary obligations; AI Verify third-party conformance',
+        },
+        {
+            name: 'bias-monitor',
+            required: true,
+            reason: 'AI fairness monitoring per AI Verify fairness metric suite; demographic parity, equalised odds, disparate impact monitoring; continuous post-deployment bias detection',
+            reference: 'AI Verify Testing Toolkit -- fairness test suite (demographic parity, equalised odds, disparate impact ratio); PDPC Model AI Governance Framework Section 2.4 -- fairness; MAS FEAT principles',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Stakeholder communication of AI use, decisions, and limitations; explainability disclosure at appropriate tier per PDPC risk classification; AI Verify report summary disclosure',
+            reference: 'PDPC Model AI Governance Framework Section 2.5 -- stakeholder communication; Companion Guide -- disclosure to affected individuals; AI Verify public report option',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            aiRiskFrameworkRequired: true,
+            pdpcDecisionMatrixClassificationRequired: true,
+            humanInvolvementLevelDeterminationRequired: true,
+            aimsContextDefined: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['AI_DECISION_RECORD', 'AI_EXPLAINABILITY_ARTIFACT', 'AI_FAIRNESS_TEST_RESULT', 'HUMAN_OVERSIGHT_RECORD', 'AI_STAKEHOLDER_COMMUNICATION', 'PII', 'CREDENTIALS'],
+            aiDecisionRecordAction: 'WARN',
+            aiExplainabilityArtifactAction: 'WARN',
+            credentialsAction: 'BLOCK',
+        },
+        'approval-queue': {
+            humanInvolvementLevelTracked: true,
+            humanOversightLevelTracked: true,
+            hiRiskAiDecisionHumanReviewRequired: true,
+            aiVerifyConformanceSignOffRequired: true,
+        },
+        'attestation-manager': {
+            aiVerifyTestPassEvidenceRequired: true,
+            aiVerifyRetentionYears: 5,
+            aiRiskRegisterRequired: true,
+            pdpcDecisionMatrixDocumentationRequired: true,
+            annualAiRiskReviewRequired: true,
+        },
+        'event-bus': {
+            aiFailureRootCauseRequired: true,
+            biasDetectionRetestRequired: true,
+            riskCommunicationEventsActive: true,
+        },
+        'bias-monitor': {
+            friaSupported: true,
+            aiVerifyFairnessTestingRequired: true,
+            demographicParityMonitoringRequired: true,
+            equalisedOddsMonitoringRequired: true,
+            responsibleAiObjectivesTracked: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['AI-VERIFY-COMPATIBLE', 'EXPLAINABILITY-CAPABLE', 'PDPA-COMPLIANT'],
+        blockReasons: {
+            deepseek: 'PRC National Intelligence Law creates AI governance accountability gaps incompatible with PDPC Model AI Governance Framework Section 2.1 governance structure requirements and PDPA cross-border transfer restrictions.',
+            baidu: 'PRC jurisdiction. No Singapore-PRC adequacy framework. Cross-border transfer of personal data to PRC without adequate protection violates PDPA s.26 and PDPC advisory guidelines.',
+            alibaba: 'PRC jurisdiction. PDPA cross-border transfer restrictions apply. No PRC-Singapore adequacy arrangement; binding corporate rules or contractual clauses required per PDPC guidelines.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: ['AI_DECISION_RECORD', 'AI_EXPLAINABILITY_ARTIFACT', 'AI_FAIRNESS_TEST_RESULT', 'HUMAN_OVERSIGHT_RECORD', 'AI_STAKEHOLDER_COMMUNICATION', 'PII', 'CREDENTIALS'],
+        categoryActions: {
+            AI_DECISION_RECORD: 'WARN',
+            AI_EXPLAINABILITY_ARTIFACT: 'WARN',
+            AI_FAIRNESS_TEST_RESULT: 'WARN',
+            HUMAN_OVERSIGHT_RECORD: 'WARN',
+            AI_STAKEHOLDER_COMMUNICATION: 'WARN',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        // AI Verify test artifacts: 5 years per AI Verify framework.
+        // AI decision logs: retain as long as needed for purpose (PDPA) plus reasonable additional period.
+        // General PDPA documentation: typically 5-7 years in Singapore commercial practice.
+        auditLogRetentionDays: 1825, // 5 years for AI Verify test artifacts
+        sessionRetentionDays: 1825, // 5 years for AI decision logs (conservative PDPA purpose-plus-period)
+        incidentRetentionDays: 1825, // 5 years for AI failure incidents and bias detection breaches
+        reference: 'AI Verify Framework -- 5-year test artifact retention standard; PDPA s.25 -- retain no longer than necessary for purpose; PDPC Advisory Guidelines on retention -- reasonable additional period; Singapore Limitation Act (Cap 163) -- 6-year claims limitation period',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['sg'], // Singapore data residency; PDPA cross-border transfer controls apply
+    },
+    incidentPolicy: {
+        // AI failure event: PDPC Model AI Governance Framework -- root cause analysis + corrective action.
+        // Bias detection breach: AI Verify re-test + remediation before continued operation.
+        // PDPA data breach: mandatory notification to PDPC within 3 calendar days of assessment (s.26D).
+        notificationDeadlineHours: 72, // PDPA s.26D -- 3 calendar days = 72 hours for PDPA breach; AI failure events use same clock
+        reference: 'PDPA s.26D -- mandatory data breach notification to PDPC within 3 calendar days; PDPC Model AI Governance Framework -- AI failure root cause and corrective action; AI Verify -- non-conformance remediation',
+        requiredRecipients: ['pdpc-breach-portal', 'ai-risk-owner', 'chief-compliance-officer', 'data-protection-officer'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'sg-ai-gov-risk-framework',
+            description: 'AI risk management framework active; PDPC Decision Matrix classification applied to each AI deployment; risk tiers documented',
+            reference: 'PDPC Model AI Governance Framework 2nd Ed. Section 2.2 -- internal governance structure; PDPC Decision Matrix (probability of harm x severity); AI Verify risk classification',
+            check: 'iso23894_framework_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'sg-ai-gov-human-oversight',
+            description: 'Human involvement level determined for each AI deployment per 4-level framework (HITL / HOTL / Human-out-of-loop / Human-controlled); high-risk deployments require HITL gate',
+            reference: 'PDPC Model AI Governance Framework Section 2.3 -- human involvement in AI-augmented decision-making; 4-level human involvement framework; PDPC Decision Matrix',
+            check: 'iso23894_human_oversight_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'sg-ai-gov-ai-verify-conformance',
+            description: 'AI Verify test pass evidence documented and retained for 5 years; 9 ethics principles and 25 testable properties covered; non-conformance triggers remediation workflow',
+            reference: 'AI Verify Testing Toolkit -- IMDA 2022; AI Verify Framework -- 9 AI ethics principles; IMDA AI Verify test report as auditable artifact',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'sg-ai-gov-fairness-testing',
+            description: 'AI fairness testing active per AI Verify fairness metric suite; demographic parity, equalised odds, and disparate impact ratio monitored; bias detection triggers re-test',
+            reference: 'AI Verify Testing Toolkit -- fairness tests (demographic parity, equalised odds, calibration); PDPC Model AI Governance Framework Section 2.4 -- fairness; MAS FEAT Fairness principle',
+            check: 'bias_monitor_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'sg-ai-gov-data-classifier',
+            description: 'AI decision records, explainability artifacts, fairness test results, and human oversight records classified for appropriate handling',
+            reference: 'PDPC Model AI Governance Framework Section 2.4 -- data management; AI Verify data classification; PDPA s.24 -- protection obligation for personal data in AI systems',
+            check: 'data_classifier_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-explainability-tier',
+            description: 'Explainability tier mapped to PDPC risk classification; AI decisions explainable at appropriate level; AI Verify explainability tests passed',
+            reference: 'PDPC Model AI Governance Framework Section 2.4 -- explainability; AI Verify explainability test suite; Companion Guide -- explainability level by risk tier',
+            check: 'iso23894_transparency_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-risk-register',
+            description: 'AI risk register maintained; PDPC Decision Matrix risk classification records stored; annual AI risk review documented',
+            reference: 'PDPC Model AI Governance Framework Section 2.6 -- documentation; AI Verify risk register; PDPC accountability obligation; annual review requirement',
+            check: 'iso23894_risk_register_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-stakeholder-communication',
+            description: 'Stakeholder communication of AI use, decisions, and limitations active; affected individuals notified per PDPC Model AI Governance Framework',
+            reference: 'PDPC Model AI Governance Framework Section 2.5 -- stakeholder communication and disclosure; Companion Guide to Framework -- notification to affected individuals',
+            check: 'transparency_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-audit-trail',
+            description: 'Tamper-evident audit trail of AI decisions, human oversight interventions, AI Verify test results, and AI failure incidents active',
+            reference: 'PDPC Model AI Governance Framework Section 2.6 -- documentation and record-keeping; PDPA s.11 -- accountability; AI Verify audit log',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-encryption',
+            description: 'Personal data in AI systems encrypted at rest and in transit per PDPA protection obligation; AI Verify test data secured',
+            reference: 'PDPA s.24 -- protection obligation; PDPC Advisory Guidelines -- encryption as reasonable security; AI Verify security requirements',
+            check: 'encryption_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-incident-response',
+            description: 'AI failure event root cause analysis workflow active; bias detection breach triggers AI Verify re-test + remediation; PDPA breach notification clock active',
+            reference: 'PDPC Model AI Governance Framework -- incident response; AI Verify non-conformance remediation; PDPA s.26D -- 3-calendar-day breach notification',
+            check: 'monitoring_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'sg-ai-gov-supply-chain',
+            description: 'Third-party AI vendor AI Verify conformance documented; PDPA data intermediary obligations enforced in AI supply chain',
+            reference: 'PDPC Model AI Governance Framework Section 2.2 -- third-party AI use; PDPA s.4 -- data intermediary; AI Verify third-party conformance requirement',
+            check: 'subservice_registry_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=sg-model-ai-gov.js.map

package/dist/packs/sg-model-ai-gov.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sg-model-ai-gov.js","sourceRoot":"","sources":["../../src/packs/sg-model-ai-gov.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAKU,QAAA,oCAAoC,GAAwB;IACvE,kBAAkB,EAAE;QAClB,UAAU,EAAE,CAAC,wFAAwF,CAAC;QACtG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gIAAgI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9J,IAAI,4GAA4G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1I,IAAI,8FAA8F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,0GAA0G,CAAC;QACxH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sHAAsH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpJ,IAAI,gHAAgH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9I,IAAI,uFAAuF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,2GAA2G,CAAC;QACzH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sHAAsH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpJ,IAAI,+GAA+G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7I,IAAI,wFAAwF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,CAAC,gGAAgG,CAAC;QAC9G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oGAAoG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClI,IAAI,sGAAsG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpI,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,4BAA4B,EAAE;QAC5B,UAAU,EAAE,CAAC,sGAAsG,CAAC;QACpH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,wHAAwH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtJ,IAAI,0GAA0G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,8FAA8F,CAAC;QAC5G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,+BAA+B;YAC/B,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,IAAI,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,8EAA8E,CAAC;QAC5F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,oBAAoB,GAAkE;IACjG,mBAAmB,EAAE,4CAAoC;IACzD,EAAE,EAAE,iBAAiB;IACrB,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,IAAI,EAAE,0DAA0D;IAChE,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,wtBAAwtB;IAC1tB,SAAS,EAAE,0FAA0F;IACrG,UAAU,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC;IAEjI,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2KAA2K;YACnL,SAAS,EAAE,+JAA+J;SAC3K;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+KAA+K;YACvL,SAAS,EAAE,iJAAiJ;SAC7J;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8LAA8L;YACtM,SAAS,EAAE,iKAAiK;SAC7K;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,mKAAmK;YAC3K,SAAS,EAAE,kJAAkJ;SAC9J;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8IAA8I;YACtJ,SAAS,EAAE,kJAAkJ;SAC9J;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iKAAiK;YACzK,SAAS,EAAE,uLAAuL;SACnM;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2KAA2K;YACnL,SAAS,EAAE,wJAAwJ;SACpK;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wKAAwK;YAChL,SAAS,EAAE,+KAA+K;SAC3L;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iJAAiJ;YACzJ,SAAS,EAAE,4KAA4K;SACxL;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wKAAwK;YAChL,SAAS,EAAE,gMAAgM;SAC5M;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kLAAkL;YAC1L,SAAS,EAAE,oKAAoK;SAChL;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,uBAAuB,EAAE,IAAI;YAC7B,wCAAwC,EAAE,IAAI;YAC9C,0CAA0C,EAAE,IAAI;YAChD,kBAAkB,EAAE,IAAI;SACzB;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,EAAE,aAAa,CAAC;YAClL,sBAAsB,EAAE,MAAM;YAC9B,8BAA8B,EAAE,MAAM;YACtC,iBAAiB,EAAE,OAAO;SAC3B;QACD,gBAAgB,EAAE;YAChB,4BAA4B,EAAE,IAAI;YAClC,0BAA0B,EAAE,IAAI;YAChC,mCAAmC,EAAE,IAAI;YACzC,kCAAkC,EAAE,IAAI;SACzC;QACD,qBAAqB,EAAE;YACrB,gCAAgC,EAAE,IAAI;YACtC,sBAAsB,EAAE,CAAC;YACzB,sBAAsB,EAAE,IAAI;YAC5B,uCAAuC,EAAE,IAAI;YAC7C,0BAA0B,EAAE,IAAI;SACjC;QACD,WAAW,EAAE;YACX,0BAA0B,EAAE,IAAI;YAChC,2BAA2B,EAAE,IAAI;YACjC,6BAA6B,EAAE,IAAI;SACpC;QACD,cAAc,EAAE;YACd,aAAa,EAAE,IAAI;YACnB,+BAA+B,EAAE,IAAI;YACrC,mCAAmC,EAAE,IAAI;YACzC,+BAA+B,EAAE,IAAI;YACrC,8BAA8B,EAAE,IAAI;SACrC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC;QAC1F,YAAY,EAAE;YACZ,QAAQ,EAAE,yNAAyN;YACnO,KAAK,EAAE,mLAAmL;YAC1L,OAAO,EAAE,sLAAsL;SAChM;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,oBAAoB,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,KAAK,EAAE,aAAa,CAAC;QAC/K,eAAe,EAAE;YACf,kBAAkB,EAAE,MAAM;YAC1B,0BAA0B,EAAE,MAAM;YAClC,uBAAuB,EAAE,MAAM;YAC/B,sBAAsB,EAAE,MAAM;YAC9B,4BAA4B,EAAE,MAAM;YACpC,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,6DAA6D;QAC7D,mGAAmG;QACnG,oFAAoF;QACpF,qBAAqB,EAAE,IAAI,EAAE,uCAAuC;QACpE,oBAAoB,EAAE,IAAI,EAAG,uEAAuE;QACpG,qBAAqB,EAAE,IAAI,EAAE,+DAA+D;QAC5F,SAAS,EAAE,wQAAwQ;QACnR,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,sEAAsE;KAC5F;IAED,cAAc,EAAE;QACd,mGAAmG;QACnG,qFAAqF;QACrF,iGAAiG;QACjG,yBAAyB,EAAE,EAAE,EAAE,6FAA6F;QAC5H,SAAS,EAAE,8MAA8M;QACzN,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,0BAA0B,EAAE,yBAAyB,CAAC;QAClH,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,+HAA+H;YAC5I,SAAS,EAAE,+KAA+K;YAC1L,KAAK,EAAE,2BAA2B;YAClC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,+KAA+K;YAC5L,SAAS,EAAE,gKAAgK;YAC3K,KAAK,EAAE,iCAAiC;YACxC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,iCAAiC;YACrC,WAAW,EAAE,yKAAyK;YACtL,SAAS,EAAE,yIAAyI;YACpJ,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,2KAA2K;YACxL,SAAS,EAAE,wLAAwL;YACnM,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,uIAAuI;YACpJ,SAAS,EAAE,sKAAsK;YACjL,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,WAAW,EAAE,8IAA8I;YAC3J,SAAS,EAAE,6JAA6J;YACxK,KAAK,EAAE,8BAA8B;YACrC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,wHAAwH;YACrI,SAAS,EAAE,qJAAqJ;YAChK,KAAK,EAAE,+BAA+B;YACtC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,8IAA8I;YAC3J,SAAS,EAAE,kKAAkK;YAC7K,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,oIAAoI;YACjJ,SAAS,EAAE,sIAAsI;YACjJ,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,WAAW,EAAE,0HAA0H;YACvI,SAAS,EAAE,oIAAoI;YAC/I,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,6JAA6J;YAC1K,SAAS,EAAE,kJAAkJ;YAC7J,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,wHAAwH;YACrI,SAAS,EAAE,oJAAoJ;YAC/J,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}

package/dist/packs/soc1.d.ts

@@ -0,0 +1,34 @@
+/**
+ * SOC 1 / SSAE 18 Compliance Pack
+ *
+ * Service Organisation Control over Internal Control over Financial
+ * Reporting (ICFR). Applies when the service organisation's controls
+ * affect user entities' financial statements -- payroll processors,
+ * SaaS handling financial data, managed financial hosting, transaction
+ * processors, fund administrators, benefits administrators.
+ *
+ * Maps AICPA SSAE 18 (AT-C 320) control objectives to governance
+ * modules. International equivalent: ISAE 3402.
+ *
+ * Type I vs Type II:
+ *   - Type I validates control DESIGN at a point in time.
+ *   - Type II validates operating EFFECTIVENESS over 6-12 months.
+ * Pax1 produces continuous evidence suitable for both. Type II
+ * requires a minimum 6 months of evidence from audit-integrity and
+ * attestation-manager.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * SOC 1 / SSAE 18 (ICFR) category classifiers.
+ * SOC 1 governs controls over financial reporting at service organisations.
+ * CREDENTIALS protects access to financial control systems; PII covers
+ * personal data appearing in financial records (payroll, benefits, etc.).
+ */
+export declare const SOC1_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const SOC1_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+};
+//# sourceMappingURL=soc1.d.ts.map

package/dist/packs/soc1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc1.d.ts","sourceRoot":"","sources":["../../src/packs/soc1.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAG/E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAyDvC,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAA;CAwMlF,CAAC"}