@euconform/core 1.2.0 → 1.3.0

package/tests/evidence/ecef-schemas.test.ts

@@ -0,0 +1,316 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+type JsonSchema = {
+  $defs?: Record<string, JsonSchema>;
+  $ref?: string;
+  const?: unknown;
+  enum?: unknown[];
+  type?: "object" | "array" | "string" | "boolean" | "integer";
+  required?: string[];
+  properties?: Record<string, JsonSchema>;
+  additionalProperties?: boolean;
+  items?: JsonSchema;
+  format?: string;
+  pattern?: string;
+  minItems?: number;
+};
+
+const ROOT = resolve(__dirname, "../../../..");
+const SCHEMAS_DIR = resolve(ROOT, "docs/ecef/schemas");
+const EXAMPLES_DIR = resolve(ROOT, "docs/ecef/examples");
+
+function readJson<T>(path: string): T {
+  return JSON.parse(readFileSync(path, "utf8")) as T;
+}
+
+function resolveRef(rootSchema: JsonSchema, ref: string): JsonSchema {
+  if (!ref.startsWith("#/")) {
+    throw new Error(`Unsupported schema ref: ${ref}`);
+  }
+
+  const pathSegments = ref.slice(2).split("/");
+  let current: unknown = rootSchema;
+
+  for (const segment of pathSegments) {
+    if (!current || typeof current !== "object" || !(segment in current)) {
+      throw new Error(`Unable to resolve schema ref: ${ref}`);
+    }
+    current = (current as Record<string, unknown>)[segment];
+  }
+
+  return current as JsonSchema;
+}
+
+function checkAdditionalProperties(
+  schema: JsonSchema,
+  objectValue: Record<string, unknown>,
+  path: string
+): string[] {
+  if (schema.additionalProperties !== false || !schema.properties) return [];
+  const allowed = new Set(Object.keys(schema.properties));
+  return Object.keys(objectValue)
+    .filter((key) => !allowed.has(key))
+    .map((key) => `${path}.${key} is not allowed (additionalProperties: false)`);
+}
+
+function validateObjectSchema(
+  rootSchema: JsonSchema,
+  schema: JsonSchema,
+  value: unknown,
+  path: string
+): string[] {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return [`${path} must be an object`];
+  }
+
+  const errors: string[] = [];
+  const objectValue = value as Record<string, unknown>;
+
+  for (const field of schema.required ?? []) {
+    if (!(field in objectValue)) {
+      errors.push(`${path}.${field} is required`);
+    }
+  }
+
+  errors.push(...checkAdditionalProperties(schema, objectValue, path));
+
+  for (const [key, propertySchema] of Object.entries(schema.properties ?? {})) {
+    if (key in objectValue) {
+      errors.push(
+        ...validateAgainstSchema(rootSchema, propertySchema, objectValue[key], `${path}.${key}`)
+      );
+    }
+  }
+
+  return errors;
+}
+
+function validateArraySchema(
+  rootSchema: JsonSchema,
+  schema: JsonSchema,
+  value: unknown,
+  path: string
+): string[] {
+  if (!Array.isArray(value)) {
+    return [`${path} must be an array`];
+  }
+
+  const errors: string[] = [];
+
+  if (schema.minItems !== undefined && value.length < schema.minItems) {
+    errors.push(`${path} must have at least ${schema.minItems} item(s)`);
+  }
+
+  if (!schema.items) return errors;
+
+  for (let i = 0; i < value.length; i++) {
+    errors.push(...validateAgainstSchema(rootSchema, schema.items, value[i], `${path}[${i}]`));
+  }
+  return errors;
+}
+
+function validatePrimitive(schema: JsonSchema, value: unknown, path: string): string[] {
+  if (schema.type === "string") {
+    if (typeof value !== "string") return [`${path} must be a string`];
+    if (schema.pattern && !new RegExp(schema.pattern).test(value)) {
+      return [`${path} must match pattern ${schema.pattern}`];
+    }
+    return [];
+  }
+  if (schema.type === "boolean" && typeof value !== "boolean") {
+    return [`${path} must be a boolean`];
+  }
+  if (schema.type === "integer" && !Number.isInteger(value)) {
+    return [`${path} must be an integer`];
+  }
+  return [];
+}
+
+function validateAgainstSchema(
+  rootSchema: JsonSchema,
+  schema: JsonSchema,
+  value: unknown,
+  path = "$"
+): string[] {
+  if (schema.$ref) {
+    return validateAgainstSchema(rootSchema, resolveRef(rootSchema, schema.$ref), value, path);
+  }
+
+  if ("const" in schema && value !== schema.const) {
+    return [`${path} must equal ${JSON.stringify(schema.const)}`];
+  }
+
+  if (schema.enum && !schema.enum.includes(value)) {
+    return [
+      `${path} must be one of ${schema.enum.map((entry) => JSON.stringify(entry)).join(", ")}`,
+    ];
+  }
+
+  if (schema.type === "object") return validateObjectSchema(rootSchema, schema, value, path);
+  if (schema.type === "array") return validateArraySchema(rootSchema, schema, value, path);
+
+  return validatePrimitive(schema, value, path);
+}
+
+const SCHEMA_FILES = {
+  report: resolve(SCHEMAS_DIR, "report-v1.schema.json"),
+  aibom: resolve(SCHEMAS_DIR, "aibom-v1.schema.json"),
+  ci: resolve(SCHEMAS_DIR, "ci-v1.schema.json"),
+  bundle: resolve(SCHEMAS_DIR, "bundle-v1.schema.json"),
+} as const;
+
+const EXAMPLE_FILES = {
+  report: "euconform.report.json",
+  aibom: "euconform.aibom.json",
+  ci: "euconform.ci.json",
+  bundle: "euconform.bundle.json",
+} as const;
+
+describe("ECEF schemas", () => {
+  const schemaEntries = Object.entries(SCHEMA_FILES).map(([kind, path]) => [
+    kind,
+    readJson<JsonSchema>(path),
+  ]) as Array<[keyof typeof SCHEMA_FILES, JsonSchema]>;
+
+  it("validates every documented example artifact set", () => {
+    const exampleDirs = readdirSync(EXAMPLES_DIR, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .sort();
+
+    expect(exampleDirs).toEqual(["local-ollama", "non-ai", "rag", "web-app"]);
+
+    for (const exampleDir of exampleDirs) {
+      for (const [kind, schema] of schemaEntries) {
+        const artifactPath = resolve(EXAMPLES_DIR, exampleDir, EXAMPLE_FILES[kind]);
+        const artifact = readJson<unknown>(artifactPath);
+        const errors = validateAgainstSchema(schema, schema, artifact);
+
+        expect(errors, `${exampleDir}/${EXAMPLE_FILES[kind]}\n${errors.join("\n")}`).toEqual([]);
+      }
+    }
+  });
+
+  it("rejects documents with missing required fields", () => {
+    for (const [kind, schema] of schemaEntries) {
+      const minimal: Record<string, unknown> = {};
+      const errors = validateAgainstSchema(schema, schema, minimal);
+      expect(errors.length, `${kind}: empty object should fail validation`).toBeGreaterThan(0);
+    }
+  });
+
+  it("rejects documents with wrong types", () => {
+    const reportSchema = schemaEntries.find(([kind]) => kind === "report")?.[1];
+    if (!reportSchema) throw new Error("report schema not found");
+
+    const badReport = {
+      schemaVersion: "euconform.report.v1",
+      generatedAt: 12345,
+      tool: "not-an-object",
+      target: null,
+      aiFootprint: [],
+      complianceSignals: "wrong",
+      assessmentHints: false,
+      gaps: "not-array",
+      recommendationSummary: {},
+    };
+    const errors = validateAgainstSchema(reportSchema, reportSchema, badReport);
+    expect(errors.length).toBeGreaterThan(0);
+  });
+
+  it("rejects documents with additional properties", () => {
+    const artifactPath = resolve(EXAMPLES_DIR, "web-app", EXAMPLE_FILES.report);
+    const artifact = readJson<Record<string, unknown>>(artifactPath);
+    const extraProps = { ...artifact, unknownField: "should-fail" };
+
+    const reportSchema = schemaEntries.find(([kind]) => kind === "report")?.[1];
+    if (!reportSchema) throw new Error("report schema not found");
+
+    const errors = validateAgainstSchema(reportSchema, reportSchema, extraProps);
+    expect(errors.some((e) => e.includes("unknownField"))).toBe(true);
+  });
+
+  it("rejects invalid enum values", () => {
+    const ciSchema = schemaEntries.find(([kind]) => kind === "ci")?.[1];
+    if (!ciSchema) throw new Error("ci schema not found");
+
+    const artifactPath = resolve(EXAMPLES_DIR, "web-app", EXAMPLE_FILES.ci);
+    const artifact = readJson<Record<string, unknown>>(artifactPath);
+    const badCi = {
+      ...artifact,
+      scanScope: "invalid-scope",
+    };
+    const errors = validateAgainstSchema(ciSchema, ciSchema, badCi);
+    expect(errors.some((e) => e.includes("scanScope"))).toBe(true);
+  });
+
+  it("keeps schemaVersion aligned with the documented file family", () => {
+    const expectedVersions = {
+      report: "euconform.report.v1",
+      aibom: "euconform.aibom.v1",
+      ci: "euconform.ci.v1",
+      bundle: "euconform.bundle.v1",
+    } as const;
+
+    const exampleDirs = readdirSync(EXAMPLES_DIR, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name);
+
+    for (const exampleDir of exampleDirs) {
+      for (const [kind, filename] of Object.entries(EXAMPLE_FILES) as Array<
+        [keyof typeof EXAMPLE_FILES, string]
+      >) {
+        const artifact = readJson<{ schemaVersion?: string }>(
+          resolve(EXAMPLES_DIR, exampleDir, filename)
+        );
+        expect(artifact.schemaVersion).toBe(expectedVersions[kind]);
+      }
+    }
+  });
+
+  it("rejects bundle with invalid sha256 format", () => {
+    const bundleSchema = schemaEntries.find(([kind]) => kind === "bundle")?.[1];
+    if (!bundleSchema) throw new Error("bundle schema not found");
+
+    const badBundle = {
+      schemaVersion: "euconform.bundle.v1",
+      generatedAt: "2026-01-01T00:00:00Z",
+      tool: { name: "euconform", version: "1.0.0" },
+      target: { name: "test", rootPath: "/test" },
+      artifacts: [
+        {
+          role: "report",
+          fileName: "euconform.report.json",
+          sha256: "not-a-valid-hash",
+          required: true,
+        },
+      ],
+    };
+    const errors = validateAgainstSchema(bundleSchema, bundleSchema, badBundle);
+    expect(errors.some((e) => e.includes("sha256"))).toBe(true);
+  });
+
+  it("rejects bundle with invalid artifact role", () => {
+    const bundleSchema = schemaEntries.find(([kind]) => kind === "bundle")?.[1];
+    if (!bundleSchema) throw new Error("bundle schema not found");
+
+    const badBundle = {
+      schemaVersion: "euconform.bundle.v1",
+      generatedAt: "2026-01-01T00:00:00Z",
+      tool: { name: "euconform", version: "1.0.0" },
+      target: { name: "test", rootPath: "/test" },
+      artifacts: [
+        {
+          role: "unknown-role",
+          fileName: "test.json",
+          sha256: "a".repeat(64),
+          required: true,
+        },
+      ],
+    };
+    const errors = validateAgainstSchema(bundleSchema, bundleSchema, badBundle);
+    expect(errors.some((e) => e.includes("role"))).toBe(true);
+  });
+});

package/tests/evidence/hash.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { sha256Hex } from "../../src/evidence/hash";
+
+describe("sha256Hex", () => {
+  it("produces correct hex digest for known input", () => {
+    expect(sha256Hex("hello")).toBe(
+      "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+    );
+  });
+
+  it("produces 64-character hex string", () => {
+    const result = sha256Hex("test content");
+    expect(result).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it("handles empty string", () => {
+    const result = sha256Hex("");
+    expect(result).toMatch(/^[a-f0-9]{64}$/);
+    expect(result).toBe("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+  });
+
+  it("produces different hashes for different inputs", () => {
+    expect(sha256Hex("a")).not.toBe(sha256Hex("b"));
+  });
+});

package/tests/evidence/markdown.test.ts

@@ -0,0 +1,92 @@
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import { generateScanOutput } from "../../src/evidence/output";
+import { scanRepository } from "../../src/scanner/aggregator";
+
+const FIXTURES = resolve(import.meta.dirname, "../fixtures");
+
+describe("generateSummaryMarkdown", () => {
+  it("includes disclaimer text", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("technical guidance only");
+    expect(output.summaryMarkdown).toContain("does not constitute legal advice");
+    expect(output.summaryMarkdown).toContain("Scan scope: `production`");
+  });
+
+  it("includes project overview section", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("## Project Overview");
+    expect(output.summaryMarkdown).toContain(output.report.target.name);
+  });
+
+  it("includes AI components section", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("## AI Components Detected");
+    // Table headers
+    expect(output.summaryMarkdown).toContain("| Component |");
+    expect(output.summaryMarkdown).toContain("| Kind |");
+  });
+
+  it("includes compliance signals table", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("## Compliance Signals");
+    expect(output.summaryMarkdown).toContain("| Area | Status |");
+  });
+
+  it("includes open questions section", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("## Open Questions");
+  });
+
+  it("includes recommended actions section", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("## Recommended Actions");
+  });
+
+  it("includes footer with artifact references", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.summaryMarkdown).toContain("euconform.report.json");
+    expect(output.summaryMarkdown).toContain("euconform.aibom.json");
+  });
+
+  it("handles project with no AI components", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "plain-webapp"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    // plain-webapp still lists framework components (e.g. express) in the BOM,
+    // but the report should indicate no AI is being used
+    expect(output.report.aiFootprint.usesAI).toBe(false);
+    // Assessment hints section should reflect no AI detected
+    expect(output.summaryMarkdown).toContain("No assessment hints generated (no AI detected)");
+  });
+});

package/tests/evidence/output.test.ts

@@ -0,0 +1,203 @@
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import { generateScanOutput } from "../../src/evidence/output";
+import { scanRepository } from "../../src/scanner/aggregator";
+
+const FIXTURES = resolve(__dirname, "../fixtures");
+const MONOREPO_ROOT = resolve(__dirname, "../../../..");
+
+describe("generateScanOutput", () => {
+  it("generates valid report schema for AI project", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.report.schemaVersion).toBe("euconform.report.v1");
+    expect(output.report.generatedAt).toBeTruthy();
+    expect(output.report.tool.name).toBe("euconform");
+    expect(output.report.tool.version).toBeTruthy();
+    expect(output.report.target.rootPath).toBeTruthy();
+    expect(output.report.target.name).toBeTruthy();
+    expect(output.report.aiFootprint).toBeDefined();
+    expect(output.report.complianceSignals).toBeDefined();
+    expect(output.report.assessmentHints).toBeDefined();
+    expect(output.report.gaps).toBeDefined();
+    expect(output.report.recommendationSummary).toBeDefined();
+  });
+
+  it("keeps documentation-only disclosure as a hint, not an implementation", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.report.complianceSignals.disclosure.status).toBe("absent");
+    expect(
+      output.report.assessmentHints.riskIndicators.some((hint) =>
+        hint.hint.toLowerCase().includes("documentation references ai disclosure")
+      )
+    ).toBe(true);
+  });
+
+  it("generates valid AIBOM schema", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.aibom.schemaVersion).toBe("euconform.aibom.v1");
+    expect(output.aibom.project.name).toBeTruthy();
+    expect(Array.isArray(output.aibom.components)).toBe(true);
+    expect(output.aibom.components.length).toBeGreaterThan(0);
+
+    // Each component should have required fields
+    for (const comp of output.aibom.components) {
+      expect(comp.id).toBeTruthy();
+      expect(comp.kind).toBeTruthy();
+      expect(comp.name).toBeTruthy();
+      expect(comp.source).toBeTruthy();
+    }
+  });
+
+  it("generates stable, readable AIBOM component ids", { timeout: 15_000 }, async () => {
+    const scanResult = await scanRepository({
+      targetPath: MONOREPO_ROOT,
+    });
+    const output = generateScanOutput(scanResult);
+    const ids = output.aibom.components.map((component) => component.id);
+
+    expect(new Set(ids).size).toBe(ids.length);
+    expect(ids.every((id) => !id.includes("--"))).toBe(true);
+    expect(ids.every((id) => id.includes(":"))).toBe(true);
+  });
+
+  it("derives export capabilities from reporting signals", { timeout: 15_000 }, async () => {
+    const scanResult = await scanRepository({
+      targetPath: MONOREPO_ROOT,
+    });
+    const output = generateScanOutput(scanResult);
+
+    const reportingEvidence = output.report.complianceSignals.reportingExports.evidence;
+    expect(output.aibom.complianceCapabilities.jsonExport).toBe(
+      reportingEvidence.some(
+        (e) => e.file.includes(".json") || e.snippet.toLowerCase().includes("json")
+      )
+    );
+  });
+
+  it("generates summary markdown", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(typeof output.summaryMarkdown).toBe("string");
+    expect(output.summaryMarkdown.length).toBeGreaterThan(0);
+
+    // Should contain expected markdown sections
+    expect(output.summaryMarkdown).toContain("# EuConform Scan Report");
+    expect(output.summaryMarkdown).toContain("## Project Overview");
+    expect(output.summaryMarkdown).toContain("## AI Components Detected");
+    expect(output.summaryMarkdown).toContain("## Compliance Signals");
+  });
+
+  it("reports AI detected = true for AI project", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.report.aiFootprint.usesAI).toBe(true);
+    expect(output.report.aiFootprint.providerHints.length).toBeGreaterThan(0);
+  });
+
+  it("reports AI detected = false for plain webapp", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "plain-webapp"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.report.aiFootprint.usesAI).toBe(false);
+    expect(output.report.aiFootprint.providerHints).toHaveLength(0);
+    expect(output.report.aiFootprint.inferenceModes).toHaveLength(0);
+  });
+
+  it("generates gaps for AI project without compliance signals", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    // nextjs-openai has AI but minimal compliance infrastructure,
+    // so gaps should be generated
+    expect(output.report.gaps.length).toBeGreaterThan(0);
+
+    // Each gap should have required fields
+    for (const gap of output.report.gaps) {
+      expect(gap.id).toBeTruthy();
+      expect(gap.title).toBeTruthy();
+      expect(gap.description).toBeTruthy();
+      expect(["critical", "high", "medium", "low"]).toContain(gap.priority);
+      expect(["missing", "partial"]).toContain(gap.status);
+      expect(gap.basis).toBe("scanner-rule");
+    }
+  });
+
+  it("generates no gaps for plain webapp", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "plain-webapp"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    // No AI detected means no compliance gaps
+    expect(output.report.gaps).toHaveLength(0);
+  });
+
+  it("includes compliance signals in report", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "compliance-good"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    const { complianceSignals } = output.report;
+
+    // compliance-good has logging (pino) and incident reporting (sentry)
+    // At least some compliance areas should not be "absent"
+    const statuses = Object.values(complianceSignals).map((g) => g.status);
+    const nonAbsent = statuses.filter((s) => s === "present" || s === "partial");
+    expect(nonAbsent.length).toBeGreaterThan(0);
+  });
+
+  it("includes recommendations", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(output.report.recommendationSummary.length).toBeGreaterThan(0);
+
+    // Should contain wizard recommendation or be capped at 5 entries
+    const hasWizard = output.report.recommendationSummary.some((r) =>
+      r.toLowerCase().includes("wizard")
+    );
+    // The list is capped at 5 — wizard may be trimmed for projects with many gaps
+    if (output.report.recommendationSummary.length < 5) {
+      expect(hasWizard).toBe(true);
+    }
+    expect(output.report.recommendationSummary.length).toBeLessThanOrEqual(5);
+  });
+
+  it("uses softened GPAI wording for cloud providers", async () => {
+    const scanResult = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+    const output = generateScanOutput(scanResult);
+
+    expect(
+      output.report.assessmentHints.gpaiIndicators.some((hint) =>
+        hint.hint.includes("Provider obligations depend on your role")
+      )
+    ).toBe(true);
+  });
+});

package/tests/fixtures/compliance-good/README.md

@@ -0,0 +1,14 @@
+# Compliant AI Service
+
+This service integrates AI capabilities with full compliance infrastructure.
+
+## AI Disclosure
+
+This service uses artificial intelligence (OpenAI GPT-4) to generate responses.
+All AI-generated outputs are clearly labeled and subject to human review.
+
+## Data Governance
+
+- All user data is anonymized before processing
+- AI model inputs and outputs are logged for audit purposes
+- Data retention policy: 90 days

package/tests/fixtures/compliance-good/lib/ai-service.ts

@@ -0,0 +1,17 @@
+import OpenAI from "openai";
+import pino from "pino";
+
+const logger = pino({ name: "ai-service" });
+const openai = new OpenAI();
+
+export async function generateResponse(prompt: string, userId: string) {
+  logger.info({ userId, action: "ai-request" }, "Processing AI request");
+
+  const response = await openai.chat.completions.create({
+    model: "gpt-4",
+    messages: [{ role: "user", content: prompt }],
+  });
+
+  logger.info({ userId, action: "ai-response", model: "gpt-4" }, "AI response generated");
+  return response;
+}

package/tests/fixtures/compliance-good/lib/review-flow.ts

@@ -0,0 +1,11 @@
+export interface ReviewDecision {
+  approved: boolean;
+  reviewerId: string;
+  timestamp: Date;
+  overrideReason?: string;
+}
+
+export async function requireHumanApproval(_aiOutput: string): Promise<ReviewDecision> {
+  // Human review gate - AI output must be approved before action
+  return { approved: false, reviewerId: "", timestamp: new Date() };
+}

package/tests/fixtures/compliance-good/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "compliant-ai-service",
+  "version": "2.0.0",
+  "dependencies": {
+    "openai": "^4.0.0",
+    "pino": "^8.0.0",
+    "@sentry/node": "^7.0.0",
+    "@euconform/core": "^1.0.0"
+  }
+}