staisix-cli 1.0.0 → 1.0.2

package/.github/workflows/publish.yml

@@ -0,0 +1,29 @@
+name: Publish Package to NPM Registry
+
+on:
+  release:
+    types: [created] # Fires automatically whenever you tag an official launch release in GitHub!
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # CRITICAL! This requests the secure OIDC cryptographic token required for Trusted Publishing!
+    steps:
+      - name: Checkout Codebase Repository
+        uses: actions/checkout@v4
+
+      - name: Initialize Node.js Environment Runtime
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://npmjs.org'
+
+      - name: Sync Project Dependencies
+        run: npm ci
+
+      - name: Execute Automated Global CDN Deployment
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # Bypassed dynamically via your secure Trusted Publisher handshake loop!

package/README.md

@@ -0,0 +1,89 @@
+# staisix-cli 📡
+
+[![npm version](https://shields.io)](https://npmjs.com)
+[![License: MIT](https://shields.io)](https://opensource.org)
+
+> **Continuous Policy-as-Code AI Governance.** Shift compliance left by embedding automated regulatory guardrails directly inside your local developer GitOps pipelines.
+
+---
+
+## 🚀 Overview
+
+**STAISIX** turns complex international AI regulations (including the **EU AI Act**, **NIST AI RMF**, and **ISO/IEC 42001**) into deterministic, automated filesystem inspection checks. 
+
+The `staisix-cli` binary intercepts non-compliant model repository builds directly within your local CI/CD engine runtimes—halting code promotions before non-compliant systems reach live production networks, while delivering 15-minute diagnostic self-remediation logs directly in the developer terminal console.
+
+---
+
+## 🛠️ Installation
+
+Install the compliance scanning engine globally on your system path via the Node Package Manager:
+
+```bash
+npm install -g staisix-cli
+```
+
+---
+
+## 🏁 Quick Start: 3-Step Repository Initialization
+
+### 1. Provision Your Local Configuration File
+Create a new file named exactly `staisix.config.json` right inside your root repository folder path to define your tenant identification parameters:
+
+```json
+{
+  "organization": "Your Company Name",
+  "aiSystemName": "your_repository_microservice_name"
+}
+```
+
+### 2. Establish Your Evidence Asset Folder Tree
+STAISIX evaluates your framework controls locally through decoupled evidence artifacts. Create your local subfolder structure:
+
+```bash
+mkdir -p .staisix/evidence
+```
+
+### 3. Execute Your First Compliance Scan
+To evaluate your repository filesystem against active global compliance guardrails, run the binary scanner natively:
+
+```bash
+staisix scan
+```
+
+---
+
+## 📋 Evaluated Framework Controls Mapping
+
+| Control Token ID | Checked Repository File Asset | Cross-Regulatory Legal Alignments |
+| :--- | :--- | :--- |
+| **`STX-OVERSIGHT-01`** | `.staisix/evidence/oversight_policy.md` | • **EU AI Act:** Article 14 (Human Oversight)<br>• **NIST AI RMF:** GOVERN 1.2 (Roles & Responsibilities)<br>• **ISO 42001:** Annex A.7.4 (Human Supervision) |
+| **`STX-DATA-02`** | `.staisix/evidence/data_manifest.csv` | • **EU AI Act:** Article 10 (Data Governance)<br>• **NIST AI RMF:** MEASURE 2.1 (Data Lineage Tracing)<br>• **ISO 42001:** Annex A.8.2 (Data for AI Systems) |
+
+---
+
+## 🛑 Self-Remediation Workflow (How to Clear Blocker Gates)
+
+If an automated scan intercepts your build layout and returns a hard exit code `1` (`🛑 [BUILD ERROR]`), read your terminal output logs to identify the missing documentation. 
+
+To "self-heal" the pipeline and unblock your release timeline, populate your nested `.staisix/evidence/` folder path with the required framework compliance artifacts:
+
+*   **To clear `STX-OVERSIGHT-01`:** Document your human-in-the-loop oversight mechanisms inside `.staisix/evidence/oversight_policy.md`.
+*   **To clear `STX-DATA-02`:** Document your training dataset characteristics, data provenance parameters, and compliance hashes inside `.staisix/evidence/data_manifest.csv`.
+
+Once the missing evidence files exist in the repository, re-running `staisix scan` will pass instantly, print a green success log, and authorize a successful production code promotion with exit code `0`.
+
+---
+
+## 🔒 Data Privacy & Multi-Tenant Security Blueprint
+
+The `staisix-cli` utility respects strict corporate data privacy standards. **Our scanner never accesses, views, or ingests your proprietary model weights or source code files.** 
+
+The scanning engine performs all logical evaluation loops completely within your local system's isolated runtime runtime memory. Only a passing/blocked status flag, your system identification tokens, and the triggered failure Control IDs are transmitted over the web to our secure multi-tenant ledger.
+
+---
+
+## ⚡ Support & Beta Pilot Access
+To acquire a verified corporate registration key or gain access to your cloud GRC Executive Summary Monitoring dashboards, visit your portal at [staisix.com](https://staisix.com).
+
+*For priority technical support channels, connect with your assigned Technical Account Manager directly inside your team's dedicated Slack connect channel.*

package/index.js

@@ -4,9 +4,18 @@ import axios from 'axios';
 import fs from 'fs';
 import path from 'path';
 
-// THE IMMUTABLE GLOBAL BACKEND DESTINATION - SECURED FROM USER TYPOS
+// ==================================================================
+// 📡 VERIFIED PLATFORM ENDPOINTS & SECURITY AUTHORIZATION KEYS
+// ==================================================================
 const GLOBAL_WEBHOOK_URL = "https://hooks.airtable.com/workflows/v1/genericWebhook/appq8GkI2I3WoCUpz/wflRsuzzM1dlsRozN/wtrJjaewHuPjtErcj";
 
+//提取 Base ID from your working webhook path string natively
+const BASE_ID = "appq8GkI2I3WoCUpz"; 
+const COMPLIANCE_API_ENDPOINT = `https://airtable.com{BASE_ID}/Table%2026`;
+
+// Replace this placeholder string with your true personal access token when ready to run web fetches
+const AIRTABLE_PAT = "patYOUR_ACTUAL_PERSONAL_ACCESS_TOKEN"; 
+
 async function runCliEngine() {
   // Capture terminal flags (e.g., node index.js scan)
   const args = process.argv.slice(2);
@@ -38,48 +47,67 @@ async function runCliEngine() {
     evidenceDirectory: path.join(currentWorkingDir, '.staisix', 'evidence')
   };
 
-  console.log("\n🔍 [STAISIX] Initiating dynamic framework verification scan...");
+  console.log("\n🔍 [STAISIX] Pulling latest multi-framework policy registry over the web...");
   console.log(`📡 [STAISIX] Target Repository Asset: [${REPO_METADATA.aiSystemName}]`);
   console.log("------------------------------------------------------------------");
 
   let failureCount = 0;
   let activeViolationID = null;
+  let dynamicRulesCatalog = [];
 
-  console.log("✅ [GATE 1 PASSED] AI use case successfully identified via metadata matrix.");
-  console.log("✅ [GATE 2 PASSED] Layer 2 risk parameters classification complete.");
-
-  // Evaluate Human Oversight File Path
-  const oversightFile = path.join(REPO_METADATA.evidenceDirectory, 'oversight_policy.md');
-  const oversightExists = fs.existsSync(oversightFile);
-
-  if (!oversightExists) {
-    failureCount = 1;
-    activeViolationID = "STX-OVERSIGHT-01";
-    console.log(`❌ [PIPELINE ERROR] Local filesystem breach mapped to Control ID: [${activeViolationID}]`);
-    console.log("❌ [GATE 3 FAILED] Critical Blocker: No qualified human operator assigned to system loops.");
-  } else {
-    console.log("✅ [GATE 3 PASSED] Manual governance & human oversight logs verified locally via oversight_policy.md.");
+  // ==================================================================
+  // 🌐 STAGE 1: Fetch all dynamic compliance rows live from Table 26
+  // ==================================================================
+  try {
+    const response = await axios.get(COMPLIANCE_API_ENDPOINT, {
+      headers: { Authorization: `Bearer ${AIRTABLE_PAT}` }
+    });
+    
+    // Map whatever rows exist in Table 26 straight to local memory
+    dynamicRulesCatalog = response.data.records.map(record => ({
+      controlID: record.fields.Control_ID,
+      fileName: record.fields["Required File Target"]
+    })).filter(rule => rule.controlID && rule.fileName); // Exclude blank rows
+
+    console.log(`✅ [SYNC SUCCESS] Loaded ${dynamicRulesCatalog.length} regulatory control rules natively.`);
+  } catch (error) {
+    // FALLBACK SAFETY NET: Ensures your MVP scans perfectly even if the PAT token is not inputted yet!
+    dynamicRulesCatalog = [
+      { controlID: "STX-OVERSIGHT-01", fileName: "oversight_policy.md" },
+      { controlID: "STX-DATA-02", fileName: "data_manifest.csv" }
+    ];
+    console.log(`⚠️ [FALLBACK ENABLED] Network sync paused. Loaded baseline controls catalog (${dynamicRulesCatalog.length} active gates).`);
   }
 
-  // Evaluate Dataset Manifest File Path
-  const dataManifestFile = path.join(REPO_METADATA.evidenceDirectory, 'data_manifest.csv');
-  const dataManifestExists = fs.existsSync(dataManifestFile);
-
-  if (oversightExists && !dataManifestExists) {
-    failureCount = 1;
-    activeViolationID = "STX-DATA-02";
-    console.log(`❌ [PIPELINE ERROR] Local filesystem breach mapped to Control ID: [${activeViolationID}]`);
-    console.log("❌ [GATE 5 FAILED] Training data lineage logs violate Clause 8 Data Governance constraints.");
-  } else if (oversightExists && dataManifestExists) {
-    console.log("✅ [GATE 5 PASSED] Training data lineage and sourcing artifacts documented.");
-  } else {
-    console.log("⚠️ [GATE 5 SKIPPED] Sourcing documentation analysis paused until baseline oversight clears.");
+  console.log("------------------------------------------------------------------");
+  console.log("🧪 [SCAN ACTIVE] Evaluating local filesystem repository files...");
+
+  // ==================================================================
+  // 🔬 STAGE 2: Dynamically loop through your incoming row metrics
+  // ==================================================================
+  for (const rule of dynamicRulesCatalog) {
+    const targetFilePath = path.join(REPO_METADATA.evidenceDirectory, rule.fileName);
+    const fileExists = fs.existsSync(targetFilePath);
+
+    if (!fileExists) {
+      failureCount++;
+      activeViolationID = rule.controlID; // Dynamically captures the current missing file's control ID
+      
+      console.log(`❌ [PIPELINE ERROR] Local filesystem breach mapped to Control ID: [${activeViolationID}]`);
+      if (activeViolationID === "STX-OVERSIGHT-01") {
+        console.log("❌ [GATE 3 FAILED] Critical Blocker: No qualified human operator assigned to system loops.");
+      } else if (activeViolationID === "STX-DATA-02") {
+        console.log("❌ [GATE 5 FAILED] Training data lineage logs violate Clause 8 Data Governance constraints.");
+      } else {
+        console.log(`❌ [GATE FAILURE] Missing tracking file target asset: ./.staisix/evidence/${rule.fileName}`);
+      }
+      break; // Halts scanning immediately at the first failure to enforce pipeline gating
+    } else {
+      console.log(`✅ [CONTROL VERIFIED] Control token [${rule.controlID}] satisfied via ./.staisix/evidence/${rule.fileName}`);
+    }
   }
 
-  console.log("✅ [GATE 4 PASSED] Subsidiary vendor risk assessment validated.");
-  console.log("✅ [GATE 6 PASSED] All baseline corporate framework controls satisfied.");
   console.log("------------------------------------------------------------------");
-
   const pipelineStatus = failureCount > 0 ? "BLOCKED" : "PASS";
 
   if (failureCount > 0) {
@@ -93,9 +121,12 @@ async function runCliEngine() {
     organization: REPO_METADATA.organization,
     cliFailureCount: failureCount,
     pipelineStatus: pipelineStatus,
-    triggeredControlID: activeViolationID 
+    triggeredControlID: activeViolationID
   };
 
+  // ==================================================================
+  // 📡 STAGE 3: Transmit telemetry package downstream to Airtable
+  // ==================================================================
   try {
     console.log("📡 [STAISIX] Transmitting pipeline telemetry payload to Softr Backend Database...");
     await axios.post(GLOBAL_WEBHOOK_URL, telemetryPayload);
@@ -108,7 +139,7 @@ async function runCliEngine() {
   
   if (pipelineStatus === "BLOCKED") {
     console.log("🛑 [BUILD ERROR] Deployment blocked by framework control guardrails.\n");
-    process.exit(1); 
+    process.exit(1);
   } else {
     console.log("📦 [BUILD SUCCESS] All framework checks passing. Pushing code live to production.\n");
     process.exit(0);

package/package.json

@@ -1,13 +1,18 @@
 {
   "name": "staisix-cli",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Automated Policy-as-Code continuous pipeline gatekeeper for AI model deployments.",
   "main": "index.js",
   "type": "module",
   "bin": {
     "staisix": "index.js"
   },
-  "keywords": ["devsecops", "ai-governance", "compliance", "gitops"],
+  "keywords": [
+    "devsecops",
+    "ai-governance",
+    "compliance",
+    "gitops"
+  ],
   "author": "STAISIX",
   "license": "MIT",
   "dependencies": {