admina-framework 0.9.5__tar.gz → 0.10.1__tar.gz

{admina_framework-0.9.5 → admina_framework-0.10.1}/NOTICE

@@ -9,7 +9,7 @@ Source:   https://github.com/admina-org/admina
 
 ─── Bundled assets ─────────────────────────────────────────────────
 
-* dashboard/heimdall.png
+* admina/dashboard/static/heimdall.png
   "Heimdall — the Governance Owl"
   Copyright © 2025–2026 Stefano Noferi & Admina contributors
   Licensed under the Apache License, Version 2.0

{admina_framework-0.9.5/admina_framework.egg-info → admina_framework-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: admina-framework
-Version: 0.9.5
+Version: 0.10.1
 Summary: Admina — governed AI development framework
 Author-email: Stefano Noferi <info@admina.org>
 Maintainer-email: Stefano Noferi <info@admina.org>
@@ -30,7 +30,7 @@ License-File: NOTICE
 Requires-Dist: pyyaml<7,>=6.0
 Requires-Dist: click<9,>=8.1
 Requires-Dist: jinja2<4,>=3.1
-Requires-Dist: cryptography<48,>=41.0
+Requires-Dist: cryptography<50,>=41.0
 Provides-Extra: proxy
 Requires-Dist: fastapi<1,>=0.104; extra == "proxy"
 Requires-Dist: uvicorn[standard]<1,>=0.24; extra == "proxy"
@@ -38,9 +38,9 @@ Requires-Dist: httpx<1,>=0.25; extra == "proxy"
 Requires-Dist: pydantic<3,>=2.5; extra == "proxy"
 Requires-Dist: pydantic-settings<3,>=2.3; extra == "proxy"
 Requires-Dist: python-dotenv<2,>=1.0; extra == "proxy"
-Requires-Dist: redis<6,>=5.0; extra == "proxy"
+Requires-Dist: redis<9,>=5.0; extra == "proxy"
 Requires-Dist: boto3<2,>=1.34; extra == "proxy"
-Requires-Dist: clickhouse-connect<1,>=0.7; extra == "proxy"
+Requires-Dist: clickhouse-connect<2,>=0.7; extra == "proxy"
 Requires-Dist: typer<1,>=0.9; extra == "proxy"
 Requires-Dist: numpy<2,>=1.24; extra == "proxy"
 Requires-Dist: scikit-learn<2,>=1.3; extra == "proxy"
@@ -52,9 +52,25 @@ Requires-Dist: opentelemetry-sdk<2,>=1.20; extra == "telemetry"
 Requires-Dist: opentelemetry-exporter-otlp-proto-grpc<2,>=1.20; extra == "telemetry"
 Requires-Dist: opentelemetry-instrumentation-fastapi<1,>=0.40b0; extra == "telemetry"
 Provides-Extra: rust
-Requires-Dist: admina-core<0.10,>=0.9.3; extra == "rust"
+Requires-Dist: admina-core<0.11,>=0.9.3; extra == "rust"
 Provides-Extra: full
 Requires-Dist: admina-framework[nlp,proxy,telemetry]; extra == "full"
+Provides-Extra: openai
+Requires-Dist: openai<3,>=1.0; extra == "openai"
+Provides-Extra: ollama
+Requires-Dist: ollama<1,>=0.3; extra == "ollama"
+Provides-Extra: anthropic
+Requires-Dist: anthropic<1,>=0.39; extra == "anthropic"
+Provides-Extra: mistral
+Requires-Dist: mistralai<3,>=1.0; extra == "mistral"
+Provides-Extra: gemini
+Requires-Dist: google-genai<3,>=1.0; extra == "gemini"
+Provides-Extra: bedrock
+Requires-Dist: boto3<2,>=1.34; extra == "bedrock"
+Provides-Extra: adapters
+Requires-Dist: admina-framework[anthropic,bedrock,gemini,mistral,ollama,openai]; extra == "adapters"
+Provides-Extra: all
+Requires-Dist: admina-framework[adapters,nlp,proxy,telemetry]; extra == "all"
 Dynamic: license-file
 
 <!--
@@ -186,6 +202,21 @@ pip install "admina-framework[proxy]"
 pip install "admina-framework[full]"
 python -m spacy download en_core_web_sm   # for [full] only
 
+# Model-adapter provider SDKs (per-provider extras):
+pip install "admina-framework[openai]"      # openai>=1.0
+pip install "admina-framework[ollama]"      # ollama>=0.3
+pip install "admina-framework[anthropic]"   # anthropic>=0.39
+pip install "admina-framework[mistral]"     # mistralai>=1.0
+pip install "admina-framework[gemini]"      # google-genai>=1.0
+pip install "admina-framework[bedrock]"     # boto3>=1.34 (AWS Bedrock)
+
+# All provider SDKs at once:
+pip install "admina-framework[adapters]"
+
+# Everything (proxy + NLP + telemetry + all adapters):
+pip install "admina-framework[all]"
+python -m spacy download en_core_web_sm   # for [all] only
+
 # Optional: Rust-accelerated engine (auto-detected at runtime).
 # Opt-in extra — pulls in the admina-core wheel from PyPI.
 pip install "admina-framework[rust]"
@@ -224,6 +255,12 @@ pip install -e ".[proxy]"
 # Everything (proxy + NLP + telemetry)
 pip install -e ".[full]"
 
+# All model-adapter SDKs
+pip install -e ".[adapters]"
+
+# Everything (proxy + NLP + telemetry + all adapters)
+pip install -e ".[all]"
+
 # CLI workflow
 admina init my-project   # Scaffold a governed AI project
 cd my-project            # admina dev runs from the project directory
@@ -258,7 +295,7 @@ flowchart LR
     class P pipe;
 ```
 
-Pipeline (identical in both modes): `PII redaction → firewall → loop-breaker → audit → forensic chain (SHA-256) → OTEL`
+Pipeline (identical in both modes): `loop-breaker → firewall → PII redaction → guards → audit → forensic chain (SHA-256) → OTEL`
 
 ## The 4 Governance Domains
 

{admina_framework-0.9.5 → admina_framework-0.10.1}/README.md

@@ -127,6 +127,21 @@ pip install "admina-framework[proxy]"
 pip install "admina-framework[full]"
 python -m spacy download en_core_web_sm   # for [full] only
 
+# Model-adapter provider SDKs (per-provider extras):
+pip install "admina-framework[openai]"      # openai>=1.0
+pip install "admina-framework[ollama]"      # ollama>=0.3
+pip install "admina-framework[anthropic]"   # anthropic>=0.39
+pip install "admina-framework[mistral]"     # mistralai>=1.0
+pip install "admina-framework[gemini]"      # google-genai>=1.0
+pip install "admina-framework[bedrock]"     # boto3>=1.34 (AWS Bedrock)
+
+# All provider SDKs at once:
+pip install "admina-framework[adapters]"
+
+# Everything (proxy + NLP + telemetry + all adapters):
+pip install "admina-framework[all]"
+python -m spacy download en_core_web_sm   # for [all] only
+
 # Optional: Rust-accelerated engine (auto-detected at runtime).
 # Opt-in extra — pulls in the admina-core wheel from PyPI.
 pip install "admina-framework[rust]"
@@ -165,6 +180,12 @@ pip install -e ".[proxy]"
 # Everything (proxy + NLP + telemetry)
 pip install -e ".[full]"
 
+# All model-adapter SDKs
+pip install -e ".[adapters]"
+
+# Everything (proxy + NLP + telemetry + all adapters)
+pip install -e ".[all]"
+
 # CLI workflow
 admina init my-project   # Scaffold a governed AI project
 cd my-project            # admina dev runs from the project directory
@@ -199,7 +220,7 @@ flowchart LR
     class P pipe;
 ```
 
-Pipeline (identical in both modes): `PII redaction → firewall → loop-breaker → audit → forensic chain (SHA-256) → OTEL`
+Pipeline (identical in both modes): `loop-breaker → firewall → PII redaction → guards → audit → forensic chain (SHA-256) → OTEL`
 
 ## The 4 Governance Domains
 

{admina_framework-0.9.5 → admina_framework-0.10.1}/admina/__init__.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 
 from admina.sdk import ComplianceKit, GovernedAgent, GovernedData, GovernedModel
 
-__version__ = "0.9.5"
+__version__ = "0.10.1"
 
 __all__ = [
     "__version__",

{admina_framework-0.9.5 → admina_framework-0.10.1}/admina/cli/main.py

@@ -38,6 +38,8 @@ from jinja2 import Environment, FileSystemLoader, select_autoescape
 from admina import __version__
 from admina.core.secrets import SecretVault, validate_password
 
+logger = logging.getLogger(__name__)
+
 _TEMPLATES_DIR = Path(__file__).parent / "templates"
 
 # Domains the user can toggle on/off during ``admina init``.
@@ -166,6 +168,7 @@ def _scaffold_project(
     context: dict[str, object] = {
         "project_name": project_name,
         "domains": {d: d in domains for d in AVAILABLE_DOMAINS},
+        "admina_version": __version__,
     }
 
     # admina.yaml
@@ -398,6 +401,7 @@ def _maybe_regenerate_compose(project_dir: Path, data: dict[str, object]) -> boo
         "project_name": project_name,
         "domains": {d: d in domains for d in AVAILABLE_DOMAINS},
         "with_llm": True,  # init scaffolds the full template; admina dev gates at runtime
+        "admina_version": __version__,
     }
     _generate_file(env, "docker-compose.yml.j2", project_dir / "docker-compose.yml", context)
     hash_file.write_text(current_hash)
@@ -686,6 +690,7 @@ def _run_compose(
             "project_name": project_name,
             "domains": {d: d in domains for d in AVAILABLE_DOMAINS},
             "with_llm": with_llm,
+            "admina_version": __version__,
         }
         _generate_file(env_j, "docker-compose.yml.j2", project_dir / "docker-compose.yml", context)
         hash_file.write_text(current_hash)
@@ -885,12 +890,23 @@ def _pip_install(package: str) -> subprocess.CompletedProcess[str]:
     )
 
 
+def _config_extra_modules() -> list[str]:
+    """Module paths from admina.yaml ``plugins:`` — empty if no config."""
+    try:
+        from admina.core.config import load_config
+
+        return list(load_config().plugins)
+    except (ImportError, ValueError, OSError) as exc:
+        logger.debug("Could not read plugins from admina.yaml: %s", exc)
+        return []
+
+
 def _discover_and_list_plugins() -> dict[str, dict[str, type]]:
     """Run plugin discovery and return all registered plugins by type."""
     from admina.plugins.registry import PluginRegistry
 
     registry = PluginRegistry()
-    registry.discover()
+    registry.discover(extra_modules=_config_extra_modules() or None)
     return registry.list_all()
 
 
@@ -915,6 +931,9 @@ def _scaffold_plugin(
         "base_class": base_class,
         "class_name": class_name,
         "name_property": name_prop,
+        "needs_any": plugin_type
+        in {"model_adapter", "data_connector", "transport_adapter", "auth_provider"},
+        "admina_version": __version__,
     }
 
     created: list[str] = []
@@ -1215,7 +1234,7 @@ def doctor() -> None:
         from admina.plugins.registry import PluginRegistry
 
         reg = PluginRegistry()
-        count = reg.discover()
+        count = reg.discover(extra_modules=_config_extra_modules() or None)
         click.echo(f"    Discovered           {ok_mark}  {count} plugins")
     except Exception as exc:
         import traceback
@@ -1327,6 +1346,52 @@ def doctor() -> None:
                 "    proxy /health        --    not reachable (stack down or different port)"
             )
 
+    # ── Forensic hash-chain integrity ───────────────────────
+    click.echo("\n  Forensic chain:")
+    forensic_backend = env.get("FORENSIC_BACKEND", os.environ.get("FORENSIC_BACKEND", "memory"))
+    if forensic_backend in ("filesystem", "s3"):
+        try:
+            import asyncio as _asyncio
+
+            from admina.domains.compliance.forensic import ForensicBlackBox
+
+            if forensic_backend == "filesystem":
+                base_dir = env.get("FORENSIC_BASE_DIR", os.environ.get("FORENSIC_BASE_DIR", ""))
+                fbox = ForensicBlackBox(filesystem_dir=base_dir if base_dir else None)
+            else:
+                # s3 — needs boto3; construct without credentials (probe only)
+                try:
+                    import boto3 as _boto3
+                except ImportError:
+                    raise ImportError("boto3 not installed")
+                s3_endpoint = env.get(
+                    "FORENSIC_S3_ENDPOINT", os.environ.get("FORENSIC_S3_ENDPOINT", "")
+                )
+                s3_bucket = env.get(
+                    "FORENSIC_S3_BUCKET", os.environ.get("FORENSIC_S3_BUCKET", "admina-forensic")
+                )
+                s3_kwargs: dict = {}
+                if s3_endpoint:
+                    s3_kwargs["endpoint_url"] = s3_endpoint
+                client = _boto3.client("s3", **s3_kwargs)
+                fbox = ForensicBlackBox(boto3_client=client, bucket=s3_bucket)
+
+            chain = _asyncio.run(fbox.verify_chain())
+            n = chain.get("records", 0)
+            if chain.get("valid"):
+                click.echo(f"    {forensic_backend:20s} {ok_mark}  {n} records, valid")
+            else:
+                click.echo(
+                    f"    {forensic_backend:20s} {fail_mark}  chain verification FAILED ({n} records)"
+                )
+                issues.append("Forensic hash-chain integrity check failed")
+        except ImportError as _exc:
+            click.echo(f"    {forensic_backend:20s} --    skipped ({_exc})")
+        except Exception as _exc:
+            click.echo(f"    {forensic_backend:20s} --    skipped (error: {_exc})")
+    else:
+        click.echo(f"    {'not configured':20s} --    memory backend (no durable chain to verify)")
+
     # ── Summary ──────────────────────────────────────────────
     click.echo("\n" + "=" * 55)
     if not issues:

{admina_framework-0.9.5 → admina_framework-0.10.1}/admina/cli/templates/docker-compose.yml.j2

@@ -7,9 +7,9 @@ services:
   # ── Core: Governance Proxy ──────────────────────────────
 {% if domains.agent_security %}
   proxy:
-    # Pinned to v0.9.0 — change to :latest to track the rolling tag.
+    # Pinned to v{{ admina_version }} — change to :latest to track the rolling tag.
     # Images are published by .github/workflows/release-docker.yml on tag push.
-    image: ghcr.io/admina-org/admina-proxy:0.9.0
+    image: ghcr.io/admina-org/admina-proxy:{{ admina_version }}
     container_name: {{ project_name }}-proxy
     ports:
       - "8080:8080"
@@ -40,7 +40,7 @@ services:
 
   # ── Dashboard ───────────────────────────────────────────
   dashboard:
-    image: ghcr.io/admina-org/admina-dashboard:0.9.0
+    image: ghcr.io/admina-org/admina-dashboard:{{ admina_version }}
     container_name: {{ project_name }}-dashboard
     ports:
       - "3000:80"

admina_framework-0.10.1/admina/cli/templates/plugin.py.j2

@@ -0,0 +1,117 @@
+"""{{ plugin_name }} — Admina {{ plugin_type }} plugin."""
+from __future__ import annotations
+
+{% if needs_any %}from typing import Any
+
+{% endif %}from admina.plugins.base import {{ base_class }}
+
+
+class {{ class_name }}({{ base_class }}):
+    """{{ plugin_type.replace('_', ' ').title() }} plugin: {{ plugin_name }}.
+
+    TODO: Implement the required methods below.
+    """
+
+    name = "{{ plugin_name }}"
+{%- if name_property == "framework_name" %}
+    framework_name = "{{ plugin_name }}"
+{%- elif name_property == "protocol_name" %}
+    protocol_name = "{{ plugin_name }}"
+{%- elif name_property == "store_name" %}
+    store_name = "{{ plugin_name }}"
+{%- elif name_property == "provider_name" %}
+    provider_name = "{{ plugin_name }}"
+{%- elif name_property == "channel_name" %}
+    channel_name = "{{ plugin_name }}"
+{%- elif name_property == "supported_languages" %}
+    supported_languages = ["en"]
+{%- endif %}
+    # Optional: accept per-plugin config from admina.yaml `plugin_config:`
+    # def __init__(self, config: dict | None = None) -> None:
+    #     self._config = config or {}
+{% if plugin_type == "model_adapter" %}
+    async def send(
+        self,
+        prompt: str,
+        context: Any = None,
+        **kwargs: Any,
+    ) -> dict[str, Any]:
+        """Send a prompt to the model and return the response.
+
+        Returns:
+            Dict with at least ``text`` and ``metadata`` keys.
+        """
+        raise NotImplementedError("TODO: implement send()")
+
+    def supports_model(self, model_name: str) -> bool:
+        """Return True if this adapter supports the given model."""
+        return True
+{%- elif plugin_type == "data_connector" %}
+    async def ingest(self, source: Any, **kwargs: Any) -> dict[str, Any]:
+        """Ingest documents from *source* into the data store."""
+        raise NotImplementedError("TODO: implement ingest()")
+
+    async def query(self, query: str, **kwargs: Any) -> list[dict[str, Any]]:
+        """Query the data store and return ranked results."""
+        raise NotImplementedError("TODO: implement query()")
+{%- elif plugin_type == "governance_guard" %}
+    async def inspect_request(self, request: dict) -> dict:
+        """Inspect an inbound request."""
+        return {"action": "ALLOW", "risk_level": "LOW", "details": ""}
+
+    async def inspect_response(self, response: dict) -> dict:
+        """Inspect an outbound response."""
+        return {"action": "ALLOW", "risk_level": "LOW", "details": ""}
+{%- elif plugin_type == "compliance_template" %}
+    def get_requirements(self) -> list[dict]:
+        """Return the list of requirements for this framework."""
+        raise NotImplementedError("TODO: implement get_requirements()")
+
+    def evaluate(self, governance_state: dict) -> dict:
+        """Evaluate governance state against the requirements."""
+        raise NotImplementedError("TODO: implement evaluate()")
+{%- elif plugin_type == "transport_adapter" %}
+    async def parse_request(self, raw_request: Any) -> Any:
+        """Parse a protocol-specific request into a GovernanceRequest."""
+        raise NotImplementedError("TODO: implement parse_request()")
+
+    async def format_response(self, gov_response: Any, original: Any) -> Any:
+        """Format a GovernanceResponse into the protocol wire format."""
+        raise NotImplementedError("TODO: implement format_response()")
+
+    def register_routes(self, app: Any) -> None:
+        """Register protocol-specific HTTP routes on the FastAPI app."""
+        raise NotImplementedError("TODO: implement register_routes()")
+{%- elif plugin_type == "forensic_store" %}
+    async def append(self, record: dict) -> str:
+        """Persist a governance record; return a storage identifier."""
+        raise NotImplementedError("TODO: implement append()")
+
+    async def verify_chain(self, last_n: int = 0) -> dict:
+        """Verify the integrity of the hash chain."""
+        raise NotImplementedError("TODO: implement verify_chain()")
+{%- elif plugin_type == "auth_provider" %}
+    async def authenticate(self, request: Any) -> dict:
+        """Authenticate a request; return ``{user_id, roles, metadata}``."""
+        raise NotImplementedError("TODO: implement authenticate()")
+
+    async def authorize(self, user: dict, action: str, resource: str = "") -> bool:
+        """Check whether *user* may perform *action*."""
+        raise NotImplementedError("TODO: implement authorize()")
+{%- elif plugin_type == "pii_engine" %}
+    async def detect(
+        self,
+        text: str,
+        categories: list[str] | None = None,
+    ) -> list[dict]:
+        """Detect PII entities in *text*."""
+        raise NotImplementedError("TODO: implement detect()")
+
+    async def redact(self, text: str, matches: list[dict]) -> str:
+        """Replace detected PII spans with placeholders."""
+        raise NotImplementedError("TODO: implement redact()")
+{%- elif plugin_type == "alert_channel" %}
+    async def send_alert(self, alert: dict) -> bool:
+        """Send a governance alert through this channel."""
+        raise NotImplementedError("TODO: implement send_alert()")
+{%- endif %}

admina_framework-0.10.1/admina/cli/templates/plugin_pyproject.toml.j2

@@ -0,0 +1,21 @@
+[build-system]
+requires = ["setuptools>=68.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "{{ plugin_name }}"
+version = "0.1.0"
+description = "Admina {{ plugin_type.replace('_', ' ') }} plugin: {{ plugin_name }}"
+requires-python = ">=3.11"
+dependencies = [
+    # Floor pinned to the admina-framework version that generated this
+    # scaffold: the plugin contract (class-attr name, async ABC methods)
+    # requires at least that runtime.
+    "admina-framework>={{ admina_version }}",
+]
+
+[project.entry-points."admina.plugins"]
+{{ plugin_name }} = "{{ plugin_name.replace('-', '_') }}"
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0"]

admina_framework-0.10.1/admina/cli/templates/plugin_test.py.j2

@@ -0,0 +1,27 @@
+"""Tests for {{ plugin_name }} plugin."""
+from __future__ import annotations
+
+from {{ plugin_name.replace('-', '_') }} import {{ class_name }}
+
+
+class Test{{ class_name }}:
+    """Basic tests for {{ class_name }}."""
+
+    def test_instantiation(self) -> None:
+        plugin = {{ class_name }}()
+        assert plugin is not None
+
+    def test_name(self) -> None:
+        plugin = {{ class_name }}()
+        assert plugin.name == "{{ plugin_name }}"
+{%- if name_property == "supported_languages" %}
+
+    def test_supported_languages(self) -> None:
+        plugin = {{ class_name }}()
+        assert "en" in plugin.supported_languages
+{%- elif name_property != "name" %}
+
+    def test_{{ name_property }}(self) -> None:
+        plugin = {{ class_name }}()
+        assert plugin.{{ name_property }} == "{{ plugin_name }}"
+{%- endif %}

{admina_framework-0.9.5 → admina_framework-0.10.1}/admina/core/config.py

@@ -138,6 +138,8 @@ class FirewallConfig:
 
     enabled: bool = True
     heuristic_threshold: float = 0.7
+    custom_patterns: list[dict] = field(default_factory=list)
+    disabled_categories: list[str] = field(default_factory=list)
 
 
 @dataclass
@@ -210,7 +212,7 @@ class AdminaConfig:
     otherwise falls back to ``.env`` variables.
     """
 
-    version: str = "2.0"
+    schema_version: int = 1
     data_sovereignty: DataSovereigntyConfig = field(default_factory=DataSovereigntyConfig)
     ai_infra: AIInfraConfig = field(default_factory=AIInfraConfig)
     agent_security: AgentSecurityConfig = field(default_factory=AgentSecurityConfig)
@@ -221,6 +223,7 @@ class AdminaConfig:
     pii_engine: str = "spacy-regex"
     alert_channels: list[AlertChannelConfig] = field(default_factory=list)
     plugins: list[str] = field(default_factory=list)
+    plugin_config: dict[str, Any] = field(default_factory=dict)
 
     # Storage — populated from .env fallback when YAML absent
     redis_url: str = "redis://localhost:6379/0"
@@ -240,6 +243,15 @@ class AdminaConfig:
 # ── YAML parsing helpers ─────────────────────────────────────
 
 
+def _parse_schema_version(data: dict) -> int:
+    """Read ``schema_version`` (int); tolerate the legacy ``version`` key."""
+    raw = data.get("schema_version", data.get("version", 1))
+    try:
+        return int(raw)
+    except (TypeError, ValueError):
+        return 1
+
+
 def _build_from_yaml(data: dict[str, Any]) -> AdminaConfig:
     """Build an :class:`AdminaConfig` from a parsed YAML dict."""
     domains = data.get("domains", {})
@@ -318,6 +330,8 @@ def _build_from_yaml(data: dict[str, Any]) -> AdminaConfig:
         firewall=FirewallConfig(
             enabled=fw_raw.get("enabled", True),
             heuristic_threshold=fw_raw.get("heuristic_threshold", 0.7),
+            custom_patterns=list(fw_raw.get("custom_patterns") or []),
+            disabled_categories=list(fw_raw.get("disabled_categories") or []),
         ),
         loop_breaker=LoopBreakerConfig(
             enabled=lb_raw.get("enabled", True),
@@ -359,7 +373,7 @@ def _build_from_yaml(data: dict[str, Any]) -> AdminaConfig:
     ]
 
     return AdminaConfig(
-        version=data.get("version", "2.0"),
+        schema_version=_parse_schema_version(data),
         data_sovereignty=ds,
         ai_infra=ai,
         agent_security=agent_sec,
@@ -370,6 +384,7 @@ def _build_from_yaml(data: dict[str, Any]) -> AdminaConfig:
         pii_engine=data.get("pii_engine", "spacy-regex"),
         alert_channels=alerts,
         plugins=data.get("plugins", []),
+        plugin_config=data.get("plugin_config", {}),
     )
 
 

{admina_framework-0.9.5 → admina_framework-0.10.1}/admina/domains/ai_infra/rag.py

@@ -32,12 +32,52 @@ import logging
 import re
 from dataclasses import dataclass, field
 from enum import Enum
+from html.parser import HTMLParser
 from pathlib import Path
 from typing import Any, Protocol, runtime_checkable
 
 logger = logging.getLogger("admina.ai_infra.rag")
 
 
+class _HTMLTextExtractor(HTMLParser):
+    """Extract visible text from HTML, dropping ``<script>``/``<style>`` bodies.
+
+    Uses the stdlib HTML parser instead of regex tag-stripping: a real parser
+    handles malformed/nested tags a regex cannot (e.g. ``<scr<script>ipt>``),
+    so script/style content can't leak into the extracted text. This is a
+    best-effort ingestion extractor for RAG, not a security sanitizer — the
+    output is embedded as LLM context, never rendered as HTML.
+    """
+
+    # Substring match (not equality): a malformed payload like
+    # "<scr<script>ipt>" is tokenised by HTMLParser as a single start tag
+    # named "scr<script", so an exact "== 'script'" check would miss it.
+    _SKIP_TAGS = ("script", "style")
+
+    def __init__(self) -> None:
+        super().__init__(convert_charrefs=True)
+        self._parts: list[str] = []
+        self._skip_depth = 0
+
+    def _is_skip(self, tag: str) -> bool:
+        return any(s in tag for s in self._SKIP_TAGS)
+
+    def handle_starttag(self, tag: str, attrs: object) -> None:
+        if self._is_skip(tag):
+            self._skip_depth += 1
+
+    def handle_endtag(self, tag: str) -> None:
+        if self._is_skip(tag) and self._skip_depth > 0:
+            self._skip_depth -= 1
+
+    def handle_data(self, data: str) -> None:
+        if self._skip_depth == 0:
+            self._parts.append(data)
+
+    def get_text(self) -> str:
+        return " ".join(self._parts)
+
+
 # ── Document types ───────────────────────────────────────────
 
 
@@ -131,12 +171,15 @@ def parse_plain_text(content: str) -> str:
 
 
 def parse_html(content: str) -> str:
-    """Strip HTML tags and return plain text."""
-    text = re.sub(r"<script[^>]*>.*?</script>", "", content, flags=re.DOTALL)
-    text = re.sub(r"<style[^>]*>.*?</style>", "", text, flags=re.DOTALL)
-    text = re.sub(r"<[^>]+>", " ", text)
-    text = re.sub(r"\s+", " ", text).strip()
-    return text
+    """Extract plain text from HTML, dropping script/style content.
+
+    Uses the stdlib HTML parser (see :class:`_HTMLTextExtractor`) rather than
+    regex tag-stripping, which a malformed-tag payload can bypass.
+    """
+    extractor = _HTMLTextExtractor()
+    extractor.feed(content)
+    text = extractor.get_text()
+    return re.sub(r"\s+", " ", text).strip()
 
 
 def parse_csv(content: str) -> str:

{admina_framework-0.9.5 → admina_framework-0.10.1}/admina/domains/compliance/eu_ai_act.py

@@ -19,9 +19,32 @@ Automated risk classification, gap analysis, and compliance reporting.
 
 import logging
 from datetime import UTC, datetime
+from typing import Any
 
 logger = logging.getLogger("admina.eu_ai_act")
 
+
+def _coerce_checks(value: Any, n: int) -> list[bool]:
+    """Normalise a declared-compliance value to exactly *n* booleans.
+
+    bool → that value for the first check, the rest unmet (a single claim
+    does not satisfy all N checks); list → padded with False / truncated to
+    n; None → all unmet. Prevents a bool/short input from being zip-truncated
+    into a falsely high score.
+    """
+    if value is None:
+        return [False] * n
+    if isinstance(value, bool):
+        declared = [value]
+    elif isinstance(value, list):
+        declared = [bool(v) for v in value]
+    else:
+        declared = [False]
+    declared = declared[:n]
+    declared += [False] * (n - len(declared))
+    return declared
+
+
 # ── EU AI Act application timeline (Art. 113, Regulation 2024/1689) ─────────
 # Reflects the "AI Act Omnibus" agreement reached by Council and Parliament
 # on 7 May 2026 (Omnibus VII), which postponed several high-risk deadlines
@@ -288,8 +311,9 @@ class EUAIActCompliance:
         passed_checks = 0
 
         for req_key, req_info in HIGH_RISK_REQUIREMENTS.items():
-            checks = current_compliance.get(req_key, [False] * len(req_info["checks"]))
-            for i, (check_desc, is_met) in enumerate(zip(req_info["checks"], checks)):
+            n = len(req_info["checks"])
+            declared = _coerce_checks(current_compliance.get(req_key), n)
+            for i, (check_desc, is_met) in enumerate(zip(req_info["checks"], declared)):
                 total_checks += 1
                 if is_met:
                     passed_checks += 1