bespoketracker-comply 1.0.2__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (113) hide show
  1. bespoketracker_comply-1.0.2/LICENSE +85 -0
  2. bespoketracker_comply-1.0.2/PKG-INFO +291 -0
  3. bespoketracker_comply-1.0.2/README.md +251 -0
  4. bespoketracker_comply-1.0.2/__init__.py +2 -0
  5. bespoketracker_comply-1.0.2/__main__.py +1788 -0
  6. bespoketracker_comply-1.0.2/_vendor/__init__.py +1 -0
  7. bespoketracker_comply-1.0.2/_vendor/codebase_scanner.py +516 -0
  8. bespoketracker_comply-1.0.2/_vendor/compliance_eval.py +1910 -0
  9. bespoketracker_comply-1.0.2/_vendor/framework_loader.py +72 -0
  10. bespoketracker_comply-1.0.2/_vendor/graph_ranking.py +474 -0
  11. bespoketracker_comply-1.0.2/_vendor/llm_client.py +141 -0
  12. bespoketracker_comply-1.0.2/adapters/__init__.py +1 -0
  13. bespoketracker_comply-1.0.2/adapters/base.py +104 -0
  14. bespoketracker_comply-1.0.2/adapters/file_adapter.py +116 -0
  15. bespoketracker_comply-1.0.2/adapters/gateway_adapter.py +225 -0
  16. bespoketracker_comply-1.0.2/adapters/github_actions.py +315 -0
  17. bespoketracker_comply-1.0.2/adapters/gitlab_ci.py +274 -0
  18. bespoketracker_comply-1.0.2/adapters/gravitee_adapter.py +136 -0
  19. bespoketracker_comply-1.0.2/adapters/kong_adapter.py +121 -0
  20. bespoketracker_comply-1.0.2/adapters/registry.py +120 -0
  21. bespoketracker_comply-1.0.2/adapters/vanta_adapter.py +263 -0
  22. bespoketracker_comply-1.0.2/app.py +140 -0
  23. bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/PKG-INFO +291 -0
  24. bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/SOURCES.txt +213 -0
  25. bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/dependency_links.txt +1 -0
  26. bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/entry_points.txt +2 -0
  27. bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/requires.txt +19 -0
  28. bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/top_level.txt +1 -0
  29. bespoketracker_comply-1.0.2/billing.py +293 -0
  30. bespoketracker_comply-1.0.2/cache.py +170 -0
  31. bespoketracker_comply-1.0.2/causal_forecast.py +497 -0
  32. bespoketracker_comply-1.0.2/ci/README.md +197 -0
  33. bespoketracker_comply-1.0.2/ci/github-action.yml +319 -0
  34. bespoketracker_comply-1.0.2/ci/gitlab-ci-template.yml +73 -0
  35. bespoketracker_comply-1.0.2/dashboard/api.js +294 -0
  36. bespoketracker_comply-1.0.2/dashboard/app.js +472 -0
  37. bespoketracker_comply-1.0.2/dashboard/catalog/catalog_index.json +18 -0
  38. bespoketracker_comply-1.0.2/dashboard/catalog/eu_ai_act.json +948 -0
  39. bespoketracker_comply-1.0.2/dashboard/catalog/nist_ai_rmf.json +401 -0
  40. bespoketracker_comply-1.0.2/dashboard/catalog/soc2_ai.json +124 -0
  41. bespoketracker_comply-1.0.2/dashboard/codegen.js +1417 -0
  42. bespoketracker_comply-1.0.2/dashboard/components.js +1741 -0
  43. bespoketracker_comply-1.0.2/dashboard/crypto.js +124 -0
  44. bespoketracker_comply-1.0.2/dashboard/demo.css +3232 -0
  45. bespoketracker_comply-1.0.2/dashboard/index.html +83 -0
  46. bespoketracker_comply-1.0.2/dashboard/report.js +1042 -0
  47. bespoketracker_comply-1.0.2/dashboard/router.js +51 -0
  48. bespoketracker_comply-1.0.2/dashboard/scandb.js +107 -0
  49. bespoketracker_comply-1.0.2/dashboard/stores.js +601 -0
  50. bespoketracker_comply-1.0.2/dashboard/style.css +825 -0
  51. bespoketracker_comply-1.0.2/dashboard/views/adapters.js +153 -0
  52. bespoketracker_comply-1.0.2/dashboard/views/audit.js +215 -0
  53. bespoketracker_comply-1.0.2/dashboard/views/compare.js +394 -0
  54. bespoketracker_comply-1.0.2/dashboard/views/demo.js +392 -0
  55. bespoketracker_comply-1.0.2/dashboard/views/detail.js +1478 -0
  56. bespoketracker_comply-1.0.2/dashboard/views/diff.js +445 -0
  57. bespoketracker_comply-1.0.2/dashboard/views/forecast.js +321 -0
  58. bespoketracker_comply-1.0.2/dashboard/views/gate.js +172 -0
  59. bespoketracker_comply-1.0.2/dashboard/views/history.js +278 -0
  60. bespoketracker_comply-1.0.2/dashboard/views/home.js +179 -0
  61. bespoketracker_comply-1.0.2/dashboard/views/landing.js +1569 -0
  62. bespoketracker_comply-1.0.2/dashboard/views/mapping.js +163 -0
  63. bespoketracker_comply-1.0.2/dashboard/views/monitor.js +230 -0
  64. bespoketracker_comply-1.0.2/dashboard/views/overlap.js +134 -0
  65. bespoketracker_comply-1.0.2/dashboard/views/progress.js +281 -0
  66. bespoketracker_comply-1.0.2/dashboard/views/scan.js +122 -0
  67. bespoketracker_comply-1.0.2/dashboard/views/settings.js +120 -0
  68. bespoketracker_comply-1.0.2/dashboard/views/trends.js +107 -0
  69. bespoketracker_comply-1.0.2/data/__init__.py +1 -0
  70. bespoketracker_comply-1.0.2/data/cwe_control_mapping.yaml +1949 -0
  71. bespoketracker_comply-1.0.2/data/frameworks.yaml +1027 -0
  72. bespoketracker_comply-1.0.2/demo_repos.yaml +9 -0
  73. bespoketracker_comply-1.0.2/demo_security.py +110 -0
  74. bespoketracker_comply-1.0.2/diff_utils.py +58 -0
  75. bespoketracker_comply-1.0.2/docx_report.py +230 -0
  76. bespoketracker_comply-1.0.2/evidence_layers.py +778 -0
  77. bespoketracker_comply-1.0.2/export_catalog.py +138 -0
  78. bespoketracker_comply-1.0.2/finding_mapper.py +607 -0
  79. bespoketracker_comply-1.0.2/forecast.py +265 -0
  80. bespoketracker_comply-1.0.2/forecast_routes.py +31 -0
  81. bespoketracker_comply-1.0.2/formats.py +347 -0
  82. bespoketracker_comply-1.0.2/funded.py +343 -0
  83. bespoketracker_comply-1.0.2/gate.py +217 -0
  84. bespoketracker_comply-1.0.2/gate_routes.py +76 -0
  85. bespoketracker_comply-1.0.2/git_clone.py +57 -0
  86. bespoketracker_comply-1.0.2/incremental.py +340 -0
  87. bespoketracker_comply-1.0.2/junit_import.py +317 -0
  88. bespoketracker_comply-1.0.2/licensing.py +166 -0
  89. bespoketracker_comply-1.0.2/mapping.py +229 -0
  90. bespoketracker_comply-1.0.2/monitor.py +661 -0
  91. bespoketracker_comply-1.0.2/monitor_routes.py +145 -0
  92. bespoketracker_comply-1.0.2/narration.py +377 -0
  93. bespoketracker_comply-1.0.2/pyproject.toml +63 -0
  94. bespoketracker_comply-1.0.2/regression.py +161 -0
  95. bespoketracker_comply-1.0.2/remediation.py +606 -0
  96. bespoketracker_comply-1.0.2/report.py +557 -0
  97. bespoketracker_comply-1.0.2/routes.py +15 -0
  98. bespoketracker_comply-1.0.2/routes_billing.py +126 -0
  99. bespoketracker_comply-1.0.2/routes_demo.py +466 -0
  100. bespoketracker_comply-1.0.2/routes_forecast.py +305 -0
  101. bespoketracker_comply-1.0.2/routes_funded.py +283 -0
  102. bespoketracker_comply-1.0.2/routes_import.py +209 -0
  103. bespoketracker_comply-1.0.2/routes_posture.py +417 -0
  104. bespoketracker_comply-1.0.2/routes_scan.py +548 -0
  105. bespoketracker_comply-1.0.2/sarif_import.py +337 -0
  106. bespoketracker_comply-1.0.2/sbom_import.py +397 -0
  107. bespoketracker_comply-1.0.2/scan_state.py +77 -0
  108. bespoketracker_comply-1.0.2/scanner.py +796 -0
  109. bespoketracker_comply-1.0.2/setup.cfg +4 -0
  110. bespoketracker_comply-1.0.2/store.py +873 -0
  111. bespoketracker_comply-1.0.2/tiers.py +150 -0
  112. bespoketracker_comply-1.0.2/url_normalize.py +43 -0
  113. bespoketracker_comply-1.0.2/watcher.py +228 -0
@@ -0,0 +1,85 @@
1
+ Business Source License 1.1
2
+
3
+ Licensor: BespokeAgile (Nicholas Salzman)
4
+ Licensed Work: BespokeTracker Comply v1.0.2
5
+ Additional Use Grant: You may use the Licensed Work for any purpose,
6
+ including production use, except for offering a competing hosted
7
+ compliance scanning service.
8
+ Change Date: 2030-03-10
9
+ Change License: Apache License, Version 2.0
10
+
11
+ License text copyright © 2024 MariaDB plc, All Rights Reserved.
12
+ "Business Source License" is a trademark of MariaDB plc.
13
+
14
+ Terms
15
+
16
+ The Licensor hereby grants you the right to copy, modify, create derivative
17
+ works, redistribute, and make non-production use of the Licensed Work. The
18
+ Licensor may make an Additional Use Grant, above, permitting limited
19
+ production use.
20
+
21
+ Effective on the Change Date, or the fourth anniversary of the first publicly
22
+ available distribution of a specific version of the Licensed Work under this
23
+ License, whichever comes first, the Licensor hereby grants you rights under
24
+ the terms of the Change License, and the rights granted in the paragraph
25
+ above terminate.
26
+
27
+ If your use of the Licensed Work does not comply with the requirements
28
+ currently in effect as described in this License, you must purchase a
29
+ commercial license from the Licensor, its affiliated entities, or authorized
30
+ resellers, or you must refrain from using the Licensed Work.
31
+
32
+ All copies of the original and modified Licensed Work, and derivative works
33
+ of the Licensed Work, are subject to this License. This License applies
34
+ separately for each version of the Licensed Work and the Change Date may vary
35
+ for each version of the Licensed Work released by Licensor.
36
+
37
+ You must conspicuously display this License on each original or modified copy
38
+ of the Licensed Work. If you receive the Licensed Work in original or
39
+ modified form from a third party, the terms and conditions set forth in this
40
+ License apply to your use of that work.
41
+
42
+ Any use of the Licensed Work in violation of this License will automatically
43
+ terminate your rights under this License for the current and all other
44
+ versions of the Licensed Work.
45
+
46
+ This License does not grant you any right in any trademark or logo of
47
+ Licensor or its affiliates (provided that you may use a trademark or logo of
48
+ Licensor as expressly required by this License).
49
+
50
+ TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
51
+ AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
52
+ EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
53
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
54
+ TITLE.
55
+
56
+ MariaDB hereby grants you permission to use this License's text to license
57
+ your works, and to refer to it using the trademark "Business Source License",
58
+ as long as you comply with the Covenants of Licensor below.
59
+
60
+ Covenants of Licensor
61
+
62
+ In consideration of the right to use this License's text and the "Business
63
+ Source License" name and trademark, Licensor covenants to MariaDB, and to all
64
+ other recipients of the licensed work to be provided by Licensor:
65
+
66
+ To specify as the Change License the GPL Version 2.0 or any later version, or
67
+ a license that is compatible with GPL Version 2.0 or a later version, where
68
+ "compatible" means that software provided under the Change License can be
69
+ included in a program with software provided under GPL Version 2.0 or a later
70
+ version. Licensor may specify additional Change Licenses without limitation.
71
+
72
+ To either: (a) specify an additional grant of rights to use that does not
73
+ impose any additional restriction on the right granted in this License, as the
74
+ Additional Use Grant; or (b) insert the text "None" to specify a Change Date.
75
+ Not to modify this License in any other way.
76
+
77
+ Notice
78
+
79
+ The Business Source License (this document, or the "License") is not an Open
80
+ Source license. However, the Licensed Work will eventually be made available
81
+ under an Open Source License, as stated in this License.
82
+
83
+ ---
84
+
85
+ Framework definitions (data/frameworks.yaml) are licensed under CC-BY-4.0.
@@ -0,0 +1,291 @@
1
+ Metadata-Version: 2.4
2
+ Name: bespoketracker-comply
3
+ Version: 1.0.2
4
+ Summary: Compliance gap analysis for any codebase — standalone scanner, CI/CD integration, and web dashboard
5
+ Author: BespokeTracker
6
+ License: BSL-1.1
7
+ Project-URL: Homepage, https://bespokeagile.com/comply/
8
+ Project-URL: Documentation, https://bespokeagile.com/comply/docs/
9
+ Project-URL: Demo, https://comply-demo.bespokeagile.com/
10
+ Project-URL: Repository, https://github.com/bespokeagile/comply
11
+ Project-URL: Bug Tracker, https://github.com/bespokeagile/comply/issues
12
+ Keywords: compliance,ai-act,governance,scanner,ci-cd
13
+ Classifier: Development Status :: 4 - Beta
14
+ Classifier: Intended Audience :: Developers
15
+ Classifier: Topic :: Software Development :: Quality Assurance
16
+ Classifier: Programming Language :: Python :: 3
17
+ Classifier: Programming Language :: Python :: 3.9
18
+ Classifier: Programming Language :: Python :: 3.10
19
+ Classifier: Programming Language :: Python :: 3.11
20
+ Classifier: Programming Language :: Python :: 3.12
21
+ Requires-Python: >=3.9
22
+ Description-Content-Type: text/markdown
23
+ License-File: LICENSE
24
+ Requires-Dist: fastapi>=0.100.0
25
+ Requires-Dist: uvicorn[standard]>=0.20.0
26
+ Requires-Dist: pydantic>=2.0
27
+ Requires-Dist: pyyaml>=6.0
28
+ Requires-Dist: httpx>=0.24.0
29
+ Requires-Dist: slowapi>=0.1.9
30
+ Provides-Extra: semantic
31
+ Requires-Dist: anthropic>=0.18.0; extra == "semantic"
32
+ Requires-Dist: openai>=1.0.0; extra == "semantic"
33
+ Provides-Extra: docx
34
+ Requires-Dist: python-docx>=0.8.11; extra == "docx"
35
+ Provides-Extra: billing
36
+ Requires-Dist: stripe>=5.0.0; extra == "billing"
37
+ Provides-Extra: all
38
+ Requires-Dist: bespoketracker-comply[billing,docx,semantic]; extra == "all"
39
+ Dynamic: license-file
40
+
41
+ # BespokeTracker Comply
42
+
43
+ **Compliance gap analysis for any codebase.** Scan any repository against 10 regulatory frameworks. Get evidence-backed compliance reports with specific file paths, control status, and remediation recommendations.
44
+
45
+ **Regulatory deadlines:** Colorado SB 24-205 (June 30, 2026) | EU AI Act (August 2, 2026)
46
+
47
+ [![PyPI version](https://img.shields.io/pypi/v/bespoketracker-comply)](https://pypi.org/project/bespoketracker-comply/)
48
+ [![License: BSL 1.1](https://img.shields.io/badge/License-BSL%201.1-blue.svg)](LICENSE)
49
+ [![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
50
+
51
+ ## Install
52
+
53
+ ```bash
54
+ # Standalone (pip)
55
+ pip install bespoketracker-comply
56
+
57
+ # From source
58
+ pip install -e ./comply
59
+
60
+ # With semantic analysis support
61
+ pip install bespoketracker-comply[semantic]
62
+ ```
63
+
64
+ ## Quick Start
65
+
66
+ ```bash
67
+ # Scan a local repository
68
+ bespoketracker-comply scan /path/to/your/repo
69
+
70
+ # Scan a GitHub repository
71
+ bespoketracker-comply scan https://github.com/org/repo --framework eu-ai-act
72
+
73
+ # Multi-framework scan
74
+ bespoketracker-comply scan . --framework eu-ai-act,nist-ai-rmf,iso-42001
75
+
76
+ # Start the web dashboard
77
+ bespoketracker-comply serve
78
+ # Open http://localhost:8001
79
+ ```
80
+
81
+ ## Docker
82
+
83
+ ```bash
84
+ # Build and run
85
+ docker build -t comply .
86
+ docker run -p 8001:8001 -v comply-data:/root/.comply comply
87
+
88
+ # With docker-compose (includes optional gateway sidecar)
89
+ docker compose up
90
+
91
+ # With gateway for three-layer evidence
92
+ docker compose --profile with-gateway up
93
+ ```
94
+
95
+ ## Supported Frameworks
96
+
97
+ | Framework | Controls | Description |
98
+ |-----------|----------|-------------|
99
+ | `eu-ai-act` | 8 | EU AI Act 2024/1689 (Articles 9-14) |
100
+ | `nist-ai-rmf` | 12 | NIST AI Risk Management Framework 1.0 |
101
+ | `iso-42001` | 10 | ISO/IEC 42001:2023 AI Management System |
102
+ | `california-ab-2013` | 3 | California AB 2013 AI Transparency Act |
103
+ | `california-sb-942` | 4 | California SB 942 AI Transparency |
104
+ | `colorado-sb-24-205` | 5 | Colorado SB 24-205 Consumer Protections |
105
+ | `soc2-ai` | 6 | SOC 2 AI Trust Services Criteria |
106
+ | `insurance-attestation` | 5 | Insurance AI Attestation (NAIC) |
107
+ | `owasp-llm-top10` | 10 | OWASP Top 10 for LLM Applications |
108
+ | `owasp-agentic-top10` | 10 | OWASP Agentic AI Top 10 |
109
+
110
+ ## Three-Layer Evidence
111
+
112
+ Comply evaluates compliance across three layers:
113
+
114
+ 1. **Layer 1 — Code**: Static analysis of your codebase (logging, tests, docs, auth, monitoring)
115
+ 2. **Layer 2 — Process**: Development process maturity (baselines, regression tracking, CI gates)
116
+ 3. **Layer 3 — Traffic**: AI agent governance (audit logs, access control, policy enforcement)
117
+
118
+ Layer 1 runs automatically. Layer 2 builds as you set baselines and track regressions. Layer 3 requires connecting audit log adapters.
119
+
120
+ ### Audit Log Adapters
121
+
122
+ Connect external systems for Layer 3 evidence:
123
+
124
+ ```yaml
125
+ # ~/.comply/config.yaml
126
+ adapters:
127
+ gateway:
128
+ mode: sqlite
129
+ db_path: ./gateway.db
130
+ kong:
131
+ admin_url: http://localhost:8001
132
+ gravitee:
133
+ management_url: http://localhost:8083/management
134
+ file:
135
+ paths:
136
+ - ./audit-logs/*.jsonl
137
+ ```
138
+
139
+ ```bash
140
+ # List adapters
141
+ bespoketracker-comply adapters list
142
+
143
+ # Test connectivity
144
+ bespoketracker-comply adapters test gateway
145
+
146
+ # Ingest records
147
+ bespoketracker-comply adapters ingest gateway
148
+ ```
149
+
150
+ ## CLI Reference
151
+
152
+ ### `comply scan`
153
+
154
+ ```
155
+ bespoketracker-comply scan <target> [options]
156
+
157
+ Options:
158
+ -f, --framework FRAMEWORK Framework(s), comma-separated (default: eu-ai-act)
159
+ -d, --depth DEPTH structure | content | semantic (default: content)
160
+ -o, --output DIR Output directory for reports
161
+ --llm-key KEY LLM API key (required for semantic depth)
162
+ --llm-provider PROVIDER anthropic | openai | gemini | grok
163
+ --format FORMAT terminal | json | sarif | junit | markdown
164
+ --fail-below N Exit 1 if score < N (for CI/CD)
165
+ --fail-on-regression Exit 1 if new gaps vs baseline
166
+ --no-cache Skip scan model cache
167
+ ```
168
+
169
+ ### Other Commands
170
+
171
+ | Command | Description |
172
+ |---------|-------------|
173
+ | `serve [--port 8001]` | Start the web dashboard |
174
+ | `config show` | Show current configuration |
175
+ | `config set KEY VALUE` | Set a config value (e.g. `llm_api_key`, `llm_provider`) |
176
+ | `config path` | Print config file path |
177
+ | `frameworks` | List supported frameworks |
178
+ | `history [--repo PATH]` | Browse past scans |
179
+ | `diff SCAN1 SCAN2` | Compare two scans |
180
+ | `baseline --set ID` | Set compliance baseline |
181
+ | `cache stats\|clear` | Manage scan cache |
182
+ | `adapters list\|test\|ingest` | Manage audit log adapters |
183
+ | `activate KEY` | Activate Pro/Enterprise license |
184
+ | `deactivate` | Revert to free tier |
185
+ | `license` | Show current license status |
186
+
187
+ ## API Reference
188
+
189
+ | Method | Endpoint | Description |
190
+ |--------|----------|-------------|
191
+ | `POST` | `/scan` | Start a scan |
192
+ | `GET` | `/scan/{id}` | Poll scan status |
193
+ | `GET` | `/scan/{id}/report` | Get report JSON |
194
+ | `GET` | `/scan/{id}/download?fmt=` | Download (json/sarif/junit/markdown/docx/zip) |
195
+ | `GET` | `/scan/{id}/regression` | Regression check |
196
+ | `GET` | `/scan/{id}/progress` | Progress polling |
197
+ | `GET` | `/history` | Scan history |
198
+ | `GET` | `/diff?scan1=&scan2=` | Diff two scans |
199
+ | `GET` | `/adapters` | List adapters |
200
+ | `POST` | `/adapters/{name}/test` | Test adapter |
201
+ | `POST` | `/adapters/{name}/ingest` | Ingest records |
202
+ | `GET` | `/adapters/{name}/records` | Query records |
203
+ | `GET` | `/posture` | All-framework posture |
204
+ | `GET` | `/posture/{framework}` | Three-layer posture |
205
+ | `POST` | `/baseline/{id}` | Set baseline |
206
+ | `GET` | `/frameworks` | List frameworks |
207
+ | `POST` | `/audit` | Predicate gap audit (free) |
208
+ | `GET` | `/matrix?frameworks=` | Cross-framework matrix |
209
+ | `GET` | `/license` | License status |
210
+ | `POST` | `/license/activate` | Activate license key |
211
+ | `GET` | `/health` | Health + version |
212
+
213
+ ## CI/CD Integration
214
+
215
+ ### GitHub Actions
216
+
217
+ ```yaml
218
+ - uses: ./comply/ci/github-action.yml
219
+ with:
220
+ framework: eu-ai-act
221
+ fail-below: '50'
222
+ upload-sarif: true
223
+ post-comment: true
224
+ ```
225
+
226
+ ### GitLab CI
227
+
228
+ ```yaml
229
+ include:
230
+ - local: comply/ci/gitlab-ci-template.yml
231
+
232
+ comply-scan:
233
+ extends: .comply-scan
234
+ variables:
235
+ COMPLY_FRAMEWORK: "eu-ai-act"
236
+ COMPLY_FAIL_BELOW: "50"
237
+ ```
238
+
239
+ ### Generic CI
240
+
241
+ ```bash
242
+ # Score gate
243
+ bespoketracker-comply scan . --fail-below 50
244
+
245
+ # SARIF for code scanning
246
+ bespoketracker-comply scan . --format sarif -o ./reports
247
+
248
+ # Regression detection
249
+ bespoketracker-comply baseline --auto
250
+ bespoketracker-comply scan . --fail-on-regression
251
+ ```
252
+
253
+ ## Standalone vs Monorepo
254
+
255
+ Comply works in two modes:
256
+
257
+ - **Standalone** (`pip install bespoketracker-comply`): Uses a vendored pure-Python scanner. No Kuzu or monorepo dependencies.
258
+ - **Monorepo**: When run inside the BespokeTracker monorepo, uses the full Kuzu-based pipeline for richer analysis.
259
+
260
+ Auto-detected at runtime — no configuration needed.
261
+
262
+ ## Self-Hosted: All Features Included
263
+
264
+ Comply is source-available under the BSL 1.1 license. All features — every framework, every scan depth, every export format — are included with no feature gates.
265
+
266
+ **Update Subscription** ($29-99/mo): Subscribers get continuous improvements to evidence evaluation, new framework support, and priority fixes via a private update channel. Public releases happen on major versions.
267
+
268
+ Configuration stored in `~/.comply/config.yaml`.
269
+
270
+ ## Contributing
271
+
272
+ We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
273
+
274
+ ### Adding a New Framework
275
+
276
+ Framework definitions live in `data/frameworks.yaml` (CC-BY-4.0 licensed). To add a new framework:
277
+
278
+ 1. Add the framework definition to `data/frameworks.yaml`
279
+ 2. Map evidence functions in `_vendor/compliance_eval.py` `_EVIDENCE_FN_MAP`
280
+ 3. Add tests in the test suite
281
+ 4. Submit a PR
282
+
283
+ ### Adding an Evidence Function
284
+
285
+ Evidence functions detect compliance-relevant patterns in codebases. See existing functions in `_vendor/compliance_eval.py` for the pattern.
286
+
287
+ ## License
288
+
289
+ Business Source License 1.1. You may use Comply for any purpose including production, except offering a competing hosted compliance scanning service. Converts to Apache 2.0 on 2030-03-10. See [LICENSE](LICENSE) for details.
290
+
291
+ Framework definitions (`data/frameworks.yaml`) are licensed under CC-BY-4.0.
@@ -0,0 +1,251 @@
1
+ # BespokeTracker Comply
2
+
3
+ **Compliance gap analysis for any codebase.** Scan any repository against 10 regulatory frameworks. Get evidence-backed compliance reports with specific file paths, control status, and remediation recommendations.
4
+
5
+ **Regulatory deadlines:** Colorado SB 24-205 (June 30, 2026) | EU AI Act (August 2, 2026)
6
+
7
+ [![PyPI version](https://img.shields.io/pypi/v/bespoketracker-comply)](https://pypi.org/project/bespoketracker-comply/)
8
+ [![License: BSL 1.1](https://img.shields.io/badge/License-BSL%201.1-blue.svg)](LICENSE)
9
+ [![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
10
+
11
+ ## Install
12
+
13
+ ```bash
14
+ # Standalone (pip)
15
+ pip install bespoketracker-comply
16
+
17
+ # From source
18
+ pip install -e ./comply
19
+
20
+ # With semantic analysis support
21
+ pip install bespoketracker-comply[semantic]
22
+ ```
23
+
24
+ ## Quick Start
25
+
26
+ ```bash
27
+ # Scan a local repository
28
+ bespoketracker-comply scan /path/to/your/repo
29
+
30
+ # Scan a GitHub repository
31
+ bespoketracker-comply scan https://github.com/org/repo --framework eu-ai-act
32
+
33
+ # Multi-framework scan
34
+ bespoketracker-comply scan . --framework eu-ai-act,nist-ai-rmf,iso-42001
35
+
36
+ # Start the web dashboard
37
+ bespoketracker-comply serve
38
+ # Open http://localhost:8001
39
+ ```
40
+
41
+ ## Docker
42
+
43
+ ```bash
44
+ # Build and run
45
+ docker build -t comply .
46
+ docker run -p 8001:8001 -v comply-data:/root/.comply comply
47
+
48
+ # With docker-compose (includes optional gateway sidecar)
49
+ docker compose up
50
+
51
+ # With gateway for three-layer evidence
52
+ docker compose --profile with-gateway up
53
+ ```
54
+
55
+ ## Supported Frameworks
56
+
57
+ | Framework | Controls | Description |
58
+ |-----------|----------|-------------|
59
+ | `eu-ai-act` | 8 | EU AI Act 2024/1689 (Articles 9-14) |
60
+ | `nist-ai-rmf` | 12 | NIST AI Risk Management Framework 1.0 |
61
+ | `iso-42001` | 10 | ISO/IEC 42001:2023 AI Management System |
62
+ | `california-ab-2013` | 3 | California AB 2013 AI Transparency Act |
63
+ | `california-sb-942` | 4 | California SB 942 AI Transparency |
64
+ | `colorado-sb-24-205` | 5 | Colorado SB 24-205 Consumer Protections |
65
+ | `soc2-ai` | 6 | SOC 2 AI Trust Services Criteria |
66
+ | `insurance-attestation` | 5 | Insurance AI Attestation (NAIC) |
67
+ | `owasp-llm-top10` | 10 | OWASP Top 10 for LLM Applications |
68
+ | `owasp-agentic-top10` | 10 | OWASP Agentic AI Top 10 |
69
+
70
+ ## Three-Layer Evidence
71
+
72
+ Comply evaluates compliance across three layers:
73
+
74
+ 1. **Layer 1 — Code**: Static analysis of your codebase (logging, tests, docs, auth, monitoring)
75
+ 2. **Layer 2 — Process**: Development process maturity (baselines, regression tracking, CI gates)
76
+ 3. **Layer 3 — Traffic**: AI agent governance (audit logs, access control, policy enforcement)
77
+
78
+ Layer 1 runs automatically. Layer 2 builds as you set baselines and track regressions. Layer 3 requires connecting audit log adapters.
79
+
80
+ ### Audit Log Adapters
81
+
82
+ Connect external systems for Layer 3 evidence:
83
+
84
+ ```yaml
85
+ # ~/.comply/config.yaml
86
+ adapters:
87
+ gateway:
88
+ mode: sqlite
89
+ db_path: ./gateway.db
90
+ kong:
91
+ admin_url: http://localhost:8001
92
+ gravitee:
93
+ management_url: http://localhost:8083/management
94
+ file:
95
+ paths:
96
+ - ./audit-logs/*.jsonl
97
+ ```
98
+
99
+ ```bash
100
+ # List adapters
101
+ bespoketracker-comply adapters list
102
+
103
+ # Test connectivity
104
+ bespoketracker-comply adapters test gateway
105
+
106
+ # Ingest records
107
+ bespoketracker-comply adapters ingest gateway
108
+ ```
109
+
110
+ ## CLI Reference
111
+
112
+ ### `comply scan`
113
+
114
+ ```
115
+ bespoketracker-comply scan <target> [options]
116
+
117
+ Options:
118
+ -f, --framework FRAMEWORK Framework(s), comma-separated (default: eu-ai-act)
119
+ -d, --depth DEPTH structure | content | semantic (default: content)
120
+ -o, --output DIR Output directory for reports
121
+ --llm-key KEY LLM API key (required for semantic depth)
122
+ --llm-provider PROVIDER anthropic | openai | gemini | grok
123
+ --format FORMAT terminal | json | sarif | junit | markdown
124
+ --fail-below N Exit 1 if score < N (for CI/CD)
125
+ --fail-on-regression Exit 1 if new gaps vs baseline
126
+ --no-cache Skip scan model cache
127
+ ```
128
+
129
+ ### Other Commands
130
+
131
+ | Command | Description |
132
+ |---------|-------------|
133
+ | `serve [--port 8001]` | Start the web dashboard |
134
+ | `config show` | Show current configuration |
135
+ | `config set KEY VALUE` | Set a config value (e.g. `llm_api_key`, `llm_provider`) |
136
+ | `config path` | Print config file path |
137
+ | `frameworks` | List supported frameworks |
138
+ | `history [--repo PATH]` | Browse past scans |
139
+ | `diff SCAN1 SCAN2` | Compare two scans |
140
+ | `baseline --set ID` | Set compliance baseline |
141
+ | `cache stats\|clear` | Manage scan cache |
142
+ | `adapters list\|test\|ingest` | Manage audit log adapters |
143
+ | `activate KEY` | Activate Pro/Enterprise license |
144
+ | `deactivate` | Revert to free tier |
145
+ | `license` | Show current license status |
146
+
147
+ ## API Reference
148
+
149
+ | Method | Endpoint | Description |
150
+ |--------|----------|-------------|
151
+ | `POST` | `/scan` | Start a scan |
152
+ | `GET` | `/scan/{id}` | Poll scan status |
153
+ | `GET` | `/scan/{id}/report` | Get report JSON |
154
+ | `GET` | `/scan/{id}/download?fmt=` | Download (json/sarif/junit/markdown/docx/zip) |
155
+ | `GET` | `/scan/{id}/regression` | Regression check |
156
+ | `GET` | `/scan/{id}/progress` | Progress polling |
157
+ | `GET` | `/history` | Scan history |
158
+ | `GET` | `/diff?scan1=&scan2=` | Diff two scans |
159
+ | `GET` | `/adapters` | List adapters |
160
+ | `POST` | `/adapters/{name}/test` | Test adapter |
161
+ | `POST` | `/adapters/{name}/ingest` | Ingest records |
162
+ | `GET` | `/adapters/{name}/records` | Query records |
163
+ | `GET` | `/posture` | All-framework posture |
164
+ | `GET` | `/posture/{framework}` | Three-layer posture |
165
+ | `POST` | `/baseline/{id}` | Set baseline |
166
+ | `GET` | `/frameworks` | List frameworks |
167
+ | `POST` | `/audit` | Predicate gap audit (free) |
168
+ | `GET` | `/matrix?frameworks=` | Cross-framework matrix |
169
+ | `GET` | `/license` | License status |
170
+ | `POST` | `/license/activate` | Activate license key |
171
+ | `GET` | `/health` | Health + version |
172
+
173
+ ## CI/CD Integration
174
+
175
+ ### GitHub Actions
176
+
177
+ ```yaml
178
+ - uses: ./comply/ci/github-action.yml
179
+ with:
180
+ framework: eu-ai-act
181
+ fail-below: '50'
182
+ upload-sarif: true
183
+ post-comment: true
184
+ ```
185
+
186
+ ### GitLab CI
187
+
188
+ ```yaml
189
+ include:
190
+ - local: comply/ci/gitlab-ci-template.yml
191
+
192
+ comply-scan:
193
+ extends: .comply-scan
194
+ variables:
195
+ COMPLY_FRAMEWORK: "eu-ai-act"
196
+ COMPLY_FAIL_BELOW: "50"
197
+ ```
198
+
199
+ ### Generic CI
200
+
201
+ ```bash
202
+ # Score gate
203
+ bespoketracker-comply scan . --fail-below 50
204
+
205
+ # SARIF for code scanning
206
+ bespoketracker-comply scan . --format sarif -o ./reports
207
+
208
+ # Regression detection
209
+ bespoketracker-comply baseline --auto
210
+ bespoketracker-comply scan . --fail-on-regression
211
+ ```
212
+
213
+ ## Standalone vs Monorepo
214
+
215
+ Comply works in two modes:
216
+
217
+ - **Standalone** (`pip install bespoketracker-comply`): Uses a vendored pure-Python scanner. No Kuzu or monorepo dependencies.
218
+ - **Monorepo**: When run inside the BespokeTracker monorepo, uses the full Kuzu-based pipeline for richer analysis.
219
+
220
+ Auto-detected at runtime — no configuration needed.
221
+
222
+ ## Self-Hosted: All Features Included
223
+
224
+ Comply is source-available under the BSL 1.1 license. All features — every framework, every scan depth, every export format — are included with no feature gates.
225
+
226
+ **Update Subscription** ($29-99/mo): Subscribers get continuous improvements to evidence evaluation, new framework support, and priority fixes via a private update channel. Public releases happen on major versions.
227
+
228
+ Configuration stored in `~/.comply/config.yaml`.
229
+
230
+ ## Contributing
231
+
232
+ We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
233
+
234
+ ### Adding a New Framework
235
+
236
+ Framework definitions live in `data/frameworks.yaml` (CC-BY-4.0 licensed). To add a new framework:
237
+
238
+ 1. Add the framework definition to `data/frameworks.yaml`
239
+ 2. Map evidence functions in `_vendor/compliance_eval.py` `_EVIDENCE_FN_MAP`
240
+ 3. Add tests in the test suite
241
+ 4. Submit a PR
242
+
243
+ ### Adding an Evidence Function
244
+
245
+ Evidence functions detect compliance-relevant patterns in codebases. See existing functions in `_vendor/compliance_eval.py` for the pattern.
246
+
247
+ ## License
248
+
249
+ Business Source License 1.1. You may use Comply for any purpose including production, except offering a competing hosted compliance scanning service. Converts to Apache 2.0 on 2030-03-10. See [LICENSE](LICENSE) for details.
250
+
251
+ Framework definitions (`data/frameworks.yaml`) are licensed under CC-BY-4.0.
@@ -0,0 +1,2 @@
1
+ """BespokeAgile Comply — compliance gap analysis for any codebase."""
2
+ __version__ = "1.0.2"