codd-dev 1.40.0__tar.gz → 1.41.0__tar.gz

{codd_dev-1.40.0 → codd_dev-1.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codd-dev
-Version: 1.40.0
+Version: 1.41.0
 Summary: CoDD: Coherence-Driven Development — cross-artifact change impact analysis
 Project-URL: Homepage, https://github.com/yohey-w/codd-dev
 Project-URL: Repository, https://github.com/yohey-w/codd-dev

{codd_dev-1.40.0 → codd_dev-1.41.0}/codd/__init__.py

@@ -1,3 +1,3 @@
 """CoDD — Coherence-Driven Development."""
 
-__version__ = "1.30.0"
+__version__ = "1.41.0"

{codd_dev-1.40.0 → codd_dev-1.41.0}/codd/cli.py

@@ -458,7 +458,19 @@ def _format_preflight_ntfy(result: Any) -> str:
     default="codd",
     help="Name of the CoDD config directory (default: codd). Use .codd when codd/ is your source directory.",
 )
-def init(project_name: str, language: str, dest: str, requirements: str | None, config_dir: str):
+@click.option(
+    "--suggest-lexicons/--no-suggest-lexicons",
+    default=True,
+    help="Detect project manifests and offer lexicon plug-in suggestions.",
+)
+def init(
+    project_name: str,
+    language: str,
+    dest: str,
+    requirements: str | None,
+    config_dir: str,
+    suggest_lexicons: bool,
+):
     """Initialize CoDD in a project directory."""
     dest_path = Path(dest).resolve()
     codd_dir = dest_path / config_dir
@@ -508,6 +520,44 @@ def init(project_name: str, language: str, dest: str, requirements: str | None,
         click.echo(f"  codd init --requirements your-spec.md --dest .")
         click.echo(f"  or: codd generate --wave 2  (auto-generates everything)")
 
+    if suggest_lexicons:
+        _offer_lexicon_suggestions(dest_path)
+
+
+def _offer_lexicon_suggestions(project_root: Path) -> None:
+    from codd.init.lexicon_suggest import (
+        append_suggested_lexicons,
+        describe_lexicons,
+        load_stack_map,
+        suggest_lexicons,
+    )
+    from codd.init.stack_detector import StackDetector
+
+    detection = StackDetector().detect(project_root)
+    if not detection.stack_hints:
+        return
+
+    suggestions = suggest_lexicons(detection.stack_hints, load_stack_map())
+    if not suggestions:
+        return
+
+    descriptions = describe_lexicons(suggestions)
+    click.echo("")
+    click.echo(f"Detected signals: {', '.join(detection.detected_signals)}")
+    click.echo(f"Detected hints: {', '.join(detection.stack_hints)}")
+    click.echo("Suggested lexicons:")
+    for lexicon_id in suggestions:
+        description = descriptions.get(lexicon_id, "")
+        suffix = f" ({description})" if description else ""
+        click.echo(f"  - {lexicon_id}{suffix}")
+
+    if not click.confirm(f"Add to {LEXICON_FILENAME}?", default=True):
+        click.echo("Suggested lexicons not added.")
+        return
+    path = append_suggested_lexicons(project_root, suggestions)
+    rel_path = path.relative_to(project_root).as_posix()
+    click.echo(f"{rel_path} updated ({len(suggestions)} suggested lexicons)")
+
 
 @main.command()
 @click.option("--path", default=".", help="Project root directory")

codd_dev-1.41.0/codd/init/__init__.py

@@ -0,0 +1,2 @@
+"""Initialization helpers for CoDD project setup."""
+

codd_dev-1.41.0/codd/init/lexicon_suggest.py

@@ -0,0 +1,117 @@
+"""Suggest lexicon plug-ins from generic stack detection results."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Sequence
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+import re
+
+import yaml
+
+from codd.lexicon import LEXICON_FILENAME
+
+
+@dataclass(frozen=True)
+class StackMapEntry:
+    hint_pattern: str
+    suggested_lexicons: tuple[str, ...]
+
+
+def default_stack_map_path() -> Path:
+    return Path(__file__).resolve().parents[2] / "codd_plugins" / "stack_map.yaml"
+
+
+def default_lexicon_root() -> Path:
+    return Path(__file__).resolve().parents[2] / "codd_plugins" / "lexicons"
+
+
+def load_stack_map(path: Path | None = None) -> list[StackMapEntry]:
+    source = path or default_stack_map_path()
+    payload = yaml.safe_load(source.read_text(encoding="utf-8")) or {}
+    rows = payload.get("stack_map", [])
+    if not isinstance(rows, list):
+        raise ValueError("stack_map.yaml must contain a stack_map list")
+    entries: list[StackMapEntry] = []
+    for row in rows:
+        if not isinstance(row, dict):
+            raise ValueError("stack_map entries must be mappings")
+        pattern = str(row.get("hint_pattern", "")).strip()
+        lexicons = tuple(str(item).strip() for item in row.get("suggested_lexicons", []) if str(item).strip())
+        if not pattern or not lexicons:
+            raise ValueError("stack_map entries require hint_pattern and suggested_lexicons")
+        re.compile(pattern)
+        entries.append(StackMapEntry(pattern, lexicons))
+    return entries
+
+
+def suggest_lexicons(stack_hints: Sequence[str], entries: Sequence[StackMapEntry]) -> list[str]:
+    suggested: list[str] = []
+    seen: set[str] = set()
+    for hint in stack_hints:
+        for entry in entries:
+            if not re.search(entry.hint_pattern, hint, flags=re.IGNORECASE):
+                continue
+            for lexicon in entry.suggested_lexicons:
+                if lexicon in seen:
+                    continue
+                seen.add(lexicon)
+                suggested.append(lexicon)
+    return suggested
+
+
+def describe_lexicons(lexicon_ids: Iterable[str], lexicon_root: Path | None = None) -> dict[str, str]:
+    root = lexicon_root or default_lexicon_root()
+    descriptions: dict[str, str] = {}
+    for lexicon_id in lexicon_ids:
+        manifest = root / lexicon_id / "manifest.yaml"
+        if not manifest.is_file():
+            descriptions[lexicon_id] = ""
+            continue
+        payload = yaml.safe_load(manifest.read_text(encoding="utf-8")) or {}
+        descriptions[lexicon_id] = str(payload.get("description", ""))
+    return descriptions
+
+
+def append_suggested_lexicons(project_root: Path, lexicon_ids: Sequence[str]) -> Path:
+    path = Path(project_root) / LEXICON_FILENAME
+    data = _load_project_lexicon(path)
+    current = data.get("suggested_lexicons", [])
+    if not isinstance(current, list):
+        raise ValueError("project_lexicon.yaml suggested_lexicons must be a list")
+    known = {_lexicon_id(item) for item in current}
+    merged = list(current)
+    for lexicon_id in lexicon_ids:
+        if lexicon_id in known:
+            continue
+        merged.append(lexicon_id)
+        known.add(lexicon_id)
+    data["suggested_lexicons"] = merged
+    path.write_text(yaml.safe_dump(data, sort_keys=False, allow_unicode=True), encoding="utf-8")
+    return path
+
+
+def _load_project_lexicon(path: Path) -> dict[str, Any]:
+    if path.is_file():
+        payload = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+        if not isinstance(payload, dict):
+            raise ValueError("project_lexicon.yaml must contain a YAML mapping")
+        return payload
+    return {
+        "version": "1.0",
+        "node_vocabulary": [],
+        "naming_conventions": [],
+        "design_principles": [
+            "Review suggested lexicons before treating project conventions as approved.",
+        ],
+    }
+
+
+def _lexicon_id(item: Any) -> str:
+    if isinstance(item, str):
+        return item
+    if isinstance(item, dict):
+        return str(item.get("id", item.get("name", item.get("lexicon_name", ""))))
+    return str(item)
+

codd_dev-1.41.0/codd/init/stack_detector.py

@@ -0,0 +1,170 @@
+"""Generic stack signal detection from common project manifests."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Iterable, Mapping
+from dataclasses import dataclass
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+try:  # pragma: no cover - Python 3.10 fallback.
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover
+    import tomli as tomllib  # type: ignore[no-redef]
+
+
+@dataclass(frozen=True)
+class StackDetection:
+    detected_signals: list[str]
+    stack_hints: list[str]
+
+
+class StackDetector:
+    """Detect package-manager signals without encoding product knowledge."""
+
+    def detect(self, project_root: Path) -> StackDetection:
+        root = Path(project_root)
+        signals: list[str] = []
+        hints: list[str] = []
+        for name, extractor in _MANIFEST_EXTRACTORS.items():
+            path = root / name
+            if not path.is_file():
+                continue
+            signals.append(name)
+            hints.extend(extractor(path))
+        return StackDetection(detected_signals=signals, stack_hints=_unique(hints))
+
+
+def _package_json(path: Path) -> Iterable[str]:
+    data = _load_json_mapping(path)
+    for key in ("dependencies", "devDependencies", "peerDependencies", "optionalDependencies"):
+        yield from _mapping_keys(data.get(key))
+
+
+def _composer_json(path: Path) -> Iterable[str]:
+    data = _load_json_mapping(path)
+    for key in ("require", "require-dev"):
+        yield from _mapping_keys(data.get(key))
+
+
+def _requirements_txt(path: Path) -> Iterable[str]:
+    for raw_line in path.read_text(encoding="utf-8").splitlines():
+        line = raw_line.split("#", 1)[0].strip()
+        if not line or line.startswith(("-", "git+", "http://", "https://")):
+            egg = re.search(r"(?:^|[&#])egg=([A-Za-z0-9_.-]+)", raw_line)
+            if egg:
+                yield egg.group(1)
+            continue
+        match = re.match(r"([A-Za-z0-9_.-]+)", line)
+        if match:
+            yield match.group(1)
+
+
+def _pyproject_toml(path: Path) -> Iterable[str]:
+    data = _load_toml_mapping(path)
+    project = data.get("project", {})
+    if isinstance(project, Mapping):
+        for item in _as_list(project.get("dependencies")):
+            yield from _requirement_name(item)
+        for group in _mapping_values(project.get("optional-dependencies")):
+            for item in _as_list(group):
+                yield from _requirement_name(item)
+    tool = data.get("tool", {})
+    if isinstance(tool, Mapping):
+        poetry = tool.get("poetry", {})
+        if isinstance(poetry, Mapping):
+            yield from _mapping_keys(poetry.get("dependencies"), exclude={"python"})
+            yield from _mapping_keys(poetry.get("dev-dependencies"), exclude={"python"})
+    for group in _mapping_values(data.get("dependency-groups")):
+        for item in _as_list(group):
+            yield from _requirement_name(item)
+
+
+def _go_mod(path: Path) -> Iterable[str]:
+    for line in path.read_text(encoding="utf-8").splitlines():
+        stripped = line.strip()
+        if not stripped or stripped.startswith(("//", "module ", ")")):
+            continue
+        if stripped.startswith("require "):
+            stripped = stripped.removeprefix("require ").strip()
+        name = stripped.split()[0] if stripped.split() else ""
+        if "/" in name:
+            yield name
+
+
+def _cargo_toml(path: Path) -> Iterable[str]:
+    data = _load_toml_mapping(path)
+    for key in ("dependencies", "dev-dependencies", "build-dependencies"):
+        yield from _mapping_keys(data.get(key))
+    workspace = data.get("workspace", {})
+    if isinstance(workspace, Mapping):
+        yield from _mapping_keys(workspace.get("dependencies"))
+
+
+def _gemfile(path: Path) -> Iterable[str]:
+    for match in re.finditer(r"\bgem\s+['\"]([^'\"]+)['\"]", path.read_text(encoding="utf-8")):
+        yield match.group(1)
+
+
+def _pom_xml(path: Path) -> Iterable[str]:
+    for match in re.finditer(r"<artifactId>\s*([^<\s]+)\s*</artifactId>", path.read_text(encoding="utf-8")):
+        yield match.group(1)
+
+
+def _load_json_mapping(path: Path) -> Mapping[str, Any]:
+    data = json.loads(path.read_text(encoding="utf-8"))
+    return data if isinstance(data, Mapping) else {}
+
+
+def _load_toml_mapping(path: Path) -> Mapping[str, Any]:
+    data = tomllib.loads(path.read_text(encoding="utf-8"))
+    return data if isinstance(data, Mapping) else {}
+
+
+def _mapping_keys(value: Any, *, exclude: set[str] | None = None) -> Iterable[str]:
+    if not isinstance(value, Mapping):
+        return []
+    skipped = exclude or set()
+    return [str(key) for key in value if str(key) not in skipped]
+
+
+def _mapping_values(value: Any) -> Iterable[Any]:
+    return value.values() if isinstance(value, Mapping) else []
+
+
+def _as_list(value: Any) -> list[Any]:
+    return value if isinstance(value, list) else []
+
+
+def _requirement_name(value: Any) -> Iterable[str]:
+    if not isinstance(value, str):
+        return []
+    match = re.match(r"\s*([A-Za-z0-9_.-]+)", value)
+    return [match.group(1)] if match else []
+
+
+def _unique(values: Iterable[str]) -> list[str]:
+    seen: set[str] = set()
+    result: list[str] = []
+    for value in values:
+        hint = value.strip().lower()
+        if not hint or hint in seen:
+            continue
+        seen.add(hint)
+        result.append(hint)
+    return result
+
+
+_MANIFEST_EXTRACTORS: dict[str, Callable[[Path], Iterable[str]]] = {
+    "package.json": _package_json,
+    "requirements.txt": _requirements_txt,
+    "pyproject.toml": _pyproject_toml,
+    "go.mod": _go_mod,
+    "Cargo.toml": _cargo_toml,
+    "Gemfile": _gemfile,
+    "pom.xml": _pom_xml,
+    "composer.json": _composer_json,
+}
+

codd_dev-1.41.0/codd_plugins/lexicons/ai_governance_eu_act/coverage_matrix.md

@@ -0,0 +1,19 @@
+# EU AI Act Governance Coverage Matrix
+
+Source: Regulation (EU) 2024/1689 on artificial intelligence.
+
+| Axis | Covered when | Implicit when | Gap when |
+| --- | --- | --- | --- |
+| `Classification rules for high-risk AI systems` | The AI system's risk class, Annex III relevance, and significant-risk reasoning are stated. | The material explicitly states no AI system is being placed on the market, put into service, or deployed. | AI features exist but risk class or high-risk reasoning is absent. |
+| `Prohibited AI practices` | The design excludes or mitigates Article 5 practices such as manipulation, vulnerability exploitation, social scoring, or banned biometric uses. | The material describes non-AI automation with no AI inference or targeting. | AI behavior could intersect Article 5 but no prohibition check is stated. |
+| `Requirements for high-risk AI systems` | Risk management, data governance, technical documentation, logging, transparency to deployers, accuracy, robustness, and cybersecurity are specified. | The system is explicitly not high-risk and the classification rationale is documented. | A high-risk or likely high-risk system lacks Section 2 requirement coverage. |
+| `Human oversight` | Natural-person oversight, intervention, interpretation, and misuse handling are specified. | The system has no autonomous recommendation, prediction, or decision support. | AI outputs affect people but oversight is not described. |
+| `Transparency obligations for providers and deployers of certain AI systems` | AI interaction notices, synthetic-content labeling, emotion-recognition disclosure, and deployer communications are specified where applicable. | No user-facing AI, synthetic content, or listed transparency scenario exists. | Users or affected persons may encounter AI or synthetic content without disclosure rules. |
+| `General-purpose AI models` | GPAI scope, documentation, downstream information, copyright policy, and systemic-risk obligations are specified. | The system uses no GPAI model and does not distribute a model. | A foundation, general-purpose, or reusable model is used or provided without GPAI duties. |
+| `Conformity assessment` | Required assessment route, internal control or notified-body path, CE/declaration artifacts, and significant-change triggers are specified. | The system is not subject to high-risk conformity assessment and that conclusion is documented. | High-risk placement, service, or major change lacks conformity assessment. |
+| `Post-market monitoring by providers and post-market monitoring plan` | Monitoring plan, lifecycle metrics, incident capture, serious-incident reporting, and corrective action are specified. | The system is not placed on market or operated as an AI system after release. | AI system operation continues after release without monitoring or incident handling. |
+| `Fundamental rights impact assessment for high-risk AI systems` | FRIA scope, affected groups, risks, mitigations, and deployer responsibilities are specified. | No high-risk deployer context applies and the reason is documented. | High-risk deployment by an in-scope deployer lacks fundamental-rights impact review. |
+| `Governance at Union and national level` | AI literacy, accountable roles, competent-authority contact, market-surveillance response, and governance escalation are specified. | A non-AI internal tool has no external governance interface. | AI obligations exist but owner, literacy, or authority interface is missing. |
+
+Reviewers should classify each axis as `covered`, `implicit`, or `gap`.
+Findings are emitted only for `gap`.

codd_dev-1.41.0/codd_plugins/lexicons/ai_governance_eu_act/elicit_extend.md

@@ -0,0 +1,54 @@
+---
+extends: codd/elicit/templates/elicit_prompt_L0.md
+lexicon_name: ai_governance_eu_act
+observation_dimensions: 10
+---
+
+# EU AI Act Governance Observation Dimensions
+
+Apply the base elicitation prompt, then inspect requirements and design notes
+through these EU AI Act dimensions:
+
+1. `Classification rules for high-risk AI systems`
+2. `Prohibited AI practices`
+3. `Requirements for high-risk AI systems`
+4. `Human oversight`
+5. `Transparency obligations for providers and deployers of certain AI systems`
+6. `General-purpose AI models`
+7. `Conformity assessment`
+8. `Post-market monitoring by providers and post-market monitoring plan`
+9. `Fundamental rights impact assessment for high-risk AI systems`
+10. `Governance at Union and national level`
+
+For each dimension, classify coverage as:
+
+- `covered`: requirements explicitly state the EU AI Act obligation, risk class,
+  workflow, evidence artifact, or documented non-applicability.
+- `implicit`: the described feature is not an AI system, not high-risk, not GPAI,
+  or not in the relevant provider/deployer context, and the non-applicability is
+  clear from the material.
+- `gap`: AI functionality exists and the dimension can affect legality,
+  fundamental rights, safety, transparency, or lifecycle controls.
+
+Emit findings only for dimensions classified as `gap`. Include the dimension in
+`details.dimension`, the AI feature or omission signal in `details.evidence`,
+and a reviewer-facing question in `question`.
+
+## Coverage-check examples
+
+- `covered`: A hiring-screening AI design states Annex III high-risk
+  classification, Article 5 exclusion checks, risk management, training-data
+  governance, human reviewer workflow, FRIA, conformity assessment, and
+  post-market monitoring; classify the high-risk dimensions as `covered`.
+- `implicit`: A deterministic invoice-number formatter uses no model,
+  inference, profiling, or generated content; classify the AI Act dimensions as
+  `implicit`.
+- `gap`: A chatbot generates user-facing legal guidance with a general-purpose
+  model but lacks AI disclosure, model documentation, risk classification, and
+  monitoring; classify `Transparency obligations for providers and deployers of
+  certain AI systems`, `General-purpose AI models`, `Classification rules for
+  high-risk AI systems`, and `Post-market monitoring by providers and
+  post-market monitoring plan` as `gap`.
+
+Use recommended kinds as guidance. Do not invent dimensions outside the ten
+listed above.

codd_dev-1.41.0/codd_plugins/lexicons/ai_governance_eu_act/lexicon.yaml

@@ -0,0 +1,177 @@
+coverage_axes:
+  - axis_type: "Classification rules for high-risk AI systems"
+    rationale: "EU AI Act Article 6 defines classification rules for high-risk AI systems and Annex III categories."
+    criticality_default: critical
+    variants:
+      - id: "high-risk AI system"
+        label: "High-risk AI system classification"
+        attributes: {source: "Article 6", source_literal: "high-risk AI system"}
+        criticality: critical
+      - id: "Annex III"
+        label: "Annex III high-risk area"
+        attributes: {source: "Article 6(2)", source_literal: "Annex III"}
+        criticality: critical
+      - id: "significant risk"
+        label: "Significant-risk assessment"
+        attributes: {source: "Article 6(3)", source_literal: "significant risk"}
+        criticality: high
+  - axis_type: "Prohibited AI practices"
+    rationale: "EU AI Act Chapter II Article 5 lists prohibited AI practices."
+    criticality_default: critical
+    variants:
+      - id: "subliminal techniques"
+        label: "Subliminal, manipulative, or deceptive techniques"
+        attributes: {source: "Article 5(1)(a)", source_literal: "subliminal techniques"}
+        criticality: critical
+      - id: "exploits any of the vulnerabilities"
+        label: "Exploitation of vulnerabilities"
+        attributes: {source: "Article 5(1)(b)", source_literal: "vulnerabilities"}
+        criticality: critical
+      - id: "social score"
+        label: "Social scoring"
+        attributes: {source: "Article 5(1)(c)", source_literal: "social score"}
+        criticality: critical
+      - id: "real-time remote biometric identification"
+        label: "Real-time remote biometric identification"
+        attributes: {source: "Article 5(1)(h)", source_literal: "real-time remote biometric identification"}
+        criticality: critical
+  - axis_type: "Requirements for high-risk AI systems"
+    rationale: "EU AI Act Section 2 Articles 8 to 15 sets requirements for high-risk AI systems."
+    criticality_default: high
+    variants:
+      - id: "risk management system"
+        label: "Risk management system"
+        attributes: {source: "Article 9", source_literal: "risk management system"}
+        criticality: high
+      - id: "data and data governance"
+        label: "Data and data governance"
+        attributes: {source: "Article 10", source_literal: "data governance"}
+        criticality: high
+      - id: "technical documentation"
+        label: "Technical documentation"
+        attributes: {source: "Article 11", source_literal: "technical documentation"}
+        criticality: high
+      - id: "record-keeping"
+        label: "Automatic logging and record-keeping"
+        attributes: {source: "Article 12", source_literal: "record-keeping"}
+        criticality: medium
+      - id: "accuracy, robustness and cybersecurity"
+        label: "Accuracy, robustness, and cybersecurity"
+        attributes: {source: "Article 15", source_literal: "accuracy, robustness and cybersecurity"}
+        criticality: high
+  - axis_type: "Human oversight"
+    rationale: "EU AI Act Article 14 requires high-risk AI systems to be designed for effective oversight by natural persons."
+    criticality_default: high
+    variants:
+      - id: "human oversight"
+        label: "Human oversight"
+        attributes: {source: "Article 14", source_literal: "human oversight"}
+        criticality: high
+      - id: "human-machine interface tools"
+        label: "Human-machine interface support"
+        attributes: {source: "Article 14(1)", source_literal: "human-machine interface tools"}
+        criticality: medium
+      - id: "reasonably foreseeable misuse"
+        label: "Misuse risk oversight"
+        attributes: {source: "Article 14(2)", source_literal: "reasonably foreseeable misuse"}
+        criticality: high
+  - axis_type: "Transparency obligations for providers and deployers of certain AI systems"
+    rationale: "EU AI Act Article 50 defines transparency obligations for specified provider and deployer scenarios."
+    criticality_default: high
+    variants:
+      - id: "transparency obligations"
+        label: "Article 50 transparency obligations"
+        attributes: {source: "Article 50", source_literal: "transparency obligations"}
+        criticality: high
+      - id: "synthetic audio, image, video or text content"
+        label: "Synthetic content disclosure"
+        attributes: {source: "Article 50", source_literal: "synthetic audio, image, video or text content"}
+        criticality: high
+      - id: "emotion recognition system"
+        label: "Emotion recognition transparency"
+        attributes: {source: "Article 50", source_literal: "emotion recognition system"}
+        criticality: medium
+  - axis_type: "General-purpose AI models"
+    rationale: "EU AI Act Chapter V and Articles 53 to 55 define obligations for providers of general-purpose AI models."
+    criticality_default: high
+    variants:
+      - id: "general-purpose AI model"
+        label: "GPAI model scope"
+        attributes: {source: "Chapter V", source_literal: "general-purpose AI model"}
+        criticality: high
+      - id: "technical documentation"
+        label: "GPAI technical documentation"
+        attributes: {source: "Article 53(1)(a)", source_literal: "technical documentation"}
+        criticality: high
+      - id: "systemic risk"
+        label: "Systemic-risk GPAI model"
+        attributes: {source: "Article 55", source_literal: "systemic risk"}
+        criticality: critical
+  - axis_type: "Conformity assessment"
+    rationale: "EU AI Act Article 43 requires conformity assessment before placing certain high-risk AI systems on the market or putting them into service."
+    criticality_default: high
+    variants:
+      - id: "conformity assessment"
+        label: "Conformity assessment procedure"
+        attributes: {source: "Article 43", source_literal: "conformity assessment"}
+        criticality: high
+      - id: "internal control"
+        label: "Internal control route"
+        attributes: {source: "Article 43 / Annex VI", source_literal: "internal control"}
+        criticality: medium
+      - id: "EU declaration of conformity"
+        label: "EU declaration of conformity"
+        attributes: {source: "Article 47", source_literal: "EU declaration of conformity"}
+        criticality: medium
+  - axis_type: "Post-market monitoring by providers and post-market monitoring plan"
+    rationale: "EU AI Act Article 72 requires providers to establish and document post-market monitoring for high-risk AI systems."
+    criticality_default: high
+    variants:
+      - id: "post-market monitoring"
+        label: "Post-market monitoring"
+        attributes: {source: "Article 72", source_literal: "post-market monitoring"}
+        criticality: high
+      - id: "post-market monitoring plan"
+        label: "Post-market monitoring plan"
+        attributes: {source: "Article 72", source_literal: "post-market monitoring plan"}
+        criticality: high
+      - id: "serious incident"
+        label: "Serious incident handling"
+        attributes: {source: "Article 73", source_literal: "serious incident"}
+        criticality: critical
+  - axis_type: "Fundamental rights impact assessment for high-risk AI systems"
+    rationale: "EU AI Act Article 27 requires specified deployers to carry out a fundamental rights impact assessment before using high-risk AI systems."
+    criticality_default: high
+    variants:
+      - id: "fundamental rights impact assessment"
+        label: "FRIA requirement"
+        attributes: {source: "Article 27", acronym: "FRIA"}
+        criticality: high
+      - id: "deployers of high-risk AI systems"
+        label: "Deployer FRIA scope"
+        attributes: {source: "Article 27", source_literal: "deployers of high-risk AI systems"}
+        criticality: high
+      - id: "risks to fundamental rights"
+        label: "Fundamental-rights risk identification"
+        attributes: {source: "Article 27", source_literal: "risks to fundamental rights"}
+        criticality: high
+  - axis_type: "Governance at Union and national level"
+    rationale: "EU AI Act Chapter VII establishes governance bodies, national competent authorities, market surveillance, and AI literacy expectations."
+    criticality_default: medium
+    variants:
+      - id: "AI Office"
+        label: "AI Office governance"
+        attributes: {source: "Chapter VII", source_literal: "AI Office"}
+        criticality: medium
+      - id: "European Artificial Intelligence Board"
+        label: "European AI Board governance"
+        attributes: {source: "Chapter VII", source_literal: "European Artificial Intelligence Board"}
+        criticality: medium
+      - id: "national competent authorities"
+        label: "National competent authority interface"
+        attributes: {source: "Chapter VII", source_literal: "national competent authorities"}
+        criticality: medium
+      - id: "AI literacy"
+        label: "AI literacy measures"
+        attributes: {source: "Article 4", source_literal: "AI literacy"}
+        criticality: medium

codd_dev-1.41.0/codd_plugins/lexicons/ai_governance_eu_act/manifest.yaml

@@ -0,0 +1,18 @@
+name: ai_governance_eu_act
+lexicon_name: ai_governance_eu_act
+version: "1.0.0"
+source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
+source_version: "Regulation (EU) 2024/1689, Official Journal 2024-07-12"
+description: "EU AI Act governance coverage axes for AI systems, high-risk systems, GPAI, and deployer obligations."
+observation_dimensions: 10
+extends: "codd/elicit/templates/elicit_prompt_L0.md"
+prompt_extension: "elicit_extend.md"
+recommended_kinds: "recommended_kinds.yaml"
+lexicon: "lexicon.yaml"
+severity_rules: "severity_rules.yaml"
+coverage_matrix: "coverage_matrix.md"
+references:
+  - title: "Regulation (EU) 2024/1689 on artificial intelligence"
+    url: "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
+  - title: "EUR-Lex CELEX 32024R1689"
+    url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"

codd_dev-1.41.0/codd_plugins/lexicons/ai_governance_eu_act/recommended_kinds.yaml

@@ -0,0 +1,11 @@
+recommended_kinds:
+  - ai_risk_classification_gap
+  - prohibited_ai_practice_gap
+  - high_risk_requirement_gap
+  - human_oversight_gap
+  - ai_transparency_gap
+  - gpai_obligation_gap
+  - conformity_assessment_gap
+  - post_market_monitoring_gap
+  - fundamental_rights_impact_gap
+  - ai_governance_authority_gap