iris-security-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.0
-Requires-Dist: iris-security-sdk>=0.1.2
+Requires-Dist: iris-security-core>=0.1.3
+Requires-Dist: iris-security-sdk>=0.1.4
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_cli/assess.py

@@ -27,7 +27,7 @@ console = Console()
 
 
 # ── Colorado AI Act impact assessment questionnaire ───────────────────────────
-# Each question maps to a specific obligation under SB 24-205.
+# Each question maps to a specific obligation under SB 26-189.
 # The answers drive the risk level and the generated assessment document.
 
 QUESTIONNAIRE = [
@@ -44,7 +44,7 @@ QUESTIONNAIRE = [
             "insurance",
             "legal services",
             "government",
-            "other (not high-risk)",
+            "other (not covered ADMT)",
         ],
         "type": "choice",
         "high_risk_values": [
@@ -58,6 +58,27 @@ QUESTIONNAIRE = [
             "government",
         ],
     },
+    {
+        "id": "impact_assessment",
+        "rule": "CO-002",
+        "severity": "MEDIUM",
+        "question": (
+            "Has an impact assessment been completed for this agent? "
+            "(Not legally required under SB 26-189 but recommended as "
+            "best practice for NIST AI RMF alignment)"
+        ),
+        "type": "confirm",
+    },
+    {
+        "id": "record_retention",
+        "rule": "CO-RR-001",
+        "severity": "HIGH",
+        "question": (
+            "Do you have a plan for retaining AI usage records for 3 years? "
+            "(Required under SB 26-189 for covered ADMT systems)"
+        ),
+        "type": "confirm",
+    },
     {
         "id": "consequential",
         "rule": "CO-004",
@@ -137,7 +158,8 @@ def run_questionnaire() -> dict:
     console.print("\n[bold]Colorado AI Act Impact Assessment[/bold]")
     console.print(
         "[dim]Answer each question honestly. IRIS uses your answers to generate "
-        "a legally-meaningful impact assessment under SB 24-205.[/dim]\n"
+        "an impact assessment under SB 26-189 (replaces SB 24-205, effective "
+        "Jan. 1, 2027).[/dim]\n"
     )
 
     for i, q in enumerate(QUESTIONNAIRE, 1):
@@ -204,7 +226,28 @@ def calculate_risk_level(answers: dict) -> tuple:
     if domain in high_risk_domains:
         risk_score += 3
         findings.append(
-            f"Agent operates in '{domain}' — a high-risk domain under SB 24-205."
+            f"Agent operates in '{domain}' — a covered ADMT domain under SB 26-189."
+        )
+
+    if not answers.get("impact_assessment"):
+        risk_score += 1
+        findings.append(
+            "No impact assessment on file (best practice under SB 26-189, "
+            "not legally required)."
+        )
+        recommendations.append(
+            "Complete an impact assessment via iris compliance assess to align "
+            "with NIST AI RMF MAP-1.5."
+        )
+
+    if not answers.get("record_retention"):
+        risk_score += 2
+        findings.append(
+            "No 3-year record retention plan documented for ADMT usage records."
+        )
+        recommendations.append(
+            "Configure Evidence Vault Pro for 3-year retention (CO-RR-001). "
+            "Run: iris license activate <your-key>"
         )
 
     if answers.get("consequential"):
@@ -297,7 +340,8 @@ def generate_assessment_markdown(
 > **Assessment ID**: `{assessment_id}`
 > **Assessed by**: {assessed_by}
 > **Date**: {now}
-> **Framework**: Colorado AI Act (SB 24-205), effective July 1, 2026
+> **Framework**: Colorado AI Act (SB 26-189), effective January 1, 2027
+> **Note**: Replaces SB 24-205, signed May 14, 2026
 > **Generated by**: IRIS Compliance Platform v0.1.0
 
 ---
@@ -316,6 +360,8 @@ def generate_assessment_markdown(
 | Owner | {owner} |
 | Operating domain | {answers.get('domain', 'not specified')} |
 | Makes consequential decisions | {'Yes' if answers.get('consequential') else 'No'} |
+| Impact assessment completed | {'Yes' if answers.get('impact_assessment') else 'No (best practice)'} |
+| 3-year record retention plan | {'Yes' if answers.get('record_retention') else 'No'} |
 | Human review available | {'Yes' if answers.get('human_review') else 'No'} |
 | Consumer opt-out available | {'Yes' if answers.get('opt_out') else 'No'} |
 | Discrimination review completed | {'Yes' if answers.get('discrimination_review') else 'No'} |
@@ -356,12 +402,12 @@ def generate_assessment_markdown(
 
 | Rule | Obligation | Status |
 |---|---|---|
-| CO-001 | High-risk AI inventory | ✅ Satisfied — agent registered in IRIS |
-| CO-002 | Impact assessment | ✅ Satisfied — this document |
-| CO-003 | Transparency disclosure | ✅ Satisfied — policy-intent.md |
-| CO-004 | Consumer opt-out | {'✅ Satisfied' if answers.get('opt_out') else '⚠️ Requires action'} |
-| CO-005 | Non-discrimination review | {'✅ Satisfied' if answers.get('discrimination_review') else '⚠️ Requires action'} |
-| CO-006 | Annual review | ✅ Scheduled — next review due {(datetime.utcnow().replace(year=datetime.utcnow().year + 1)).strftime('%Y-%m-%d')} |
+| CO-001 | ADMT inventory | ✅ Satisfied — agent registered in IRIS |
+| CO-002 | Impact assessment (best practice) | {'✅ Satisfied' if answers.get('impact_assessment') else '⚠️ Recommended'} |
+| CO-003 | Consumer notice / transparency | ✅ Satisfied — policy-intent.md |
+| CO-004 | Post-adverse-action notice | {'✅ Satisfied' if answers.get('opt_out') else '⚠️ Requires action'} |
+| CO-RR-001 | 3-year record retention | {'✅ Satisfied' if answers.get('record_retention') else '⚠️ Requires action'} |
+| CO-DEV-001 | Developer documentation | ✅ Satisfied — policy-intent.md + passport.yaml |
 
 ---
 
@@ -374,9 +420,10 @@ def generate_assessment_markdown(
 
 ---
 
-*This document was generated by IRIS and constitutes a formal impact assessment
-under Colorado AI Act SB 24-205. It should be reviewed annually or whenever
-the agent's capabilities, data access, or decision scope changes.*
+*This document was generated by IRIS and constitutes an impact assessment
+under Colorado AI Act SB 26-189 (replaces SB 24-205, effective Jan. 1, 2027).
+It should be reviewed whenever the agent's capabilities, data access, or
+decision scope changes.*
 """
 
 
@@ -428,8 +475,8 @@ def compliance_assess(agent, assessor, governance_dir, yes, answers):
     console.print(Panel(
         f"[bold]IRIS Impact Assessment[/bold]\n"
         f"Agent: [cyan]{agent}[/cyan]\n"
-        f"Framework: Colorado AI Act (SB 24-205)\n"
-        f"Effective: July 1, 2026",
+        f"Framework: Colorado AI Act (SB 26-189)\n"
+        f"Effective: January 1, 2027 (replaces SB 24-205)",
         style="blue"
     ))
 
@@ -500,7 +547,7 @@ def compliance_assess(agent, assessor, governance_dir, yes, answers):
         f"Files updated:\n"
         f"  [dim]{assessment_file}[/dim]\n"
         f"  [dim]{passport_file}[/dim]\n\n"
-        f"CO-002 violation: [bold green]CLOSED[/bold green]\n\n"
+        f"CO-002 best practice: [bold green]{'SATISFIED' if questionnaire_answers.get('impact_assessment') else 'RECOMMENDED'}[/bold green]\n\n"
         f"Next step: [bold]iris compliance check --framework colorado-ai-act[/bold]",
         style="green"
     ))

iris_security_cli-0.1.4/iris_cli/cost.py

@@ -0,0 +1,418 @@
+"""iris cost — token cost tracking, reporting, and optimization suggestions."""
+
+from __future__ import annotations
+
+import csv
+import io
+import json
+import sys
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Dict, List, Optional
+
+import click
+import yaml
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+
+from iris_core.cost.pricing import DEFAULT_PRICING, overrides_path, PricingRegistry
+from iris_core.cost.tracker import CostSummary, CostTracker, discover_agent_trackers
+
+console = Console()
+
+ALERTS_PATH = Path.home() / ".iris" / "cost-alerts.yaml"
+
+
+def _since_from_days(days: int) -> str:
+    return (datetime.now(timezone.utc) - timedelta(days=days)).isoformat()
+
+
+def _since_from_date(since: Optional[str], days: int) -> str:
+    if since:
+        return datetime.fromisoformat(since).replace(tzinfo=timezone.utc).isoformat()
+    return _since_from_days(days)
+
+
+def _format_usd(amount: float) -> str:
+    if amount >= 1:
+        return f"${amount:,.2f}"
+    return f"${amount:.3f}"
+
+
+def _find_tracker(agent_name: str) -> Optional[CostTracker]:
+    for tracker in discover_agent_trackers():
+        if tracker.agent_name == agent_name or tracker.agent_id == agent_name:
+            return tracker
+    return None
+
+
+def _resolve_trackers(agent: Optional[str]) -> List[CostTracker]:
+    trackers = discover_agent_trackers()
+    if not agent:
+        return trackers
+    matched = [t for t in trackers if t.agent_name == agent or t.agent_id == agent]
+    if not matched:
+        console.print(f"[yellow]No cost data found for agent '{agent}'.[/yellow]")
+        sys.exit(1)
+    return matched
+
+
+def _model_call_counts(tracker: CostTracker, since: str) -> Dict[str, int]:
+    counts: Dict[str, int] = {}
+    for entry in tracker.get_entries(since=since):
+        counts[entry.model] = counts.get(entry.model, 0) + 1
+    return counts
+
+
+def _render_report_table(summary: CostSummary, days: int) -> None:
+    generated = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+    header = (
+        f"┌─ Cost Report: {summary.agent_name} "
+        f"{'─' * max(1, 40 - len(summary.agent_name))}┐\n"
+        f"│ Period: last {days} days  │  Generated: {generated}"
+        f"{' ' * max(1, 18 - len(str(days)))}│\n"
+        f"└{'─' * 58}┘"
+    )
+    console.print(header)
+    console.print("\n[bold]SUMMARY[/bold]")
+    console.print(f"Total spend:        {_format_usd(summary.total_cost_usd)}")
+    console.print(f"Total calls:         {summary.total_calls:,}")
+    console.print(f"Avg cost per call:  {_format_usd(summary.avg_cost_per_call)}")
+    console.print(f"Estimated monthly:  {_format_usd(summary.estimated_monthly_cost)}")
+
+    if summary.cost_by_model:
+        console.print("\n[bold]BY MODEL[/bold]")
+        tracker = _find_tracker(summary.agent_name)
+        since = summary.period_start
+        call_counts = _model_call_counts(tracker, since) if tracker else {}
+        total = summary.total_cost_usd or 1.0
+        for model, cost in sorted(summary.cost_by_model.items(), key=lambda x: -x[1]):
+            pct = int(cost / total * 100)
+            calls = call_counts.get(model, 0)
+            console.print(
+                f"{model:<20} {_format_usd(cost):>8}  {pct:>3}%   ({calls:,} calls)"
+            )
+
+    if summary.cost_by_tool:
+        console.print("\n[bold]BY TOOL[/bold]")
+        for tool, cost in sorted(summary.cost_by_tool.items(), key=lambda x: -x[1]):
+            entries = [
+                e for e in (_find_tracker(summary.agent_name) or CostTracker("", "")).get_entries(since=summary.period_start)
+                if e.tool_name == tool
+            ]
+            calls = len(entries) if entries else 0
+            per_call = cost / calls if calls else 0.0
+            console.print(
+                f"{tool:<20} {_format_usd(cost):>8}   ({calls:,} calls)  "
+                f"{_format_usd(per_call)}/call"
+            )
+
+    if summary.anomalies:
+        console.print("\n[bold]ANOMALIES[/bold]")
+        for anomaly in summary.anomalies[:10]:
+            ts = anomaly.call.timestamp[:16].replace("T", " ")
+            console.print(
+                f"⚠ {ts}  {_format_usd(anomaly.call.cost_usd)} call — "
+                f"{anomaly.call.tool_name}()\n"
+                f"  {anomaly.description}"
+            )
+
+
+def _render_summary_table(summaries: List[CostSummary], days: int) -> None:
+    total_org = sum(s.total_cost_usd for s in summaries)
+    header = (
+        f"┌─ IRIS Cost Summary — All Agents {'─' * 24}┐\n"
+        f"│ Period: last {days} days  │  Total org spend: {_format_usd(total_org):<12}│\n"
+        f"└{'─' * 58}┘"
+    )
+    console.print(header)
+    console.print("")
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Agent")
+    table.add_column("Spend", justify="right")
+    table.add_column("Calls", justify="right")
+    table.add_column("Avg/call", justify="right")
+    table.add_column("Trend")
+
+    for summary in sorted(summaries, key=lambda s: -s.total_cost_usd):
+        trend = summary.cost_trend
+        if trend == "INCREASING":
+            trend_display = "↑ increasing"
+        elif trend == "DECREASING":
+            trend_display = "↓ decreasing"
+        else:
+            trend_display = "→ stable"
+        table.add_row(
+            summary.agent_name,
+            _format_usd(summary.total_cost_usd),
+            f"{summary.total_calls:,}",
+            _format_usd(summary.avg_cost_per_call),
+            trend_display,
+        )
+    console.print(table)
+
+
+def _suggest_optimizations(summary: CostSummary, since: str) -> List[str]:
+    suggestions: List[str] = []
+    tracker = _find_tracker(summary.agent_name)
+    if not tracker:
+        return suggestions
+
+    downgrade_map = {
+        "gpt-4o": "gpt-4o-mini",
+        "claude-sonnet-4-6": "claude-haiku-4-5",
+        "claude-opus-4-6": "claude-sonnet-4-6",
+        "gemini-2.0-pro": "gemini-2.0-flash",
+        "gemini-1.5-pro": "gemini-1.5-flash",
+    }
+    registry = PricingRegistry()
+    idx = 1
+    total_saving = 0.0
+
+    for tool, tool_cost in sorted(summary.cost_by_tool.items(), key=lambda x: -x[1]):
+        tool_entries = [e for e in tracker.get_entries(since=since) if e.tool_name == tool]
+        if not tool_entries:
+            continue
+        current_model = max(
+            {(e.model, e.cost_usd) for e in tool_entries},
+            key=lambda x: x[1],
+        )[0]
+        suggested_model = downgrade_map.get(current_model)
+        if not suggested_model:
+            continue
+
+        calls = len(tool_entries)
+        current_per_call = tool_cost / calls
+        provider = tool_entries[0].provider
+        avg_input = sum(e.input_tokens for e in tool_entries) // calls
+        avg_output = sum(e.output_tokens for e in tool_entries) // calls
+        suggested_cost = registry.calculate_cost(provider, suggested_model, avg_input, avg_output)
+        suggested_total = suggested_cost * calls
+        saving = tool_cost - suggested_total
+        if saving <= 0:
+            continue
+        total_saving += saving
+        suggestions.append(
+            f"{idx}. Switch {tool} to {suggested_model}\n"
+            f"   Current: {current_model} at {_format_usd(current_per_call)}/call "
+            f"({calls:,} calls = {_format_usd(tool_cost)})\n"
+            f"   Suggested: {suggested_model} at {_format_usd(suggested_cost)}/call "
+            f"({calls:,} calls = {_format_usd(suggested_total)})\n"
+            f"   Estimated saving: {_format_usd(saving)}/month "
+            f"({int(saving / tool_cost * 100)}% reduction)\n"
+            f"   Risk: Lower capability model. Test accuracy before switching."
+        )
+        idx += 1
+
+    large_prompt_entries = [
+        e for e in tracker.get_entries(since=since) if e.input_tokens > 10_000
+    ]
+    if large_prompt_entries:
+        avg_tokens = int(
+            sum(e.input_tokens for e in large_prompt_entries) / len(large_prompt_entries)
+        )
+        excess_cost = sum(e.cost_usd for e in large_prompt_entries) * 0.3
+        total_saving += excess_cost
+        suggestions.append(
+            f"{idx}. The {min(3, len(large_prompt_entries))} most expensive calls include "
+            f"large prompts (avg {avg_tokens:,} tokens). Consider summarizing first.\n"
+            f"   Estimated saving: {_format_usd(excess_cost)}/month"
+        )
+
+    if suggestions:
+        pct = int(total_saving / max(summary.estimated_monthly_cost, 0.01) * 100)
+        suggestions.append(
+            f"\nTotal estimated saving: {_format_usd(total_saving)}/month ({pct}% reduction)"
+        )
+    return suggestions
+
+
+def load_alert_config() -> dict:
+    if not ALERTS_PATH.exists():
+        return {}
+    return yaml.safe_load(ALERTS_PATH.read_text()) or {}
+
+
+def save_alert_config(config: dict) -> None:
+    ALERTS_PATH.parent.mkdir(parents=True, exist_ok=True)
+    ALERTS_PATH.write_text(yaml.dump(config, default_flow_style=False, sort_keys=False))
+
+
+@click.group()
+def cost():
+    """Token cost tracking and reporting across all IRIS integrations."""
+    pass
+
+
+@cost.command("report")
+@click.option("--agent", default=None, help="Agent name (default: all agents)")
+@click.option("--days", default=30, type=int, help="Report period in days")
+@click.option("--format", "output_format", default="table", type=click.Choice(["table", "json", "csv"]))
+@click.option("--since", default=None, help="ISO date string for period start")
+def cost_report(agent: Optional[str], days: int, output_format: str, since: Optional[str]) -> None:
+    """Show a detailed cost report for one or all agents."""
+    since_iso = _since_from_date(since, days)
+    trackers = _resolve_trackers(agent)
+    summaries = [t.get_summary(since=since_iso) for t in trackers]
+
+    if output_format == "json":
+        payload = [
+            {
+                "agent_name": s.agent_name,
+                "total_cost_usd": s.total_cost_usd,
+                "total_calls": s.total_calls,
+                "avg_cost_per_call": s.avg_cost_per_call,
+                "estimated_monthly_cost": s.estimated_monthly_cost,
+                "cost_by_model": s.cost_by_model,
+                "cost_by_tool": s.cost_by_tool,
+                "cost_trend": s.cost_trend,
+            }
+            for s in summaries
+        ]
+        click.echo(json.dumps(payload, indent=2))
+        return
+
+    if output_format == "csv":
+        buffer = io.StringIO()
+        writer = csv.writer(buffer)
+        writer.writerow(
+            ["agent", "total_cost_usd", "total_calls", "avg_cost_per_call", "estimated_monthly"]
+        )
+        for s in summaries:
+            writer.writerow(
+                [s.agent_name, s.total_cost_usd, s.total_calls, s.avg_cost_per_call, s.estimated_monthly_cost]
+            )
+        click.echo(buffer.getvalue())
+        return
+
+    for summary in summaries:
+        _render_report_table(summary, days)
+        if len(summaries) > 1:
+            console.print("")
+
+
+@cost.command("summary")
+@click.option("--days", default=30, type=int, help="Report period in days")
+@click.option("--since", default=None, help="ISO date string for period start")
+def cost_summary(days: int, since: Optional[str]) -> None:
+    """CFO report — cost across all agents sorted by spend."""
+    since_iso = _since_from_date(since, days)
+    trackers = discover_agent_trackers()
+    if not trackers:
+        console.print("[yellow]No cost data recorded yet.[/yellow]")
+        console.print("Cost tracking starts automatically when governed LLM calls are made.")
+        return
+    summaries = [t.get_summary(since=since_iso) for t in trackers]
+    _render_summary_table(summaries, days)
+
+
+@cost.command("alert")
+@click.option("--agent", default=None, help="Agent name to monitor")
+@click.option("--threshold", type=float, default=None, help="Alert if single call exceeds USD")
+@click.option("--monthly-budget", type=float, default=None, help="Alert if monthly spend exceeds USD")
+def cost_alert(agent: Optional[str], threshold: Optional[float], monthly_budget: Optional[float]) -> None:
+    """Configure cost alerts (terminal delivery on free tier)."""
+    config = load_alert_config()
+    if agent:
+        agents = config.setdefault("agents", {})
+        agent_cfg = agents.setdefault(agent, {})
+        if threshold is not None:
+            agent_cfg["single_call_threshold_usd"] = threshold
+        if monthly_budget is not None:
+            agent_cfg["monthly_budget_usd"] = monthly_budget
+        save_alert_config(config)
+        console.print(f"[green]✓ Alert config saved for {agent}[/green]")
+        console.print(f"Config: {ALERTS_PATH}")
+
+    config = load_alert_config()
+    if not config.get("agents"):
+        console.print("[yellow]No alert rules configured.[/yellow]")
+        console.print("Example: iris cost alert --agent my-agent --threshold 1.00 --monthly-budget 50")
+        return
+
+    since_iso = _since_from_days(30)
+    for agent_name, rules in config.get("agents", {}).items():
+        tracker = _find_tracker(agent_name)
+        if not tracker:
+            continue
+        summary = tracker.get_summary(since=since_iso)
+        if rules.get("monthly_budget_usd") and summary.estimated_monthly_cost > rules["monthly_budget_usd"]:
+            console.print(
+                f"[red]⚠ BUDGET ALERT[/red] {agent_name}: "
+                f"estimated monthly {_format_usd(summary.estimated_monthly_cost)} "
+                f"exceeds budget {_format_usd(rules['monthly_budget_usd'])}"
+            )
+        call_threshold = rules.get("single_call_threshold_usd")
+        if call_threshold:
+            for entry in tracker.get_entries(since=since_iso):
+                if entry.cost_usd > call_threshold:
+                    console.print(
+                        f"[red]⚠ CALL ALERT[/red] {agent_name}: "
+                        f"{entry.tool_name}() cost {_format_usd(entry.cost_usd)} "
+                        f"at {entry.timestamp[:16]}"
+                    )
+
+
+@cost.command("optimize")
+@click.option("--agent", required=True, help="Agent name to analyze")
+@click.option("--days", default=30, type=int, help="Analysis period in days")
+def cost_optimize(agent: str, days: int) -> None:
+    """Suggest cost optimizations without modifying any code or config."""
+    since_iso = _since_from_days(days)
+    tracker = _find_tracker(agent)
+    if not tracker:
+        console.print(f"[yellow]No cost data found for agent '{agent}'.[/yellow]")
+        sys.exit(1)
+
+    summary = tracker.get_summary(since=since_iso)
+    console.print(f"\n[bold]IRIS Cost Optimization — {summary.agent_name}[/bold]\n")
+    suggestions = _suggest_optimizations(summary, since_iso)
+    if not suggestions:
+        console.print("[green]No optimization opportunities identified.[/green]")
+        return
+    for block in suggestions:
+        console.print(block)
+        console.print("")
+
+
+@cost.command("pricing")
+@click.option("--provider", default=None, help="Filter pricing by provider")
+@click.option("--update", is_flag=True, help="Show pricing override instructions")
+def cost_pricing(provider: Optional[str], update: bool) -> None:
+    """Show current LLM pricing table and custom override options."""
+    registry = PricingRegistry()
+    pricing = registry.all_pricing()
+
+    if update:
+        console.print(
+            Panel(
+                "Custom pricing overrides are stored in:\n"
+                f"  {overrides_path()}\n\n"
+                "Format:\n"
+                "  pricing:\n"
+                '    "openai/gpt-4o":\n'
+                "      input_per_1m: 2.50\n"
+                "      output_per_1m: 10.00\n\n"
+                "Overrides always take precedence over the built-in table.",
+                title="Pricing Overrides",
+                style="blue",
+            )
+        )
+        return
+
+    table = Table(title="IRIS LLM Pricing (per 1M tokens)", show_header=True, header_style="bold")
+    table.add_column("Model")
+    table.add_column("Input", justify="right")
+    table.add_column("Output", justify="right")
+
+    combined = {**DEFAULT_PRICING, **pricing}
+    for model_key in sorted(combined):
+        if provider and not model_key.startswith(f"{provider.lower()}/"):
+            continue
+        input_price, output_price = combined[model_key]
+        table.add_row(model_key, f"${input_price:.3f}", f"${output_price:.3f}")
+
+    console.print(table)
+    console.print(f"\n[dim]Overrides: {overrides_path()}[/dim]")

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_cli/evidence.py

@@ -57,23 +57,25 @@ def _compliance_status(passport: AgentPassport) -> List[dict]:
     statuses: List[dict] = []
 
     checks = {
-        "CO-001": passport.is_high_risk_ai and bool(passport.agent_id),
+        "CO-001": bool(passport.agent_id) and bool(passport.owner),
         "CO-002": bool(passport.evidence_vault_id),
         "CO-003": bool(passport.intent_ref),
         "CO-004": bool(passport.intent_ref),
-        "CO-005": None,
-        "CO-006": bool(passport.last_reviewed_at),
+        "CO-RR-001": None,
+        "CO-DEV-001": bool(passport.intent_ref) and bool(passport.description),
     }
 
     for rule in rules:
         rule_id = rule["rule_id"]
-        if rule.get("phase") == 2:
+        if rule.get("status") == "BEST_PRACTICE":
+            passed = checks.get(rule_id)
+            status = "PASS" if passed else "RECOMMENDED"
             statuses.append(
                 {
                     "rule_id": rule_id,
                     "name": rule["name"],
-                    "status": "PENDING",
-                    "detail": "Phase 2",
+                    "status": status,
+                    "detail": "Best practice (not legally required under SB 26-189)",
                 }
             )
             continue

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_cli/framework_suggest.py

@@ -17,7 +17,32 @@ from rich.table import Table
 console = Console()
 
 MAJOR_CLOUDS = {"Google Cloud (GCP)", "AWS", "Microsoft Azure", "Multiple clouds"}
-FREE_FRAMEWORKS = {"colorado-ai-act"}
+FREE_FRAMEWORKS = {
+    "colorado-ai-act",
+    "colorado-chatbot",
+    "colorado-health-ai",
+    "colorado-mental-health-ai",
+}
+
+COLORADO_AI_ACT_NOTE = (
+    "Note: Colorado SB 26-189 replaced the original Colorado AI Act on May 14, 2026. "
+    "Key changes: impact assessments are no longer legally required (retained as best "
+    "practice). Record retention for 3 years is now required. Effective January 1, 2027."
+)
+
+MENTAL_HEALTH_KEYWORDS = (
+    "therapy",
+    "counseling",
+    "mental health",
+    "psychotherapy",
+    "clinician",
+)
+
+CONVERSATIONAL_KEYWORDS = (
+    "conversational ai",
+    "chatbot",
+    "chat bot",
+)
 
 Q1_CHOICES = [
     "Makes decisions that affect individual people (hiring, loans, medical, etc.)",
@@ -119,6 +144,10 @@ def _prefill_answers(passport: dict[str, Any] | None) -> dict[str, Any]:
         prefill["q6"] = True
         prefill["q2"] = Q2_CHOICES[0]
 
+    description = str(spec.get("description", "")).strip()
+    if description:
+        prefill["agent_description"] = description
+
     return prefill
 
 
@@ -205,11 +234,30 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     q6 = bool(answers.get("q6"))
     q7 = set(answers.get("q7", []))
     q8 = set(answers.get("q8", []))
+    agent_description = str(answers.get("agent_description", "")).lower()
 
     colorado = (
         (q5 and "Colorado" in q8)
         or (q1 == Q1_CHOICES[0] and "Colorado" in q8)
     )
+    conversational = (
+        any(kw in q1.lower() for kw in CONVERSATIONAL_KEYWORDS)
+        or any(kw in agent_description for kw in CONVERSATIONAL_KEYWORDS)
+        or q1 == Q1_CHOICES[3]
+    )
+    consumer_facing = q2 in {Q2_CHOICES[4], Q2_CHOICES[2]} or "minor" in agent_description
+    chatbot = conversational and consumer_facing and "Colorado" in q8
+
+    health_data = q4 == Q4_CHOICES[0] or "health" in str(q4).lower() or "medical" in str(q4).lower()
+    health_insurance = (
+        "HIPAA (healthcare)" in q7
+        or q2 == Q2_CHOICES[3]
+        or "health insurance" in agent_description
+    )
+    health_ai = (health_data or health_insurance) and "Colorado" in q8
+
+    mental_health = any(kw in agent_description for kw in MENTAL_HEALTH_KEYWORDS)
+
     nist = q6 or "FedRAMP (federal government contracts)" in q7 or q2 == Q2_CHOICES[0]
     fedramp = (
         (q6 or "FedRAMP (federal government contracts)" in q7 or q2 in {Q2_CHOICES[0], Q2_CHOICES[1]})
@@ -219,17 +267,61 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     soc2 = q2 == Q2_CHOICES[5] or "SOC 2 (SaaS / enterprise)" in q7
     gdpr = "Outside the US" in q8 or "Other / multiple states" in q8
 
+    colorado_reason = (
+        "Your agent makes consequential decisions for Colorado users. "
+        "SB 26-189 applies (replaces SB 24-205, effective Jan. 1, 2027). "
+        f"{COLORADO_AI_ACT_NOTE}"
+        if colorado
+        else "No Colorado consequential decision scope detected."
+    )
+
     recommendations = [
         Recommendation(
             framework="colorado-ai-act",
             tier="FREE",
             status="REQUIRED" if colorado else "NOT APPLICABLE",
+            reason=colorado_reason,
+            command="iris compliance check --framework colorado-ai-act" if colorado else None,
+        ),
+        Recommendation(
+            framework="colorado-chatbot",
+            tier="FREE",
+            status="REQUIRED" if chatbot else "NOT APPLICABLE",
             reason=(
-                "Your agent makes consequential decisions for Colorado users. SB 24-205 applies."
-                if colorado
-                else "No Colorado consequential decision scope detected."
+                "Conversational AI serving Colorado consumers requires HB 26-1263 "
+                "chatbot safety controls (effective Jan. 1, 2027)."
+                if chatbot
+                else "No conversational AI + consumer audience trigger detected."
+            ),
+            command="iris compliance check --framework colorado-chatbot" if chatbot else None,
+        ),
+        Recommendation(
+            framework="colorado-health-ai",
+            tier="FREE",
+            status="REQUIRED" if health_ai else "NOT APPLICABLE",
+            reason=(
+                "Health or insurance data handling in Colorado requires HB 26-1139 "
+                "AI in health insurance controls (effective Jan. 1, 2027)."
+                if health_ai
+                else "No Colorado health insurance AI trigger detected."
+            ),
+            command="iris compliance check --framework colorado-health-ai" if health_ai else None,
+        ),
+        Recommendation(
+            framework="colorado-mental-health-ai",
+            tier="FREE",
+            status="REQUIRED" if mental_health else "NOT APPLICABLE",
+            reason=(
+                "Mental health services agent detected. HB 26-1195 applies "
+                "(effective Aug. 12, 2026 — two months from now)."
+                if mental_health
+                else "No mental health services scope detected."
+            ),
+            command=(
+                "iris compliance check --framework colorado-mental-health-ai"
+                if mental_health
+                else None
             ),
-            command="iris compliance check --framework colorado-ai-act" if colorado else None,
         ),
         Recommendation(
             framework="nist-ai-rmf",
@@ -396,6 +488,8 @@ def framework_suggest(agent: str | None, output_format: str) -> None:
 
     prefill = _prefill_answers(passport)
     answers = run_questionnaire(prefill)
+    if prefill.get("agent_description"):
+        answers["agent_description"] = prefill["agent_description"]
     recommendations = build_recommendations(answers)
     save_path = _save_recommendations(agent, answers, recommendations)
 

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_cli/main.py

@@ -25,7 +25,7 @@ console = Console()
 
 
 @click.group()
-@click.version_option(version="0.1.2", prog_name="iris")
+@click.version_option(version="0.1.4", prog_name="iris")
 def cli():
     """
     IRIS — AI Agent Governance Platform
@@ -35,7 +35,9 @@ def cli():
 
     Docs: https://docs.iris.ai
     """
-    pass
+    from iris._telemetry import maybe_fire_first_run
+
+    maybe_fire_first_run()
 
 
 # ── iris scan ─────────────────────────────────────────────────────────────────
@@ -555,6 +557,21 @@ cli.add_command(red_team)
 from iris_cli.users import users
 cli.add_command(users)
 
+from iris_cli.cost import cost
+cli.add_command(cost)
+
+
+@cli.command("ping", hidden=True)
+def ping():
+    """Internal telemetry verification (hidden)."""
+    from iris._telemetry import send_ping, telemetry_enabled
+
+    if not telemetry_enabled():
+        return
+
+    send_ping()
+    click.echo("Telemetry ping sent. Opt-out status: enabled")
+
 
 @compliance.command("check")
 @click.option("--agent", default=None, help="Specific agent to check (or all)")

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_cli/mcp_server.py

@@ -335,7 +335,7 @@ def handle_suggest_policy(params: dict) -> dict:
 - Call any API not listed above
 
 ## Compliance notes
-This agent operates under the Colorado AI Act (SB 24-205).
+This agent operates under the Colorado AI Act (SB 26-189, effective Jan. 1, 2027).
 User consent must be logged before any consequential decision.
 """
 

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_cli/status_cmd.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import List, Optional
 
@@ -12,6 +13,7 @@ from rich.panel import Panel
 from iris import AgentPassport
 from iris_cli.action_plan import compliance_score, progress_bar
 from iris_core.compliance.registry import ComplianceRegistry
+from iris_core.cost.tracker import discover_agent_trackers
 
 console = Console()
 
@@ -49,6 +51,16 @@ def _status_label(score: float, violations: bool) -> str:
     return "NOT REGISTERED"
 
 
+def _monthly_cost_by_agent(days: int = 30) -> dict[str, float]:
+    since = (datetime.now(timezone.utc) - timedelta(days=days)).isoformat()
+    costs: dict[str, float] = {}
+    for tracker in discover_agent_trackers():
+        summary = tracker.get_summary(since=since)
+        costs[tracker.agent_name] = summary.estimated_monthly_cost
+        costs[tracker.agent_id] = summary.estimated_monthly_cost
+    return costs
+
+
 @click.command("status")
 @click.option("--agent", default=None, help="Show status for a specific agent")
 @click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
@@ -81,6 +93,7 @@ def status_cmd(agent: Optional[str], governance_dir: Optional[Path], include_dem
     registry = ComplianceRegistry()
     next_global: Optional[str] = None
     lowest_score = 2.0
+    monthly_costs = _monthly_cost_by_agent()
 
     for name in sorted(all_agents):
         agent_dir = all_agents[name]
@@ -95,8 +108,10 @@ def status_cmd(agent: Optional[str], governance_dir: Optional[Path], include_dem
             next_global = _next_action(passport, agent_dir)
 
         color = "green" if score >= 1.0 else "yellow" if score >= 0.4 else "red"
+        cost = monthly_costs.get(name) or monthly_costs.get(passport.agent_id)
+        cost_str = f"  ${cost:.2f}/mo" if cost else ""
         lines.append(
-            f"  [{color}]{name:<24}[/{color}]  {bar} {pct:>3}%  {label}"
+            f"  [{color}]{name:<24}[/{color}]  {bar} {pct:>3}%  {label}{cost_str}"
         )
 
     lines.append("")

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_security_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.0
-Requires-Dist: iris-security-sdk>=0.1.2
+Requires-Dist: iris-security-core>=0.1.3
+Requires-Dist: iris-security-sdk>=0.1.4
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_security_cli.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ iris_cli/action_plan.py
 iris_cli/assess.py
 iris_cli/cedar_parser.py
 iris_cli/compiler_config.py
+iris_cli/cost.py
 iris_cli/dlp_cmd.py
 iris_cli/drift.py
 iris_cli/evidence.py

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/iris_security_cli.egg-info/requires.txt

@@ -1,5 +1,5 @@
-iris-security-core>=0.1.0
-iris-security-sdk>=0.1.2
+iris-security-core>=0.1.3
+iris-security-sdk>=0.1.4
 click>=8.1
 rich>=13.0
 pyyaml>=6.0

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "iris-security-cli"
-version = "0.1.2"
+version = "0.1.4"
 description = "IRIS CLI — iris scan, iris register, iris policy, iris compliance"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -20,8 +20,8 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "iris-security-core>=0.1.0",
-  "iris-security-sdk>=0.1.2",
+  "iris-security-core>=0.1.3",
+  "iris-security-sdk>=0.1.4",
   "click>=8.1",
   "rich>=13.0",
   "pyyaml>=6.0",

{iris_security_cli-0.1.2 → iris_security_cli-0.1.4}/tests/test_framework_suggest.py

@@ -41,7 +41,7 @@ def test_colorado_consequential_gets_colorado_act(tmp_path):
     )
     assert result.exit_code == 0, result.output
     assert "colorado-ai-act" in result.output
-    assert "SB 24-205 applies" in result.output
+    assert "SB 26-189" in result.output
 
 
 def test_hipaa_trigger_on_health_data(tmp_path):