iris-security-cli 0.1.3__tar.gz → 0.1.4__tar.gz

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.2
-Requires-Dist: iris-security-sdk>=0.1.3
+Requires-Dist: iris-security-core>=0.1.3
+Requires-Dist: iris-security-sdk>=0.1.4
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_cli/assess.py

@@ -27,7 +27,7 @@ console = Console()
 
 
 # ── Colorado AI Act impact assessment questionnaire ───────────────────────────
-# Each question maps to a specific obligation under SB 24-205.
+# Each question maps to a specific obligation under SB 26-189.
 # The answers drive the risk level and the generated assessment document.
 
 QUESTIONNAIRE = [
@@ -44,7 +44,7 @@ QUESTIONNAIRE = [
             "insurance",
             "legal services",
             "government",
-            "other (not high-risk)",
+            "other (not covered ADMT)",
         ],
         "type": "choice",
         "high_risk_values": [
@@ -58,6 +58,27 @@ QUESTIONNAIRE = [
             "government",
         ],
     },
+    {
+        "id": "impact_assessment",
+        "rule": "CO-002",
+        "severity": "MEDIUM",
+        "question": (
+            "Has an impact assessment been completed for this agent? "
+            "(Not legally required under SB 26-189 but recommended as "
+            "best practice for NIST AI RMF alignment)"
+        ),
+        "type": "confirm",
+    },
+    {
+        "id": "record_retention",
+        "rule": "CO-RR-001",
+        "severity": "HIGH",
+        "question": (
+            "Do you have a plan for retaining AI usage records for 3 years? "
+            "(Required under SB 26-189 for covered ADMT systems)"
+        ),
+        "type": "confirm",
+    },
     {
         "id": "consequential",
         "rule": "CO-004",
@@ -137,7 +158,8 @@ def run_questionnaire() -> dict:
     console.print("\n[bold]Colorado AI Act Impact Assessment[/bold]")
     console.print(
         "[dim]Answer each question honestly. IRIS uses your answers to generate "
-        "a legally-meaningful impact assessment under SB 24-205.[/dim]\n"
+        "an impact assessment under SB 26-189 (replaces SB 24-205, effective "
+        "Jan. 1, 2027).[/dim]\n"
     )
 
     for i, q in enumerate(QUESTIONNAIRE, 1):
@@ -204,7 +226,28 @@ def calculate_risk_level(answers: dict) -> tuple:
     if domain in high_risk_domains:
         risk_score += 3
         findings.append(
-            f"Agent operates in '{domain}' — a high-risk domain under SB 24-205."
+            f"Agent operates in '{domain}' — a covered ADMT domain under SB 26-189."
+        )
+
+    if not answers.get("impact_assessment"):
+        risk_score += 1
+        findings.append(
+            "No impact assessment on file (best practice under SB 26-189, "
+            "not legally required)."
+        )
+        recommendations.append(
+            "Complete an impact assessment via iris compliance assess to align "
+            "with NIST AI RMF MAP-1.5."
+        )
+
+    if not answers.get("record_retention"):
+        risk_score += 2
+        findings.append(
+            "No 3-year record retention plan documented for ADMT usage records."
+        )
+        recommendations.append(
+            "Configure Evidence Vault Pro for 3-year retention (CO-RR-001). "
+            "Run: iris license activate <your-key>"
         )
 
     if answers.get("consequential"):
@@ -297,7 +340,8 @@ def generate_assessment_markdown(
 > **Assessment ID**: `{assessment_id}`
 > **Assessed by**: {assessed_by}
 > **Date**: {now}
-> **Framework**: Colorado AI Act (SB 24-205), effective July 1, 2026
+> **Framework**: Colorado AI Act (SB 26-189), effective January 1, 2027
+> **Note**: Replaces SB 24-205, signed May 14, 2026
 > **Generated by**: IRIS Compliance Platform v0.1.0
 
 ---
@@ -316,6 +360,8 @@ def generate_assessment_markdown(
 | Owner | {owner} |
 | Operating domain | {answers.get('domain', 'not specified')} |
 | Makes consequential decisions | {'Yes' if answers.get('consequential') else 'No'} |
+| Impact assessment completed | {'Yes' if answers.get('impact_assessment') else 'No (best practice)'} |
+| 3-year record retention plan | {'Yes' if answers.get('record_retention') else 'No'} |
 | Human review available | {'Yes' if answers.get('human_review') else 'No'} |
 | Consumer opt-out available | {'Yes' if answers.get('opt_out') else 'No'} |
 | Discrimination review completed | {'Yes' if answers.get('discrimination_review') else 'No'} |
@@ -356,12 +402,12 @@ def generate_assessment_markdown(
 
 | Rule | Obligation | Status |
 |---|---|---|
-| CO-001 | High-risk AI inventory | ✅ Satisfied — agent registered in IRIS |
-| CO-002 | Impact assessment | ✅ Satisfied — this document |
-| CO-003 | Transparency disclosure | ✅ Satisfied — policy-intent.md |
-| CO-004 | Consumer opt-out | {'✅ Satisfied' if answers.get('opt_out') else '⚠️ Requires action'} |
-| CO-005 | Non-discrimination review | {'✅ Satisfied' if answers.get('discrimination_review') else '⚠️ Requires action'} |
-| CO-006 | Annual review | ✅ Scheduled — next review due {(datetime.utcnow().replace(year=datetime.utcnow().year + 1)).strftime('%Y-%m-%d')} |
+| CO-001 | ADMT inventory | ✅ Satisfied — agent registered in IRIS |
+| CO-002 | Impact assessment (best practice) | {'✅ Satisfied' if answers.get('impact_assessment') else '⚠️ Recommended'} |
+| CO-003 | Consumer notice / transparency | ✅ Satisfied — policy-intent.md |
+| CO-004 | Post-adverse-action notice | {'✅ Satisfied' if answers.get('opt_out') else '⚠️ Requires action'} |
+| CO-RR-001 | 3-year record retention | {'✅ Satisfied' if answers.get('record_retention') else '⚠️ Requires action'} |
+| CO-DEV-001 | Developer documentation | ✅ Satisfied — policy-intent.md + passport.yaml |
 
 ---
 
@@ -374,9 +420,10 @@ def generate_assessment_markdown(
 
 ---
 
-*This document was generated by IRIS and constitutes a formal impact assessment
-under Colorado AI Act SB 24-205. It should be reviewed annually or whenever
-the agent's capabilities, data access, or decision scope changes.*
+*This document was generated by IRIS and constitutes an impact assessment
+under Colorado AI Act SB 26-189 (replaces SB 24-205, effective Jan. 1, 2027).
+It should be reviewed whenever the agent's capabilities, data access, or
+decision scope changes.*
 """
 
 
@@ -428,8 +475,8 @@ def compliance_assess(agent, assessor, governance_dir, yes, answers):
     console.print(Panel(
         f"[bold]IRIS Impact Assessment[/bold]\n"
         f"Agent: [cyan]{agent}[/cyan]\n"
-        f"Framework: Colorado AI Act (SB 24-205)\n"
-        f"Effective: July 1, 2026",
+        f"Framework: Colorado AI Act (SB 26-189)\n"
+        f"Effective: January 1, 2027 (replaces SB 24-205)",
         style="blue"
     ))
 
@@ -500,7 +547,7 @@ def compliance_assess(agent, assessor, governance_dir, yes, answers):
         f"Files updated:\n"
         f"  [dim]{assessment_file}[/dim]\n"
         f"  [dim]{passport_file}[/dim]\n\n"
-        f"CO-002 violation: [bold green]CLOSED[/bold green]\n\n"
+        f"CO-002 best practice: [bold green]{'SATISFIED' if questionnaire_answers.get('impact_assessment') else 'RECOMMENDED'}[/bold green]\n\n"
         f"Next step: [bold]iris compliance check --framework colorado-ai-act[/bold]",
         style="green"
     ))

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_cli/evidence.py

@@ -57,23 +57,25 @@ def _compliance_status(passport: AgentPassport) -> List[dict]:
     statuses: List[dict] = []
 
     checks = {
-        "CO-001": passport.is_high_risk_ai and bool(passport.agent_id),
+        "CO-001": bool(passport.agent_id) and bool(passport.owner),
         "CO-002": bool(passport.evidence_vault_id),
         "CO-003": bool(passport.intent_ref),
         "CO-004": bool(passport.intent_ref),
-        "CO-005": None,
-        "CO-006": bool(passport.last_reviewed_at),
+        "CO-RR-001": None,
+        "CO-DEV-001": bool(passport.intent_ref) and bool(passport.description),
     }
 
     for rule in rules:
         rule_id = rule["rule_id"]
-        if rule.get("phase") == 2:
+        if rule.get("status") == "BEST_PRACTICE":
+            passed = checks.get(rule_id)
+            status = "PASS" if passed else "RECOMMENDED"
             statuses.append(
                 {
                     "rule_id": rule_id,
                     "name": rule["name"],
-                    "status": "PENDING",
-                    "detail": "Phase 2",
+                    "status": status,
+                    "detail": "Best practice (not legally required under SB 26-189)",
                 }
             )
             continue

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_cli/framework_suggest.py

@@ -17,7 +17,32 @@ from rich.table import Table
 console = Console()
 
 MAJOR_CLOUDS = {"Google Cloud (GCP)", "AWS", "Microsoft Azure", "Multiple clouds"}
-FREE_FRAMEWORKS = {"colorado-ai-act"}
+FREE_FRAMEWORKS = {
+    "colorado-ai-act",
+    "colorado-chatbot",
+    "colorado-health-ai",
+    "colorado-mental-health-ai",
+}
+
+COLORADO_AI_ACT_NOTE = (
+    "Note: Colorado SB 26-189 replaced the original Colorado AI Act on May 14, 2026. "
+    "Key changes: impact assessments are no longer legally required (retained as best "
+    "practice). Record retention for 3 years is now required. Effective January 1, 2027."
+)
+
+MENTAL_HEALTH_KEYWORDS = (
+    "therapy",
+    "counseling",
+    "mental health",
+    "psychotherapy",
+    "clinician",
+)
+
+CONVERSATIONAL_KEYWORDS = (
+    "conversational ai",
+    "chatbot",
+    "chat bot",
+)
 
 Q1_CHOICES = [
     "Makes decisions that affect individual people (hiring, loans, medical, etc.)",
@@ -119,6 +144,10 @@ def _prefill_answers(passport: dict[str, Any] | None) -> dict[str, Any]:
         prefill["q6"] = True
         prefill["q2"] = Q2_CHOICES[0]
 
+    description = str(spec.get("description", "")).strip()
+    if description:
+        prefill["agent_description"] = description
+
     return prefill
 
 
@@ -205,11 +234,30 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     q6 = bool(answers.get("q6"))
     q7 = set(answers.get("q7", []))
     q8 = set(answers.get("q8", []))
+    agent_description = str(answers.get("agent_description", "")).lower()
 
     colorado = (
         (q5 and "Colorado" in q8)
         or (q1 == Q1_CHOICES[0] and "Colorado" in q8)
     )
+    conversational = (
+        any(kw in q1.lower() for kw in CONVERSATIONAL_KEYWORDS)
+        or any(kw in agent_description for kw in CONVERSATIONAL_KEYWORDS)
+        or q1 == Q1_CHOICES[3]
+    )
+    consumer_facing = q2 in {Q2_CHOICES[4], Q2_CHOICES[2]} or "minor" in agent_description
+    chatbot = conversational and consumer_facing and "Colorado" in q8
+
+    health_data = q4 == Q4_CHOICES[0] or "health" in str(q4).lower() or "medical" in str(q4).lower()
+    health_insurance = (
+        "HIPAA (healthcare)" in q7
+        or q2 == Q2_CHOICES[3]
+        or "health insurance" in agent_description
+    )
+    health_ai = (health_data or health_insurance) and "Colorado" in q8
+
+    mental_health = any(kw in agent_description for kw in MENTAL_HEALTH_KEYWORDS)
+
     nist = q6 or "FedRAMP (federal government contracts)" in q7 or q2 == Q2_CHOICES[0]
     fedramp = (
         (q6 or "FedRAMP (federal government contracts)" in q7 or q2 in {Q2_CHOICES[0], Q2_CHOICES[1]})
@@ -219,17 +267,61 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     soc2 = q2 == Q2_CHOICES[5] or "SOC 2 (SaaS / enterprise)" in q7
     gdpr = "Outside the US" in q8 or "Other / multiple states" in q8
 
+    colorado_reason = (
+        "Your agent makes consequential decisions for Colorado users. "
+        "SB 26-189 applies (replaces SB 24-205, effective Jan. 1, 2027). "
+        f"{COLORADO_AI_ACT_NOTE}"
+        if colorado
+        else "No Colorado consequential decision scope detected."
+    )
+
     recommendations = [
         Recommendation(
             framework="colorado-ai-act",
             tier="FREE",
             status="REQUIRED" if colorado else "NOT APPLICABLE",
+            reason=colorado_reason,
+            command="iris compliance check --framework colorado-ai-act" if colorado else None,
+        ),
+        Recommendation(
+            framework="colorado-chatbot",
+            tier="FREE",
+            status="REQUIRED" if chatbot else "NOT APPLICABLE",
             reason=(
-                "Your agent makes consequential decisions for Colorado users. SB 24-205 applies."
-                if colorado
-                else "No Colorado consequential decision scope detected."
+                "Conversational AI serving Colorado consumers requires HB 26-1263 "
+                "chatbot safety controls (effective Jan. 1, 2027)."
+                if chatbot
+                else "No conversational AI + consumer audience trigger detected."
+            ),
+            command="iris compliance check --framework colorado-chatbot" if chatbot else None,
+        ),
+        Recommendation(
+            framework="colorado-health-ai",
+            tier="FREE",
+            status="REQUIRED" if health_ai else "NOT APPLICABLE",
+            reason=(
+                "Health or insurance data handling in Colorado requires HB 26-1139 "
+                "AI in health insurance controls (effective Jan. 1, 2027)."
+                if health_ai
+                else "No Colorado health insurance AI trigger detected."
+            ),
+            command="iris compliance check --framework colorado-health-ai" if health_ai else None,
+        ),
+        Recommendation(
+            framework="colorado-mental-health-ai",
+            tier="FREE",
+            status="REQUIRED" if mental_health else "NOT APPLICABLE",
+            reason=(
+                "Mental health services agent detected. HB 26-1195 applies "
+                "(effective Aug. 12, 2026 — two months from now)."
+                if mental_health
+                else "No mental health services scope detected."
+            ),
+            command=(
+                "iris compliance check --framework colorado-mental-health-ai"
+                if mental_health
+                else None
             ),
-            command="iris compliance check --framework colorado-ai-act" if colorado else None,
         ),
         Recommendation(
             framework="nist-ai-rmf",
@@ -396,6 +488,8 @@ def framework_suggest(agent: str | None, output_format: str) -> None:
 
     prefill = _prefill_answers(passport)
     answers = run_questionnaire(prefill)
+    if prefill.get("agent_description"):
+        answers["agent_description"] = prefill["agent_description"]
     recommendations = build_recommendations(answers)
     save_path = _save_recommendations(agent, answers, recommendations)
 

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_cli/main.py

@@ -25,7 +25,7 @@ console = Console()
 
 
 @click.group()
-@click.version_option(version="0.1.3", prog_name="iris")
+@click.version_option(version="0.1.4", prog_name="iris")
 def cli():
     """
     IRIS — AI Agent Governance Platform
@@ -35,7 +35,9 @@ def cli():
 
     Docs: https://docs.iris.ai
     """
-    pass
+    from iris._telemetry import maybe_fire_first_run
+
+    maybe_fire_first_run()
 
 
 # ── iris scan ─────────────────────────────────────────────────────────────────
@@ -559,6 +561,18 @@ from iris_cli.cost import cost
 cli.add_command(cost)
 
 
+@cli.command("ping", hidden=True)
+def ping():
+    """Internal telemetry verification (hidden)."""
+    from iris._telemetry import send_ping, telemetry_enabled
+
+    if not telemetry_enabled():
+        return
+
+    send_ping()
+    click.echo("Telemetry ping sent. Opt-out status: enabled")
+
+
 @compliance.command("check")
 @click.option("--agent", default=None, help="Specific agent to check (or all)")
 @click.option("--framework", "-f", default="colorado-ai-act")

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_cli/mcp_server.py

@@ -335,7 +335,7 @@ def handle_suggest_policy(params: dict) -> dict:
 - Call any API not listed above
 
 ## Compliance notes
-This agent operates under the Colorado AI Act (SB 24-205).
+This agent operates under the Colorado AI Act (SB 26-189, effective Jan. 1, 2027).
 User consent must be logged before any consequential decision.
 """
 

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_security_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.2
-Requires-Dist: iris-security-sdk>=0.1.3
+Requires-Dist: iris-security-core>=0.1.3
+Requires-Dist: iris-security-sdk>=0.1.4
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/iris_security_cli.egg-info/requires.txt

@@ -1,5 +1,5 @@
-iris-security-core>=0.1.2
-iris-security-sdk>=0.1.3
+iris-security-core>=0.1.3
+iris-security-sdk>=0.1.4
 click>=8.1
 rich>=13.0
 pyyaml>=6.0

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "iris-security-cli"
-version = "0.1.3"
+version = "0.1.4"
 description = "IRIS CLI — iris scan, iris register, iris policy, iris compliance"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -20,8 +20,8 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "iris-security-core>=0.1.2",
-  "iris-security-sdk>=0.1.3",
+  "iris-security-core>=0.1.3",
+  "iris-security-sdk>=0.1.4",
   "click>=8.1",
   "rich>=13.0",
   "pyyaml>=6.0",

{iris_security_cli-0.1.3 → iris_security_cli-0.1.4}/tests/test_framework_suggest.py

@@ -41,7 +41,7 @@ def test_colorado_consequential_gets_colorado_act(tmp_path):
     )
     assert result.exit_code == 0, result.output
     assert "colorado-ai-act" in result.output
-    assert "SB 24-205 applies" in result.output
+    assert "SB 26-189" in result.output
 
 
 def test_hipaa_trigger_on_health_data(tmp_path):