iris-security-cli 0.1.3__tar.gz → 0.1.7__tar.gz

{iris_security_cli-0.1.3 → iris_security_cli-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.3
+Version: 0.1.7
 Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.2
-Requires-Dist: iris-security-sdk>=0.1.3
+Requires-Dist: iris-security-core>=0.1.6
+Requires-Dist: iris-security-sdk>=0.1.7
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.1.3 → iris_security_cli-0.1.7}/iris_cli/assess.py

@@ -21,13 +21,13 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.prompt import Prompt, Confirm
 from rich.table import Table
-from rich import print as rprint
+from iris_core import __version__ as IRIS_PLATFORM_VERSION
 
 console = Console()
 
 
 # ── Colorado AI Act impact assessment questionnaire ───────────────────────────
-# Each question maps to a specific obligation under SB 24-205.
+# Each question maps to a specific obligation under SB 26-189.
 # The answers drive the risk level and the generated assessment document.
 
 QUESTIONNAIRE = [
@@ -44,7 +44,7 @@ QUESTIONNAIRE = [
             "insurance",
             "legal services",
             "government",
-            "other (not high-risk)",
+            "other (not covered ADMT)",
         ],
         "type": "choice",
         "high_risk_values": [
@@ -58,6 +58,27 @@ QUESTIONNAIRE = [
             "government",
         ],
     },
+    {
+        "id": "impact_assessment",
+        "rule": "CO-002",
+        "severity": "MEDIUM",
+        "question": (
+            "Has an impact assessment been completed for this agent? "
+            "(Not legally required under SB 26-189 but recommended as "
+            "best practice for NIST AI RMF alignment)"
+        ),
+        "type": "confirm",
+    },
+    {
+        "id": "record_retention",
+        "rule": "CO-RR-001",
+        "severity": "HIGH",
+        "question": (
+            "Do you have a plan for retaining AI usage records for 3 years? "
+            "(Required under SB 26-189 for covered ADMT systems)"
+        ),
+        "type": "confirm",
+    },
     {
         "id": "consequential",
         "rule": "CO-004",
@@ -137,7 +158,8 @@ def run_questionnaire() -> dict:
     console.print("\n[bold]Colorado AI Act Impact Assessment[/bold]")
     console.print(
         "[dim]Answer each question honestly. IRIS uses your answers to generate "
-        "a legally-meaningful impact assessment under SB 24-205.[/dim]\n"
+        "an impact assessment under SB 26-189 (replaces SB 24-205, effective "
+        "Jan. 1, 2027).[/dim]\n"
     )
 
     for i, q in enumerate(QUESTIONNAIRE, 1):
@@ -204,7 +226,28 @@ def calculate_risk_level(answers: dict) -> tuple:
     if domain in high_risk_domains:
         risk_score += 3
         findings.append(
-            f"Agent operates in '{domain}' — a high-risk domain under SB 24-205."
+            f"Agent operates in '{domain}' — a covered ADMT domain under SB 26-189."
+        )
+
+    if not answers.get("impact_assessment"):
+        risk_score += 1
+        findings.append(
+            "No impact assessment on file (best practice under SB 26-189, "
+            "not legally required)."
+        )
+        recommendations.append(
+            "Complete an impact assessment via iris compliance assess to align "
+            "with NIST AI RMF MAP-1.5."
+        )
+
+    if not answers.get("record_retention"):
+        risk_score += 2
+        findings.append(
+            "No 3-year record retention plan documented for ADMT usage records."
+        )
+        recommendations.append(
+            "Configure Evidence Vault Pro for 3-year retention (CO-RR-001). "
+            "Run: iris license activate <your-key>"
         )
 
     if answers.get("consequential"):
@@ -297,8 +340,9 @@ def generate_assessment_markdown(
 > **Assessment ID**: `{assessment_id}`
 > **Assessed by**: {assessed_by}
 > **Date**: {now}
-> **Framework**: Colorado AI Act (SB 24-205), effective July 1, 2026
-> **Generated by**: IRIS Compliance Platform v0.1.0
+> **Framework**: Colorado AI Act (SB 26-189), effective January 1, 2027
+> **Note**: Replaces SB 24-205, signed May 14, 2026
+> **Generated by**: IRIS Compliance Platform v{IRIS_PLATFORM_VERSION}
 
 ---
 
@@ -316,6 +360,8 @@ def generate_assessment_markdown(
 | Owner | {owner} |
 | Operating domain | {answers.get('domain', 'not specified')} |
 | Makes consequential decisions | {'Yes' if answers.get('consequential') else 'No'} |
+| Impact assessment completed | {'Yes' if answers.get('impact_assessment') else 'No (best practice)'} |
+| 3-year record retention plan | {'Yes' if answers.get('record_retention') else 'No'} |
 | Human review available | {'Yes' if answers.get('human_review') else 'No'} |
 | Consumer opt-out available | {'Yes' if answers.get('opt_out') else 'No'} |
 | Discrimination review completed | {'Yes' if answers.get('discrimination_review') else 'No'} |
@@ -356,12 +402,12 @@ def generate_assessment_markdown(
 
 | Rule | Obligation | Status |
 |---|---|---|
-| CO-001 | High-risk AI inventory | ✅ Satisfied — agent registered in IRIS |
-| CO-002 | Impact assessment | ✅ Satisfied — this document |
-| CO-003 | Transparency disclosure | ✅ Satisfied — policy-intent.md |
-| CO-004 | Consumer opt-out | {'✅ Satisfied' if answers.get('opt_out') else '⚠️ Requires action'} |
-| CO-005 | Non-discrimination review | {'✅ Satisfied' if answers.get('discrimination_review') else '⚠️ Requires action'} |
-| CO-006 | Annual review | ✅ Scheduled — next review due {(datetime.utcnow().replace(year=datetime.utcnow().year + 1)).strftime('%Y-%m-%d')} |
+| CO-001 | ADMT inventory | ✅ Satisfied — agent registered in IRIS |
+| CO-002 | Impact assessment (best practice) | {'✅ Satisfied' if answers.get('impact_assessment') else '⚠️ Recommended'} |
+| CO-003 | Consumer notice / transparency | ✅ Satisfied — policy-intent.md |
+| CO-004 | Post-adverse-action notice | {'✅ Satisfied' if answers.get('opt_out') else '⚠️ Requires action'} |
+| CO-RR-001 | 3-year record retention | {'✅ Satisfied' if answers.get('record_retention') else '⚠️ Requires action'} |
+| CO-DEV-001 | Developer documentation | ✅ Satisfied — policy-intent.md + passport.yaml |
 
 ---
 
@@ -374,9 +420,10 @@ def generate_assessment_markdown(
 
 ---
 
-*This document was generated by IRIS and constitutes a formal impact assessment
-under Colorado AI Act SB 24-205. It should be reviewed annually or whenever
-the agent's capabilities, data access, or decision scope changes.*
+*This document was generated by IRIS and constitutes an impact assessment
+under Colorado AI Act SB 26-189 (replaces SB 24-205, effective Jan. 1, 2027).
+It should be reviewed whenever the agent's capabilities, data access, or
+decision scope changes.*
 """
 
 
@@ -428,8 +475,8 @@ def compliance_assess(agent, assessor, governance_dir, yes, answers):
     console.print(Panel(
         f"[bold]IRIS Impact Assessment[/bold]\n"
         f"Agent: [cyan]{agent}[/cyan]\n"
-        f"Framework: Colorado AI Act (SB 24-205)\n"
-        f"Effective: July 1, 2026",
+        f"Framework: Colorado AI Act (SB 26-189)\n"
+        f"Effective: January 1, 2027 (replaces SB 24-205)",
         style="blue"
     ))
 
@@ -500,7 +547,7 @@ def compliance_assess(agent, assessor, governance_dir, yes, answers):
         f"Files updated:\n"
         f"  [dim]{assessment_file}[/dim]\n"
         f"  [dim]{passport_file}[/dim]\n\n"
-        f"CO-002 violation: [bold green]CLOSED[/bold green]\n\n"
+        f"CO-002 best practice: [bold green]{'SATISFIED' if questionnaire_answers.get('impact_assessment') else 'RECOMMENDED'}[/bold green]\n\n"
         f"Next step: [bold]iris compliance check --framework colorado-ai-act[/bold]",
         style="green"
     ))

iris_security_cli-0.1.7/iris_cli/compliance_check_cmd.py

@@ -0,0 +1,127 @@
+"""iris compliance check — framework compliance with Pro preview."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+
+from iris import AgentPassport
+from iris_core.compliance.framework_check import run_framework_check
+from iris_core.compliance.results import ComplianceCheckStatus
+from iris_core.entitlements.display import build_pro_preview_box
+
+console = Console()
+
+
+def _discover_passports(
+    gov_dir: Path,
+    agent: Optional[str],
+) -> list[AgentPassport]:
+    passports: list[AgentPassport] = []
+    if agent:
+        passport_file = gov_dir / agent / "passport.yaml"
+        if passport_file.exists():
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        return passports
+
+    for passport_file in gov_dir.rglob("passport.yaml"):
+        try:
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        except Exception:
+            continue
+    return passports
+
+
+@click.command("check")
+@click.option("--agent", default=None, help="Specific agent to check (or all)")
+@click.option("--framework", "-f", default="colorado-ai-act")
+@click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
+def compliance_check_cmd(
+    agent: Optional[str],
+    framework: str,
+    governance_dir: Optional[Path],
+) -> None:
+    """
+    Check an agent against a compliance framework.
+
+    Shows a detailed breakdown of which rules pass and fail,
+    with plain-English remediation guidance for each failure.
+
+    Example:
+      iris compliance check --framework colorado-ai-act
+      iris compliance check --agent payment-agent --framework hipaa
+    """
+    gov_dir = governance_dir or Path.cwd() / "governance" / "agents"
+    passports = _discover_passports(gov_dir, agent)
+    if not passports:
+        console.print("[yellow]No agent passports found.[/yellow]")
+        sys.exit(0)
+
+    all_pass = True
+    for passport in passports:
+        result = run_framework_check(passport, framework)
+
+        if result.preview_only:
+            preview_lines = [
+                f"{rule.rule_id}  {rule.severity}  {rule.name}  [{rule.status}]"
+                for rule in result.rule_results
+            ]
+            console.print(
+                build_pro_preview_box(
+                    framework,
+                    result.framework_name,
+                    result.total_controls,
+                    preview_lines,
+                )
+            )
+            all_pass = False
+            continue
+
+        has_failures = any(rule.status == "FAIL" for rule in result.rule_results) or bool(
+            result.violations
+        )
+        status = "[bold green]PASS[/bold green]" if not has_failures else "[bold red]FAIL[/bold red]"
+        console.print(f"\nAgent: [cyan]{passport.name}[/cyan] — {status}")
+
+        if result.violations:
+            all_pass = False
+            for violation in result.violations:
+                console.print(f"  [red]✗[/red] [{violation.rule_id}] {violation.message}")
+                if violation.remediation:
+                    console.print(f"     [yellow]→[/yellow] {violation.remediation}")
+
+        shown_ids = {v.rule_id for v in result.violations}
+        for rule in result.rule_results:
+            if rule.rule_id in shown_ids:
+                continue
+            if rule.status == "PASS":
+                console.print(f"  [green]✓[/green] [{rule.rule_id}] {rule.name}")
+            elif rule.status == "FAIL":
+                all_pass = False
+                console.print(f"  [red]✗[/red] [{rule.rule_id}] {rule.name}")
+                if rule.message:
+                    console.print(f"     {rule.message}")
+                if rule.remediation:
+                    console.print(f"     [yellow]→[/yellow] {rule.remediation}")
+
+        if not result.violations and not any(r.status == "FAIL" for r in result.rule_results):
+            console.print(f"  [green]✓[/green] All {framework} rules satisfied")
+
+        for guidance in result.guidance:
+            if guidance.status == ComplianceCheckStatus.GUIDANCE:
+                console.print(f"  [blue]ℹ[/blue] [{guidance.rule_id}] {guidance.message}")
+                if guidance.remediation:
+                    console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+            elif guidance.status == ComplianceCheckStatus.PRO_REQUIRED:
+                console.print(f"  [yellow]⚠[/yellow] [{guidance.rule_id}] {guidance.message}")
+                if guidance.remediation:
+                    console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+
+        for note in result.check_notes:
+            console.print(f"  [dim]ℹ {note}[/dim]")
+
+    sys.exit(0 if all_pass else 1)

{iris_security_cli-0.1.3 → iris_security_cli-0.1.7}/iris_cli/drift.py

@@ -13,7 +13,7 @@ import click
 from rich.console import Console
 from rich.table import Table
 
-from iris_core.compliance.license import IrisLicense
+from iris_core.entitlements import Entitlements, Feature
 from iris_core.drift.detector import DriftDetector, DriftReport
 from iris_core.drift.notifier import DriftNotifier, load_alert_config, save_alert_config
 
@@ -24,15 +24,14 @@ def _gov_dir(governance_dir: Path | None) -> Path:
     return governance_dir or Path.cwd() / "governance" / "agents"
 
 
-def _require_pro_license(feature: str) -> None:
-    result = IrisLicense().check("gdpr")
-    if not result.valid:
-        console.print(
-            f"[red]{feature} requires an IRIS Pro license.[/red]\n"
-            "Drift watch (terminal alerts) is available on the free tier.\n"
-            "Run: iris license activate <your-key>  |  https://iris.ai/pricing"
-        )
-        sys.exit(1)
+def _require_pro_license(feature_name: str, feature: Feature) -> None:
+    ents = Entitlements()
+    if not ents.has(feature):
+        try:
+            ents.require(feature, context=feature_name)
+        except Exception as exc:
+            console.print(str(exc))
+            sys.exit(1)
 
 
 def _render_check_table(report: DriftReport) -> None:
@@ -249,10 +248,10 @@ def drift_alert_config(slack_webhook: Optional[str], email: Optional[str], webho
     config = load_alert_config()
 
     if slack_webhook:
-        _require_pro_license("Slack drift alerts")
+        _require_pro_license("Slack drift alerts", Feature.DRIFT_SLACK_ALERT)
         config["slack_webhook"] = slack_webhook
     if email:
-        _require_pro_license("Email drift alerts")
+        _require_pro_license("Email drift alerts", Feature.DRIFT_EMAIL_ALERT)
         config["email"] = email
     if webhook:
         config["webhook"] = webhook

iris_security_cli-0.1.7/iris_cli/entitlements_cmd.py

@@ -0,0 +1,16 @@
+"""iris entitlements — transparent feature map by tier."""
+
+from __future__ import annotations
+
+import click
+from rich.console import Console
+
+from iris_core.entitlements.display import build_entitlements_panel
+
+console = Console()
+
+
+@click.command("entitlements")
+def entitlements_cmd() -> None:
+    """Show the complete IRIS feature map — what is available at each tier."""
+    console.print(build_entitlements_panel())

{iris_security_cli-0.1.3 → iris_security_cli-0.1.7}/iris_cli/evidence.py

@@ -57,23 +57,25 @@ def _compliance_status(passport: AgentPassport) -> List[dict]:
     statuses: List[dict] = []
 
     checks = {
-        "CO-001": passport.is_high_risk_ai and bool(passport.agent_id),
+        "CO-001": bool(passport.agent_id) and bool(passport.owner),
         "CO-002": bool(passport.evidence_vault_id),
         "CO-003": bool(passport.intent_ref),
         "CO-004": bool(passport.intent_ref),
-        "CO-005": None,
-        "CO-006": bool(passport.last_reviewed_at),
+        "CO-RR-001": None,
+        "CO-DEV-001": bool(passport.intent_ref) and bool(passport.description),
     }
 
     for rule in rules:
         rule_id = rule["rule_id"]
-        if rule.get("phase") == 2:
+        if rule.get("status") == "BEST_PRACTICE":
+            passed = checks.get(rule_id)
+            status = "PASS" if passed else "RECOMMENDED"
             statuses.append(
                 {
                     "rule_id": rule_id,
                     "name": rule["name"],
-                    "status": "PENDING",
-                    "detail": "Phase 2",
+                    "status": status,
+                    "detail": "Best practice (not legally required under SB 26-189)",
                 }
             )
             continue

{iris_security_cli-0.1.3 → iris_security_cli-0.1.7}/iris_cli/framework_suggest.py

@@ -17,7 +17,32 @@ from rich.table import Table
 console = Console()
 
 MAJOR_CLOUDS = {"Google Cloud (GCP)", "AWS", "Microsoft Azure", "Multiple clouds"}
-FREE_FRAMEWORKS = {"colorado-ai-act"}
+FREE_FRAMEWORKS = {
+    "colorado-ai-act",
+    "colorado-chatbot",
+    "colorado-health-ai",
+    "colorado-mental-health-ai",
+}
+
+COLORADO_AI_ACT_NOTE = (
+    "Note: Colorado SB 26-189 replaced the original Colorado AI Act on May 14, 2026. "
+    "Key changes: impact assessments are no longer legally required (retained as best "
+    "practice). Record retention for 3 years is now required. Effective January 1, 2027."
+)
+
+MENTAL_HEALTH_KEYWORDS = (
+    "therapy",
+    "counseling",
+    "mental health",
+    "psychotherapy",
+    "clinician",
+)
+
+CONVERSATIONAL_KEYWORDS = (
+    "conversational ai",
+    "chatbot",
+    "chat bot",
+)
 
 Q1_CHOICES = [
     "Makes decisions that affect individual people (hiring, loans, medical, etc.)",
@@ -119,6 +144,10 @@ def _prefill_answers(passport: dict[str, Any] | None) -> dict[str, Any]:
         prefill["q6"] = True
         prefill["q2"] = Q2_CHOICES[0]
 
+    description = str(spec.get("description", "")).strip()
+    if description:
+        prefill["agent_description"] = description
+
     return prefill
 
 
@@ -205,11 +234,30 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     q6 = bool(answers.get("q6"))
     q7 = set(answers.get("q7", []))
     q8 = set(answers.get("q8", []))
+    agent_description = str(answers.get("agent_description", "")).lower()
 
     colorado = (
         (q5 and "Colorado" in q8)
         or (q1 == Q1_CHOICES[0] and "Colorado" in q8)
     )
+    conversational = (
+        any(kw in q1.lower() for kw in CONVERSATIONAL_KEYWORDS)
+        or any(kw in agent_description for kw in CONVERSATIONAL_KEYWORDS)
+        or q1 == Q1_CHOICES[3]
+    )
+    consumer_facing = q2 in {Q2_CHOICES[4], Q2_CHOICES[2]} or "minor" in agent_description
+    chatbot = conversational and consumer_facing and "Colorado" in q8
+
+    health_data = q4 == Q4_CHOICES[0] or "health" in str(q4).lower() or "medical" in str(q4).lower()
+    health_insurance = (
+        "HIPAA (healthcare)" in q7
+        or q2 == Q2_CHOICES[3]
+        or "health insurance" in agent_description
+    )
+    health_ai = (health_data or health_insurance) and "Colorado" in q8
+
+    mental_health = any(kw in agent_description for kw in MENTAL_HEALTH_KEYWORDS)
+
     nist = q6 or "FedRAMP (federal government contracts)" in q7 or q2 == Q2_CHOICES[0]
     fedramp = (
         (q6 or "FedRAMP (federal government contracts)" in q7 or q2 in {Q2_CHOICES[0], Q2_CHOICES[1]})
@@ -219,17 +267,61 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     soc2 = q2 == Q2_CHOICES[5] or "SOC 2 (SaaS / enterprise)" in q7
     gdpr = "Outside the US" in q8 or "Other / multiple states" in q8
 
+    colorado_reason = (
+        "Your agent makes consequential decisions for Colorado users. "
+        "SB 26-189 applies (replaces SB 24-205, effective Jan. 1, 2027). "
+        f"{COLORADO_AI_ACT_NOTE}"
+        if colorado
+        else "No Colorado consequential decision scope detected."
+    )
+
     recommendations = [
         Recommendation(
             framework="colorado-ai-act",
             tier="FREE",
             status="REQUIRED" if colorado else "NOT APPLICABLE",
+            reason=colorado_reason,
+            command="iris compliance check --framework colorado-ai-act" if colorado else None,
+        ),
+        Recommendation(
+            framework="colorado-chatbot",
+            tier="FREE",
+            status="REQUIRED" if chatbot else "NOT APPLICABLE",
             reason=(
-                "Your agent makes consequential decisions for Colorado users. SB 24-205 applies."
-                if colorado
-                else "No Colorado consequential decision scope detected."
+                "Conversational AI serving Colorado consumers requires HB 26-1263 "
+                "chatbot safety controls (effective Jan. 1, 2027)."
+                if chatbot
+                else "No conversational AI + consumer audience trigger detected."
+            ),
+            command="iris compliance check --framework colorado-chatbot" if chatbot else None,
+        ),
+        Recommendation(
+            framework="colorado-health-ai",
+            tier="FREE",
+            status="REQUIRED" if health_ai else "NOT APPLICABLE",
+            reason=(
+                "Health or insurance data handling in Colorado requires HB 26-1139 "
+                "AI in health insurance controls (effective Jan. 1, 2027)."
+                if health_ai
+                else "No Colorado health insurance AI trigger detected."
+            ),
+            command="iris compliance check --framework colorado-health-ai" if health_ai else None,
+        ),
+        Recommendation(
+            framework="colorado-mental-health-ai",
+            tier="FREE",
+            status="REQUIRED" if mental_health else "NOT APPLICABLE",
+            reason=(
+                "Mental health services agent detected. HB 26-1195 applies "
+                "(effective Aug. 12, 2026 — two months from now)."
+                if mental_health
+                else "No mental health services scope detected."
+            ),
+            command=(
+                "iris compliance check --framework colorado-mental-health-ai"
+                if mental_health
+                else None
             ),
-            command="iris compliance check --framework colorado-ai-act" if colorado else None,
         ),
         Recommendation(
             framework="nist-ai-rmf",
@@ -396,6 +488,8 @@ def framework_suggest(agent: str | None, output_format: str) -> None:
 
     prefill = _prefill_answers(passport)
     answers = run_questionnaire(prefill)
+    if prefill.get("agent_description"):
+        answers["agent_description"] = prefill["agent_description"]
     recommendations = build_recommendations(answers)
     save_path = _save_recommendations(agent, answers, recommendations)