iris-security-cli 0.1.4__tar.gz → 0.1.7__tar.gz

{iris_security_cli-0.1.4 → iris_security_cli-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.4
+Version: 0.1.7
 Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.3
-Requires-Dist: iris-security-sdk>=0.1.4
+Requires-Dist: iris-security-core>=0.1.6
+Requires-Dist: iris-security-sdk>=0.1.7
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.1.4 → iris_security_cli-0.1.7}/iris_cli/assess.py

@@ -21,7 +21,7 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.prompt import Prompt, Confirm
 from rich.table import Table
-from rich import print as rprint
+from iris_core import __version__ as IRIS_PLATFORM_VERSION
 
 console = Console()
 
@@ -342,7 +342,7 @@ def generate_assessment_markdown(
 > **Date**: {now}
 > **Framework**: Colorado AI Act (SB 26-189), effective January 1, 2027
 > **Note**: Replaces SB 24-205, signed May 14, 2026
-> **Generated by**: IRIS Compliance Platform v0.1.0
+> **Generated by**: IRIS Compliance Platform v{IRIS_PLATFORM_VERSION}
 
 ---
 

iris_security_cli-0.1.7/iris_cli/compliance_check_cmd.py

@@ -0,0 +1,127 @@
+"""iris compliance check — framework compliance with Pro preview."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+
+from iris import AgentPassport
+from iris_core.compliance.framework_check import run_framework_check
+from iris_core.compliance.results import ComplianceCheckStatus
+from iris_core.entitlements.display import build_pro_preview_box
+
+console = Console()
+
+
+def _discover_passports(
+    gov_dir: Path,
+    agent: Optional[str],
+) -> list[AgentPassport]:
+    passports: list[AgentPassport] = []
+    if agent:
+        passport_file = gov_dir / agent / "passport.yaml"
+        if passport_file.exists():
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        return passports
+
+    for passport_file in gov_dir.rglob("passport.yaml"):
+        try:
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        except Exception:
+            continue
+    return passports
+
+
+@click.command("check")
+@click.option("--agent", default=None, help="Specific agent to check (or all)")
+@click.option("--framework", "-f", default="colorado-ai-act")
+@click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
+def compliance_check_cmd(
+    agent: Optional[str],
+    framework: str,
+    governance_dir: Optional[Path],
+) -> None:
+    """
+    Check an agent against a compliance framework.
+
+    Shows a detailed breakdown of which rules pass and fail,
+    with plain-English remediation guidance for each failure.
+
+    Example:
+      iris compliance check --framework colorado-ai-act
+      iris compliance check --agent payment-agent --framework hipaa
+    """
+    gov_dir = governance_dir or Path.cwd() / "governance" / "agents"
+    passports = _discover_passports(gov_dir, agent)
+    if not passports:
+        console.print("[yellow]No agent passports found.[/yellow]")
+        sys.exit(0)
+
+    all_pass = True
+    for passport in passports:
+        result = run_framework_check(passport, framework)
+
+        if result.preview_only:
+            preview_lines = [
+                f"{rule.rule_id}  {rule.severity}  {rule.name}  [{rule.status}]"
+                for rule in result.rule_results
+            ]
+            console.print(
+                build_pro_preview_box(
+                    framework,
+                    result.framework_name,
+                    result.total_controls,
+                    preview_lines,
+                )
+            )
+            all_pass = False
+            continue
+
+        has_failures = any(rule.status == "FAIL" for rule in result.rule_results) or bool(
+            result.violations
+        )
+        status = "[bold green]PASS[/bold green]" if not has_failures else "[bold red]FAIL[/bold red]"
+        console.print(f"\nAgent: [cyan]{passport.name}[/cyan] — {status}")
+
+        if result.violations:
+            all_pass = False
+            for violation in result.violations:
+                console.print(f"  [red]✗[/red] [{violation.rule_id}] {violation.message}")
+                if violation.remediation:
+                    console.print(f"     [yellow]→[/yellow] {violation.remediation}")
+
+        shown_ids = {v.rule_id for v in result.violations}
+        for rule in result.rule_results:
+            if rule.rule_id in shown_ids:
+                continue
+            if rule.status == "PASS":
+                console.print(f"  [green]✓[/green] [{rule.rule_id}] {rule.name}")
+            elif rule.status == "FAIL":
+                all_pass = False
+                console.print(f"  [red]✗[/red] [{rule.rule_id}] {rule.name}")
+                if rule.message:
+                    console.print(f"     {rule.message}")
+                if rule.remediation:
+                    console.print(f"     [yellow]→[/yellow] {rule.remediation}")
+
+        if not result.violations and not any(r.status == "FAIL" for r in result.rule_results):
+            console.print(f"  [green]✓[/green] All {framework} rules satisfied")
+
+        for guidance in result.guidance:
+            if guidance.status == ComplianceCheckStatus.GUIDANCE:
+                console.print(f"  [blue]ℹ[/blue] [{guidance.rule_id}] {guidance.message}")
+                if guidance.remediation:
+                    console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+            elif guidance.status == ComplianceCheckStatus.PRO_REQUIRED:
+                console.print(f"  [yellow]⚠[/yellow] [{guidance.rule_id}] {guidance.message}")
+                if guidance.remediation:
+                    console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+
+        for note in result.check_notes:
+            console.print(f"  [dim]ℹ {note}[/dim]")
+
+    sys.exit(0 if all_pass else 1)

{iris_security_cli-0.1.4 → iris_security_cli-0.1.7}/iris_cli/drift.py

@@ -13,7 +13,7 @@ import click
 from rich.console import Console
 from rich.table import Table
 
-from iris_core.compliance.license import IrisLicense
+from iris_core.entitlements import Entitlements, Feature
 from iris_core.drift.detector import DriftDetector, DriftReport
 from iris_core.drift.notifier import DriftNotifier, load_alert_config, save_alert_config
 
@@ -24,15 +24,14 @@ def _gov_dir(governance_dir: Path | None) -> Path:
     return governance_dir or Path.cwd() / "governance" / "agents"
 
 
-def _require_pro_license(feature: str) -> None:
-    result = IrisLicense().check("gdpr")
-    if not result.valid:
-        console.print(
-            f"[red]{feature} requires an IRIS Pro license.[/red]\n"
-            "Drift watch (terminal alerts) is available on the free tier.\n"
-            "Run: iris license activate <your-key>  |  https://iris.ai/pricing"
-        )
-        sys.exit(1)
+def _require_pro_license(feature_name: str, feature: Feature) -> None:
+    ents = Entitlements()
+    if not ents.has(feature):
+        try:
+            ents.require(feature, context=feature_name)
+        except Exception as exc:
+            console.print(str(exc))
+            sys.exit(1)
 
 
 def _render_check_table(report: DriftReport) -> None:
@@ -249,10 +248,10 @@ def drift_alert_config(slack_webhook: Optional[str], email: Optional[str], webho
     config = load_alert_config()
 
     if slack_webhook:
-        _require_pro_license("Slack drift alerts")
+        _require_pro_license("Slack drift alerts", Feature.DRIFT_SLACK_ALERT)
         config["slack_webhook"] = slack_webhook
     if email:
-        _require_pro_license("Email drift alerts")
+        _require_pro_license("Email drift alerts", Feature.DRIFT_EMAIL_ALERT)
         config["email"] = email
     if webhook:
         config["webhook"] = webhook

iris_security_cli-0.1.7/iris_cli/entitlements_cmd.py

@@ -0,0 +1,16 @@
+"""iris entitlements — transparent feature map by tier."""
+
+from __future__ import annotations
+
+import click
+from rich.console import Console
+
+from iris_core.entitlements.display import build_entitlements_panel
+
+console = Console()
+
+
+@click.command("entitlements")
+def entitlements_cmd() -> None:
+    """Show the complete IRIS feature map — what is available at each tier."""
+    console.print(build_entitlements_panel())

{iris_security_cli-0.1.4 → iris_security_cli-0.1.7}/iris_cli/framework_test.py

@@ -12,9 +12,9 @@ import click
 from rich.console import Console
 from rich.panel import Panel
 
-from iris_core.compliance.license import IrisLicense, is_free_bundle
+from iris_core.entitlements import Entitlements, Feature
 from iris_core.evidence.vault import EvidenceVault
-from iris_core.models.passport import AgentPassport
+from iris_core.models.passport import AgentPassport, DataClassification
 
 console = Console()
 
@@ -27,6 +27,17 @@ PRO_BUNDLES = {
 }
 
 SEVERITY_ORDER = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
+MS25_PARTIAL_MISSING = (
+    "Free tier provides 30-day local retention. "
+    "NIST AI RMF MS-2.5 recommends ongoing risk tracking. "
+    "30 days of history partially satisfies this control."
+)
+MS25_PARTIAL_FIX = (
+    "For full satisfaction:\n"
+    "iris license activate <key>\n"
+    "This enables unlimited Evidence Vault retention so your "
+    "complete governance history satisfies MS-2.5."
+)
 EFFORT_BY_REASON = {
     "infrastructure": "1 week",
     "document": "1 hour",
@@ -190,10 +201,79 @@ def _framework_bundle(framework: str) -> Dict[str, Any]:
                 ),
             ],
         },
+        "hipaa": {
+            "bundle_id": "hipaa",
+            "full_name": _framework_name("hipaa"),
+            "rules": [
+                _rule(
+                    "HIPAA-001",
+                    "PHI data classification",
+                    "CRITICAL",
+                    "passport.data_classification == DataClassification.PHI",
+                    "PHI data classification missing",
+                    "Set data_classification=PHI in passport",
+                    "passport",
+                ),
+                _rule(
+                    "HIPAA-002",
+                    "Evidence Vault PHI audit trail",
+                    "HIGH",
+                    "vault.total_evaluations > 0",
+                    "Evidence Vault not recording PHI",
+                    "Ensure IRIS client is wrapping LLM calls",
+                    "process",
+                ),
+                _rule(
+                    "HIPAA-003",
+                    "Region restriction for PHI",
+                    "HIGH",
+                    "len(passport.allowed_regions) > 0",
+                    "No region restriction declared",
+                    "Add allowed_regions to passport",
+                    "passport",
+                ),
+                _rule(
+                    "HIPAA-004",
+                    "Minimum necessary tool permissions",
+                    "HIGH",
+                    "len(passport.tool_permissions) > 0",
+                    "No minimum-necessary tool permissions declared",
+                    "Declare tool_permissions in passport.yaml",
+                    "passport",
+                ),
+                _rule(
+                    "HIPAA-005",
+                    "Business Associate Agreement evidence",
+                    "CRITICAL",
+                    "passport.evidence_vault_id is not None",
+                    "BAA evidence not linked in Evidence Vault",
+                    f"Run: iris evidence init --agent <agent>",
+                    "document",
+                ),
+                _rule(
+                    "HIPAA-006",
+                    "Breach notification readiness",
+                    "CRITICAL",
+                    "files['policy_cedar_exists']",
+                    "Runtime policy enforcement not configured",
+                    "Run: iris policy compile --agent <agent>",
+                    "document",
+                ),
+                _rule(
+                    "HIPAA-007",
+                    "De-identification policy",
+                    "HIGH",
+                    "passport.intent_ref is not None",
+                    "De-identification policy not declared",
+                    "Add policy-intent.md and run iris policy compile",
+                    "document",
+                ),
+            ],
+        },
     }
 
     # Reuse NIST-style checks for paid frameworks until dedicated bundles are added.
-    for paid_alias in ("fedramp-moderate", "hipaa", "soc2", "gdpr"):
+    for paid_alias in ("fedramp-moderate", "soc2", "gdpr"):
         alias_bundle = dict(bundles["nist-ai-rmf"])
         alias_bundle["bundle_id"] = paid_alias
         alias_bundle["full_name"] = _framework_name(paid_alias)
@@ -210,6 +290,7 @@ def _evaluate_check(check_expr: str, passport: AgentPassport, vault_summary: Any
         "passport": passport,
         "vault": vault_summary,
         "files": files,
+        "DataClassification": DataClassification,
         "bool": bool,
         "len": len,
         "all": all,
@@ -284,6 +365,13 @@ def _build_result(framework: str, agent: str, passport: AgentPassport) -> Framew
 
     for rule in bundle["rules"]:
         status = _evaluate_check(rule["check"], passport, summary, files)
+        if (
+            rule["rule_id"] == "MS-2.5"
+            and status == "FAIL"
+            and not Entitlements().has(Feature.VAULT_UNLIMITED_RETENTION)
+        ):
+            status = "PARTIAL"
+
         if status == "PASS":
             pass_count += 1
             continue
@@ -296,14 +384,20 @@ def _build_result(framework: str, agent: str, passport: AgentPassport) -> Framew
             fail_count += 1
             status = "FAIL"
 
+        what_is_missing = rule["what_is_missing"]
+        how_to_fix = rule["how_to_fix"]
+        if rule["rule_id"] == "MS-2.5" and status == "PARTIAL":
+            what_is_missing = MS25_PARTIAL_MISSING
+            how_to_fix = MS25_PARTIAL_FIX
+
         gaps.append(
             ControlGap(
                 rule_id=rule["rule_id"],
                 name=rule["name"],
                 severity=rule["severity"],
                 status=status,
-                what_is_missing=rule["what_is_missing"],
-                how_to_fix=rule["how_to_fix"].replace("<agent>", agent),
+                what_is_missing=what_is_missing,
+                how_to_fix=how_to_fix.replace("<agent>", agent),
                 estimated_effort=rule["estimated_effort"],
             )
         )
@@ -329,12 +423,51 @@ def _build_result(framework: str, agent: str, passport: AgentPassport) -> Framew
     )
 
 
+def _render_free_tier_panel(result: FrameworkTestResult) -> str:
+    framework_label = _framework_name(result.framework)
+    evaluated = result.passed_controls + result.failed_controls + result.partial_controls
+    filled = int((evaluated / max(1, result.total_controls)) * 10)
+    bar = f"{'█' * filled}{'░' * (10 - filled)}"
+    title = f"{framework_label} Test: {result.agent_name}"
+    pad = max(0, 60 - len(title) - 4)
+    lines = [
+        f"┌─ {title} {'─' * pad}┐",
+        "│ Certification Readiness                                     │",
+        f"│ {bar}  {evaluated} / {result.total_controls} controls evaluated{' ' * max(0, 22 - len(str(evaluated)) - len(str(result.total_controls)))}│",
+        "│ Score: requires Pro for full evaluation                    │",
+        "│                                                             │",
+        "│ TOP 3 GAPS (free preview)                                  │",
+    ]
+    for index, gap in enumerate(result.gaps[:3], start=1):
+        lines.append(
+            f"│ {index}. [{gap.severity}] {gap.rule_id} — {gap.name[:35]:<35} │"
+        )
+        fix = gap.how_to_fix.split("\n")[0][:48]
+        lines.append(f"│    Fix: {fix:<51}│")
+        lines.append(f"│    Time: {gap.estimated_effort:<49}│")
+        if index < min(3, len(result.gaps)):
+            lines.append("│                                                             │")
+    total = result.total_controls
+    lines.extend(
+        [
+            "│                                                             │",
+            f"│ See all {total} controls + evidence package:{' ' * max(0, 24 - len(str(total)))}│",
+            "│ iris license activate <key>                                │",
+            "└─────────────────────────────────────────────────────────────┘",
+        ]
+    )
+    return "\n".join(lines)
+
+
 def _render_table(result: FrameworkTestResult, has_pro: bool) -> None:
+    if not has_pro:
+        console.print(_render_free_tier_panel(result))
+        return
+
     framework_label = _framework_name(result.framework)
-    subtitle = "IRIS Pro active" if has_pro else "IRIS Pro required for full report"
     console.print(
         Panel(
-            f"Framework: {framework_label}\nGenerated: {datetime.utcnow().strftime('%Y-%m-%d')}  |  {subtitle}",
+            f"Framework: {framework_label}\nGenerated: {datetime.utcnow().strftime('%Y-%m-%d')}  |  IRIS Pro active",
             title=f"{framework_label} Test — {result.agent_name}",
             style="blue",
         )
@@ -351,29 +484,20 @@ def _render_table(result: FrameworkTestResult, has_pro: bool) -> None:
         f"PASSED ({result.passed_controls})   FAILED ({result.failed_controls})   "
         f"PARTIAL ({result.partial_controls})   N/A ({result.not_applicable})"
     )
-    if has_pro and result.progress_delta_percent is not None:
+    if result.progress_delta_percent is not None:
         delta = result.progress_delta_percent
         sign = "+" if delta >= 0 else ""
         console.print(f"Progress since last run: [bold]{sign}{delta}%[/bold]")
 
-    gaps = result.gaps if has_pro else result.gaps[:3]
-    hidden = max(0, len(result.gaps) - len(gaps))
-    title = "ALL GAPS" if has_pro else f"TOP 3 GAPS (upgrade to IRIS Pro to see all {len(result.gaps)})"
-    console.print(f"\n[bold]{title}[/bold]")
+    console.print("\n[bold]ALL GAPS[/bold]")
     console.print("─" * 65)
-    for gap in gaps:
+    for gap in result.gaps:
         console.print(f"[{gap.severity}] {gap.rule_id} — {gap.name}")
+        console.print(f"Status: {gap.status}")
         console.print(f"Missing: {gap.what_is_missing}")
         console.print(f"Fix: {gap.how_to_fix}")
         console.print(f"Effort: {gap.estimated_effort}\n")
 
-    if hidden and not has_pro:
-        console.print("─" * 65)
-        console.print("See all gaps and generate your evidence package:")
-        console.print("iris license activate <your-key>")
-        console.print("https://iris.ai/pricing")
-        console.print("─" * 65)
-
 
 def _render_markdown(result: FrameworkTestResult, has_pro: bool) -> str:
     lines = [
@@ -440,9 +564,8 @@ def test(framework: str, agent_name: str, output_format: str, export_format: Opt
         raise click.ClickException(f"Passport not found: {passport_path}")
     passport = AgentPassport.from_yaml(passport_path.read_text())
 
-    has_pro = is_free_bundle(framework)
-    if framework in PRO_BUNDLES:
-        has_pro = IrisLicense().check("gdpr").valid
+    ents = Entitlements()
+    has_pro = ents.has(Feature.CLI_TEST_FULL_REPORT)
 
     result = _build_result(framework, agent_name, passport)
     previous = _load_previous_score(agent_name, framework)
@@ -452,8 +575,11 @@ def test(framework: str, agent_name: str, output_format: str, export_format: Opt
     saved_path = _save_result(result)
 
     if export_format == "pdf":
-        if not has_pro:
-            raise click.ClickException("PDF export requires IRIS Pro. Run: iris license activate <your-key>")
+        if not ents.has(Feature.CLI_TEST_PDF_EXPORT):
+            try:
+                ents.require(Feature.CLI_TEST_PDF_EXPORT, context="PDF export")
+            except Exception as exc:
+                raise click.ClickException(str(exc)) from exc
         pdf_path = saved_path.with_suffix(".pdf")
         pdf_path.write_text("PDF export placeholder. Use IRIS Pro renderer in hosted pipeline.")
 

iris_security_cli-0.1.7/iris_cli/license_cmd.py

@@ -0,0 +1,153 @@
+"""iris license — IRIS Pro license management commands."""
+
+from __future__ import annotations
+
+import sys
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+
+from iris_core.entitlements import Entitlements, Feature, LicenseKey, Tier
+from iris_core.entitlements.features import FEATURE_TIERS, TIER_RANK
+
+console = Console()
+
+_STATUS_BOX = """┌─ IRIS License Status ──────────────────────────────────────┐
+│ Tier:    {tier:<52}│
+│ Key:     {key:<52}│
+│                                                             │
+│ Available now (free forever):                              │
+│   Colorado AI Act bundle, all LLM integrations,            │
+│   Cursor MCP, local Evidence Vault (30 days),              │
+│   iris scan, iris status, iris framework suggest           │
+│                                                             │
+│ Unlock with Pro:                                           │
+│   NIST AI RMF, FedRAMP, HIPAA, SOC 2, GDPR, EU AI Act    │
+│   Unlimited Evidence Vault + cloud sync + PDF export       │
+│   K8s sidecar, HITL gate, SCM org scanner                 │
+│   Team RBAC, SSO, drift alerts, cost anomaly alerts        │
+│                                                             │
+│ Activate: iris license activate <your-key>                 │
+│ Get a key: https://iris.ai/pricing                         │
+└────────────────────────────────────────────────────────────┘"""
+
+
+def _mask_key(key: str | None) -> str:
+    if not key:
+        return "Not activated"
+    if len(key) <= 16:
+        return key
+    return f"{key[:9]}…{key[-4:]}"
+
+
+def _is_test_key(key: str) -> bool:
+    return key.startswith("IRIS-TEST-") or key.startswith("IRIS-DEMO-")
+
+
+def _features_for_tier(tier: Tier) -> list[Feature]:
+    return [
+        feature
+        for feature, required in FEATURE_TIERS.items()
+        if TIER_RANK[tier] >= TIER_RANK[required]
+    ]
+
+
+def _features_exactly_tier(tier: Tier) -> list[Feature]:
+    return [feature for feature, required in FEATURE_TIERS.items() if required == tier]
+
+
+@click.group()
+def license():
+    """IRIS Pro license management."""
+    pass
+
+
+@license.command("status")
+def license_status():
+    """Show current license status, tier, and what is unlocked."""
+    ents = Entitlements()
+    key = ents.license_key
+    tier_label = ents.tier_name()
+    key_label = _mask_key(key)
+    if key and not ents.license_valid:
+        tier_label = f"{tier_label} (invalid key: {ents.license_reason})"
+        key_label = "Invalid"
+
+    console.print(_STATUS_BOX.format(tier=tier_label, key=key_label))
+
+
+@license.command("activate")
+@click.argument("key")
+def license_activate(key: str):
+    """Validate and save an IRIS license key."""
+    key = key.strip()
+    valid, tier, reason = LicenseKey.validate(key)
+    if not valid:
+        console.print(
+            "[red]Invalid license key format.[/red]\n"
+            "Expected: IRIS-XXXX-XXXX-XXXX-XXXX (uppercase letters and digits)\n"
+            "Example:  IRIS-P123-ABCD-EFGH-5678\n"
+            "Get a key: https://iris.ai/pricing"
+        )
+        sys.exit(1)
+
+    LicenseKey.save(key)
+    ents = Entitlements()
+    test_note = " (test key)" if _is_test_key(key) else ""
+    unlocked = _features_for_tier(tier)
+    newly = [f.value for f in unlocked if FEATURE_TIERS[f] == tier]
+    feature_list = ", ".join(newly[:12])
+    if len(newly) > 12:
+        feature_list += f", … (+{len(newly) - 12} more)"
+
+    console.print(
+        Panel(
+            f"[bold green]✓ License activated{test_note}[/bold green]\n\n"
+            f"Tier unlocked: [cyan]{ents.tier_name()}[/cyan]\n"
+            f"Saved to: {LicenseKey.license_file_path()}\n\n"
+            f"Features unlocked at this tier:\n  {feature_list}",
+            style="green",
+        )
+    )
+
+
+@license.command("deactivate")
+@click.confirmation_option(prompt="Remove your IRIS license key?")
+def license_deactivate():
+    """Remove the license key and revert to the free tier."""
+    removed = LicenseKey.clear()
+    if removed:
+        console.print("[yellow]License deactivated.[/yellow] You are now on the Free tier.")
+    else:
+        console.print("[dim]No license key was stored.[/dim]")
+
+
+@license.command("features")
+@click.option("--tier", type=click.Choice(["free", "pro", "enterprise"]), default=None)
+def license_features(tier: str | None):
+    """List features by tier (comparison table by default)."""
+    if tier:
+        selected = Tier(tier)
+        features = _features_exactly_tier(selected)
+        console.print(f"\n[bold]{selected.value.title()} tier features[/bold] ({len(features)})\n")
+        for feature in sorted(features, key=lambda f: f.value):
+            console.print(f"  • {feature.value}")
+        return
+
+    table = Table(title="IRIS Feature Comparison")
+    table.add_column("Feature", style="bold")
+    table.add_column("Free")
+    table.add_column("Pro")
+    table.add_column("Enterprise")
+
+    for feature in sorted(FEATURE_TIERS, key=lambda f: f.value):
+        required = FEATURE_TIERS[feature]
+        table.add_row(
+            feature.value,
+            "✓" if TIER_RANK[Tier.FREE] >= TIER_RANK[required] else "—",
+            "✓" if TIER_RANK[Tier.PRO] >= TIER_RANK[required] else "—",
+            "✓" if TIER_RANK[Tier.ENTERPRISE] >= TIER_RANK[required] else "—",
+        )
+    console.print(table)