iris-security-cli 0.1.7__tar.gz → 0.1.9__tar.gz

{iris_security_cli-0.1.7 → iris_security_cli-0.1.9}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.7
-Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
+Version: 0.1.9
+Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
 Project-URL: Repository, https://github.com/gimartinb/iris-sdk
@@ -15,13 +15,13 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.6
-Requires-Dist: iris-security-sdk>=0.1.7
+Requires-Dist: iris-security-core>=0.1.7
+Requires-Dist: iris-security-sdk>=0.1.9
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: scm
-Requires-Dist: iris-security-scm[all]>=0.1.0; extra == "scm"
+Requires-Dist: iris-security-scm[all]>=0.1.1; extra == "scm"
 
 # iris-security-cli
 

iris_security_cli-0.1.9/iris_cli/certify.py

@@ -0,0 +1,105 @@
+"""iris certify — prove compliance readiness to any regulatory framework."""
+
+from __future__ import annotations
+
+from datetime import datetime
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+
+from iris_core.entitlements import Entitlements, Feature
+from iris_core.models.passport import AgentPassport
+
+from iris_cli.framework_test import (
+    _build_result,
+    _framework_name,
+    _load_previous_score,
+    _render_json,
+    _render_markdown,
+    _render_table,
+    _save_result,
+)
+
+console = Console()
+
+
+def _render_certification_header(
+    framework: str,
+    agent_name: str,
+    result,
+) -> None:
+    framework_label = _framework_name(framework)
+    if framework == "colorado-ai-act":
+        framework_label = "Colorado AI Act (SB 26-189)"
+
+    console.print(Panel(
+        f"Agent:      {agent_name}\n"
+        f"Framework:  {framework_label}\n"
+        f"Generated:  {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}\n"
+        f"Attested:   IRIS · Commit: local",
+        title=f"IRIS Certification — {framework}",
+        style="blue",
+    ))
+
+    evaluated = result.passed_controls + result.failed_controls + result.partial_controls
+    pct = result.score_percent
+    filled = int((pct / 100) * 20)
+    bar = "█" * filled + "░" * (20 - filled)
+    readiness = "READY" if pct >= 95 else result.readiness_level
+
+    console.print(f"\n[bold]CERTIFICATION RESULT: {readiness}[/bold]")
+    console.print(f"{bar}  {result.passed_controls} / {result.total_controls} controls  {pct}%")
+
+    if framework == "colorado-ai-act" and pct >= 95:
+        console.print(
+            f"\nThis agent is certification-ready for Colorado AI Act (SB 26-189).\n"
+            f"Effective date: January 1, 2027\n\n"
+            f"Evidence package: iris evidence report --agent {agent_name}\n"
+            f"Auditor note: Present this output alongside the Evidence Vault report "
+            f"to demonstrate compliance readiness."
+        )
+
+
+@click.command("certify")
+@click.option(
+    "--framework",
+    required=True,
+    type=click.Choice(sorted(["colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr"])),
+)
+@click.option("--agent", "agent_name", required=True, help="Agent name under governance/agents")
+@click.option("--format", "output_format", default="table", type=click.Choice(["table", "json", "markdown"]))
+def certify_cmd(framework: str, agent_name: str, output_format: str) -> None:
+    """
+    Certify compliance readiness against a regulatory framework.
+
+    Alias: iris test
+    """
+    passport_path = Path.cwd() / "governance" / "agents" / agent_name / "passport.yaml"
+    if not passport_path.exists():
+        raise click.ClickException(f"Passport not found: {passport_path}")
+    passport = AgentPassport.from_yaml(passport_path.read_text())
+
+    ents = Entitlements()
+    has_pro = ents.has(Feature.CLI_TEST_FULL_REPORT)
+
+    result = _build_result(framework, agent_name, passport)
+    previous = _load_previous_score(agent_name, framework)
+    if previous is not None and has_pro:
+        result.progress_delta_percent = result.score_percent - previous
+
+    _save_result(result)
+
+    if output_format == "json":
+        click.echo(_render_json(result, has_pro))
+    elif output_format == "markdown":
+        click.echo(_render_markdown(result, has_pro))
+    else:
+        _render_certification_header(framework, agent_name, result)
+        _render_table(result, has_pro)
+
+
+# Legacy alias: iris test → iris certify
+test = certify_cmd

iris_security_cli-0.1.9/iris_cli/compliance_check_cmd.py

@@ -0,0 +1,180 @@
+"""iris compliance check — framework compliance with Pro preview."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+
+from iris import AgentPassport
+from iris_core.compliance.framework_check import run_framework_check
+from iris_core.compliance.results import ComplianceCheckStatus
+from iris_core.entitlements.display import build_pro_preview_box
+
+from iris_cli.compliance_fix import offer_remediation, recheck_after_fixes
+from iris_core.compliance.remediation import collect_fixable_issues
+
+console = Console()
+
+
+def _discover_passports(
+    gov_dir: Path,
+    agent: Optional[str],
+) -> list[AgentPassport]:
+    passports: list[AgentPassport] = []
+    if agent:
+        passport_file = gov_dir / agent / "passport.yaml"
+        if passport_file.exists():
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        return passports
+
+    for passport_file in gov_dir.rglob("passport.yaml"):
+        try:
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        except Exception:
+            continue
+    return passports
+
+
+def _render_result(
+    passport: AgentPassport,
+    framework: str,
+    result,
+) -> bool:
+    """Print one agent's check result. Returns False if failures were found."""
+    if result.preview_only:
+        preview_lines = [
+            f"{rule.rule_id}  {rule.severity}  {rule.name}  [{rule.status}]"
+            for rule in result.rule_results
+        ]
+        console.print(
+            build_pro_preview_box(
+                framework,
+                result.framework_name,
+                result.total_controls,
+                preview_lines,
+            )
+        )
+        return False
+
+    has_failures = any(rule.status == "FAIL" for rule in result.rule_results) or bool(
+        result.violations
+    )
+    status = "[bold green]PASS[/bold green]" if not has_failures else "[bold red]FAIL[/bold red]"
+    console.print(f"\nAgent: [cyan]{passport.name}[/cyan] — {status}")
+
+    if result.violations:
+        for violation in result.violations:
+            console.print(f"  [red]✗[/red] [{violation.rule_id}] {violation.message}")
+            if violation.remediation:
+                console.print(f"     [yellow]→[/yellow] {violation.remediation}")
+
+    shown_ids = {v.rule_id for v in result.violations}
+    for rule in result.rule_results:
+        if rule.rule_id in shown_ids:
+            continue
+        if rule.status == "PASS":
+            console.print(f"  [green]✓[/green] [{rule.rule_id}] {rule.name}")
+        elif rule.status == "FAIL":
+            console.print(f"  [red]✗[/red] [{rule.rule_id}] {rule.name}")
+            if rule.message:
+                console.print(f"     {rule.message}")
+            if rule.remediation:
+                console.print(f"     [yellow]→[/yellow] {rule.remediation}")
+
+    if not result.violations and not any(r.status == "FAIL" for r in result.rule_results):
+        console.print(f"  [green]✓[/green] All {framework} rules satisfied")
+
+    for guidance in result.guidance:
+        if guidance.status == ComplianceCheckStatus.GUIDANCE:
+            console.print(f"  [blue]ℹ[/blue] [{guidance.rule_id}] {guidance.message}")
+            if guidance.remediation:
+                console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+        elif guidance.status == ComplianceCheckStatus.PRO_REQUIRED:
+            console.print(f"  [yellow]⚠[/yellow] [{guidance.rule_id}] {guidance.message}")
+            if guidance.remediation:
+                console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+
+    for note in result.check_notes:
+        console.print(f"  [dim]ℹ {note}[/dim]")
+
+    return not has_failures
+
+
+@click.command("check")
+@click.option("--agent", default=None, help="Specific agent to check (or all)")
+@click.option("--framework", "-f", default="colorado-ai-act")
+@click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
+@click.option(
+    "--fix",
+    is_flag=True,
+    help="Apply all auto-fixable remediations without per-issue prompts",
+)
+@click.option(
+    "--yes",
+    "-y",
+    is_flag=True,
+    help="Apply auto-fixes without confirmation (use with --fix)",
+)
+@click.option(
+    "--no-fix",
+    is_flag=True,
+    help="Show remediations only — never offer to apply fixes",
+)
+def compliance_check_cmd(
+    agent: Optional[str],
+    framework: str,
+    governance_dir: Optional[Path],
+    fix: bool,
+    yes: bool,
+    no_fix: bool,
+) -> None:
+    """
+    Check an agent against a compliance framework.
+
+    Shows a detailed breakdown of which rules pass and fail,
+    with plain-English remediation guidance for each failure.
+    When run interactively, IRIS offers to apply safe fixes automatically.
+
+    Example:
+      iris compliance check --framework colorado-ai-act
+      iris compliance check --agent payment-agent --framework hipaa
+      iris compliance check --agent payment-agent --framework hipaa --fix -y
+    """
+    gov_dir = governance_dir or Path.cwd() / "governance" / "agents"
+    passports = _discover_passports(gov_dir, agent)
+    if not passports:
+        console.print("[yellow]No agent passports found.[/yellow]")
+        sys.exit(0)
+
+    all_pass = True
+    offer_fixes = bool(agent) or len(passports) == 1
+    for passport in passports:
+        result = run_framework_check(passport, framework)
+        agent_passed = _render_result(passport, framework, result)
+        if not agent_passed:
+            all_pass = False
+
+        if offer_fixes:
+            applied = offer_remediation(
+                passport,
+                framework,
+                result,
+                gov_dir,
+                auto_fix=fix,
+                yes=yes,
+                no_fix=no_fix,
+            )
+            recheck_after_fixes(passport, framework, gov_dir, applied)
+        elif not no_fix and not agent_passed and collect_fixable_issues(
+            passport, framework, result
+        ):
+            console.print(
+                f"[dim]Fixable issues for {passport.name}. "
+                f"Re-run with --agent {passport.name} to let IRIS apply fixes.[/dim]"
+            )
+
+    sys.exit(0 if all_pass else 1)

iris_security_cli-0.1.9/iris_cli/compliance_fix.py

@@ -0,0 +1,202 @@
+"""Interactive compliance remediation — IRIS governance assistant."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import List, Optional
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+
+from iris import AgentPassport
+from iris_core.compliance.framework_check import FrameworkCheckResult, run_framework_check
+from iris_core.compliance.remediation import (
+    FixResult,
+    FixableIssue,
+    apply_fix,
+    collect_fixable_issues,
+)
+
+console = Console()
+
+
+def _is_interactive() -> bool:
+    return click.get_text_stream("stdin").isatty()
+
+
+def _print_fixable_summary(agent_name: str, issues: List[FixableIssue]) -> None:
+    lines = [
+        f"[bold]IRIS found {len(issues)} fixable issue"
+        f"{'s' if len(issues) != 1 else ''} for [cyan]{agent_name}[/cyan][/bold]\n"
+    ]
+    for issue in issues:
+        lines.append(f"  [yellow]•[/yellow] [{issue.rule_id}] {issue.preview}")
+    lines.append(
+        "\n[dim]IRIS can apply safe passport and policy updates automatically. "
+        "Review each change before applying.[/dim]"
+    )
+    console.print(Panel("\n".join(lines), title="IRIS Governance Assistant", style="blue"))
+
+
+def offer_remediation(
+    passport: AgentPassport,
+    framework: str,
+    result: FrameworkCheckResult,
+    governance_dir: Path,
+    *,
+    auto_fix: bool = False,
+    yes: bool = False,
+    no_fix: bool = False,
+) -> List[FixResult]:
+    """
+    Offer to apply fixable remediations after a compliance check.
+
+  Returns applied fix results (may be empty).
+    """
+    if no_fix or result.preview_only:
+        return []
+
+    issues = collect_fixable_issues(passport, framework, result)
+    if not issues:
+        return []
+
+    agent_dir = governance_dir / passport.name
+    passport_file = agent_dir / "passport.yaml"
+
+    if auto_fix or yes:
+        return _apply_all(issues, passport_file, framework, passport.name)
+
+    if not _is_interactive():
+        console.print(
+            "[dim]Fixable issues detected. Re-run with --fix to apply automatically.[/dim]"
+        )
+        return []
+
+    _print_fixable_summary(passport.name, issues)
+    if not click.confirm(
+        f"\nWould you like IRIS to fix these {len(issues)} issue"
+        f"{'s' if len(issues) != 1 else ''} for {passport.name}?",
+        default=True,
+    ):
+        console.print("[dim]Skipped automatic fixes. Apply remediations manually when ready.[/dim]")
+        return []
+
+    return _apply_interactive(issues, passport_file, framework, passport.name)
+
+
+def _apply_all(
+    issues: List[FixableIssue],
+    passport_file: Path,
+    framework: str,
+    agent_name: str,
+) -> List[FixResult]:
+    results: List[FixResult] = []
+    for issue in issues:
+        result = apply_fix(issue, passport_file, framework)
+        results.append(result)
+        _print_fix_result(agent_name, issue, result)
+    if results:
+        console.print(
+            Panel(
+                f"[bold green]✓ IRIS applied {sum(1 for r in results if r.applied)} fix"
+                f"{'es' if sum(1 for r in results if r.applied) != 1 else ''}[/bold green]\n\n"
+                f"Re-run: [bold]iris compliance check --agent {agent_name} "
+                f"--framework {framework}[/bold]",
+                style="green",
+            )
+        )
+    return results
+
+
+def _apply_interactive(
+    issues: List[FixableIssue],
+    passport_file: Path,
+    framework: str,
+    agent_name: str,
+) -> List[FixResult]:
+    results: List[FixResult] = []
+    apply_all = False
+
+    for issue in issues:
+        if apply_all:
+            result = apply_fix(issue, passport_file, framework)
+            results.append(result)
+            _print_fix_result(agent_name, issue, result)
+            continue
+
+        console.print(
+            f"\n[bold]IRIS can fix[/bold] [{issue.rule_id}] {issue.preview}\n"
+            f"[dim]{issue.message}[/dim]"
+        )
+        console.print("Apply this fix? ([yes]/no/skip/all)")
+        choice = click.prompt("", default="no", show_default=False).strip().lower()
+
+        if choice in ("yes", "y"):
+            result = apply_fix(issue, passport_file, framework)
+            results.append(result)
+            _print_fix_result(agent_name, issue, result)
+        elif choice == "all":
+            apply_all = True
+            result = apply_fix(issue, passport_file, framework)
+            results.append(result)
+            _print_fix_result(agent_name, issue, result)
+        elif choice == "skip":
+            console.print("[dim]Skipped.[/dim]")
+        else:
+            console.print("[dim]Not applied — fix manually when ready.[/dim]")
+
+    applied_count = sum(1 for r in results if r.applied)
+    if applied_count:
+        console.print(
+            Panel(
+                f"[bold green]✓ IRIS applied {applied_count} fix"
+                f"{'es' if applied_count != 1 else ''}[/bold green]\n\n"
+                f"Re-run: [bold]iris compliance check --agent {agent_name} "
+                f"--framework {framework}[/bold]",
+                style="green",
+            )
+        )
+    return results
+
+
+def _print_fix_result(agent_name: str, issue: FixableIssue, result: FixResult) -> None:
+    if result.applied:
+        change_text = "\n".join(f"  [dim]• {change}[/dim]" for change in result.changes)
+        console.print(f"[green]✓ Applied[/green] [{issue.rule_id}]\n{change_text}")
+        return
+    if result.skipped_reason:
+        console.print(
+            f"[yellow]⚠ Skipped[/yellow] [{issue.rule_id}]: {result.skipped_reason}"
+        )
+
+
+def recheck_after_fixes(
+    passport: AgentPassport,
+    framework: str,
+    governance_dir: Path,
+    applied: List[FixResult],
+) -> Optional[FrameworkCheckResult]:
+    """Re-run check and show delta when fixes were applied."""
+    if not any(result.applied for result in applied):
+        return None
+
+    passport_file = governance_dir / passport.name / "passport.yaml"
+    if not passport_file.exists():
+        return None
+
+    updated = AgentPassport.from_yaml(passport_file.read_text())
+    result = run_framework_check(updated, framework)
+    remaining = collect_fixable_issues(updated, framework, result)
+    fail_count = sum(1 for rule in result.rule_results if rule.status == "FAIL")
+    fail_count += len(result.violations)
+
+    console.print(
+        Panel(
+            f"[bold]Re-check: {updated.name}[/bold]\n"
+            f"Remaining failures: {fail_count}\n"
+            f"Auto-fixable remaining: {len(remaining)}",
+            style="cyan",
+        )
+    )
+    return result

iris_security_cli-0.1.9/iris_cli/declare.py

@@ -0,0 +1,177 @@
+"""iris declare — register an agent with optional interactive wizard."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+
+console = Console()
+
+_DATA_CLASSIFICATIONS = {
+    "none": "internal",
+    "internal": "internal",
+    "pii": "pii",
+    "phi": "phi",
+    "financial": "confidential",
+}
+
+
+def _run_framework_suggest(agent_name: str) -> None:
+    console.print(f"[dim]Run: iris framework suggest --agent {agent_name}[/dim]")
+
+
+def _write_agent_files(
+    name: str,
+    owner: str,
+    team: str,
+    env: tuple[str, ...],
+    high_risk: bool,
+    compliance_list: list[str],
+    output: Path,
+    description: str = "",
+) -> None:
+    from iris import IrisAgent, DataClassification, ComplianceTag
+
+    data_class = DataClassification.INTERNAL
+    agent = IrisAgent(
+        name=name,
+        owner=owner,
+        team=team,
+        compliance=compliance_list,
+        environments=list(env),
+        is_high_risk_ai=high_risk,
+        policy_dir=output,
+    )
+    if description:
+        agent.passport.description = description
+
+    output.mkdir(parents=True, exist_ok=True)
+    (output / "passport.yaml").write_text(agent.passport.to_yaml())
+
+    intent_template = f"""# Policy Intent — {name}
+
+> Edit this file to describe what your agent is allowed to do.
+> Then run: iris compile --agent {name}
+
+## What this agent does
+{description or "[Describe the agent's purpose here]"}
+
+## What it is allowed to access
+[List the tools, APIs, and data sources this agent needs]
+
+## What it must never do
+[List explicit prohibitions]
+
+## Compliance notes
+[Any compliance-specific context]
+"""
+    (output / "policy-intent.md").write_text(intent_template)
+
+
+def _interactive_wizard(output_dir: Optional[Path]) -> None:
+    console.print(Panel("[bold]IRIS Agent Declaration[/bold]", style="blue"))
+
+    name = click.prompt("What is this agent's name?", type=str).strip()
+    description = click.prompt("What does this agent do? (plain English)", type=str).strip()
+    owner = click.prompt("Who owns it? (email)", type=str).strip()
+    team = click.prompt("Which team?", type=str).strip()
+    high_risk = click.confirm("Does it make consequential decisions?", default=False)
+
+    console.print("What data does it access?")
+    console.print("  1. None  2. Internal only  3. PII  4. PHI  5. Financial")
+    data_choice = click.prompt("Choice", type=click.IntRange(1, 5), default=2)
+    data_keys = ["none", "internal", "pii", "phi", "financial"]
+    data_key = data_keys[data_choice - 1]
+
+    output = output_dir or (Path.cwd() / "governance" / "agents" / name)
+    compliance_list = ["colorado-ai-act"]
+
+    if not click.confirm(f"Write agent files to {output}?", default=True):
+        console.print("[yellow]Cancelled.[/yellow]")
+        return
+
+    _write_agent_files(
+        name=name,
+        owner=owner,
+        team=team,
+        env=("dev",),
+        high_risk=high_risk,
+        compliance_list=compliance_list,
+        output=output,
+        description=description,
+    )
+
+    console.print("\n[bold]Recommended compliance tags:[/bold]")
+    _run_framework_suggest(name)
+
+    console.print(Panel(
+        f"[bold green]✓ Agent declared[/bold green]\n\n"
+        f"Name: [cyan]{name}[/cyan]\n"
+        f"Data: {_DATA_CLASSIFICATIONS.get(data_key, 'internal')}\n"
+        f"Passport: {output / 'passport.yaml'}\n\n"
+        f"Next: Edit [bold]{output / 'policy-intent.md'}[/bold]\n"
+        f"Then:  [bold]iris compile --agent {name}[/bold]",
+        style="green",
+    ))
+
+
+@click.command("declare")
+@click.option("--name", default=None, help="Agent identifier (kebab-case)")
+@click.option("--owner", default=None, help="Owner email address")
+@click.option("--team", default=None, help="Team or squad name")
+@click.option("--env", multiple=True, default=None, help="Environments (repeatable)")
+@click.option("--high-risk", is_flag=True, default=False, help="Flag as high-risk AI")
+@click.option("--compliance", "-c", multiple=True, help="Compliance frameworks to tag")
+@click.option("--dir", "output_dir", type=click.Path(path_type=Path), default=None)
+def declare(
+    name: Optional[str],
+    owner: Optional[str],
+    team: Optional[str],
+    env: Optional[tuple[str, ...]],
+    high_risk: bool,
+    compliance: tuple[str, ...],
+    output_dir: Optional[Path],
+) -> None:
+    """
+    Declare what an agent is allowed to do — creates passport.yaml and intent template.
+
+    Run without flags for the interactive declaration wizard.
+
+    Example:
+      iris declare
+      iris declare --name payment-agent --owner alice@co.com --team platform
+    """
+    if name is None and owner is None and team is None:
+        _interactive_wizard(output_dir)
+        return
+
+    resolved_name = name or click.prompt("Agent name")
+    resolved_owner = owner or click.prompt("Owner email")
+    resolved_team = team or click.prompt("Team name")
+    compliance_list = list(compliance) or ["colorado-ai-act"]
+    env_list = tuple(env) if env else ("dev",)
+    output = output_dir or (Path.cwd() / "governance" / "agents" / resolved_name)
+
+    _write_agent_files(
+        name=resolved_name,
+        owner=resolved_owner,
+        team=resolved_team,
+        env=env_list,
+        high_risk=high_risk,
+        compliance_list=compliance_list,
+        output=output,
+    )
+
+    console.print(Panel(
+        f"[bold green]✓ Agent declared[/bold green]\n\n"
+        f"Name: [cyan]{resolved_name}[/cyan]\n"
+        f"Passport: {output / 'passport.yaml'}\n"
+        f"Intent template: {output / 'policy-intent.md'}\n\n"
+        f"Next step: Edit [bold]{output / 'policy-intent.md'}[/bold]\n"
+        f"Then run:  [bold]iris compile --agent {resolved_name}[/bold]",
+        style="green",
+    ))