iris-security-cli 0.1.7__tar.gz → 0.2.0__tar.gz

{iris_security_cli-0.1.7 → iris_security_cli-0.2.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.1.7
-Summary: IRIS CLI — iris scan, iris register, iris policy, iris compliance
+Version: 0.2.0
+Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
 Project-URL: Repository, https://github.com/gimartinb/iris-sdk
@@ -15,13 +15,13 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.6
-Requires-Dist: iris-security-sdk>=0.1.7
+Requires-Dist: iris-security-core>=0.1.8
+Requires-Dist: iris-security-sdk>=0.2.0
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: scm
-Requires-Dist: iris-security-scm[all]>=0.1.0; extra == "scm"
+Requires-Dist: iris-security-scm[all]>=0.1.1; extra == "scm"
 
 # iris-security-cli
 

iris_security_cli-0.2.0/iris_cli/certify.py

@@ -0,0 +1,154 @@
+"""iris certify — prove compliance readiness to any regulatory framework."""
+
+from __future__ import annotations
+
+from datetime import datetime
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+
+from iris_core.entitlements import Entitlements, Feature
+from iris_core.models.passport import AgentPassport
+
+from iris_cli.framework_test import (
+    _build_result,
+    _framework_name,
+    _load_previous_score,
+    _render_json,
+    _render_markdown,
+    _render_table,
+    _save_result,
+)
+
+console = Console()
+
+
+def _render_certification_header(
+    framework: str,
+    agent_name: str,
+    result,
+) -> None:
+    framework_label = _framework_name(framework)
+    if framework == "colorado-ai-act":
+        framework_label = "Colorado AI Act (SB 26-189)"
+
+    console.print(Panel(
+        f"Agent:      {agent_name}\n"
+        f"Framework:  {framework_label}\n"
+        f"Generated:  {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}\n"
+        f"Attested:   IRIS · Commit: local",
+        title=f"IRIS Certification — {framework}",
+        style="blue",
+    ))
+
+    evaluated = result.passed_controls + result.failed_controls + result.partial_controls
+    pct = result.score_percent
+    filled = int((pct / 100) * 20)
+    bar = "█" * filled + "░" * (20 - filled)
+    readiness = "READY" if pct >= 95 else result.readiness_level
+
+    console.print(f"\n[bold]CERTIFICATION RESULT: {readiness}[/bold]")
+    console.print(f"{bar}  {result.passed_controls} / {result.total_controls} controls  {pct}%")
+
+    if framework == "colorado-ai-act" and pct >= 95:
+        console.print(
+            f"\nThis agent is certification-ready for Colorado AI Act (SB 26-189).\n"
+            f"Effective date: January 1, 2027\n\n"
+            f"Evidence package: iris evidence report --agent {agent_name}\n"
+            f"Auditor note: Present this output alongside the Evidence Vault report "
+            f"to demonstrate compliance readiness."
+        )
+
+
+@click.command("certify")
+@click.option(
+    "--framework",
+    required=True,
+    type=click.Choice(sorted(["colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr"])),
+)
+@click.option("--agent", "agent_name", required=True, help="Agent name under governance/agents")
+@click.option("--format", "output_format", default="table", type=click.Choice(["table", "json", "markdown"]))
+def certify_cmd(framework: str, agent_name: str, output_format: str) -> None:
+    """
+    Certify compliance readiness against a regulatory framework.
+
+    Alias: iris test
+    """
+    passport_path = Path.cwd() / "governance" / "agents" / agent_name / "passport.yaml"
+    if not passport_path.exists():
+        raise click.ClickException(f"Passport not found: {passport_path}")
+    passport = AgentPassport.from_yaml(passport_path.read_text())
+
+    ents = Entitlements()
+    has_pro = ents.has(Feature.CLI_TEST_FULL_REPORT)
+
+    result = _build_result(framework, agent_name, passport)
+    previous = _load_previous_score(agent_name, framework)
+    if previous is not None and has_pro:
+        result.progress_delta_percent = result.score_percent - previous
+
+    _save_result(result)
+
+    if output_format == "json":
+        click.echo(_render_json(result, has_pro))
+    elif output_format == "markdown":
+        click.echo(_render_markdown(result, has_pro))
+    else:
+        _render_certification_header(framework, agent_name, result)
+        _render_table(result, has_pro)
+        _render_response_configuration(framework, passport)
+
+
+def _render_response_configuration(framework: str, passport: AgentPassport) -> None:
+    from iris_core.compliance.framework_check import load_bundle_data
+    from iris_core.compliance.violation_response import (
+        get_effective_response,
+        rule_response_label,
+        ViolationResponse,
+    )
+
+    try:
+        bundle = load_bundle_data(framework)
+    except ValueError:
+        return
+    rules = bundle.get("rules", [])
+    if not rules:
+        return
+
+    console.print("\n[bold]RESPONSE CONFIGURATION[/bold]")
+    console.print("─" * 65)
+    overrides = passport.compliance_response_overrides or {}
+    for rule in rules:
+        rule_id = rule.get("rule_id", "")
+        default = rule.get("violation_response", "inform").upper()
+        effective = rule_response_label(rule, overrides)
+        line = f"{rule_id:<12} {effective:<8}"
+        if rule.get("violation_response"):
+            base = ViolationResponse(rule["violation_response"])
+            if base == ViolationResponse.BLOCK:
+                line += " (unconditional — cannot be overridden)"
+            elif effective != default:
+                line += f" (override active)"
+            else:
+                line += " (default)"
+        console.print(line)
+
+    if overrides:
+        console.print("\n[dim]Active overrides in passport.yaml:[/dim]")
+        for rule_id, cfg in overrides.items():
+            console.print(f"  {rule_id}: {cfg.get('response', 'inform')} — {cfg.get('reason', '')}")
+    else:
+        console.print(
+            "\n[dim]Override example (add to passport.yaml if needed):[/dim]\n"
+            "  compliance_response_overrides:\n"
+            "    CO-003:\n"
+            "      response: inform\n"
+            "      reason: Pre-production — not serving CO consumers yet"
+        )
+
+
+# Legacy alias: iris test → iris certify
+test = certify_cmd

iris_security_cli-0.2.0/iris_cli/compliance_check_cmd.py

@@ -0,0 +1,193 @@
+"""iris compliance check — framework compliance with Pro preview."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Optional
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+from iris import AgentPassport
+from iris_core.compliance.framework_check import run_framework_check
+from iris_core.compliance.results import ComplianceCheckStatus
+from iris_core.entitlements.display import build_pro_preview_box
+
+from iris_cli.compliance_fix import offer_remediation, recheck_after_fixes
+from iris_core.compliance.remediation import collect_fixable_issues
+
+console = Console()
+
+
+def _discover_passports(
+    gov_dir: Path,
+    agent: Optional[str],
+) -> list[AgentPassport]:
+    passports: list[AgentPassport] = []
+    if agent:
+        passport_file = gov_dir / agent / "passport.yaml"
+        if passport_file.exists():
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        return passports
+
+    for passport_file in gov_dir.rglob("passport.yaml"):
+        try:
+            passports.append(AgentPassport.from_yaml(passport_file.read_text()))
+        except Exception:
+            continue
+    return passports
+
+
+def _render_result(
+    passport: AgentPassport,
+    framework: str,
+    result,
+) -> bool:
+    """Print one agent's check result. Returns False if failures were found."""
+    if result.preview_only:
+        preview_lines = [
+            f"{rule.rule_id}  {rule.severity}  {rule.name}  [{rule.status}]"
+            for rule in result.rule_results
+        ]
+        console.print(
+            build_pro_preview_box(
+                framework,
+                result.framework_name,
+                result.total_controls,
+                preview_lines,
+            )
+        )
+        return False
+
+    has_failures = any(rule.status == "FAIL" for rule in result.rule_results) or bool(
+        result.violations
+    )
+    status = "[bold green]PASS[/bold green]" if not has_failures else "[bold red]FAIL[/bold red]"
+    console.print(f"\nAgent: [cyan]{passport.name}[/cyan] — {status}")
+
+    if result.rule_results:
+        table = Table(title=f"{result.framework_name}", show_header=True, header_style="bold")
+        table.add_column("Rule", style="cyan")
+        table.add_column("Severity")
+        table.add_column("Status")
+        table.add_column("Response")
+        table.add_column("Notes")
+        for rule in result.rule_results:
+            status_icon = "[green]✓ PASS[/green]" if rule.status == "PASS" else "[red]✗ FAIL[/red]"
+            notes = rule.message if rule.status == "FAIL" else ""
+            table.add_row(
+                rule.rule_id,
+                rule.severity,
+                status_icon,
+                rule.response,
+                notes[:80] + ("..." if len(notes) > 80 else ""),
+            )
+        console.print(table)
+        console.print(
+            "\n[dim]RESPONSE KEY: INFORM — log and proceed | "
+            "HITL — human review required | BLOCK — unconditional block[/dim]"
+        )
+
+    if result.violations:
+        for violation in result.violations:
+            if any(r.rule_id == violation.rule_id for r in result.rule_results):
+                continue
+            console.print(f"  [red]✗[/red] [{violation.rule_id}] {violation.message}")
+            if violation.remediation:
+                console.print(f"     [yellow]→[/yellow] {violation.remediation}")
+
+    if not result.violations and not any(r.status == "FAIL" for r in result.rule_results):
+        console.print(f"  [green]✓[/green] All {framework} rules satisfied")
+
+    for guidance in result.guidance:
+        if guidance.status == ComplianceCheckStatus.GUIDANCE:
+            console.print(f"  [blue]ℹ[/blue] [{guidance.rule_id}] {guidance.message}")
+            if guidance.remediation:
+                console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+        elif guidance.status == ComplianceCheckStatus.PRO_REQUIRED:
+            console.print(f"  [yellow]⚠[/yellow] [{guidance.rule_id}] {guidance.message}")
+            if guidance.remediation:
+                console.print(f"     [yellow]→[/yellow] {guidance.remediation}")
+
+    for note in result.check_notes:
+        console.print(f"  [dim]ℹ {note}[/dim]")
+
+    return not has_failures
+
+
+@click.command("check")
+@click.option("--agent", default=None, help="Specific agent to check (or all)")
+@click.option("--framework", "-f", default="colorado-ai-act")
+@click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
+@click.option(
+    "--fix",
+    is_flag=True,
+    help="Apply all auto-fixable remediations without per-issue prompts",
+)
+@click.option(
+    "--yes",
+    "-y",
+    is_flag=True,
+    help="Apply auto-fixes without confirmation (use with --fix)",
+)
+@click.option(
+    "--no-fix",
+    is_flag=True,
+    help="Show remediations only — never offer to apply fixes",
+)
+def compliance_check_cmd(
+    agent: Optional[str],
+    framework: str,
+    governance_dir: Optional[Path],
+    fix: bool,
+    yes: bool,
+    no_fix: bool,
+) -> None:
+    """
+    Check an agent against a compliance framework.
+
+    Shows a detailed breakdown of which rules pass and fail,
+    with plain-English remediation guidance for each failure.
+    When run interactively, IRIS offers to apply safe fixes automatically.
+
+    Example:
+      iris compliance check --framework colorado-ai-act
+      iris compliance check --agent payment-agent --framework hipaa
+      iris compliance check --agent payment-agent --framework hipaa --fix -y
+    """
+    gov_dir = governance_dir or Path.cwd() / "governance" / "agents"
+    passports = _discover_passports(gov_dir, agent)
+    if not passports:
+        console.print("[yellow]No agent passports found.[/yellow]")
+        sys.exit(0)
+
+    all_pass = True
+    offer_fixes = bool(agent) or len(passports) == 1
+    for passport in passports:
+        result = run_framework_check(passport, framework)
+        agent_passed = _render_result(passport, framework, result)
+        if not agent_passed:
+            all_pass = False
+
+        if offer_fixes:
+            applied = offer_remediation(
+                passport,
+                framework,
+                result,
+                gov_dir,
+                auto_fix=fix,
+                yes=yes,
+                no_fix=no_fix,
+            )
+            recheck_after_fixes(passport, framework, gov_dir, applied)
+        elif not no_fix and not agent_passed and collect_fixable_issues(
+            passport, framework, result
+        ):
+            console.print(
+                f"[dim]Fixable issues for {passport.name}. "
+                f"Re-run with --agent {passport.name} to let IRIS apply fixes.[/dim]"
+            )
+
+    sys.exit(0 if all_pass else 1)

iris_security_cli-0.2.0/iris_cli/compliance_fix.py

@@ -0,0 +1,202 @@
+"""Interactive compliance remediation — IRIS governance assistant."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import List, Optional
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+
+from iris import AgentPassport
+from iris_core.compliance.framework_check import FrameworkCheckResult, run_framework_check
+from iris_core.compliance.remediation import (
+    FixResult,
+    FixableIssue,
+    apply_fix,
+    collect_fixable_issues,
+)
+
+console = Console()
+
+
+def _is_interactive() -> bool:
+    return click.get_text_stream("stdin").isatty()
+
+
+def _print_fixable_summary(agent_name: str, issues: List[FixableIssue]) -> None:
+    lines = [
+        f"[bold]IRIS found {len(issues)} fixable issue"
+        f"{'s' if len(issues) != 1 else ''} for [cyan]{agent_name}[/cyan][/bold]\n"
+    ]
+    for issue in issues:
+        lines.append(f"  [yellow]•[/yellow] [{issue.rule_id}] {issue.preview}")
+    lines.append(
+        "\n[dim]IRIS can apply safe passport and policy updates automatically. "
+        "Review each change before applying.[/dim]"
+    )
+    console.print(Panel("\n".join(lines), title="IRIS Governance Assistant", style="blue"))
+
+
+def offer_remediation(
+    passport: AgentPassport,
+    framework: str,
+    result: FrameworkCheckResult,
+    governance_dir: Path,
+    *,
+    auto_fix: bool = False,
+    yes: bool = False,
+    no_fix: bool = False,
+) -> List[FixResult]:
+    """
+    Offer to apply fixable remediations after a compliance check.
+
+  Returns applied fix results (may be empty).
+    """
+    if no_fix or result.preview_only:
+        return []
+
+    issues = collect_fixable_issues(passport, framework, result)
+    if not issues:
+        return []
+
+    agent_dir = governance_dir / passport.name
+    passport_file = agent_dir / "passport.yaml"
+
+    if auto_fix or yes:
+        return _apply_all(issues, passport_file, framework, passport.name)
+
+    if not _is_interactive():
+        console.print(
+            "[dim]Fixable issues detected. Re-run with --fix to apply automatically.[/dim]"
+        )
+        return []
+
+    _print_fixable_summary(passport.name, issues)
+    if not click.confirm(
+        f"\nWould you like IRIS to fix these {len(issues)} issue"
+        f"{'s' if len(issues) != 1 else ''} for {passport.name}?",
+        default=True,
+    ):
+        console.print("[dim]Skipped automatic fixes. Apply remediations manually when ready.[/dim]")
+        return []
+
+    return _apply_interactive(issues, passport_file, framework, passport.name)
+
+
+def _apply_all(
+    issues: List[FixableIssue],
+    passport_file: Path,
+    framework: str,
+    agent_name: str,
+) -> List[FixResult]:
+    results: List[FixResult] = []
+    for issue in issues:
+        result = apply_fix(issue, passport_file, framework)
+        results.append(result)
+        _print_fix_result(agent_name, issue, result)
+    if results:
+        console.print(
+            Panel(
+                f"[bold green]✓ IRIS applied {sum(1 for r in results if r.applied)} fix"
+                f"{'es' if sum(1 for r in results if r.applied) != 1 else ''}[/bold green]\n\n"
+                f"Re-run: [bold]iris compliance check --agent {agent_name} "
+                f"--framework {framework}[/bold]",
+                style="green",
+            )
+        )
+    return results
+
+
+def _apply_interactive(
+    issues: List[FixableIssue],
+    passport_file: Path,
+    framework: str,
+    agent_name: str,
+) -> List[FixResult]:
+    results: List[FixResult] = []
+    apply_all = False
+
+    for issue in issues:
+        if apply_all:
+            result = apply_fix(issue, passport_file, framework)
+            results.append(result)
+            _print_fix_result(agent_name, issue, result)
+            continue
+
+        console.print(
+            f"\n[bold]IRIS can fix[/bold] [{issue.rule_id}] {issue.preview}\n"
+            f"[dim]{issue.message}[/dim]"
+        )
+        console.print("Apply this fix? ([yes]/no/skip/all)")
+        choice = click.prompt("", default="no", show_default=False).strip().lower()
+
+        if choice in ("yes", "y"):
+            result = apply_fix(issue, passport_file, framework)
+            results.append(result)
+            _print_fix_result(agent_name, issue, result)
+        elif choice == "all":
+            apply_all = True
+            result = apply_fix(issue, passport_file, framework)
+            results.append(result)
+            _print_fix_result(agent_name, issue, result)
+        elif choice == "skip":
+            console.print("[dim]Skipped.[/dim]")
+        else:
+            console.print("[dim]Not applied — fix manually when ready.[/dim]")
+
+    applied_count = sum(1 for r in results if r.applied)
+    if applied_count:
+        console.print(
+            Panel(
+                f"[bold green]✓ IRIS applied {applied_count} fix"
+                f"{'es' if applied_count != 1 else ''}[/bold green]\n\n"
+                f"Re-run: [bold]iris compliance check --agent {agent_name} "
+                f"--framework {framework}[/bold]",
+                style="green",
+            )
+        )
+    return results
+
+
+def _print_fix_result(agent_name: str, issue: FixableIssue, result: FixResult) -> None:
+    if result.applied:
+        change_text = "\n".join(f"  [dim]• {change}[/dim]" for change in result.changes)
+        console.print(f"[green]✓ Applied[/green] [{issue.rule_id}]\n{change_text}")
+        return
+    if result.skipped_reason:
+        console.print(
+            f"[yellow]⚠ Skipped[/yellow] [{issue.rule_id}]: {result.skipped_reason}"
+        )
+
+
+def recheck_after_fixes(
+    passport: AgentPassport,
+    framework: str,
+    governance_dir: Path,
+    applied: List[FixResult],
+) -> Optional[FrameworkCheckResult]:
+    """Re-run check and show delta when fixes were applied."""
+    if not any(result.applied for result in applied):
+        return None
+
+    passport_file = governance_dir / passport.name / "passport.yaml"
+    if not passport_file.exists():
+        return None
+
+    updated = AgentPassport.from_yaml(passport_file.read_text())
+    result = run_framework_check(updated, framework)
+    remaining = collect_fixable_issues(updated, framework, result)
+    fail_count = sum(1 for rule in result.rule_results if rule.status == "FAIL")
+    fail_count += len(result.violations)
+
+    console.print(
+        Panel(
+            f"[bold]Re-check: {updated.name}[/bold]\n"
+            f"Remaining failures: {fail_count}\n"
+            f"Auto-fixable remaining: {len(remaining)}",
+            style="cyan",
+        )
+    )
+    return result