iris-security-cli 0.2.0__py3-none-any.whl → 0.2.4__py3-none-any.whl

iris_cli/certify.py

@@ -10,6 +10,7 @@ import click
 from rich.console import Console
 from rich.panel import Panel
 
+from iris_core.compliance.dynamic_loader import ComplianceRule, DynamicBundleLoader
 from iris_core.entitlements import Entitlements, Feature
 from iris_core.models.passport import AgentPassport
 
@@ -26,20 +27,60 @@ from iris_cli.framework_test import (
 console = Console()
 
 
+def _evaluate_custom_rule(rule: ComplianceRule, passport: AgentPassport) -> str:
+    safe_globals = {"__builtins__": {}}
+    safe_locals = {
+        "passport": passport,
+        "hitl_config": getattr(passport, "hitl_config", None),
+        "cost_config": getattr(passport, "cost_config", None),
+        "bool": bool,
+        "len": len,
+    }
+    try:
+        value = eval(rule.check_expression, safe_globals, safe_locals)
+    except Exception:
+        return "FAIL"
+    return "PASS" if value else "FAIL"
+
+
+def _rule_source_label(loader: DynamicBundleLoader) -> str:
+    info = loader.registry_info()
+    if info.source == "live":
+        return "Live registry"
+    if info.source == "cache":
+        hours = info.cache_age_hours
+        if hours is not None and hours < 1:
+            return "Live registry (updated recently)"
+        if hours is not None:
+            return f"Live registry (updated {int(hours)} hours ago)"
+        return "Cached registry"
+    return "Bundled fallback"
+
+
 def _render_certification_header(
     framework: str,
     agent_name: str,
     result,
+    *,
+    loader: DynamicBundleLoader,
+    custom_rule_count: int,
 ) -> None:
+    bundle = loader.load_bundle(framework)
+    info = loader.registry_info()
     framework_label = _framework_name(framework)
     if framework == "colorado-ai-act":
         framework_label = "Colorado AI Act (SB 26-189)"
 
+    version = bundle.metadata.get("current_version", info.registry_version)
+    law_name = bundle.metadata.get("law_name", framework_label)
+
     console.print(Panel(
-        f"Agent:      {agent_name}\n"
-        f"Framework:  {framework_label}\n"
-        f"Generated:  {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}\n"
-        f"Attested:   IRIS · Commit: local",
+        f"Agent:        {agent_name}\n"
+        f"Framework:    {law_name} v{version}\n"
+        f"Rule source:  {_rule_source_label(loader)}\n"
+        f"Custom rules: {custom_rule_count} organization rule{'s' if custom_rule_count != 1 else ''} evaluated\n"
+        f"Generated:    {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}\n"
+        f"Attested:     IRIS · Commit: local",
         title=f"IRIS Certification — {framework}",
         style="blue",
     ))
@@ -63,25 +104,72 @@ def _render_certification_header(
         )
 
 
+def _render_custom_rules_section(
+    custom_rules: list[ComplianceRule],
+    passport: AgentPassport,
+) -> None:
+    if not custom_rules:
+        return
+    console.print("\n[bold]ORGANIZATION POLICY[/bold]")
+    console.print("─" * 65)
+    for rule in custom_rules:
+        status = _evaluate_custom_rule(rule, passport)
+        icon = "[green]✓[/green]" if status == "PASS" else "[red]✗[/red]"
+        console.print(f"{icon} {rule.rule_id:<14} {rule.name}")
+        if status != "PASS" and rule.remediation_command:
+            console.print(f"   Fix: {rule.remediation_command}")
+
+
 @click.command("certify")
 @click.option(
     "--framework",
     required=True,
-    type=click.Choice(sorted(["colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr"])),
+    type=click.Choice(sorted([
+        "colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr",
+        "nyc-ll144", "illinois-ai-video", "eu-ai-act", "ccpa-admt", "china-pipl",
+    ])),
 )
 @click.option("--agent", "agent_name", required=True, help="Agent name under governance/agents")
 @click.option("--format", "output_format", default="table", type=click.Choice(["table", "json", "markdown"]))
-def certify_cmd(framework: str, agent_name: str, output_format: str) -> None:
+@click.option(
+    "--registry-version",
+    default=None,
+    help="Pin to a specific registry version for reproducible certifications",
+)
+@click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
+@click.option("--offline", is_flag=True, help="Use bundled registry only (no network refresh)")
+def certify_cmd(
+    framework: str,
+    agent_name: str,
+    output_format: str,
+    registry_version: Optional[str],
+    governance_dir: Optional[Path],
+    offline: bool,
+) -> None:
     """
     Certify compliance readiness against a regulatory framework.
 
     Alias: iris test
     """
-    passport_path = Path.cwd() / "governance" / "agents" / agent_name / "passport.yaml"
+    gov_dir = governance_dir or Path.cwd() / "governance"
+    passport_path = gov_dir / "agents" / agent_name / "passport.yaml"
     if not passport_path.exists():
         raise click.ClickException(f"Passport not found: {passport_path}")
     passport = AgentPassport.from_yaml(passport_path.read_text())
 
+    loader = DynamicBundleLoader(pinned_version=registry_version)
+
+    if not offline and not registry_version:
+        if not loader.is_cache_fresh():
+            console.print("[dim]Checking for regulatory updates...[/dim]")
+            updated = loader.refresh_registry()
+            if updated:
+                console.print("[green]✓ Regulatory intelligence updated[/green]")
+                console.print("[dim]  Run: iris regulatory check for change summary[/dim]")
+
+    custom_rules = loader.load_custom_rules(gov_dir)
+    loader.get_effective_rules(framework, gov_dir)
+
     ents = Entitlements()
     has_pro = ents.has(Feature.CLI_TEST_FULL_REPORT)
 
@@ -97,13 +185,22 @@ def certify_cmd(framework: str, agent_name: str, output_format: str) -> None:
     elif output_format == "markdown":
         click.echo(_render_markdown(result, has_pro))
     else:
-        _render_certification_header(framework, agent_name, result)
+        _render_certification_header(
+            framework, agent_name, result,
+            loader=loader,
+            custom_rule_count=len(custom_rules),
+        )
         _render_table(result, has_pro)
-        _render_response_configuration(framework, passport)
+        _render_custom_rules_section(custom_rules, passport)
+        _render_response_configuration(framework, passport, loader=loader)
 
 
-def _render_response_configuration(framework: str, passport: AgentPassport) -> None:
-    from iris_core.compliance.framework_check import load_bundle_data
+def _render_response_configuration(
+    framework: str,
+    passport: AgentPassport,
+    *,
+    loader: Optional[DynamicBundleLoader] = None,
+) -> None:
     from iris_core.compliance.violation_response import (
         get_effective_response,
         rule_response_label,
@@ -111,7 +208,11 @@ def _render_response_configuration(framework: str, passport: AgentPassport) -> N
     )
 
     try:
-        bundle = load_bundle_data(framework)
+        if loader:
+            bundle = loader.load_bundle(framework).to_dict()
+        else:
+            from iris_core.compliance.framework_check import load_bundle_data
+            bundle = load_bundle_data(framework)
     except ValueError:
         return
     rules = bundle.get("rules", [])
@@ -131,7 +232,7 @@ def _render_response_configuration(framework: str, passport: AgentPassport) -> N
             if base == ViolationResponse.BLOCK:
                 line += " (unconditional — cannot be overridden)"
             elif effective != default:
-                line += f" (override active)"
+                line += " (override active)"
             else:
                 line += " (default)"
         console.print(line)

iris_cli/framework_suggest.py

@@ -44,6 +44,25 @@ CONVERSATIONAL_KEYWORDS = (
     "chat bot",
 )
 
+EMPLOYMENT_KEYWORDS = (
+    "hiring",
+    "recruiting",
+    "recruitment",
+    "hr",
+    "ats",
+    "screening",
+    "employment",
+    "interview",
+    "resume",
+    "candidate",
+)
+
+VIDEO_KEYWORDS = (
+    "video",
+    "interview",
+    "biometric",
+)
+
 Q1_CHOICES = [
     "Makes decisions that affect individual people (hiring, loans, medical, etc.)",
     "Automates business processes (summarization, classification, routing)",
@@ -267,6 +286,48 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     soc2 = q2 == Q2_CHOICES[5] or "SOC 2 (SaaS / enterprise)" in q7
     gdpr = "Outside the US" in q8 or "Other / multiple states" in q8
 
+    ccpa_admt = (
+        "California" in q8
+        and q5
+        and (
+            q1 == Q1_CHOICES[0]
+            or q2 in {Q2_CHOICES[2], Q2_CHOICES[3]}
+        )
+    )
+    china_pipl = (
+        "Outside the US" in q8
+        or "china" in agent_description
+        or "asia" in agent_description
+        or (q2 == Q2_CHOICES[4] and "Outside the US" in q8)
+    )
+
+    employment_domain = (
+        q1 == Q1_CHOICES[0]
+        or any(kw in q1.lower() for kw in EMPLOYMENT_KEYWORDS)
+        or any(kw in agent_description for kw in EMPLOYMENT_KEYWORDS)
+        or q2 in {Q2_CHOICES[4], Q2_CHOICES[6]}
+    )
+    illinois_video = (
+        employment_domain
+        and (
+            "Illinois" in q8
+            or "Other / multiple states" in q8
+        )
+        and (
+            any(kw in agent_description for kw in VIDEO_KEYWORDS)
+            or q4 == Q4_CHOICES[3]
+            or "video" in q1.lower()
+            or "interview" in q1.lower()
+        )
+    )
+    nyc_ll144 = (
+        employment_domain
+        and (
+            "New York" in q8
+            or "Other / multiple states" in q8
+        )
+    )
+
     colorado_reason = (
         "Your agent makes consequential decisions for Colorado users. "
         "SB 26-189 applies (replaces SB 24-205, effective Jan. 1, 2027). "
@@ -378,6 +439,62 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
             ),
             command="iris test --framework gdpr" if gdpr else None,
         ),
+        Recommendation(
+            framework="ccpa-admt",
+            tier="PRO",
+            status="REQUIRED" if ccpa_admt else "NOT APPLICABLE",
+            reason=(
+                "California ADMT regulations (effective Jan. 1, 2026) apply to "
+                "automated decisions affecting California consumers in employment, "
+                "credit, healthcare, housing, or education."
+                if ccpa_admt
+                else "No California ADMT scope detected."
+            ),
+            command="iris compliance check --framework ccpa-admt" if ccpa_admt else None,
+        ),
+        Recommendation(
+            framework="china-pipl",
+            tier="PRO",
+            status="REQUIRED" if china_pipl else "NOT APPLICABLE",
+            reason=(
+                "China PIPL applies when processing personal information of "
+                "individuals located in China, including automated decision-making "
+                "and cross-border transfer restrictions."
+                if china_pipl
+                else "No China or Asia-Pacific user footprint detected."
+            ),
+            command="iris compliance check --framework china-pipl" if china_pipl else None,
+        ),
+        Recommendation(
+            framework="illinois-ai-video",
+            tier="PRO",
+            status="REQUIRED" if illinois_video else "NOT APPLICABLE",
+            reason=(
+                "Illinois AI Video Interview Act applies to AI analysis of video "
+                "interviews for Illinois-based positions. Consent must be logged "
+                "before any video analysis (820 ILCS 42)."
+                if illinois_video
+                else "No Illinois video interview AI scope detected."
+            ),
+            command=(
+                "iris compliance check --framework illinois-ai-video"
+                if illinois_video
+                else None
+            ),
+        ),
+        Recommendation(
+            framework="nyc-ll144",
+            tier="PRO",
+            status="REQUIRED" if nyc_ll144 else "NOT APPLICABLE",
+            reason=(
+                "NYC Local Law 144 requires annual independent bias audits, public "
+                "disclosure, and candidate notice before using Automated Employment "
+                "Decision Tools (AEDTs) for NYC hiring."
+                if nyc_ll144
+                else "No NYC AEDT hiring scope detected."
+            ),
+            command="iris compliance check --framework nyc-ll144" if nyc_ll144 else None,
+        ),
     ]
     return recommendations
 

iris_cli/main.py

@@ -24,7 +24,7 @@ console = Console()
 
 
 @click.group()
-@click.version_option(version="0.2.0", prog_name="iris")
+@click.version_option(version="0.2.4", prog_name="iris")
 def cli():
     """
     IRIS — Policy as Code for AI Agents

iris_cli/regulatory.py

@@ -50,6 +50,41 @@ def _format_effective_date(iso_date: str) -> str:
         return iso_date
 
 
+def _render_rule_changes(bundle_id: str, old_version: str, new_version: str) -> None:
+    """Show rule-level changes when registry versions differ."""
+    import json
+
+    from iris_core.compliance.dynamic_loader import DynamicBundleLoader, _bundled_registry_path
+
+    loader = DynamicBundleLoader()
+    cache_path = Path.home() / ".iris" / "registry-cache.json"
+    bundled = _bundled_registry_path()
+
+    old_registry: dict = {}
+    if cache_path.exists():
+        try:
+            old_registry = json.loads(cache_path.read_text())
+        except Exception:
+            pass
+    elif bundled.exists():
+        old_registry = json.loads(bundled.read_text())
+
+    if not bundled.exists():
+        return
+    new_registry = json.loads(bundled.read_text())
+    changes = loader.diff_rules(bundle_id, old_registry, new_registry)
+    if not changes:
+        return
+
+    console.print(f"\n   [bold]REGULATORY UPDATE — {bundle_id} v{old_version} → v{new_version}[/bold]")
+    console.print("   [bold]RULE CHANGES:[/bold]")
+    for change in changes[:10]:
+        console.print(f"   ● {change}")
+    console.print(
+        "\n   Run: [bold]iris certify --agent <name>[/bold] to see updated status"
+    )
+
+
 def _render_check_output(
     tracker: RegulatoryTracker,
     updates: list,
@@ -101,6 +136,7 @@ def _render_check_output(
                 console.print(
                     f"Effective: {_format_effective_date(update.effective_date)}"
                 )
+                _render_rule_changes(update.bundle_id, update.current_installed_version, update.available_version)
                 console.print("   Action required:")
                 console.print(
                     "   1. Run: [bold]pip install --upgrade iris-security-sdk[/bold]"

{iris_security_cli-0.2.0.dist-info → iris_security_cli-0.2.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.0
+Version: 0.2.4
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,13 +15,13 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.8
-Requires-Dist: iris-security-sdk>=0.2.0
+Requires-Dist: iris-security-core>=0.1.11
+Requires-Dist: iris-security-sdk>=0.2.4
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: scm
-Requires-Dist: iris-security-scm[all]>=0.1.1; extra == "scm"
+Requires-Dist: iris-security-scm[all]>=0.2.0; extra == "scm"
 
 # iris-security-cli
 

{iris_security_cli-0.2.0.dist-info → iris_security_cli-0.2.4.dist-info}/RECORD

@@ -2,7 +2,7 @@ iris_cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 iris_cli/action_plan.py,sha256=qSI9ZusJcfZKDXMeQhUJgTECwS4CP1dvXeuogWBpUlQ,11147
 iris_cli/assess.py,sha256=ZXcjRr7FT4vPLe_xC76c4WHQGbPzLDzeP0RAh3P9j20,19182
 iris_cli/cedar_parser.py,sha256=3V1t-L3cSBCAMDmCkzcoBDA6S4ulg5LKpWDN2fU_jbM,15161
-iris_cli/certify.py,sha256=lW49-UIBKp-uIcQchR7imWLPn-8iO88WfVql12xk76o,5433
+iris_cli/certify.py,sha256=aVUXI_TkX-gTs0TaIp9EvhEOYxbDxNC0tiFtdzsYVv4,9069
 iris_cli/compiler_config.py,sha256=9SX2IkkWWc2R5vx_QBd7L4veKfLx2KSk2XzXm53tNS8,2083
 iris_cli/compliance_check_cmd.py,sha256=N8N-01X8eACmoxM7uEyi-whtXKPkDxAgJ75Podpco9A,6803
 iris_cli/compliance_fix.py,sha256=8zs_GR9R7U93KncDcTUBSsyeyk75ExSm-tocgRbCcC4,6545
@@ -15,11 +15,11 @@ iris_cli/enforce.py,sha256=GX0vKT5FQPi8HoBB6PMYiBiIeLHgYg5J8wh6EKZqJuY,5911
 iris_cli/entitlements_cmd.py,sha256=lgwFP-uv3JC6lAT9J9EK3xUd_5rYPp7kjcQfzCCjRDM,426
 iris_cli/evidence.py,sha256=H4uq_o0RAGHkmqLO20D9JNXKYGT6V9uLqvuxxeKm1Iw,29814
 iris_cli/explain.py,sha256=ShtQsTDFm8BntufsLLyleAHI1sjmI0lUFh23OwwYvx0,2708
-iris_cli/framework_suggest.py,sha256=Ez3I_a-SDr4O399WAocm1QV-Fx-0ttcxDPousYAgg5M,19199
+iris_cli/framework_suggest.py,sha256=B9DObZXk10ccf2_KMLIuUN5raqSh7RWTngsBKvKADHk,23090
 iris_cli/framework_test.py,sha256=0WCzuJScXJHO2Gh58Gv0mB0kat2F0_vMMaVOQveyk-M,22200
 iris_cli/hitl.py,sha256=vN_aEsoi7qMTc7ZqgnZvnXm1amZZqxim5zrDHX_GJVQ,11672
 iris_cli/license_cmd.py,sha256=fq5lnxAuyU13VMRDNr-afQA7LoeBKKL9Wem_adOelaY,5649
-iris_cli/main.py,sha256=mxy3zub-oFzNqlAufSVB80Afb3G7qOwnxjm8xGWZlzs,18625
+iris_cli/main.py,sha256=ExpdhEtgjDyjFpScZjU1jZZLBSoztk3CLW7m3Wg0FbA,18625
 iris_cli/mcp_server.py,sha256=Cpwtdy94NzTJqiCrM_4YUdyi-_-Dti_4d-2AXQCor7g,20815
 iris_cli/models_cmd.py,sha256=D44ajAzIg5TodKvWvpcbzegKEDKn-JGLeugeok_FuiU,4767
 iris_cli/policy_cache.py,sha256=cSqbbvSwFfQU3JnD8EWxQ0dW8sOcHYfTEXVpMkre87U,3456
@@ -27,7 +27,7 @@ iris_cli/policy_diff.py,sha256=CymsDBeWJ30WonIzhTtWcA03mcW6v9UA-6VFh1fpByc,15945
 iris_cli/preview.py,sha256=nIeHdK3pFMRe8ydCSS3Kh_Y-NN274td_-NbXQB0O5QU,4238
 iris_cli/quickstart.py,sha256=Vvz6pn78MvR29ykw1Dh5e4tdPjku9RVzhi_X2TOqMPM,13428
 iris_cli/redteam.py,sha256=Ao1V510_y0qYMJXS-xDN62jxldxZDc8Pg7yWopC4GFg,6087
-iris_cli/regulatory.py,sha256=iCN7WYiiumi1ARht96mGIaTv-LkLaCBSWGRz7uRK9DQ,12111
+iris_cli/regulatory.py,sha256=uk5xyELgwFB8WMqn8hXGReRJbImGNsIGzZWbWMGcDT0,13431
 iris_cli/scan_govern.py,sha256=YPfWwcj0kgVFI4s9mMllKMYzSmjQjkkTOMbJB069BYQ,11466
 iris_cli/scan_report.py,sha256=myYuvF6rfUxJFDHWi-iErB17-QbHbfwzUleXt6MU0uo,5097
 iris_cli/scm.py,sha256=ubqaH7EKmVKDhSGxZDL0KOU_cMfrpObVXDyC9HuQGho,11960
@@ -46,8 +46,8 @@ tests/test_mcp_model_governance.py,sha256=_-WFjm9i4ZzVYuaKVb76dOHiLLgiBA1zkFxs81
 tests/test_policy_diff.py,sha256=338L3eb6BKiUAixan_TGSCSGFkUEw74F12RxH2rHxLo,8052
 tests/test_quickstart.py,sha256=2Iumgg4r2Hy-2K3RhvahrqycVDPaDv3REUDx0rnmQQ8,2969
 tests/test_vocabulary.py,sha256=qu5Wh1Y27hV-vCF8pdQ-41VQCOPr7PlK5YWERQquXXQ,13204
-iris_security_cli-0.2.0.dist-info/METADATA,sha256=j7JvrRY0tOFd5hcD0tznH_hPQ_w0k0ZlCagNDfS12rI,1492
-iris_security_cli-0.2.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
-iris_security_cli-0.2.0.dist-info/entry_points.txt,sha256=MGi5_jQ_DETbkKiZLmgKYNRt6vIXtMQvmwCSU0T7e64,43
-iris_security_cli-0.2.0.dist-info/top_level.txt,sha256=OanTp8Sdq_suSs9gfugtQibn3SJ71i-JCSsOfA9CSsg,15
-iris_security_cli-0.2.0.dist-info/RECORD,,
+iris_security_cli-0.2.4.dist-info/METADATA,sha256=aUVQYs5hsNoWd3zUy4hQlr5nNgiDqDX8J9s-1yRNRqg,1493
+iris_security_cli-0.2.4.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+iris_security_cli-0.2.4.dist-info/entry_points.txt,sha256=MGi5_jQ_DETbkKiZLmgKYNRt6vIXtMQvmwCSU0T7e64,43
+iris_security_cli-0.2.4.dist-info/top_level.txt,sha256=OanTp8Sdq_suSs9gfugtQibn3SJ71i-JCSsOfA9CSsg,15
+iris_security_cli-0.2.4.dist-info/RECORD,,