iris-security-cli 0.2.0__tar.gz → 0.2.5__tar.gz

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.0
+Version: 0.2.5
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,13 +15,13 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.8
-Requires-Dist: iris-security-sdk>=0.2.0
+Requires-Dist: iris-security-core>=0.1.13
+Requires-Dist: iris-security-sdk>=0.2.5
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: scm
-Requires-Dist: iris-security-scm[all]>=0.1.1; extra == "scm"
+Requires-Dist: iris-security-scm[all]>=0.2.0; extra == "scm"
 
 # iris-security-cli
 

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/iris_cli/certify.py

@@ -10,6 +10,7 @@ import click
 from rich.console import Console
 from rich.panel import Panel
 
+from iris_core.compliance.dynamic_loader import ComplianceRule, DynamicBundleLoader
 from iris_core.entitlements import Entitlements, Feature
 from iris_core.models.passport import AgentPassport
 
@@ -26,20 +27,60 @@ from iris_cli.framework_test import (
 console = Console()
 
 
+def _evaluate_custom_rule(rule: ComplianceRule, passport: AgentPassport) -> str:
+    safe_globals = {"__builtins__": {}}
+    safe_locals = {
+        "passport": passport,
+        "hitl_config": getattr(passport, "hitl_config", None),
+        "cost_config": getattr(passport, "cost_config", None),
+        "bool": bool,
+        "len": len,
+    }
+    try:
+        value = eval(rule.check_expression, safe_globals, safe_locals)
+    except Exception:
+        return "FAIL"
+    return "PASS" if value else "FAIL"
+
+
+def _rule_source_label(loader: DynamicBundleLoader) -> str:
+    info = loader.registry_info()
+    if info.source == "live":
+        return "Live registry"
+    if info.source == "cache":
+        hours = info.cache_age_hours
+        if hours is not None and hours < 1:
+            return "Live registry (updated recently)"
+        if hours is not None:
+            return f"Live registry (updated {int(hours)} hours ago)"
+        return "Cached registry"
+    return "Bundled fallback"
+
+
 def _render_certification_header(
     framework: str,
     agent_name: str,
     result,
+    *,
+    loader: DynamicBundleLoader,
+    custom_rule_count: int,
 ) -> None:
+    bundle = loader.load_bundle(framework)
+    info = loader.registry_info()
     framework_label = _framework_name(framework)
     if framework == "colorado-ai-act":
         framework_label = "Colorado AI Act (SB 26-189)"
 
+    version = bundle.metadata.get("current_version", info.registry_version)
+    law_name = bundle.metadata.get("law_name", framework_label)
+
     console.print(Panel(
-        f"Agent:      {agent_name}\n"
-        f"Framework:  {framework_label}\n"
-        f"Generated:  {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}\n"
-        f"Attested:   IRIS · Commit: local",
+        f"Agent:        {agent_name}\n"
+        f"Framework:    {law_name} v{version}\n"
+        f"Rule source:  {_rule_source_label(loader)}\n"
+        f"Custom rules: {custom_rule_count} organization rule{'s' if custom_rule_count != 1 else ''} evaluated\n"
+        f"Generated:    {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}\n"
+        f"Attested:     IRIS · Commit: local",
         title=f"IRIS Certification — {framework}",
         style="blue",
     ))
@@ -63,25 +104,72 @@ def _render_certification_header(
         )
 
 
+def _render_custom_rules_section(
+    custom_rules: list[ComplianceRule],
+    passport: AgentPassport,
+) -> None:
+    if not custom_rules:
+        return
+    console.print("\n[bold]ORGANIZATION POLICY[/bold]")
+    console.print("─" * 65)
+    for rule in custom_rules:
+        status = _evaluate_custom_rule(rule, passport)
+        icon = "[green]✓[/green]" if status == "PASS" else "[red]✗[/red]"
+        console.print(f"{icon} {rule.rule_id:<14} {rule.name}")
+        if status != "PASS" and rule.remediation_command:
+            console.print(f"   Fix: {rule.remediation_command}")
+
+
 @click.command("certify")
 @click.option(
     "--framework",
     required=True,
-    type=click.Choice(sorted(["colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr"])),
+    type=click.Choice(sorted([
+        "colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr",
+        "nyc-ll144", "illinois-ai-video", "eu-ai-act", "ccpa-admt", "china-pipl",
+    ])),
 )
 @click.option("--agent", "agent_name", required=True, help="Agent name under governance/agents")
 @click.option("--format", "output_format", default="table", type=click.Choice(["table", "json", "markdown"]))
-def certify_cmd(framework: str, agent_name: str, output_format: str) -> None:
+@click.option(
+    "--registry-version",
+    default=None,
+    help="Pin to a specific registry version for reproducible certifications",
+)
+@click.option("--dir", "governance_dir", type=click.Path(path_type=Path), default=None)
+@click.option("--offline", is_flag=True, help="Use bundled registry only (no network refresh)")
+def certify_cmd(
+    framework: str,
+    agent_name: str,
+    output_format: str,
+    registry_version: Optional[str],
+    governance_dir: Optional[Path],
+    offline: bool,
+) -> None:
     """
     Certify compliance readiness against a regulatory framework.
 
     Alias: iris test
     """
-    passport_path = Path.cwd() / "governance" / "agents" / agent_name / "passport.yaml"
+    gov_dir = governance_dir or Path.cwd() / "governance"
+    passport_path = gov_dir / "agents" / agent_name / "passport.yaml"
     if not passport_path.exists():
         raise click.ClickException(f"Passport not found: {passport_path}")
     passport = AgentPassport.from_yaml(passport_path.read_text())
 
+    loader = DynamicBundleLoader(pinned_version=registry_version)
+
+    if not offline and not registry_version:
+        if not loader.is_cache_fresh():
+            console.print("[dim]Checking for regulatory updates...[/dim]")
+            updated = loader.refresh_registry()
+            if updated:
+                console.print("[green]✓ Regulatory intelligence updated[/green]")
+                console.print("[dim]  Run: iris regulatory check for change summary[/dim]")
+
+    custom_rules = loader.load_custom_rules(gov_dir)
+    loader.get_effective_rules(framework, gov_dir)
+
     ents = Entitlements()
     has_pro = ents.has(Feature.CLI_TEST_FULL_REPORT)
 
@@ -97,13 +185,22 @@ def certify_cmd(framework: str, agent_name: str, output_format: str) -> None:
     elif output_format == "markdown":
         click.echo(_render_markdown(result, has_pro))
     else:
-        _render_certification_header(framework, agent_name, result)
+        _render_certification_header(
+            framework, agent_name, result,
+            loader=loader,
+            custom_rule_count=len(custom_rules),
+        )
         _render_table(result, has_pro)
-        _render_response_configuration(framework, passport)
+        _render_custom_rules_section(custom_rules, passport)
+        _render_response_configuration(framework, passport, loader=loader)
 
 
-def _render_response_configuration(framework: str, passport: AgentPassport) -> None:
-    from iris_core.compliance.framework_check import load_bundle_data
+def _render_response_configuration(
+    framework: str,
+    passport: AgentPassport,
+    *,
+    loader: Optional[DynamicBundleLoader] = None,
+) -> None:
     from iris_core.compliance.violation_response import (
         get_effective_response,
         rule_response_label,
@@ -111,7 +208,11 @@ def _render_response_configuration(framework: str, passport: AgentPassport) -> N
     )
 
     try:
-        bundle = load_bundle_data(framework)
+        if loader:
+            bundle = loader.load_bundle(framework).to_dict()
+        else:
+            from iris_core.compliance.framework_check import load_bundle_data
+            bundle = load_bundle_data(framework)
     except ValueError:
         return
     rules = bundle.get("rules", [])
@@ -131,7 +232,7 @@ def _render_response_configuration(framework: str, passport: AgentPassport) -> N
             if base == ViolationResponse.BLOCK:
                 line += " (unconditional — cannot be overridden)"
             elif effective != default:
-                line += f" (override active)"
+                line += " (override active)"
             else:
                 line += " (default)"
         console.print(line)

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/iris_cli/framework_suggest.py

@@ -44,6 +44,25 @@ CONVERSATIONAL_KEYWORDS = (
     "chat bot",
 )
 
+EMPLOYMENT_KEYWORDS = (
+    "hiring",
+    "recruiting",
+    "recruitment",
+    "hr",
+    "ats",
+    "screening",
+    "employment",
+    "interview",
+    "resume",
+    "candidate",
+)
+
+VIDEO_KEYWORDS = (
+    "video",
+    "interview",
+    "biometric",
+)
+
 Q1_CHOICES = [
     "Makes decisions that affect individual people (hiring, loans, medical, etc.)",
     "Automates business processes (summarization, classification, routing)",
@@ -267,6 +286,48 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
     soc2 = q2 == Q2_CHOICES[5] or "SOC 2 (SaaS / enterprise)" in q7
     gdpr = "Outside the US" in q8 or "Other / multiple states" in q8
 
+    ccpa_admt = (
+        "California" in q8
+        and q5
+        and (
+            q1 == Q1_CHOICES[0]
+            or q2 in {Q2_CHOICES[2], Q2_CHOICES[3]}
+        )
+    )
+    china_pipl = (
+        "Outside the US" in q8
+        or "china" in agent_description
+        or "asia" in agent_description
+        or (q2 == Q2_CHOICES[4] and "Outside the US" in q8)
+    )
+
+    employment_domain = (
+        q1 == Q1_CHOICES[0]
+        or any(kw in q1.lower() for kw in EMPLOYMENT_KEYWORDS)
+        or any(kw in agent_description for kw in EMPLOYMENT_KEYWORDS)
+        or q2 in {Q2_CHOICES[4], Q2_CHOICES[6]}
+    )
+    illinois_video = (
+        employment_domain
+        and (
+            "Illinois" in q8
+            or "Other / multiple states" in q8
+        )
+        and (
+            any(kw in agent_description for kw in VIDEO_KEYWORDS)
+            or q4 == Q4_CHOICES[3]
+            or "video" in q1.lower()
+            or "interview" in q1.lower()
+        )
+    )
+    nyc_ll144 = (
+        employment_domain
+        and (
+            "New York" in q8
+            or "Other / multiple states" in q8
+        )
+    )
+
     colorado_reason = (
         "Your agent makes consequential decisions for Colorado users. "
         "SB 26-189 applies (replaces SB 24-205, effective Jan. 1, 2027). "
@@ -378,6 +439,62 @@ def build_recommendations(answers: dict[str, Any]) -> list[Recommendation]:
             ),
             command="iris test --framework gdpr" if gdpr else None,
         ),
+        Recommendation(
+            framework="ccpa-admt",
+            tier="PRO",
+            status="REQUIRED" if ccpa_admt else "NOT APPLICABLE",
+            reason=(
+                "California ADMT regulations (effective Jan. 1, 2026) apply to "
+                "automated decisions affecting California consumers in employment, "
+                "credit, healthcare, housing, or education."
+                if ccpa_admt
+                else "No California ADMT scope detected."
+            ),
+            command="iris compliance check --framework ccpa-admt" if ccpa_admt else None,
+        ),
+        Recommendation(
+            framework="china-pipl",
+            tier="PRO",
+            status="REQUIRED" if china_pipl else "NOT APPLICABLE",
+            reason=(
+                "China PIPL applies when processing personal information of "
+                "individuals located in China, including automated decision-making "
+                "and cross-border transfer restrictions."
+                if china_pipl
+                else "No China or Asia-Pacific user footprint detected."
+            ),
+            command="iris compliance check --framework china-pipl" if china_pipl else None,
+        ),
+        Recommendation(
+            framework="illinois-ai-video",
+            tier="PRO",
+            status="REQUIRED" if illinois_video else "NOT APPLICABLE",
+            reason=(
+                "Illinois AI Video Interview Act applies to AI analysis of video "
+                "interviews for Illinois-based positions. Consent must be logged "
+                "before any video analysis (820 ILCS 42)."
+                if illinois_video
+                else "No Illinois video interview AI scope detected."
+            ),
+            command=(
+                "iris compliance check --framework illinois-ai-video"
+                if illinois_video
+                else None
+            ),
+        ),
+        Recommendation(
+            framework="nyc-ll144",
+            tier="PRO",
+            status="REQUIRED" if nyc_ll144 else "NOT APPLICABLE",
+            reason=(
+                "NYC Local Law 144 requires annual independent bias audits, public "
+                "disclosure, and candidate notice before using Automated Employment "
+                "Decision Tools (AEDTs) for NYC hiring."
+                if nyc_ll144
+                else "No NYC AEDT hiring scope detected."
+            ),
+            command="iris compliance check --framework nyc-ll144" if nyc_ll144 else None,
+        ),
     ]
     return recommendations
 

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/iris_cli/main.py

@@ -24,7 +24,7 @@ console = Console()
 
 
 @click.group()
-@click.version_option(version="0.2.0", prog_name="iris")
+@click.version_option(version="0.2.5", prog_name="iris")
 def cli():
     """
     IRIS — Policy as Code for AI Agents

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/iris_cli/regulatory.py

@@ -50,6 +50,41 @@ def _format_effective_date(iso_date: str) -> str:
         return iso_date
 
 
+def _render_rule_changes(bundle_id: str, old_version: str, new_version: str) -> None:
+    """Show rule-level changes when registry versions differ."""
+    import json
+
+    from iris_core.compliance.dynamic_loader import DynamicBundleLoader, _bundled_registry_path
+
+    loader = DynamicBundleLoader()
+    cache_path = Path.home() / ".iris" / "registry-cache.json"
+    bundled = _bundled_registry_path()
+
+    old_registry: dict = {}
+    if cache_path.exists():
+        try:
+            old_registry = json.loads(cache_path.read_text())
+        except Exception:
+            pass
+    elif bundled.exists():
+        old_registry = json.loads(bundled.read_text())
+
+    if not bundled.exists():
+        return
+    new_registry = json.loads(bundled.read_text())
+    changes = loader.diff_rules(bundle_id, old_registry, new_registry)
+    if not changes:
+        return
+
+    console.print(f"\n   [bold]REGULATORY UPDATE — {bundle_id} v{old_version} → v{new_version}[/bold]")
+    console.print("   [bold]RULE CHANGES:[/bold]")
+    for change in changes[:10]:
+        console.print(f"   ● {change}")
+    console.print(
+        "\n   Run: [bold]iris certify --agent <name>[/bold] to see updated status"
+    )
+
+
 def _render_check_output(
     tracker: RegulatoryTracker,
     updates: list,
@@ -101,6 +136,7 @@ def _render_check_output(
                 console.print(
                     f"Effective: {_format_effective_date(update.effective_date)}"
                 )
+                _render_rule_changes(update.bundle_id, update.current_installed_version, update.available_version)
                 console.print("   Action required:")
                 console.print(
                     "   1. Run: [bold]pip install --upgrade iris-security-sdk[/bold]"

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/iris_security_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.0
+Version: 0.2.5
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,13 +15,13 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.8
-Requires-Dist: iris-security-sdk>=0.2.0
+Requires-Dist: iris-security-core>=0.1.13
+Requires-Dist: iris-security-sdk>=0.2.5
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
 Provides-Extra: scm
-Requires-Dist: iris-security-scm[all]>=0.1.1; extra == "scm"
+Requires-Dist: iris-security-scm[all]>=0.2.0; extra == "scm"
 
 # iris-security-cli
 

iris_security_cli-0.2.5/iris_security_cli.egg-info/requires.txt

@@ -0,0 +1,8 @@
+iris-security-core>=0.1.13
+iris-security-sdk>=0.2.5
+click>=8.1
+rich>=13.0
+pyyaml>=6.0
+
+[scm]
+iris-security-scm[all]>=0.2.0

{iris_security_cli-0.2.0 → iris_security_cli-0.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "iris-security-cli"
-version = "0.2.0"
+version = "0.2.5"
 description = "IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -20,15 +20,15 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "iris-security-core>=0.1.8",
-  "iris-security-sdk>=0.2.0",
+  "iris-security-core>=0.1.13",
+  "iris-security-sdk>=0.2.5",
   "click>=8.1",
   "rich>=13.0",
   "pyyaml>=6.0",
 ]
 
 [project.optional-dependencies]
-scm = ["iris-security-scm[all]>=0.1.1"]
+scm = ["iris-security-scm[all]>=0.2.0"]
 
 [project.urls]
 Homepage = "https://github.com/gimartinb/iris-sdk"

iris_security_cli-0.2.0/iris_security_cli.egg-info/requires.txt

@@ -1,8 +0,0 @@
-iris-security-core>=0.1.8
-iris-security-sdk>=0.2.0
-click>=8.1
-rich>=13.0
-pyyaml>=6.0
-
-[scm]
-iris-security-scm[all]>=0.1.1