iris-security-cli 0.2.5__tar.gz → 0.2.12__tar.gz

{iris_security_cli-0.2.5 → iris_security_cli-0.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.5
+Version: 0.2.12
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.13
-Requires-Dist: iris-security-sdk>=0.2.5
+Requires-Dist: iris-security-core>=0.1.16
+Requires-Dist: iris-security-sdk>=0.2.12
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0

{iris_security_cli-0.2.5 → iris_security_cli-0.2.12}/iris_cli/certify.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 from datetime import datetime
 from pathlib import Path
 from typing import Optional
@@ -9,8 +10,17 @@ from typing import Optional
 import click
 from rich.console import Console
 from rich.panel import Panel
+from rich.table import Table
 
 from iris_core.compliance.dynamic_loader import ComplianceRule, DynamicBundleLoader
+from iris_core.compliance.exporters.aiuc1_export import AIUC1EvidenceExporter
+from iris_core.compliance.framework_check import load_bundle_data, run_framework_check
+from iris_core.compliance.bundles.iso42001 import (
+    ISO42001_BUNDLE,
+    ISO42001_CLAUSES,
+    coverage_breakdown,
+    stale_crosswalk_warning,
+)
 from iris_core.entitlements import Entitlements, Feature
 from iris_core.models.passport import AgentPassport
 
@@ -26,6 +36,12 @@ from iris_cli.framework_test import (
 
 console = Console()
 
+_CERTIFY_FRAMEWORKS = sorted([
+    "colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr",
+    "nyc-ll144", "illinois-ai-video", "eu-ai-act", "ccpa-admt", "china-pipl",
+    "aiuc-1", "iso-42001",
+])
+
 
 def _evaluate_custom_rule(rule: ComplianceRule, passport: AgentPassport) -> str:
     safe_globals = {"__builtins__": {}}
@@ -120,17 +136,116 @@ def _render_custom_rules_section(
             console.print(f"   Fix: {rule.remediation_command}")
 
 
+def _render_iso42001_certification(agent_name: str) -> None:
+    crosswalk_date = ISO42001_BUNDLE["source_crosswalk_date"]
+    console.print(Panel(
+        f"Derived from AIUC-1 crosswalk ({crosswalk_date}) + IRIS evidence",
+        title=f"ISO 42001 Coverage — {agent_name}",
+        style="blue",
+    ))
+
+    warning = stale_crosswalk_warning()
+    if warning:
+        console.print(f"\n[yellow]⚠ {warning}[/yellow]")
+
+    counts = coverage_breakdown()
+    console.print(
+        f"\n[green]FULL[/green] coverage (IRIS evidence satisfies the clause):"
+        f"    {counts['FULL']} clauses"
+    )
+    console.print(
+        f"[yellow]PARTIAL[/yellow] coverage (IRIS evidence + org action needed):"
+        f"  {counts['PARTIAL']} clauses"
+    )
+    console.print(
+        f"[dim]NOT APPLICABLE[/dim] (organizational/human activity only):"
+        f"   {counts['NOT_APPLICABLE']} clauses"
+    )
+    if counts.get("NONE", 0):
+        console.print(
+            f"[red]NONE[/red] (IRIS inherits AIUC-1 gap — no technical evidence):"
+            f"     {counts['NONE']} clauses"
+        )
+
+    for tier, style in (
+        ("FULL", "green"),
+        ("PARTIAL", "yellow"),
+        ("NOT_APPLICABLE", "dim"),
+        ("NONE", "red"),
+    ):
+        section = [c for c in ISO42001_CLAUSES if c.get("iris_coverage") == tier]
+        if not section:
+            continue
+        console.print(f"\n[bold {style}]{tier}[/bold {style}] ({len(section)} clauses)")
+        table = Table(show_header=True, header_style="bold")
+        table.add_column("Clause")
+        table.add_column("Title")
+        table.add_column("AIUC-1 Gap")
+        table.add_column("Evidence / Gap note", overflow="fold")
+        for clause in section:
+            note = clause.get("iris_evidence") or clause.get("gap_note") or "—"
+            table.add_row(
+                clause["clause"],
+                clause["title"],
+                clause["aiuc1_gap"],
+                note,
+            )
+        console.print(table)
+
+
+def _render_aiuc1_certification(agent_name: str, passport: AgentPassport) -> None:
+    result = run_framework_check(passport, "aiuc-1")
+    bundle = load_bundle_data("aiuc-1")
+    console.print(Panel(
+        f"Agent: {agent_name}\n"
+        f"Framework: {bundle.get('full_name', 'AIUC-1')}\n"
+        f"Source crosswalk: {bundle.get('source_crosswalk_date', '2025-09-18')}\n"
+        f"Generated: {datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')}",
+        title="IRIS Certification — aiuc-1",
+        style="blue",
+    ))
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Control")
+    table.add_column("Coverage")
+    table.add_column("Status")
+    table.add_column("Notes", overflow="fold")
+    for rule_result in result.rule_results:
+        bundle_rule = next(
+            (r for r in bundle.get("rules", []) if r["rule_id"] == rule_result.rule_id),
+            {},
+        )
+        coverage = bundle_rule.get("coverage", "")
+        if rule_result.status == "OUT_OF_SCOPE":
+            status = "[dim]OUT OF SCOPE[/dim]"
+            note = bundle_rule.get("gap_note", "")
+        elif rule_result.status == "PASS":
+            status = "[green]PASS[/green]"
+            note = bundle_rule.get("gap_note", "") if coverage == "PARTIAL" else ""
+        else:
+            status = "[red]FAIL[/red]"
+            note = rule_result.message
+        table.add_row(rule_result.rule_id, coverage, status, note)
+    console.print(table)
+    console.print(
+        "\n[dim]Export auditor-ready evidence: "
+        f"iris certify --framework aiuc-1 --agent {agent_name} "
+        "--format aiuc1-export[/dim]"
+    )
+
+
 @click.command("certify")
 @click.option(
     "--framework",
     required=True,
-    type=click.Choice(sorted([
-        "colorado-ai-act", "nist-ai-rmf", "fedramp-moderate", "hipaa", "soc2", "gdpr",
-        "nyc-ll144", "illinois-ai-video", "eu-ai-act", "ccpa-admt", "china-pipl",
-    ])),
+    type=click.Choice(_CERTIFY_FRAMEWORKS),
 )
 @click.option("--agent", "agent_name", required=True, help="Agent name under governance/agents")
-@click.option("--format", "output_format", default="table", type=click.Choice(["table", "json", "markdown"]))
+@click.option(
+    "--format",
+    "output_format",
+    default="table",
+    type=click.Choice(["table", "json", "markdown", "aiuc1-export"]),
+)
 @click.option(
     "--registry-version",
     default=None,
@@ -157,6 +272,51 @@ def certify_cmd(
         raise click.ClickException(f"Passport not found: {passport_path}")
     passport = AgentPassport.from_yaml(passport_path.read_text())
 
+    if framework == "iso-42001":
+        Entitlements().require(Feature.BUNDLE_ISO42001, context="iso-42001 certification")
+        if output_format == "json":
+            click.echo(
+                json.dumps(
+                    {
+                        "framework": "iso-42001",
+                        "agent": agent_name,
+                        "source_crosswalk_date": ISO42001_BUNDLE["source_crosswalk_date"],
+                        "coverage_breakdown": coverage_breakdown(),
+                        "clauses": ISO42001_CLAUSES,
+                        "stale_warning": stale_crosswalk_warning(),
+                    },
+                    indent=2,
+                )
+            )
+        else:
+            _render_iso42001_certification(agent_name)
+        return
+
+    if framework == "aiuc-1":
+        Entitlements().require(Feature.BUNDLE_AIUC1, context="aiuc-1 certification")
+        if output_format == "aiuc1-export":
+            exporter = AIUC1EvidenceExporter(passport, gov_dir)
+            click.echo(json.dumps(exporter.export_full_package(agent_name), indent=2))
+            return
+        if output_format in ("json", "markdown"):
+            result = run_framework_check(passport, "aiuc-1")
+            payload = {
+                "framework": "aiuc-1",
+                "agent": agent_name,
+                "rules": [
+                    {
+                        "rule_id": r.rule_id,
+                        "status": r.status,
+                        "message": r.message,
+                    }
+                    for r in result.rule_results
+                ],
+            }
+            click.echo(json.dumps(payload, indent=2) if output_format == "json" else str(payload))
+            return
+        _render_aiuc1_certification(agent_name, passport)
+        return
+
     loader = DynamicBundleLoader(pinned_version=registry_version)
 
     if not offline and not registry_version:

{iris_security_cli-0.2.5 → iris_security_cli-0.2.12}/iris_cli/compliance_check_cmd.py

@@ -11,7 +11,7 @@ from rich.console import Console
 from rich.table import Table
 
 from iris import AgentPassport
-from iris_core.compliance.framework_check import run_framework_check
+from iris_core.compliance.framework_check import load_bundle_data, run_framework_check
 from iris_core.compliance.results import ComplianceCheckStatus
 from iris_core.entitlements.display import build_pro_preview_box
 
@@ -61,29 +61,50 @@ def _render_result(
         )
         return False
 
-    has_failures = any(rule.status == "FAIL" for rule in result.rule_results) or bool(
-        result.violations
-    )
+    has_failures = any(
+        rule.status == "FAIL" for rule in result.rule_results
+    ) or bool(result.violations)
     status = "[bold green]PASS[/bold green]" if not has_failures else "[bold red]FAIL[/bold red]"
     console.print(f"\nAgent: [cyan]{passport.name}[/cyan] — {status}")
 
     if result.rule_results:
+        bundle_rules = []
+        if framework == "aiuc-1":
+            try:
+                bundle_rules = load_bundle_data(framework).get("rules", [])
+            except ValueError:
+                bundle_rules = []
         table = Table(title=f"{result.framework_name}", show_header=True, header_style="bold")
         table.add_column("Rule", style="cyan")
         table.add_column("Severity")
         table.add_column("Status")
+        if framework == "aiuc-1":
+            table.add_column("Coverage")
         table.add_column("Response")
         table.add_column("Notes")
         for rule in result.rule_results:
-            status_icon = "[green]✓ PASS[/green]" if rule.status == "PASS" else "[red]✗ FAIL[/red]"
+            if rule.status == "PASS":
+                status_icon = "[green]✓ PASS[/green]"
+            elif rule.status == "OUT_OF_SCOPE":
+                status_icon = "[dim]— OUT OF SCOPE[/dim]"
+            else:
+                status_icon = "[red]✗ FAIL[/red]"
             notes = rule.message if rule.status == "FAIL" else ""
-            table.add_row(
-                rule.rule_id,
-                rule.severity,
-                status_icon,
-                rule.response,
-                notes[:80] + ("..." if len(notes) > 80 else ""),
-            )
+            if rule.status == "OUT_OF_SCOPE":
+                notes = rule.message
+            row = [rule.rule_id, rule.severity, status_icon]
+            if framework == "aiuc-1":
+                bundle_rule = next(
+                    (
+                        r
+                        for r in bundle_rules
+                        if r.get("rule_id") == rule.rule_id
+                    ),
+                    {},
+                )
+                row.append(bundle_rule.get("coverage", ""))
+            row.extend([rule.response, notes[:80] + ("..." if len(notes) > 80 else "")])
+            table.add_row(*row)
         console.print(table)
         console.print(
             "\n[dim]RESPONSE KEY: INFORM — log and proceed | "

{iris_security_cli-0.2.5 → iris_security_cli-0.2.12}/iris_cli/declare.py

@@ -9,6 +9,8 @@ import click
 from rich.console import Console
 from rich.panel import Panel
 
+from iris_core.cli_timing.instrument import timed_cli_command
+
 console = Console()
 
 _DATA_CLASSIFICATIONS = {
@@ -127,6 +129,7 @@ def _interactive_wizard(output_dir: Optional[Path]) -> None:
 @click.option("--high-risk", is_flag=True, default=False, help="Flag as high-risk AI")
 @click.option("--compliance", "-c", multiple=True, help="Compliance frameworks to tag")
 @click.option("--dir", "output_dir", type=click.Path(path_type=Path), default=None)
+@timed_cli_command("iris declare")
 def declare(
     name: Optional[str],
     owner: Optional[str],

iris_security_cli-0.2.12/iris_cli/discover.py

@@ -0,0 +1,223 @@
+"""Org-wide discovery CLI — iris discover org."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import List, Optional
+
+import click
+
+from iris_core.discovery.coordinator import DiscoveryCoordinator
+from iris_core.discovery.sources import (
+    CICDDiscoverySource,
+    KubernetesDiscoverySource,
+    MCPRegistryDiscoverySource,
+    SCMDiscoverySource,
+)
+
+SOURCE_MAP = {
+    "scm": SCMDiscoverySource,
+    "cicd": CICDDiscoverySource,
+    "k8s": KubernetesDiscoverySource,
+    "mcp": MCPRegistryDiscoverySource,
+}
+
+FRAMEWORK_LABELS = {
+    "langchain": "LangChain",
+    "openai_sdk": "OpenAI SDK",
+    "anthropic_sdk": "Anthropic SDK",
+    "bedrock": "Bedrock",
+    "gemini": "Gemini",
+    "crewai": "CrewAI",
+    "autogen": "Autogen",
+    "mcp_server": "MCP Server",
+    "custom": "Custom/unknown",
+    "unknown": "Custom/unknown",
+}
+
+
+def _format_duration(seconds: float) -> str:
+    minutes = int(seconds // 60)
+    secs = int(seconds % 60)
+    if minutes:
+        return f"{minutes}m {secs}s"
+    return f"{secs}s"
+
+
+def _resolve_scm_config(org_name: str, config_file: Optional[Path]) -> dict:
+    if config_file and config_file.exists():
+        data = json.loads(config_file.read_text())
+        scm = data.get("scm", data)
+        scm.setdefault("org", org_name)
+        return scm
+
+    token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
+    config: dict = {"provider": "github", "org": org_name}
+    if token:
+        config["token"] = token
+    if os.environ.get("IRIS_DISCOVERY_REPOS"):
+        config["repos"] = json.loads(os.environ["IRIS_DISCOVERY_REPOS"])
+    return config
+
+
+def _build_configs(
+    source_names: List[str],
+    org_name: str,
+    config_file: Optional[Path],
+) -> dict:
+    configs: dict = {}
+    if config_file and config_file.exists():
+        all_cfg = json.loads(config_file.read_text())
+    else:
+        all_cfg = {}
+
+    if "scm" in source_names:
+        configs["scm_repo"] = all_cfg.get("scm", _resolve_scm_config(org_name, config_file))
+        configs["scm_repo"].setdefault("org", org_name)
+
+    if "cicd" in source_names:
+        cicd = all_cfg.get("cicd", {})
+        if configs.get("scm_repo", {}).get("repos"):
+            cicd["repos"] = configs["scm_repo"]["repos"]
+        configs["cicd_pipeline"] = cicd
+
+    if "k8s" in source_names:
+        k8s = all_cfg.get("k8s", {})
+        kubeconfig = os.environ.get("KUBECONFIG")
+        if kubeconfig:
+            k8s.setdefault("kubeconfig", kubeconfig)
+        configs["k8s_workload"] = k8s
+
+    if "mcp" in source_names:
+        configs["mcp_registry"] = all_cfg.get("mcp", {})
+
+    return configs
+
+
+def render_org_discovery_report(inventory, duration_seconds: float) -> str:
+    """Render CLI output matching the Brownfield demo format."""
+    lines: List[str] = []
+    org = inventory.org_id
+
+    repos = 0
+    pipelines = 0
+    clusters = 0
+    for src in inventory.sources_scanned:
+        if src.get("source_type") == "scm_repo":
+            repos = src.get("repos_scanned", repos)
+        elif src.get("source_type") == "cicd_pipeline":
+            pipelines = src.get("findings_count", pipelines)
+        elif src.get("source_type") == "k8s_workload":
+            clusters = src.get("clusters_scanned", 1 if src.get("status") == "complete" else 0)
+
+    cicd_count = sum(
+        1
+        for a in inventory.agents
+        if a.source_type == "cicd_pipeline" and a.confidence == "certain"
+    )
+    if pipelines == 0 and cicd_count:
+        pipelines = cicd_count
+
+    lines.append(f"IRIS Org Discovery — {org}")
+    lines.append(
+        f"Scanned: {repos} repos, {pipelines} CI/CD pipelines, {clusters} K8s clusters"
+    )
+    lines.append(
+        f"Duration: {_format_duration(duration_seconds)}, Status: {inventory.status}"
+    )
+    lines.append("")
+    lines.append(f"Found {inventory.total_agents} agents across your organization.")
+    lines.append(
+        f"{inventory.ungoverned_count} are ungoverned — no IRIS policy, no audit trail."
+    )
+    lines.append("")
+    lines.append("By framework:")
+
+    ungoverned_by_fw = inventory.ungoverned_by_framework()
+    fw_counts = inventory.by_framework
+    sorted_fw = sorted(
+        fw_counts.keys(),
+        key=lambda k: fw_counts[k],
+        reverse=True,
+    )
+    for fw in sorted_fw:
+        label = FRAMEWORK_LABELS.get(fw, fw.replace("_", " ").title())
+        total = fw_counts[fw]
+        ungov = ungoverned_by_fw.get(fw, 0)
+        lines.append(f"  {label:<18} {total:>4}   ({ungov} ungoverned)")
+
+    prod_unowned = inventory.ungoverned_production_without_owner()
+    if prod_unowned:
+        lines.append("")
+        lines.append(
+            f"{prod_unowned} ungoverned agents are in PRODUCTION with no owner on record."
+        )
+
+    lines.append("Run: iris discover org --report for the full inventory.")
+    return "\n".join(lines)
+
+
+@click.group()
+def discover():
+    """Org-wide AI agent discovery across SCM, CI/CD, Kubernetes, and MCP."""
+    pass
+
+
+@discover.command("org")
+@click.option(
+    "--sources",
+    default="scm,cicd,k8s,mcp",
+    show_default=True,
+    help="Comma-separated discovery sources",
+)
+@click.option("--org-name", required=True, help="Organization identifier for this scan")
+@click.option(
+    "--config",
+    "config_file",
+    type=click.Path(exists=False, path_type=Path),
+    default=None,
+    help="JSON config file with source credentials and repo fixtures",
+)
+@click.option("--report", is_flag=True, help="Output full JSON inventory")
+@click.option(
+    "--vault-dir",
+    type=click.Path(path_type=Path),
+    default=None,
+    help="Evidence vault directory for scan results",
+)
+def discover_org(sources: str, org_name: str, config_file: Optional[Path], report: bool, vault_dir: Optional[Path]):
+    """
+    Scan your organization for AI agents across all configured surfaces.
+
+    Example:
+      iris discover org --sources scm --org-name acme-corp
+    """
+    source_names = [s.strip() for s in sources.split(",") if s.strip()]
+    unknown = set(source_names) - set(SOURCE_MAP)
+    if unknown:
+        raise click.ClickException(f"Unknown sources: {', '.join(sorted(unknown))}")
+
+    if not config_file and not os.environ.get("GITHUB_TOKEN") and "scm" in source_names:
+        if not os.environ.get("IRIS_DISCOVERY_REPOS"):
+            token = click.prompt("GitHub token (contents:read)", hide_input=True, default="", show_default=False)
+            if token:
+                os.environ["GITHUB_TOKEN"] = token
+            org_name = click.prompt("GitHub organization name", default=org_name)
+
+    configs = _build_configs(source_names, org_name, config_file)
+    instances = [SOURCE_MAP[name]() for name in source_names]
+    coordinator = DiscoveryCoordinator(vault_dir=vault_dir)
+
+    start = time.monotonic()
+    inventory = coordinator.run_scan_sync(org_name, instances, configs)
+    duration = time.monotonic() - start
+
+    if report:
+        payload = inventory.to_dict()
+        payload["duration_seconds"] = duration
+        click.echo(json.dumps(payload, indent=2))
+    else:
+        click.echo(render_org_discovery_report(inventory, duration))