opencomplai-cli 0.1.2__tar.gz → 0.3.0__tar.gz

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/.gitignore

@@ -57,6 +57,7 @@ docs/checker-widget/node_modules/
 packages/cli/src/opencomplai_cli/data/checker-local.html
 
 # --- Public-repo hardening (keep AI-tooling and internal artifacts out) ---
+.oss-sync-state
 .claude/
 .cursor/
 .autopilot.json
@@ -67,3 +68,17 @@ x.key
 .tmp-*.db
 ci-logs/
 tmp/
+
+.vercel
+.env*.local
+
+# `vercel env pull <environment>` writes to a file named after the environment
+# when no `-o` path is given, so a mistyped pull drops a real token into the
+# repo root under a name none of the patterns above match. Ignore the three
+# environment names outright rather than relying on catching it in review.
+/development
+/preview
+/production
+
+# Scratch worktrees created by local agent tooling.
+.harness-worktrees/

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: opencomplai-cli
-Version: 0.1.2
+Version: 0.3.0
 Summary: Opencomplai command-line interface for EU AI Act compliance assessment
 Project-URL: Homepage, https://opencomplai.com
 Project-URL: Documentation, https://docs.opencomplai.com
@@ -12,8 +12,12 @@ Requires-Dist: questionary>=2.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: typer>=0.9.0
 Provides-Extra: dev
+Requires-Dist: jsonschema>=4.21; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
 Requires-Dist: ruff>=0.1.0; extra == 'dev'
+Provides-Extra: serve
+Requires-Dist: fastapi>=0.110; extra == 'serve'
+Requires-Dist: uvicorn>=0.27; extra == 'serve'
 Description-Content-Type: text/markdown
 
 # opencomplai-cli

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "opencomplai-cli"
-version = "0.1.2"
+version = "0.3.0"
 description = "Opencomplai command-line interface for EU AI Act compliance assessment"
 readme = "README.md"
 license = { text = "AGPL-3.0-only" }
@@ -24,6 +24,17 @@ opencomplai = "opencomplai_cli.main:app"
 dev = [
     "pytest>=7.0",
     "ruff>=0.1.0",
+    # Only used by test_publish.py's structural schema-validation test (an
+    # end-to-end proof that the real repo-root compliance-artifact.json,
+    # once mapped, validates against dashboard-saas's vendored
+    # first_scan_status.schema.json) -- never imported by runtime code.
+    # Same package/version floor dashboard-saas/services/ingest-api's
+    # pyproject.toml already declares.
+    "jsonschema>=4.21",
+]
+serve = [
+    "fastapi>=0.110",
+    "uvicorn>=0.27",
 ]
 
 [tool.hatch.build.targets.wheel]

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/src/opencomplai_cli/__init__.py

@@ -1,6 +1,6 @@
 """Opencomplai CLI."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 # Canonical project metadata — single source of truth for the `--version`
 # flag and the `opencomplai info` command. Mirrors the [project] table in

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/src/opencomplai_cli/commands/checker.py

@@ -155,25 +155,48 @@ def run_interactive_wizard(*, skip_allowed: bool = True) -> CheckerSession | Non
         "Is the system a product with AI as safety component under Annex I harmonisation law?",
         default=False,
     )
+    if answers["hr1_annex_i"]:
+        answers["hr8_conformity_assessment"] = _confirm(
+            "Is that Annex I product required to undergo a third-party "
+            "conformity assessment by a notified body (Art 6(1)(b))?",
+            default=False,
+        )
     answers["hr2_annex_iii"] = _confirm(
         "Does the system fall within an Annex III high-risk use case?",
         default=False,
     )
-    if answers["hr1_annex_i"] or answers["hr2_annex_iii"]:
+    if answers["hr2_annex_iii"]:
+        answers["hr7_profiling"] = _confirm(
+            "Does the system perform profiling of natural persons (automated "
+            "processing of personal data to evaluate, analyse, or predict "
+            "aspects such as behaviour, preferences, location, or performance)?",
+            default=False,
+        )
+    # The Art. 6(3)(a)-(d) exceptions are an Annex III derogation only; an
+    # Annex I trigger (safety component + conformity assessment) has none.
+    hr1_effective = answers["hr1_annex_i"] and answers.get(
+        "hr8_conformity_assessment", False
+    )
+    if answers["hr2_annex_iii"] and not hr1_effective:
         answers["hr3_art_6_3"] = _confirm(
-            "Does Article 6(3) apply (safety component required for product conformity)?",
+            "Is the AI system intended only to improve the result of a "
+            "previously completed human activity (Art 6(3)(b))?",
             default=False,
         )
         answers["hr4_narrow_task"] = _confirm(
-            "Is the AI intended only for a narrow procedural task (Art 6(3) exception)?",
+            "Is the AI intended only for a narrow procedural task (Art 6(3)(a))?",
             default=False,
         )
         answers["hr5_no_significant_risk"] = _confirm(
-            "Does the system NOT pose significant risk to health, safety, or fundamental rights?",
+            "Is the AI system intended only to detect decision-making patterns "
+            "or deviations from prior decisions, without replacing or "
+            "influencing the prior human assessment and without proper human "
+            "review (Art 6(3)(c))?",
             default=False,
         )
         answers["hr6_accessory"] = _confirm(
-            "Is the system purely accessory to the relevant human decision (Art 6(3))?",
+            "Is the AI system intended only to perform a preparatory task for "
+            "an assessment relevant to the Annex III use case (Art 6(3)(d))?",
             default=False,
         )
 
@@ -199,6 +222,7 @@ def run_interactive_wizard(*, skip_allowed: bool = True) -> CheckerSession | Non
         default=False,
     )
     if answers["s1_gpai"]:
+        _show_help("gpai_systemic_risk_threshold")
         answers["s1_gpai_systemic_risk"] = _confirm(
             "Does the GPAI model have systemic risk (high impact capabilities)?",
             default=False,

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/src/opencomplai_cli/commands/dashboard.py

@@ -62,6 +62,30 @@ _CONFIG_FILE = _OPENCOMPLAI_DIR / "config.yaml"
 _SIGNING_PUB = _OPENCOMPLAI_DIR / "signing.pub"
 _EGRESS_ALLOWLIST = _OPENCOMPLAI_DIR / "egress_allowlist.json"
 _LEDGER_FILE = _OPENCOMPLAI_DIR / "ledger.jsonl"
+_CLIENT_SECRET_FILE = _OPENCOMPLAI_DIR / "client.secret"
+
+
+def _write_client_secret(raw_secret: str) -> None:
+    """
+    Persist the plaintext client_secret received once from /enroll. Stored
+    as a dedicated file (mirroring signing.key/signing.pub's separateness
+    from config.yaml's non-secret flat scalars), chmod 0600 where the
+    platform supports it — a no-op on Windows, where this permission model
+    doesn't apply the same way.
+    """
+    _OPENCOMPLAI_DIR.mkdir(parents=True, exist_ok=True)
+    _CLIENT_SECRET_FILE.write_text(raw_secret)
+    try:
+        os.chmod(_CLIENT_SECRET_FILE, 0o600)
+    except (OSError, NotImplementedError):
+        pass
+
+
+def _read_client_secret() -> str | None:
+    if not _CLIENT_SECRET_FILE.exists():
+        return None
+    secret = _CLIENT_SECRET_FILE.read_text().strip()
+    return secret or None
 
 
 # ---------------------------------------------------------------------------
@@ -242,6 +266,17 @@ def enroll(
     audit_event_hash = data.get("audit_event_hash", "")
     dashboard_url_from_api = data.get("dashboard_url", base_url)
 
+    # --- Persist OIDC client-credentials pair (AUTH-SAAS) ---
+    # /enroll is the only place these are ever returned; client_id is not
+    # secret (like install_id) and lives in config.yaml, client_secret gets
+    # its own file since it must never be handed back a second time.
+    client_id = data.get("client_id", "")
+    client_secret = data.get("client_secret", "")
+    if client_id and client_secret:
+        cfg["client_id"] = client_id
+        _write_config(cfg)
+        _write_client_secret(client_secret)
+
     # --- Write EgressConsent ledger event (OSS-side immutable ledger) ---
     from datetime import UTC, datetime
 
@@ -269,6 +304,9 @@ def enroll(
     _console.print(f"  tenant_id:        {tenant}")
     _console.print(f"  install_id:       {install_id}")
     _console.print(f"  audit_event_hash: {audit_event_hash}")
+    if client_id and client_secret:
+        _console.print(f"  client_id:        {client_id}")
+        _console.print(f"  client_secret:    saved to {_CLIENT_SECRET_FILE}")
     _console.print(f"\nDashboard: {dashboard_url_from_api}")
     _console.print(
         "\nNext step: run [bold]opencomplai check --sign[/bold] to emit your first signed artifact."
@@ -307,6 +345,18 @@ def withdraw(
     ).rstrip("/")
 
     # --- Notify dashboard if URL is available ---
+    # Best-effort and non-fatal by design (an offline install can still clear
+    # its own local state) — but a >=400 response is not the same as being
+    # unreachable: the dashboard *processed* the request and refused it, so
+    # egress consent almost certainly stays active server-side. That case
+    # gets its own louder message below rather than folding into the local
+    # "Withdrawal complete" line, which would otherwise claim a success that
+    # did not happen remotely (admin-api's /v1/admin/withdraw requires an
+    # authenticated, tenant-scoped service JWT as of SEC-2 — this CLI does
+    # not yet mint one, so every call currently gets 401; see HANDOFF.md).
+    # Vacuously true when no dashboard URL is configured at all — a purely
+    # local install has no remote consent state to fall out of sync with.
+    dashboard_notified = not base_url
     if base_url:
         try:
             status, data = _post(
@@ -315,9 +365,12 @@ def withdraw(
             )
             if status >= 400:
                 _err_console.print(
-                    f"[yellow]Warning:[/yellow] dashboard withdraw call returned {status}: "
-                    f"{data.get('message', data)}"
+                    f"[red]Error:[/red] dashboard rejected the withdraw request "
+                    f"({status}: {data.get('message', data)}) — egress consent was "
+                    "NOT revoked server-side. Clearing local state only."
                 )
+            else:
+                dashboard_notified = True
         except ConnectionError as exc:
             _err_console.print(
                 f"[yellow]Warning:[/yellow] could not reach dashboard: {exc}"
@@ -342,9 +395,16 @@ def withdraw(
     _write_egress_allowlist(allowlist)
 
     if removed:
-        _console.print(
-            f"[green]Withdrawal complete.[/green] Egress allowlist entry removed for tenant {tenant}."
-        )
+        if dashboard_notified:
+            _console.print(
+                f"[green]Withdrawal complete.[/green] Egress allowlist entry removed for tenant {tenant}."
+            )
+        else:
+            _console.print(
+                f"[yellow]Local withdrawal complete[/yellow] — egress allowlist entry removed "
+                f"for tenant {tenant}, but the dashboard was not notified (see error above). "
+                "Server-side egress consent likely remains active."
+            )
     else:
         _console.print(
             f"[dim]No egress allowlist entry found for tenant {tenant} — nothing to remove.[/dim]"

opencomplai_cli-0.3.0/src/opencomplai_cli/commands/push.py

@@ -0,0 +1,153 @@
+"""
+CLI: ``opencomplai push`` — publish a signed ``compliance-artifact.json`` to
+the Opencomplai Premium Dashboard (GO-LIVE CORE-4).
+
+Deliberately a standalone command, not a ``--push`` flag on ``check``/
+``scan``: those commands' exit-code semantics are a CI-gating contract
+(0/1/2/3/4, see ``main.py``'s module docstring) that must never depend on
+network reachability. ``push`` is a separate, opt-in step a pipeline runs
+*after* ``check`` has already gated the build locally.
+
+Auth model: API-key, not the CI connectors' JWT/OIDC path. ``push`` sends
+no ``install_id`` in its envelope at all -- ``dashboard_ingest.routes``
+derives it server-side from the authenticated API key's own project (see
+ingest-api's ``test_key_auth.py::test_envelope_install_id_unknown_is
+_overridden_by_principal``), and a key-authed request MAY omit
+``signature`` entirely since the key itself attests authenticity
+(``dashboard_ingest.contract.validate_envelope_shape``'s
+``require_install_id=False`` default for this path).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+from rich.console import Console
+from rich.markup import escape
+
+from opencomplai_cli.publish import (
+    envelope_signature,
+    prepare_scan_status_artifact,
+    publish_scan_status,
+)
+
+console = Console()
+err_console = Console(stderr=True)
+
+EXIT_OK = 0
+EXIT_PUBLISH_FAILED = 3
+
+_LOCAL_HOSTNAMES = {"localhost", "127.0.0.1"}
+
+
+def run_push(artifact_file: Path, *, env: dict[str, str] | None = None) -> int:
+    """
+    Read ``artifact_file``, shape it, and POST it to the dashboard.
+
+    Returns the process exit code (0 on HTTP 200/201, 3 otherwise) instead
+    of calling ``sys.exit`` directly -- same convention as
+    ``connectors.github_actions.run_connector`` -- so tests can assert on
+    the return value without catching ``SystemExit``. The ``env`` mapping
+    defaults to ``os.environ`` and exists for the same reason: tests pass a
+    synthetic environment instead of monkeypatching process-global state.
+    """
+    _env = env if env is not None else os.environ
+
+    if not artifact_file.exists():
+        err_console.print(f"[red]Error:[/red] artifact file not found: {artifact_file}")
+        err_console.print(
+            "Run [bold]opencomplai check --sign[/bold] first to produce one."
+        )
+        return EXIT_PUBLISH_FAILED
+
+    # A directory path, an unreadable file, or non-UTF-8 bytes must all
+    # produce a clean one-line error rather than an uncaught traceback --
+    # this is a CLI a pipeline script parses stderr from, not a Python API.
+    try:
+        raw_text = artifact_file.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as exc:
+        err_console.print(f"[red]Error:[/red] could not read {artifact_file}: {exc}")
+        return EXIT_PUBLISH_FAILED
+
+    try:
+        artifact: Any = json.loads(raw_text)
+    except json.JSONDecodeError as exc:
+        err_console.print(f"[red]Error:[/red] {artifact_file} is not valid JSON: {exc}")
+        return EXIT_PUBLISH_FAILED
+
+    if not isinstance(artifact, dict):
+        err_console.print(
+            f"[red]Error:[/red] {artifact_file} must contain a JSON object "
+            "(a ScanStatusArtifact), not a "
+            f"{type(artifact).__name__}"
+        )
+        return EXIT_PUBLISH_FAILED
+
+    api_key = _env.get("OPENCOMPLAI_API_KEY", "")
+    dashboard_url = _env.get("OPENCOMPLAI_DASHBOARD_URL", "").rstrip("/")
+    if not api_key or not dashboard_url:
+        err_console.print(
+            "[red]Error:[/red] OPENCOMPLAI_API_KEY and OPENCOMPLAI_DASHBOARD_URL "
+            "must both be set."
+        )
+        return EXIT_PUBLISH_FAILED
+
+    parsed_url = urlparse(dashboard_url)
+    if parsed_url.scheme == "http" and parsed_url.hostname not in _LOCAL_HOSTNAMES:
+        err_console.print(
+            f"[yellow]Warning:[/yellow] OPENCOMPLAI_DASHBOARD_URL ({dashboard_url}) "
+            "uses plain http -- the API key will be sent unencrypted over the network. "
+            "Use https unless this is local development."
+        )
+
+    prepared = prepare_scan_status_artifact(
+        artifact, commit_env=_env, repo_dir=artifact_file.resolve().parent
+    )
+
+    # No install_id (see module docstring) -- the server derives it from
+    # the API key's own project. signature is only forwarded when the
+    # mapper changed nothing at all (G-5, see publish.envelope_signature);
+    # otherwise it falls back to "" (never null) so the envelope always
+    # matches the JSON Schema's string-or-absent shape.
+    signature = envelope_signature(artifact, prepared)
+    original_signature = artifact.get("signature")
+    if (
+        isinstance(original_signature, str)
+        and original_signature != ""
+        and not signature
+    ):
+        err_console.print(
+            "[dim]note: artifact signature not forwarded (mapped payload differs "
+            "from signed bytes; the API key attests this push)[/dim]"
+        )
+
+    envelope = {
+        "system_id": prepared.get("system_id", "unknown"),
+        "artifact": prepared,
+        "signature": signature,
+    }
+
+    status, data = publish_scan_status(dashboard_url, api_key, envelope)
+
+    if status in (200, 201):
+        outcome = escape(
+            str(data.get("outcome", "accepted" if status == 201 else "replayed"))
+        )
+        content_hash = escape(str(data.get("content_hash", "")))
+        console.print(f"[green]Push {outcome}.[/green]")
+        console.print(f"  system_id:    {envelope['system_id']}")
+        console.print(f"  content_hash: {content_hash}")
+        console.print(f"\nDashboard: {dashboard_url}")
+        return EXIT_OK
+
+    # `data` is server-controlled (a JSON error body echoed back to the
+    # terminal) -- escaped so it can never inject rich markup.
+    err_console.print(f"[red]Push failed ({status}):[/red] {escape(str(data))}")
+    return EXIT_PUBLISH_FAILED
+
+
+__all__ = ["EXIT_OK", "EXIT_PUBLISH_FAILED", "run_push"]

opencomplai_cli-0.3.0/src/opencomplai_cli/commands/serve.py

@@ -0,0 +1,37 @@
+"""CLI: opencomplai serve — local loopback dashboard."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import typer
+from rich.console import Console
+
+err_console = Console(stderr=True)
+
+
+def run_serve(project_root: Path, host: str, port: int) -> None:
+    if host not in {"127.0.0.1", "localhost"}:
+        err_console.print(
+            "[red]Error:[/red] serve binds to 127.0.0.1/localhost only "
+            "(this is not the Pro SaaS dashboard)."
+        )
+        raise typer.Exit(2)
+    try:
+        import uvicorn
+    except ImportError as exc:
+        err_console.print(
+            "[red]Error:[/red] Install the serve extra: "
+            "pip install 'opencomplai-cli[serve]'"
+        )
+        raise typer.Exit(2) from exc
+
+    from opencomplai_core.local_dashboard import create_app
+
+    app = create_app(project_root.resolve())
+    err_console.print(
+        f"[green]OpenComplAI local dashboard[/green] on http://{host}:{port}/ "
+        "(loopback only — not Pro/SaaS)"
+    )
+    uvicorn.run(app, host=host, port=port, log_level="info")

{opencomplai_cli-0.1.2 → opencomplai_cli-0.3.0}/src/opencomplai_cli/connectors/github_actions.py

@@ -19,7 +19,19 @@ Environment variables consumed
 ``GITHUB_STEP_SUMMARY``      — path to the job summary markdown file.
 ``OPENCOMPLAI_DASHBOARD_URL`` — dashboard ingest base URL.
 ``OPENCOMPLAI_TENANT_ID``    — tenant ID for the current org.
-``OPENCOMPLAI_AUTH_TOKEN``   — bearer token for dashboard ingest.
+``OPENCOMPLAI_API_KEY``      — an ``ock_...`` API key (GO-LIVE CORE-3/-4).
+                               Takes precedence over everything below: when
+                               set, the connector sends the key-authed
+                               envelope (no ``install_id``) and never
+                               touches ``OPENCOMPLAI_AUTH_TOKEN`` or OIDC.
+``OPENCOMPLAI_AUTH_TOKEN``   — bearer token for dashboard ingest (legacy
+                               JWT path, only consulted when
+                               OPENCOMPLAI_API_KEY is unset). Takes
+                               precedence over the three vars below when set.
+``OPENCOMPLAI_CLIENT_ID``       — OIDC client_id from /enroll, used only when
+                                   OPENCOMPLAI_AUTH_TOKEN is unset.
+``OPENCOMPLAI_CLIENT_SECRET``   — OIDC client_secret from /enroll (same gate).
+``OPENCOMPLAI_TOKEN_ENDPOINT``  — the IdP's OAuth2 token endpoint (same gate).
 
 Exit codes
 ----------
@@ -49,8 +61,14 @@ import json
 import os
 import subprocess
 import sys
+from pathlib import Path
 from typing import Any
 
+# `check --sign` (main.py's check_cmd) always writes its artifact here,
+# relative to whatever cwd the subprocess inherited -- this connector never
+# passes cwd= to subprocess.run, so that is this process's own cwd too.
+_ARTIFACT_FILENAME = "compliance-artifact.json"
+
 # ---------------------------------------------------------------------------
 # Platform detection helpers
 # ---------------------------------------------------------------------------
@@ -119,8 +137,18 @@ def run_connector(
     stdout = result.stdout
     stderr = result.stderr
 
-    # Parse the signed artifact result from stdout (JSON line on stdout).
-    artifact_result = _parse_artifact_result(stdout)
+    # Prefer the artifact `check --sign` wrote to disk. The `cmd` list
+    # above never passes `-o json`, so real stdout is Rich's indent=2
+    # human/JSON output (`console.print_json`) -- never the single-line
+    # JSON-object-per-line shape `_parse_artifact_result` scans for, so
+    # that parse essentially never matches a real CI run and this
+    # connector silently never published anything. The stdout parse is
+    # kept as a fallback for a caller who passes `-o json` explicitly via
+    # `check_args`, or if the artifact file is missing for some other
+    # reason (e.g. `check` crashed before writing it).
+    artifact_result = _read_disk_artifact(
+        Path(_ARTIFACT_FILENAME)
+    ) or _parse_artifact_result(stdout)
 
     # Set step output.
     if artifact_result:
@@ -153,6 +181,26 @@ def run_connector(
     return 0
 
 
+def _read_disk_artifact(path: Path) -> dict[str, Any] | None:
+    """Read a ``ScanStatusArtifact`` dict written to disk by ``check --sign``.
+
+    Returns ``None`` (never raises) on anything short of a real artifact --
+    missing file, unreadable/non-UTF-8, invalid JSON, JSON that isn't an
+    object, or an object missing the ``result`` field -- so callers can
+    fall back to the stdout parse in every one of those cases exactly as
+    if the disk read had never been attempted.
+    """
+    if not path.exists():
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    if not isinstance(data, dict) or "result" not in data:
+        return None
+    return data
+
+
 def _parse_artifact_result(stdout: str) -> dict[str, Any] | None:
     for line in stdout.splitlines():
         line = line.strip()
@@ -204,35 +252,88 @@ def _publish_to_dashboard(artifact: dict | None, env: dict[str, str]) -> None:
     if not artifact:
         return
     base_url = env.get("OPENCOMPLAI_DASHBOARD_URL", "").rstrip("/")
+    if not base_url:
+        return
+
+    from opencomplai_cli.publish import (
+        envelope_signature,
+        prepare_scan_status_artifact,
+        publish_scan_status,
+    )
+
+    # G-4: the raw artifact never validated against ingest's schema
+    # (additionalProperties: false rejected evidence_hashes/rationale_hash/
+    # scan_summary/gap_report/eval_summary/install_id outright, and
+    # commit_ref="HEAD" failed minLength: 7) — every payload this connector
+    # ever sent was rejected with a 422. prepare_scan_status_artifact fills
+    # in only what the OSS artifact genuinely lacks (policy_bundle_version,
+    # timestamp, a real commit_ref); everything else passes through
+    # untouched onto the now-widened schema.
+
+    api_key = env.get("OPENCOMPLAI_API_KEY", "")
+    if api_key:
+        # ock_ key-authed path (GO-LIVE CORE-3/CORE-4) — the same auth
+        # `opencomplai push` uses. Takes priority over OPENCOMPLAI_AUTH_TOKEN
+        # and the OIDC client-credentials grant below: a caller who sets
+        # OPENCOMPLAI_API_KEY has opted into the key-authed contract, which
+        # is a different envelope shape (no install_id at all — the server
+        # derives it from the key's own project), not just a different
+        # bearer value on the same envelope.
+        prepared = prepare_scan_status_artifact(artifact, commit_env=env)
+        envelope = {
+            "system_id": prepared.get("system_id", "unknown"),
+            "artifact": prepared,
+            "signature": envelope_signature(artifact, prepared),
+        }
+        status, data = publish_scan_status(base_url, api_key, envelope)
+        if status not in (200, 201):
+            _annotate(
+                "warning",
+                f"Opencomplai dashboard publish failed: HTTP {status} {data}",
+            )
+        return
+
+    # Legacy JWT/OIDC path (pre-CORE-3 envelope contract). An operator-set
+    # OPENCOMPLAI_AUTH_TOKEN always wins. If unset, acquire one via the
+    # OIDC client-credentials grant using the pair /enroll issued
+    # (AUTH-SAAS) — same trio of env vars, no manual token pasting.
     token = env.get("OPENCOMPLAI_AUTH_TOKEN", "")
-    if not base_url or not token:
+    if not token:
+        client_id = env.get("OPENCOMPLAI_CLIENT_ID", "")
+        client_secret = env.get("OPENCOMPLAI_CLIENT_SECRET", "")
+        token_endpoint = env.get("OPENCOMPLAI_TOKEN_ENDPOINT", "")
+        if client_id and client_secret and token_endpoint:
+            from opencomplai_cli.oidc_client import OidcTokenError, acquire_token
+
+            try:
+                token, _ = acquire_token(token_endpoint, client_id, client_secret)
+            except OidcTokenError as exc:
+                _annotate(
+                    "warning", f"Opencomplai OIDC token acquisition failed: {exc}"
+                )
+
+    if not token:
         return
 
-    import urllib.error
-    import urllib.request
+    prepared = prepare_scan_status_artifact(artifact, commit_env=env)
 
     install_id = env.get("OPENCOMPLAI_INSTALL_ID", "unknown")
-    payload = {
+    envelope = {
         "install_id": install_id,
-        "system_id": artifact.get("system_id", "unknown"),
-        "artifact": artifact,
-        "signature": artifact.get("signature", ""),
+        "system_id": prepared.get("system_id", "unknown"),
+        "artifact": prepared,
+        # envelope_signature (not prepared.get("signature", "")) — otherwise
+        # an unsigned OSS artifact dict carrying an explicit
+        # `"signature": None` key would send JSON `null`: .get()'s default
+        # only applies when the key is absent, not when it's None.
+        "signature": envelope_signature(artifact, prepared),
     }
-    data = json.dumps(payload).encode()
-    req = urllib.request.Request(
-        f"{base_url}/v1/ingest/scan-status",
-        data=data,
-        headers={
-            "Content-Type": "application/json",
-            "Authorization": f"Bearer {token}",
-        },
-        method="POST",
-    )
-    try:
-        with urllib.request.urlopen(req, timeout=30):
-            pass
-    except Exception as exc:
-        _annotate("warning", f"Opencomplai dashboard publish failed: {exc}")
+    status, data = publish_scan_status(base_url, token, envelope)
+    if status not in (200, 201):
+        _annotate(
+            "warning",
+            f"Opencomplai dashboard publish failed: HTTP {status} {data}",
+        )
 
 
 # ---------------------------------------------------------------------------