opencomplai-cli 0.9.0__tar.gz → 0.9.2__tar.gz

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opencomplai-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: Opencomplai command-line interface for AI compliance: the EU AI Act, and NIST AI RMF derived from the same evidence
 Project-URL: Homepage, https://opencomplai.com
 Project-URL: Documentation, https://docs.opencomplai.com
@@ -18,7 +18,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.11
-Requires-Dist: opencomplai-core[reports]>=0.9.0
+Requires-Dist: opencomplai-core[reports]>=0.9.2
 Requires-Dist: questionary>=2.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: typer>=0.9.0

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "opencomplai-cli"
-version = "0.9.0"
+version = "0.9.2"
 description = "Opencomplai command-line interface for AI compliance: the EU AI Act, and NIST AI RMF derived from the same evidence"
 readme = "README.md"
 license = { text = "AGPL-3.0-only" }
@@ -17,7 +17,7 @@ classifiers = [
     "Topic :: Software Development :: Quality Assurance",
 ]
 dependencies = [
-    "opencomplai-core[reports]>=0.9.0",
+    "opencomplai-core[reports]>=0.9.2",
     "typer>=0.9.0",
     "rich>=13.0.0",
     "questionary>=2.0.0",

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/__init__.py

@@ -1,6 +1,6 @@
 """Opencomplai CLI."""
 
-__version__ = "0.9.0"
+__version__ = "0.9.2"
 
 # Canonical project metadata — single source of truth for the `--version`
 # flag and the `opencomplai info` command. Mirrors the [project] table in

opencomplai_cli-0.9.2/src/opencomplai_cli/ai_status.py

@@ -0,0 +1,37 @@
+"""Pure helpers for `opencomplai ai status` (stdlib only)."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+def cache_files(cache_dir: Path) -> list[tuple[str, int]]:
+    """Regular files under cache_dir (recursive) as (relative posix path, bytes), sorted."""
+    root = Path(cache_dir)
+    if not root.is_dir():
+        return []
+    found: list[tuple[str, int]] = []
+    for dirpath, _dirs, names in os.walk(root, followlinks=False):
+        for name in names:
+            p = Path(dirpath) / name
+            try:
+                if p.is_symlink() or not p.is_file():
+                    continue
+                size = p.stat().st_size
+            except OSError:
+                continue
+            found.append((p.relative_to(root).as_posix(), size))
+    return sorted(found)
+
+
+def format_cache_size(total_bytes: int) -> str:
+    if total_bytes <= 0:
+        return "0 MB"
+    if total_bytes < 1024 * 1024:
+        return "<1 MB"
+    return f"{total_bytes // (1024 * 1024)} MB"
+
+
+def spec_size_label(size_mb: int) -> str:
+    return "unknown" if size_mb <= 0 else f"~{size_mb} MB"

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/commands/dashboard.py

@@ -71,7 +71,7 @@ def _write_client_secret(raw_secret: str) -> None:
     doesn't apply the same way.
     """
     _OPENCOMPLAI_DIR.mkdir(parents=True, exist_ok=True)
-    _CLIENT_SECRET_FILE.write_text(raw_secret)
+    _CLIENT_SECRET_FILE.write_text(raw_secret, encoding="utf-8")
     try:
         os.chmod(_CLIENT_SECRET_FILE, 0o600)
     except (OSError, NotImplementedError):
@@ -81,7 +81,7 @@ def _write_client_secret(raw_secret: str) -> None:
 def _read_client_secret() -> str | None:
     if not _CLIENT_SECRET_FILE.exists():
         return None
-    secret = _CLIENT_SECRET_FILE.read_text().strip()
+    secret = _CLIENT_SECRET_FILE.read_text(encoding="utf-8").strip()
     return secret or None
 
 
@@ -117,14 +117,14 @@ def _load_egress_allowlist() -> dict:
     if not _EGRESS_ALLOWLIST.exists():
         return {}
     try:
-        return json.loads(_EGRESS_ALLOWLIST.read_text())
+        return json.loads(_EGRESS_ALLOWLIST.read_text(encoding="utf-8"))
     except Exception:
         return {}
 
 
 def _write_egress_allowlist(data: dict) -> None:
     _OPENCOMPLAI_DIR.mkdir(parents=True, exist_ok=True)
-    _EGRESS_ALLOWLIST.write_text(json.dumps(data, indent=2) + "\n")
+    _EGRESS_ALLOWLIST.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
 
 
 def _append_ledger_event(event: dict) -> None:
@@ -137,7 +137,7 @@ def _ledger_events() -> list[dict]:
     if not _LEDGER_FILE.exists():
         return []
     events: list[dict] = []
-    for line in _LEDGER_FILE.read_text().splitlines():
+    for line in _LEDGER_FILE.read_text(encoding="utf-8").splitlines():
         try:
             events.append(json.loads(line))
         except Exception:
@@ -236,7 +236,7 @@ def enroll(
             "[red]Error:[/red] signing.pub not found — run `opencomplai init` first."
         )
         sys.exit(2)
-    public_key_pem = _SIGNING_PUB.read_text().strip()
+    public_key_pem = _SIGNING_PUB.read_text(encoding="utf-8").strip()
 
     # --- POST /v1/admin/enroll ---
     try:

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/commands/halt.py

@@ -235,7 +235,7 @@ def resume_cmd(
     if token_str.startswith("@"):
         token_path = Path(token_str[1:])
         try:
-            token_str = token_path.read_text().strip()
+            token_str = token_path.read_text(encoding="utf-8").strip()
         except OSError as exc:
             main_mod.err_console.print(
                 f"[red]Error:[/red] cannot read approval token file: {exc}"

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/commands/oversight_log.py

@@ -56,7 +56,9 @@ def declared_roles(manifest_path: Path) -> list[str]:
     if not manifest_path.exists():
         return []
     try:
-        manifest = SystemManifest.model_validate_json(manifest_path.read_text())
+        manifest = SystemManifest.model_validate_json(
+            manifest_path.read_text(encoding="utf-8")
+        )
     except (OSError, ValueError) as exc:
         raise ValueError(f"cannot read manifest {manifest_path}: {exc}") from None
     if manifest.human_oversight is None:

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/commands/portfolio.py

@@ -66,6 +66,11 @@ def safe_dir_name(system_id: str) -> str:
     return "_" if name in ("", ".", "..") else name
 
 
+def _per_system_path(path: Path, sid: str) -> Path:
+    """`r.xml` + `alpha` -> `r.alpha.xml`, so systems never share a report file."""
+    return path.with_name(f"{path.stem}.{safe_dir_name(sid)}{path.suffix}")
+
+
 def _read_raw(path: Path) -> object:
     from opencomplai_cli.inputs import read_json_file
 
@@ -75,6 +80,30 @@ def _read_raw(path: Path) -> object:
         return None
 
 
+def _per_system_sample_set(path: Path | None, sid: str, sys_dir: Path) -> Path | None:
+    """Copy of the shared sample set with `system_id` set to `sid`, written to
+    `sys_dir`. Anything unreadable or malformed returns `path` unchanged so the
+    child run prints its normal error; the shared file is never modified."""
+    if path is None:
+        return None
+    try:
+        raw = json.loads(Path(path).read_text(encoding="utf-8-sig"))
+    except (OSError, ValueError):
+        return path
+    if not isinstance(raw, dict) or not isinstance(raw.get("system_id"), str):
+        return path
+    try:
+        sys_dir.mkdir(parents=True, exist_ok=True)
+        copy = sys_dir / "sample-set.json"
+        copy.write_text(
+            json.dumps({**raw, "system_id": sid}, indent=2, ensure_ascii=False),
+            encoding="utf-8",
+        )
+    except OSError:
+        return path
+    return copy
+
+
 def _system_id(path: Path) -> str:
     raw = _read_raw(path)
     sid = raw.get("system_id") if isinstance(raw, dict) else None
@@ -123,6 +152,13 @@ def run_portfolio(
             "output_dir": sys_dir,
             "output": _consoles()[2].human,
         }
+        for key in ("report_junit", "sarif_output", "summary_md"):
+            if params.get(key) is not None:
+                params[key] = _per_system_path(Path(params[key]), sid)
+        if params.get("sample_set_file") is not None:
+            params["sample_set_file"] = _per_system_sample_set(
+                params["sample_set_file"], sid, sys_dir
+            )
         try:
             invoke(**params)
             code = 0
@@ -159,7 +195,7 @@ def run_portfolio(
     out = ctx_params["output"]
     console = _consoles()[0]
     if getattr(out, "value", out) == "json":
-        console.print_json(path.read_text())
+        console.print_json(path.read_text(encoding="utf-8"))
     else:
         console.print("\n[bold]Portfolio[/bold]")
         for e in sorted(entries, key=lambda e: e["system_id"]):

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/commands/qms.py

@@ -124,7 +124,7 @@ def generate_cmd(
             sys.exit(2)
         try:
             manifest = SystemManifest.model_validate(
-                json.loads(manifest_file.read_text())
+                json.loads(manifest_file.read_text(encoding="utf-8"))
             )
         except Exception as e:
             _main.err_console.print(f"[red]Validation error:[/red] {e}")
@@ -134,7 +134,7 @@ def generate_cmd(
     if scan_report_file.exists():
         try:
             scan_report = CorroborationReport.model_validate(
-                json.loads(scan_report_file.read_text())
+                json.loads(scan_report_file.read_text(encoding="utf-8"))
             )
         except Exception as exc:
             _main.err_console.print(
@@ -145,7 +145,7 @@ def generate_cmd(
     if eval_report_file.exists():
         try:
             eval_report = EvalReport.model_validate(
-                json.loads(eval_report_file.read_text())
+                json.loads(eval_report_file.read_text(encoding="utf-8"))
             )
         except Exception as exc:
             _main.err_console.print(

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/connectors/github_actions.py

@@ -125,7 +125,7 @@ def _gha_cmd(cmd: str, value: str) -> None:
 def _set_output(name: str, value: str) -> None:
     output_file = os.environ.get("GITHUB_OUTPUT", "")
     if output_file:
-        with open(output_file, "a") as fh:
+        with open(output_file, "a", encoding="utf-8") as fh:
             fh.write(f"{name}={value}\n")
     else:
         _gha_cmd("set-output", f"name={name}::{value}")
@@ -134,7 +134,7 @@ def _set_output(name: str, value: str) -> None:
 def _append_summary(markdown: str) -> None:
     summary_file = os.environ.get("GITHUB_STEP_SUMMARY", "")
     if summary_file:
-        with open(summary_file, "a") as fh:
+        with open(summary_file, "a", encoding="utf-8") as fh:
             fh.write(markdown + "\n")
 
 

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/connectors/gitlab_ci.py

@@ -216,7 +216,7 @@ def run_connector(
     # JUnit XML artifact.
     xml_content = _build_junit_xml(artifact_result, stdout)
     try:
-        with open(junit_path, "w") as fh:
+        with open(junit_path, "w", encoding="utf-8") as fh:
             fh.write(xml_content)
     except OSError:
         pass
@@ -307,7 +307,7 @@ def _write_dotenv(path: str, artifact: dict) -> None:
         f"OPENCOMPLAI_CONTENT_HASH={artifact.get('content_hash', '')}",
     ]
     try:
-        with open(path, "w") as fh:
+        with open(path, "w", encoding="utf-8") as fh:
             fh.write("\n".join(lines) + "\n")
     except OSError:
         pass

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/src/opencomplai_cli/main.py

@@ -5028,9 +5028,11 @@ def ai_configure_cmd(
     else:
         import questionary
 
+        from opencomplai_cli.ai_status import spec_size_label
+
         choices = []
         for mid, spec in MODEL_CATALOG.items():
-            label = f"{mid:<28} [{spec.size_mb} MB,  {spec.license},  {spec.runtime}]"
+            label = f"{mid:<28} [{spec_size_label(spec.size_mb)},  {spec.license},  {spec.runtime}]"
             if mid == "qwen2.5-coder-1.5b":
                 label += "  ← recommended"
             if mid == "codebert-onnx":
@@ -5068,6 +5070,12 @@ def ai_status_cmd() -> None:
     from opencomplai_ai.config import get_active_model, get_cache_dir
     from opencomplai_ai.models import MODEL_CATALOG
 
+    from opencomplai_cli.ai_status import (
+        cache_files,
+        format_cache_size,
+        spec_size_label,
+    )
+
     active = get_active_model()
     spec = MODEL_CATALOG.get(active)
     cache_dir = get_cache_dir()
@@ -5076,7 +5084,7 @@ def ai_status_cmd() -> None:
     console.print(f"  active model  : {active}")
     if spec:
         console.print(f"  display name  : {spec.display_name}")
-        console.print(f"  size          : ~{spec.size_mb} MB")
+        console.print(f"  size          : {spec_size_label(spec.size_mb)}")
         console.print(f"  runtime       : {spec.runtime}")
         console.print(f"  license       : {spec.license}")
         deep_status = (
@@ -5088,17 +5096,21 @@ def ai_status_cmd() -> None:
             console.print(f"  llama-cpp     : {deep_status}")
     console.print(f"  cache dir     : {cache_dir}")
 
-    if cache_dir.exists():
-        total = sum(f.stat().st_size for f in cache_dir.iterdir() if f.is_file())
-        console.print(f"  cache size    : {total // (1024 * 1024)} MB")
-        cached = [f.name for f in cache_dir.iterdir() if f.is_file()]
-        if cached:
-            console.print(f"  cached files  : {', '.join(cached)}")
+    files = cache_files(cache_dir)
+    if files:
+        from rich.markup import escape
+
+        console.print(
+            f"  cache size    : {format_cache_size(sum(n for _, n in files))}"
+        )
+        console.print(f"  cached files  : {', '.join(escape(p) for p, _ in files)}")
     elif spec is None or spec.needs_preload:
         # codebert-onnx (deterministic matcher) and saas (cloud client) have no
         # local artifact, so an empty cache is not a missing download. Models
         # downloaded earlier are still listed above when the cache exists.
         console.print("  cache dir     : (empty — model not yet downloaded)")
+    elif cache_dir.exists():
+        console.print("  cache size    : 0 MB")
     console.print()
 
 

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/tests/test_agents_cmd.py

@@ -17,7 +17,9 @@ runner = CliRunner()
 FIXTURES = Path(__file__).parent / "fixtures" / "agents"
 MANIFEST = str(FIXTURES / "sample-manifest.json")
 SCAN = str(FIXTURES / "sample-scan-report.json")
-_MET = re.compile(r"\bMet\b")
+_MET = re.compile(
+    r'\bMet\b|\bMET\b|(?i:"(?:status|verdict|result)"\s*:\s*"met"|\|\s*met\s*\||\bstatus\s*[:=]\s*met\b)'
+)
 
 
 @pytest.fixture(autouse=True)
@@ -130,6 +132,41 @@ def test_check_never_emits_met(tmp_path):
             assert "not a compliance verdict" in out
 
 
+@pytest.mark.parametrize(
+    "text",
+    ['{"status": "met"}', '"status": "MET"', "| Met |", "Met"],
+)
+def test_met_guard_matches_every_spelling(text):
+    assert _MET.search(text)
+
+
+@pytest.mark.parametrize(
+    "text",
+    ['"status": "partial"', "evidence only; not a compliance verdict"],
+)
+def test_met_guard_ignores_other_values(text):
+    assert not _MET.search(text)
+
+
+def _strings(node):
+    if isinstance(node, dict):
+        for key, value in node.items():
+            yield from _strings(key)
+            yield from _strings(value)
+    elif isinstance(node, list):
+        for item in node:
+            yield from _strings(item)
+    elif isinstance(node, str):
+        yield node
+
+
+def test_check_json_has_no_met_value(tmp_path):
+    for scan in (None, SCAN, _clean_scan(tmp_path)):
+        extra = ["--scan-report", scan] if scan else []
+        data = json.loads(_run("check", "-m", MANIFEST, *extra, "-o", "json").output)
+        assert all(s.lower() != "met" for s in _strings(data))
+
+
 def test_report_lists_responsibilities_with_review_flag():
     expected = {r.id for r in get_responsibilities()}
     data = json.loads(_run("report", "-m", MANIFEST, "--format", "json").output)

{opencomplai_cli-0.9.0 → opencomplai_cli-0.9.2}/tests/test_ai_status.py

@@ -74,3 +74,72 @@ def test_status_for_gguf_model_still_reports_missing_download(monkeypatch, tmp_p
 
     assert "llama-cpp" in out
     assert "not yet downloaded" in out
+
+
+def _status_with_cache(monkeypatch, cache, model_id: str) -> str:
+    monkeypatch.setattr("opencomplai_ai.config.get_active_model", lambda: model_id)
+    monkeypatch.setattr("opencomplai_ai.config.get_cache_dir", lambda: cache)
+    result = runner.invoke(app, ["ai", "status"])
+    assert result.exit_code == 0, result.output
+    return result.output
+
+
+def test_status_counts_nested_cache_file(monkeypatch, tmp_path):
+    cache = tmp_path / "cache"
+    (cache / "codebert-base").mkdir(parents=True)
+    (cache / "codebert-base" / "model.onnx").write_bytes(b"x" * (3 * 1024 * 1024))
+
+    out = _status_with_cache(monkeypatch, cache, "codebert-onnx")
+
+    assert "cache size    : 3 MB" in out
+    assert "codebert-base/model.onnx" in out
+    assert "not yet downloaded" not in out
+
+
+def test_status_small_nested_cache_file_reports_less_than_one_mb(monkeypatch, tmp_path):
+    cache = tmp_path / "cache"
+    (cache / "sub").mkdir(parents=True)
+    (cache / "sub" / "f.bin").write_bytes(b"x" * 10)
+
+    out = _status_with_cache(monkeypatch, cache, "codebert-onnx")
+
+    assert "<1 MB" in out
+
+
+@pytest.mark.parametrize("sub", [False, True])
+def test_status_empty_cache_dir_prints_not_yet_downloaded(monkeypatch, tmp_path, sub):
+    cache = tmp_path / "cache"
+    cache.mkdir()
+    if sub:
+        (cache / "empty-sub").mkdir()
+
+    out = _status_with_cache(monkeypatch, cache, "qwen2.5-coder-1.5b")
+
+    assert "not yet downloaded" in out
+    assert "cache size" not in out
+
+
+@pytest.mark.parametrize("model_id", ["codebert-onnx", "saas"])
+def test_status_empty_cache_dir_for_no_download_backend_has_no_not_yet_downloaded_line(
+    monkeypatch, tmp_path, model_id
+):
+    cache = tmp_path / "cache"
+    cache.mkdir()
+
+    out = _status_with_cache(monkeypatch, cache, model_id)
+
+    assert "not yet downloaded" not in out
+
+
+@pytest.mark.parametrize("model_id", ["codebert-onnx", "saas"])
+def test_status_size_mb_zero_prints_unknown(monkeypatch, tmp_path, model_id):
+    out = _status(monkeypatch, tmp_path, model_id)
+
+    assert "size          : unknown" in out
+    assert "~0 MB" not in out
+
+
+def test_status_known_size_still_prints_approximate_mb(monkeypatch, tmp_path):
+    out = _status(monkeypatch, tmp_path, "qwen2.5-coder-1.5b")
+
+    assert "~1000 MB" in out

opencomplai_cli-0.9.2/tests/test_ai_status_cache.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+import os
+
+import pytest
+from opencomplai_cli.ai_status import cache_files, format_cache_size, spec_size_label
+
+
+def test_cache_files_counts_nested_files_sorted(tmp_path):
+    (tmp_path / "b.gguf").write_bytes(b"x" * 5)
+    (tmp_path / "codebert-base").mkdir()
+    (tmp_path / "codebert-base" / "model.onnx").write_bytes(b"y" * 7)
+    assert cache_files(tmp_path) == [("b.gguf", 5), ("codebert-base/model.onnx", 7)]
+
+
+def test_cache_files_ignores_missing_dir_and_empty_subdirs(tmp_path):
+    assert cache_files(tmp_path / "nope") == []
+    (tmp_path / "a" / "b").mkdir(parents=True)
+    assert cache_files(tmp_path) == []
+
+
+def test_cache_files_skips_symlinks(tmp_path):
+    target = tmp_path / "real.bin"
+    target.write_bytes(b"z")
+    cache = tmp_path / "cache"
+    cache.mkdir()
+    try:
+        os.symlink(target, cache / "link.bin")
+    except (OSError, NotImplementedError):
+        pytest.skip("symlinks unavailable")
+    assert cache_files(cache) == []
+
+
+def test_format_cache_size_boundaries():
+    assert format_cache_size(0) == "0 MB"
+    assert format_cache_size(1) == "<1 MB"
+    assert format_cache_size(1048575) == "<1 MB"
+    assert format_cache_size(1048576) == "1 MB"
+    assert format_cache_size(3 * 1048576 + 5) == "3 MB"
+
+
+def test_spec_size_label():
+    assert spec_size_label(0) == "unknown"
+    assert spec_size_label(-1) == "unknown"
+    assert spec_size_label(1000) == "~1000 MB"

opencomplai_cli-0.9.2/tests/test_changelog_newest_block.py

@@ -0,0 +1,82 @@
+"""Structure and hygiene guard for the newest release block of CHANGELOG.md.
+
+Text only: the newest ``## [x.y.z]`` block must match the CLI version, keep the
+Keep a Changelog heading order, have its footer link, carry no internal words,
+and share no bullet with the dashboard notes.
+"""
+
+import re
+import tomllib
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[3]
+CHANGELOG = ROOT / "CHANGELOG.md"
+SAAS_CHANGELOG = ROOT / "dashboard-saas" / "CHANGELOG.md"
+CLI_PYPROJECT = ROOT / "packages" / "cli" / "pyproject.toml"
+
+pytestmark = pytest.mark.skipif(
+    not CHANGELOG.is_file(), reason="CHANGELOG.md is not in this tree"
+)
+
+ORDER = ["Breaking", "Added", "Changed", "Removed", "Fixed", "Security"]
+FORBIDDEN = (
+    r"dashboard|hosted|SaaS|tenant|\bSU-\d|\bCL-[A-Z]|HANDOFF|lawyer"
+    r"|trust pack|enterprise|private"
+)
+BLOCK_START = re.compile(r"^## \[(\d+\.\d+\.\d+)\]", re.M)
+
+
+def _newest(path: Path) -> tuple[str, str]:
+    text = path.read_text(encoding="utf-8")
+    first = BLOCK_START.search(text)
+    assert first, f"no release block in {path}"
+    nxt = BLOCK_START.search(text, first.end())
+    end = nxt.start() if nxt else len(text)
+    return first.group(1), text[first.start() : end]
+
+
+def _bullets(block: str) -> set[str]:
+    return {ln for ln in block.splitlines() if ln.startswith("- ")}
+
+
+def test_newest_block_version_matches_cli():
+    version, _ = _newest(CHANGELOG)
+    cli = tomllib.loads(CLI_PYPROJECT.read_text(encoding="utf-8"))["project"]["version"]
+    assert version == cli
+
+
+def test_newest_block_headings_in_order():
+    _, block = _newest(CHANGELOG)
+    headings = re.findall(r"^### (.+?)\s*$", block, re.M)
+    assert len(headings) == len(set(headings)), f"duplicate headings: {headings}"
+    unknown = [h for h in headings if h not in ORDER]
+    assert not unknown, f"unknown headings: {unknown}"
+    assert headings == sorted(headings, key=ORDER.index), headings
+
+
+def test_footer_link_present():
+    version, _ = _newest(CHANGELOG)
+    link = (
+        f"[{version}]: https://github.com/Opencomplai/opencomplai"
+        f"/releases/tag/v{version}"
+    )
+    assert link in CHANGELOG.read_text(encoding="utf-8").splitlines()
+
+
+def test_newest_release_has_no_forbidden_words():
+    _, block = _newest(CHANGELOG)
+    pattern = re.compile(FORBIDDEN, re.I)
+    hits = [ln for ln in block.splitlines() if pattern.search(ln)]
+    assert not hits, f"internal words in the newest block: {hits}"
+
+
+def test_saas_notes_share_no_bullet_with_public():
+    if not SAAS_CHANGELOG.is_file():
+        pytest.skip("dashboard-saas/CHANGELOG.md is not in this tree")
+    public_version, public = _newest(CHANGELOG)
+    saas_version, saas = _newest(SAAS_CHANGELOG)
+    assert saas_version == public_version
+    shared = _bullets(public) & _bullets(saas)
+    assert not shared, f"bullets in both blocks: {sorted(shared)}"