opencomplai-core 0.1.0__tar.gz

opencomplai_core-0.1.0/.gitignore

@@ -0,0 +1,69 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+.coverage
+htmlcov/
+.mypy_cache/
+
+# uv — DO NOT ignore uv.lock
+.venv/
+
+# Node.js
+node_modules/
+dist/
+*.js.map
+.pnpm-store/
+
+# Editors
+.idea/
+.vscode/
+*.swp
+.DS_Store
+.cursor/*
+.autopilot.json
+
+# Secrets
+.env
+*.pem
+*.key
+
+# Docs build output
+site/
+docs/site/
+docs-env/
+.mkdocs/
+
+# Build artifacts
+.mintlify/
+
+# Opencomplai generated artifacts (output of `opencomplai init` / `opencomplai check`)
+compliance-artifact.json
+system-manifest.json
+# ...but keep the committed example fixtures used by the scanner docs
+!examples/sample-system/**/system-manifest.json
+!tests/fixtures/**/system-manifest.json
+.venv-ci-check/*
+# GitHub issues sync output (local mirror; may contain PII from issues)
+github-issues/
+
+docs/src/assets/js/checker-widget.js
+docs/checker-widget/src/data/
+docs/checker-widget/node_modules/
+packages/cli/src/opencomplai_cli/data/checker-local.html
+
+# --- Public-repo hardening (keep AI-tooling and internal artifacts out) ---
+.claude/
+.cursor/
+.autopilot.json
+.selfaudit/
+compliance-reports/
+*.plan.md
+x.key
+.tmp-*.db
+ci-logs/
+tmp/

opencomplai_core-0.1.0/PKG-INFO

@@ -0,0 +1,108 @@
+Metadata-Version: 2.4
+Name: opencomplai-core
+Version: 0.1.0
+Summary: Opencomplai core risk assessment engine for EU AI Act compliance
+Project-URL: Homepage, https://opencomplai.com
+Project-URL: Documentation, https://docs.opencomplai.com
+Author-email: Opencomplai <hello@opencomplai.com>
+License: AGPL-3.0-only
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=48.0.1
+Requires-Dist: pydantic>=2.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: ruff>=0.1.0; extra == 'dev'
+Provides-Extra: reports
+Requires-Dist: fpdf2>=2.7; extra == 'reports'
+Description-Content-Type: text/markdown
+
+# opencomplai-core
+
+[![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
+[![PyPI](https://img.shields.io/pypi/v/opencomplai-core.svg)](https://pypi.org/project/opencomplai-core/)
+[![Python](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
+
+The EU AI Act compliance risk engine at the heart of [Opencomplai](https://opencomplai.com).
+`opencomplai-core` turns a declared `system-manifest.json` and your source tree into a
+deterministic, rule-based risk classification — no LLM calls, no network access, fully
+reproducible.
+
+It powers risk classification (`UnacceptableRiskRule`, `AnnexIIIClassifierRule`,
+`ProfilingDetectionRule`, `SubstantialModificationRule`) and the code-corroboration scan
+engine that cross-checks what a manifest *claims* against what the code actually does.
+
+## Install
+
+```bash
+pip install opencomplai-core
+```
+
+For PDF report generation, install the optional extra:
+
+```bash
+pip install "opencomplai-core[reports]"
+```
+
+> Most users want the [`opencomplai`](https://pypi.org/project/opencomplai/) meta-package
+> (engine + CLI) or the [`opencomplai-cli`](https://pypi.org/project/opencomplai-cli/)
+> command-line tool. Install `opencomplai-core` directly when you are embedding the engine
+> in your own application.
+
+## Quick start
+
+### Classify a model from a declared manifest
+
+```python
+from opencomplai import assess, AssessmentInput, ModelMetadata
+
+result = assess(AssessmentInput(
+    model=ModelMetadata(
+        name="loan-scorer",
+        version="1.0.0",
+        modality="tabular",
+        use_case="creditworthiness scoring for consumer loans",
+        deployment_context="production",
+    )
+))
+
+print(result.risk_level)        # e.g. RiskLevel.HIGH
+for rule in result.rule_results:
+    print(rule.rule_id, "PASS" if rule.passed else "FAIL")
+```
+
+### Corroborate a manifest against the code
+
+```python
+from pathlib import Path
+from opencomplai_core.scan_engine import run_scan
+
+report = run_scan(
+    repo_root=Path("."),
+    commit_ref="HEAD",
+)
+
+print(report.summary.result)            # PASS / CONTROL_FAIL / ...
+for finding in report.findings:
+    print(finding.finding_id, finding.mapped_taxonomy)
+```
+
+The scan engine extracts features from the repository, fuses evidence across detectors,
+and maps findings to EU AI Act taxonomy (Annex III high-risk areas, Article 5 prohibited
+practices, profiling under Article 6).
+
+## What you get
+
+- **Deterministic risk classification** — same inputs always produce the same output, so
+  results are auditable and CI-gateable.
+- **Code corroboration** — detect when a manifest under-declares (claims minimal risk while
+  the code does biometric identification, profiling, etc.).
+- **Merkle-linked evidence** — findings carry verifiable evidence items for audit trails.
+
+## Documentation
+
+Full docs, the EU AI Act concepts guide, and the SDK reference live at
+**[docs.opencomplai.com](https://docs.opencomplai.com)**.
+
+## License
+
+AGPL-3.0-only. See [LICENSE](https://www.gnu.org/licenses/agpl-3.0).

opencomplai_core-0.1.0/README.md

@@ -0,0 +1,90 @@
+# opencomplai-core
+
+[![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
+[![PyPI](https://img.shields.io/pypi/v/opencomplai-core.svg)](https://pypi.org/project/opencomplai-core/)
+[![Python](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
+
+The EU AI Act compliance risk engine at the heart of [Opencomplai](https://opencomplai.com).
+`opencomplai-core` turns a declared `system-manifest.json` and your source tree into a
+deterministic, rule-based risk classification — no LLM calls, no network access, fully
+reproducible.
+
+It powers risk classification (`UnacceptableRiskRule`, `AnnexIIIClassifierRule`,
+`ProfilingDetectionRule`, `SubstantialModificationRule`) and the code-corroboration scan
+engine that cross-checks what a manifest *claims* against what the code actually does.
+
+## Install
+
+```bash
+pip install opencomplai-core
+```
+
+For PDF report generation, install the optional extra:
+
+```bash
+pip install "opencomplai-core[reports]"
+```
+
+> Most users want the [`opencomplai`](https://pypi.org/project/opencomplai/) meta-package
+> (engine + CLI) or the [`opencomplai-cli`](https://pypi.org/project/opencomplai-cli/)
+> command-line tool. Install `opencomplai-core` directly when you are embedding the engine
+> in your own application.
+
+## Quick start
+
+### Classify a model from a declared manifest
+
+```python
+from opencomplai import assess, AssessmentInput, ModelMetadata
+
+result = assess(AssessmentInput(
+    model=ModelMetadata(
+        name="loan-scorer",
+        version="1.0.0",
+        modality="tabular",
+        use_case="creditworthiness scoring for consumer loans",
+        deployment_context="production",
+    )
+))
+
+print(result.risk_level)        # e.g. RiskLevel.HIGH
+for rule in result.rule_results:
+    print(rule.rule_id, "PASS" if rule.passed else "FAIL")
+```
+
+### Corroborate a manifest against the code
+
+```python
+from pathlib import Path
+from opencomplai_core.scan_engine import run_scan
+
+report = run_scan(
+    repo_root=Path("."),
+    commit_ref="HEAD",
+)
+
+print(report.summary.result)            # PASS / CONTROL_FAIL / ...
+for finding in report.findings:
+    print(finding.finding_id, finding.mapped_taxonomy)
+```
+
+The scan engine extracts features from the repository, fuses evidence across detectors,
+and maps findings to EU AI Act taxonomy (Annex III high-risk areas, Article 5 prohibited
+practices, profiling under Article 6).
+
+## What you get
+
+- **Deterministic risk classification** — same inputs always produce the same output, so
+  results are auditable and CI-gateable.
+- **Code corroboration** — detect when a manifest under-declares (claims minimal risk while
+  the code does biometric identification, profiling, etc.).
+- **Merkle-linked evidence** — findings carry verifiable evidence items for audit trails.
+
+## Documentation
+
+Full docs, the EU AI Act concepts guide, and the SDK reference live at
+**[docs.opencomplai.com](https://docs.opencomplai.com)**.
+
+## License
+
+AGPL-3.0-only. See [LICENSE](https://www.gnu.org/licenses/agpl-3.0).

opencomplai_core-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[project]
+name = "opencomplai-core"
+version = "0.1.0"
+description = "Opencomplai core risk assessment engine for EU AI Act compliance"
+readme = "README.md"
+license = { text = "AGPL-3.0-only" }
+authors = [{ name = "Opencomplai", email = "hello@opencomplai.com" }]
+requires-python = ">=3.11"
+dependencies = [
+    "pydantic>=2.0",
+    "cryptography>=48.0.1",
+]
+
+[project.urls]
+Homepage = "https://opencomplai.com"
+Documentation = "https://docs.opencomplai.com"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0",
+    "ruff>=0.1.0",
+]
+reports = [
+    "fpdf2>=2.7",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

opencomplai_core-0.1.0/src/opencomplai_core/__init__.py

@@ -0,0 +1,22 @@
+"""Opencomplai core risk assessment engine."""
+
+from opencomplai_core.engine import assess
+from opencomplai_core.models import (
+    AssessmentInput,
+    EvidenceObject,
+    LedgerEvent,
+    RiskResult,
+    ScanStatusArtifact,
+    SystemManifest,
+)
+
+__version__ = "0.1.0"
+__all__ = [
+    "AssessmentInput",
+    "EvidenceObject",
+    "LedgerEvent",
+    "RiskResult",
+    "ScanStatusArtifact",
+    "SystemManifest",
+    "assess",
+]

opencomplai_core-0.1.0/src/opencomplai_core/adapters/__init__.py

@@ -0,0 +1,25 @@
+"""Source adapter registry for the Ground Truth Verification Graph."""
+
+from __future__ import annotations
+
+from opencomplai_core.adapters.base import SourceAdapter
+from opencomplai_core.adapters.http import HTTPAdapter
+from opencomplai_core.adapters.offline import OfflineAdapter
+
+__all__ = ["HTTPAdapter", "OfflineAdapter", "SourceAdapter", "get_adapter"]
+
+
+def get_adapter(source_ref: str, egress_proxy_url: str = "") -> SourceAdapter:
+    """
+    Return the appropriate SourceAdapter for source_ref.
+
+    Routing:
+      offline://* → OfflineAdapter (deterministic stub; safe in airgap/tests)
+      http://* | https://* → HTTPAdapter (routes through egress proxy)
+      (anything else) → OfflineAdapter as safe fallback
+    """
+    if source_ref.startswith("offline://") or not source_ref.startswith(
+        ("http://", "https://")
+    ):
+        return OfflineAdapter()
+    return HTTPAdapter(egress_proxy_url=egress_proxy_url)

opencomplai_core-0.1.0/src/opencomplai_core/adapters/base.py

@@ -0,0 +1,33 @@
+"""Abstract base class for ground-truth source adapters."""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+
+class SourceAdapter(ABC):
+    """
+    Adapter that fetches a ground-truth value for a given claim.
+
+    Implementations must be safe to call concurrently and must not
+    store mutable state between calls.
+    """
+
+    @abstractmethod
+    async def lookup(self, claim: dict) -> dict:
+        """
+        Look up the ground-truth value for claim.
+
+        Args:
+            claim: dict with at least claim_ref, source_ref, and optionally
+                   expected_value, metric, threshold.
+
+        Returns:
+            dict with at least a "value" key containing the looked-up value.
+            May include additional metadata (e.g. source, timestamp).
+
+        Raises:
+            RuntimeError: if the external source is unavailable (caller should
+                          treat this as DEPENDENCY_UNAVAILABLE).
+        """
+        ...

opencomplai_core-0.1.0/src/opencomplai_core/adapters/http.py

@@ -0,0 +1,57 @@
+"""
+HTTP adapter — routes external source lookups through the egress proxy.
+
+All outbound HTTP calls must go through the egress proxy (REQ-ARC-001).
+Raises RuntimeError on connectivity failure so the caller can handle
+DEPENDENCY_UNAVAILABLE and queue for retry.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+
+from opencomplai_core.adapters.base import SourceAdapter
+
+
+class HTTPAdapter(SourceAdapter):
+    """
+    Fetches a ground-truth value from an external HTTP source via the egress proxy.
+
+    The egress proxy enforces the allowlisted schema and destinations
+    (PRD §4.4); this adapter just routes through it.
+    """
+
+    def __init__(self, egress_proxy_url: str = "http://egress-proxy:8004") -> None:
+        self._proxy_url = egress_proxy_url.rstrip("/")
+
+    async def lookup(self, claim: dict) -> dict:
+        source_ref = claim.get("source_ref", "")
+        if not source_ref:
+            raise RuntimeError("claim missing source_ref for HTTP lookup")
+
+        payload = json.dumps(
+            {
+                "destination": source_ref,
+                "claim_ref": claim.get("claim_ref", ""),
+                "expected_value": claim.get("expected_value"),
+            }
+        ).encode("utf-8")
+
+        req = urllib.request.Request(
+            f"{self._proxy_url}/v1/egress/lookup",
+            data=payload,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                return json.loads(resp.read())
+        except urllib.error.HTTPError as exc:
+            body = exc.read().decode(errors="replace")
+            raise RuntimeError(
+                f"Egress proxy returned {exc.code} for {source_ref}: {body}"
+            ) from exc
+        except Exception as exc:
+            raise RuntimeError(f"HTTP adapter lookup failed: {exc}") from exc

opencomplai_core-0.1.0/src/opencomplai_core/adapters/offline.py

@@ -0,0 +1,27 @@
+"""
+Offline (deterministic stub) adapter.
+
+Used in airgap scan mode and all unit tests. Always returns the expected_value
+from the claim, so every claim resolves as VERIFIED — this is intentional for
+local/offline environments where external verification is unavailable.
+"""
+
+from __future__ import annotations
+
+from opencomplai_core.adapters.base import SourceAdapter
+
+
+class OfflineAdapter(SourceAdapter):
+    """
+    Returns expected_value from the claim as the lookup result.
+
+    Produces a deterministic, dependency-free response suitable for
+    airgap mode and CI environments that cannot reach external sources.
+    """
+
+    async def lookup(self, claim: dict) -> dict:
+        return {
+            "value": claim.get("expected_value"),
+            "source": "offline",
+            "deterministic": True,
+        }

opencomplai_core-0.1.0/src/opencomplai_core/compliance_checker/__init__.py

@@ -0,0 +1,28 @@
+"""EU AI Act Compliance Checker — FLI-parity decision engine."""
+
+from opencomplai_core.compliance_checker.bridge import bridge_to_manifest_fields
+from opencomplai_core.compliance_checker.engine import CHECKER_VERSION, evaluate
+from opencomplai_core.compliance_checker.models import (
+    CheckerSession,
+    ComplianceCheckerResult,
+    EntityType,
+)
+from opencomplai_core.compliance_checker.report import (
+    export_all,
+    render_json,
+    render_markdown,
+    render_pdf,
+)
+
+__all__ = [
+    "CHECKER_VERSION",
+    "CheckerSession",
+    "ComplianceCheckerResult",
+    "EntityType",
+    "bridge_to_manifest_fields",
+    "evaluate",
+    "export_all",
+    "render_json",
+    "render_markdown",
+    "render_pdf",
+]

opencomplai_core-0.1.0/src/opencomplai_core/compliance_checker/bridge.py

@@ -0,0 +1,30 @@
+"""Bridge compliance checker results to system manifest fields."""
+
+from __future__ import annotations
+
+from opencomplai_core.compliance_checker.models import ComplianceCheckerResult
+
+
+def bridge_to_manifest_fields(result: ComplianceCheckerResult) -> dict[str, object]:
+    """Map checker output to SystemManifest-compatible fields."""
+    entity = result.effective_entity
+    operator_role = entity.value if entity is not None else "unknown"
+
+    if result.is_prohibited:
+        intended_purpose = "prohibited_practice"
+    elif result.is_high_risk:
+        intended_purpose = "high_risk_ai_system"
+    elif any(item.id == "transparency" for item in result.obligations):
+        intended_purpose = "limited_risk_transparency"
+    elif any(item.id == "gpai_provider" for item in result.obligations):
+        intended_purpose = "general_purpose_ai_model"
+    elif result.in_scope:
+        intended_purpose = "in_scope_ai_system"
+    else:
+        intended_purpose = "out_of_scope"
+
+    return {
+        "operator_role": operator_role,
+        "intended_purpose": intended_purpose,
+        "high_risk_presumption": result.is_high_risk,
+    }

opencomplai_core-0.1.0/src/opencomplai_core/compliance_checker/catalog.py

@@ -0,0 +1,50 @@
+"""Load FLI catalog JSON from the bundled data directory."""
+
+from __future__ import annotations
+
+import json
+from functools import lru_cache
+from pathlib import Path
+
+from opencomplai_core.compliance_checker.models import ObligationItem, StatusChangeItem
+
+_DATA_DIR = Path(__file__).resolve().parent / "data"
+
+
+def _load_json(name: str) -> dict:
+    path = _DATA_DIR / name
+    with path.open(encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+@lru_cache(maxsize=1)
+def load_obligations() -> dict[str, ObligationItem]:
+    raw = _load_json("obligations.json")
+    return {key: ObligationItem(id=key, **value) for key, value in raw.items()}
+
+
+@lru_cache(maxsize=1)
+def load_status_changes() -> dict[str, StatusChangeItem]:
+    raw = _load_json("status_changes.json")
+    return {key: StatusChangeItem(id=key, **value) for key, value in raw.items()}
+
+
+@lru_cache(maxsize=1)
+def load_help_content() -> dict[str, dict[str, str]]:
+    return _load_json("help_content.json")
+
+
+def get_obligation(obligation_id: str) -> ObligationItem:
+    obligations = load_obligations()
+    if obligation_id not in obligations:
+        msg = f"Unknown obligation id: {obligation_id}"
+        raise KeyError(msg)
+    return obligations[obligation_id]
+
+
+def get_status_change(status_id: str) -> StatusChangeItem:
+    status_changes = load_status_changes()
+    if status_id not in status_changes:
+        msg = f"Unknown status change id: {status_id}"
+        raise KeyError(msg)
+    return status_changes[status_id]

opencomplai_core-0.1.0/src/opencomplai_core/compliance_checker/data/help_content.json

@@ -0,0 +1,56 @@
+{
+  "entity_definitions": {
+    "title": "Operator roles under the AI Act",
+    "body": "Article 3(3) defines operators: a provider develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark; a deployer uses an AI system under its authority; a distributor makes an AI system available on the Union market; an importer places an AI system from a third country on the Union market; a product manufacturer places on the market an AI system together with its product under its own name or trademark; an authorised representative is a natural or legal person established in the Union who has received a written mandate from a provider."
+  },
+  "entity_roles": {
+    "provider": {
+      "title": "Provider",
+      "description": "You develop an AI system (or have it developed) and place it on the market or put it into service under your own name or trademark. In short: you build and ship it."
+    },
+    "deployer": {
+      "title": "Deployer",
+      "description": "You use an AI system under your own authority in a professional capacity — you are not an affected end-user. In short: you bought it and run it on people or data."
+    },
+    "distributor": {
+      "title": "Distributor",
+      "description": "You make an AI system available on the EU market in the supply chain, without being its provider or importer. In short: you are a reseller or sales channel."
+    },
+    "importer": {
+      "title": "Importer",
+      "description": "You are established in the EU and place on the market an AI system carrying the name or trademark of a provider established outside the EU. In short: you bring a non-EU system into the EU."
+    },
+    "product_manufacturer": {
+      "title": "Product manufacturer",
+      "description": "You place on the market or put into service an AI system together with your product and under your own name or trademark. In short: AI is built into a product you sell."
+    },
+    "authorised_rep": {
+      "title": "Authorised representative",
+      "description": "You are a person or entity in the EU holding a written mandate from a non-EU provider to act on its behalf for AI Act obligations."
+    }
+  },
+  "ai_system_definition": {
+    "title": "Definition of an AI system",
+    "body": "An AI system is a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments (Article 3(1))."
+  },
+  "high_risk_overview": {
+    "title": "High-risk classification",
+    "body": "An AI system is high-risk if it is a product covered by Union harmonisation legislation listed in Annex I with a required third-party conformity assessment, and the product includes an AI system as a safety component; or if it is listed in Annex III and none of the Article 6(3) exceptions apply."
+  },
+  "scope_overview": {
+    "title": "Scope of the AI Act",
+    "body": "The AI Act applies to providers placing AI systems on the Union market or putting them into service, deployers with a place of establishment or located in the Union, and to providers and deployers in third countries where the output is used in the Union. Certain exclusions apply under Article 2 for military, national security, research, and personal non-professional activities."
+  },
+  "modifications_overview": {
+    "title": "Substantial modifications",
+    "body": "A substantial modification of an AI system is a change that affects compliance with the AI Act and requires a new conformity assessment. A deployer, distributor, importer, or product manufacturer that substantially modifies a system becomes a provider under Article 25(1)(b)."
+  },
+  "gpai_overview": {
+    "title": "General-purpose AI models",
+    "body": "A general-purpose AI model is an AI model, including where trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks. Chapter V sets obligations for GPAI model providers distinct from high-risk AI system obligations."
+  },
+  "disclaimer": {
+    "title": "Not legal advice",
+    "body": "This tool automates the Future of Life Institute compliance checker logic for educational and planning purposes. It does not constitute legal advice. Seek qualified legal counsel and follow national guidance for formal compliance decisions."
+  }
+}