refactorai-core 3.0.0__py3-none-any.whl

refactor_core/compliance/loader.py

@@ -0,0 +1,233 @@
+"""Managed compliance pack loader (R18 Phase 2)."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from importlib import resources
+
+from refactor_core import __version__ as CORE_VERSION
+from refactor_core.compliance.models import CompliancePack, CompliancePackResolution, ComplianceRuleDef
+
+VALID_LEVELS = {"off", "advisory", "standard", "strict"}
+_PACK_FILES_BY_FRAMEWORK = {
+    "soc2": "soc2-core.json",
+    "iso27001": "iso27001-sdlc.json",
+    "privacy-gdpr": "privacy-gdpr.json",
+    "pci-payments": "pci-payments.json",
+    "hipaa-ephi": "hipaa-ephi.json",
+}
+
+
+class CompliancePackError(RuntimeError):
+    """Raised when a compliance pack cannot be loaded/validated."""
+
+
+def _norm_framework(value: str) -> str:
+    return str(value or "").strip().lower()
+
+
+def _norm_level(value: str) -> str:
+    level = str(value or "").strip().lower()
+    return level if level in VALID_LEVELS else "standard"
+
+
+def _version_tuple(value: str) -> tuple[int, ...]:
+    chunks = []
+    for part in str(value or "").split("."):
+        token = "".join(ch for ch in part if ch.isdigit())
+        if not token:
+            break
+        chunks.append(int(token))
+    return tuple(chunks or [0])
+
+
+def _canonical_rules_hash(rules: list[dict]) -> str:
+    text = json.dumps(rules, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def _load_embedded_payload(filename: str) -> dict:
+    try:
+        text = resources.files("refactor_core.compliance.packs").joinpath(filename).read_text(
+            encoding="utf-8"
+        )
+    except Exception as exc:  # pragma: no cover - defensive
+        raise CompliancePackError(f"Could not read embedded compliance pack {filename}: {exc}") from exc
+    try:
+        payload = json.loads(text)
+    except json.JSONDecodeError as exc:
+        raise CompliancePackError(f"Invalid JSON in embedded compliance pack {filename}: {exc}") from exc
+    if not isinstance(payload, dict):
+        raise CompliancePackError(f"Invalid compliance pack {filename}: root must be an object")
+    return payload
+
+
+def _parse_pack(payload: dict, *, origin: str) -> CompliancePack:
+    schema_version = int(payload.get("schema_version", 0) or 0)
+    if schema_version != 1:
+        raise CompliancePackError(
+            f"Incompatible compliance pack schema in {origin}: expected 1, got {schema_version}"
+        )
+    pack_id = str(payload.get("pack_id", "") or "").strip()
+    framework = _norm_framework(str(payload.get("framework", "") or ""))
+    version = str(payload.get("version", "") or "").strip()
+    channel = str(payload.get("channel", "stable") or "stable").strip().lower()
+    runtime = payload.get("runtime_compat")
+    runtime = runtime if isinstance(runtime, dict) else {}
+    min_core_version = str(runtime.get("min_core_version", "0.0.0") or "0.0.0")
+    signature = str(payload.get("signature", "") or "").strip()
+    rules_sha256 = str(payload.get("rules_sha256", "") or "").strip().lower()
+    if not pack_id or not framework or not version:
+        raise CompliancePackError(
+            f"Invalid compliance pack {origin}: pack_id/framework/version are required"
+        )
+    if not signature:
+        raise CompliancePackError(f"Invalid compliance pack {origin}: signature is required")
+    raw_depends = payload.get("depends_on", [])
+    if raw_depends is None:
+        raw_depends = []
+    if not isinstance(raw_depends, list):
+        raise CompliancePackError(f"Invalid compliance pack {origin}: depends_on must be a list")
+    depends_on = tuple(_norm_framework(str(item)) for item in raw_depends if str(item).strip())
+    raw_coverage = payload.get("coverage", {})
+    if raw_coverage is None:
+        raw_coverage = {}
+    if not isinstance(raw_coverage, dict):
+        raise CompliancePackError(f"Invalid compliance pack {origin}: coverage must be an object")
+    coverage = {
+        str(key).strip(): str(value).strip().lower()
+        for key, value in raw_coverage.items()
+        if str(key).strip() and str(value).strip()
+    }
+    raw_rules = payload.get("rules", [])
+    if not isinstance(raw_rules, list):
+        raise CompliancePackError(f"Invalid compliance pack {origin}: rules must be a list")
+    computed_hash = _canonical_rules_hash(raw_rules)
+    if rules_sha256 == "__placeholder__":
+        # Development-time embedded packs may carry a placeholder that is
+        # replaced during pack publishing/signing. Keep runtime deterministic by
+        # normalizing to the computed hash.
+        rules_sha256 = computed_hash
+    if not rules_sha256 or rules_sha256 != computed_hash:
+        raise CompliancePackError(
+            f"Integrity check failed for compliance pack {origin}: rules_sha256 mismatch"
+        )
+    rules: list[ComplianceRuleDef] = []
+    for item in raw_rules:
+        if not isinstance(item, dict):
+            continue
+        rule_id = str(item.get("rule_id", "") or "").strip()
+        operation_intent = str(item.get("operation_intent", "") or "").strip()
+        base_severity = str(item.get("base_severity", "") or "").strip().lower()
+        try:
+            priority = int(item.get("priority", 100) or 100)
+        except (TypeError, ValueError):
+            priority = 100
+        if not rule_id or not operation_intent:
+            continue
+        rules.append(
+            ComplianceRuleDef(
+                rule_id=rule_id,
+                operation_intent=operation_intent,
+                base_severity=base_severity or "medium",
+                priority=priority,
+                source_standard=str(item.get("source_standard", "") or "").strip(),
+                control_objective=str(item.get("control_objective", "") or "").strip(),
+            )
+        )
+    if not rules:
+        raise CompliancePackError(f"Invalid compliance pack {origin}: no valid rules found")
+    if _version_tuple(CORE_VERSION) < _version_tuple(min_core_version):
+        raise CompliancePackError(
+            f"Compliance pack {origin} requires core>={min_core_version} (current={CORE_VERSION})"
+        )
+    return CompliancePack(
+        pack_id=pack_id,
+        framework=framework,
+        version=version,
+        channel=channel,
+        schema_version=schema_version,
+        min_core_version=min_core_version,
+        depends_on=depends_on,
+        rules=tuple(rules),
+        coverage=coverage,
+        signature=signature,
+        rules_sha256=rules_sha256,
+    )
+
+
+def load_compliance_pack_for_framework(framework: str) -> CompliancePack:
+    """Load and validate one embedded pack by framework id."""
+    normalized = _norm_framework(framework)
+    filename = _PACK_FILES_BY_FRAMEWORK.get(normalized)
+    if not filename:
+        raise CompliancePackError(f"Unknown compliance framework: {framework}")
+    payload = _load_embedded_payload(filename)
+    return _parse_pack(payload, origin=filename)
+
+
+def resolve_compliance_packs(
+    frameworks: tuple[str, ...] | list[str] | None,
+    *,
+    level: str,
+) -> CompliancePackResolution:
+    """Resolve selected frameworks to validated packs (+ dependencies).
+
+    Strict-mode behavior:
+    - any loader/validation/integrity error raises `CompliancePackError`
+
+    Non-strict behavior (`advisory`/`standard`/`off`):
+    - pack errors become warnings and invalid packs are skipped
+    """
+    selected = tuple(_norm_framework(item) for item in (frameworks or ()) if str(item).strip())
+    level_norm = _norm_level(level)
+    if not selected:
+        return CompliancePackResolution(
+            packs=(),
+            warnings=(),
+            selected_frameworks=(),
+            level=level_norm,
+        )
+    warnings: list[str] = []
+    resolved: dict[str, CompliancePack] = {}
+    stack = list(selected)
+    seen: set[str] = set()
+    while stack:
+        framework = _norm_framework(stack.pop(0))
+        if not framework or framework in seen:
+            continue
+        seen.add(framework)
+        try:
+            pack = load_compliance_pack_for_framework(framework)
+        except CompliancePackError as exc:
+            if level_norm == "strict":
+                raise
+            warnings.append(str(exc))
+            continue
+        resolved[framework] = pack
+        for dep in pack.depends_on:
+            dep_norm = _norm_framework(dep)
+            if dep_norm and dep_norm not in seen:
+                stack.append(dep_norm)
+    # deterministic order by original selection then dependency tail.
+    ordered: list[CompliancePack] = []
+    added: set[str] = set()
+    for fw in selected:
+        pack = resolved.get(fw)
+        if pack and pack.pack_id not in added:
+            ordered.append(pack)
+            added.add(pack.pack_id)
+    for fw in sorted(resolved):
+        pack = resolved[fw]
+        if pack.pack_id in added:
+            continue
+        ordered.append(pack)
+        added.add(pack.pack_id)
+    return CompliancePackResolution(
+        packs=tuple(ordered),
+        warnings=tuple(warnings),
+        selected_frameworks=selected,
+        level=level_norm,
+    )
+

refactor_core/compliance/models.py

@@ -0,0 +1,68 @@
+"""Compliance pack models (R18 Phase 2)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from refactor_core.refactor_ops import OperationScope
+
+
+@dataclass(frozen=True)
+class ComplianceRuleDef:
+    """Minimal machine-readable rule record for pack validation/loading."""
+
+    rule_id: str
+    operation_intent: str
+    base_severity: str
+    priority: int = 100
+    source_standard: str = ""
+    control_objective: str = ""
+
+
+@dataclass(frozen=True)
+class CompliancePack:
+    """Validated compliance pack manifest."""
+
+    pack_id: str
+    framework: str
+    version: str
+    channel: str = "stable"
+    schema_version: int = 1
+    min_core_version: str = "0.0.0"
+    depends_on: tuple[str, ...] = ()
+    rules: tuple[ComplianceRuleDef, ...] = ()
+    coverage: dict[str, str] = field(default_factory=dict)
+    signature: str = ""
+    rules_sha256: str = ""
+
+
+@dataclass(frozen=True)
+class CompliancePackResolution:
+    """Resolved packs for one run with non-fatal loader warnings."""
+
+    packs: tuple[CompliancePack, ...] = ()
+    warnings: tuple[str, ...] = ()
+    selected_frameworks: tuple[str, ...] = ()
+    level: str = "standard"
+
+    @property
+    def pack_versions(self) -> dict[str, str]:
+        return {pack.pack_id: pack.version for pack in self.packs}
+
+
+@dataclass(frozen=True)
+class ComplianceProjectedRule:
+    """One projected compliance decision for a finding."""
+
+    rule_id: str
+    pack_id: str
+    framework: str
+    decision: str  # allow | warn | block
+    reason_code: str
+    message: str
+    operation_intent: str
+    priority: int = 100
+    operation_type: str = ""
+    scope: OperationScope = field(default_factory=OperationScope)
+
+

refactor_core/compliance/packs/__init__.py

@@ -0,0 +1,2 @@
+"""Embedded managed compliance packs."""
+

refactor_core/compliance/packs/hipaa-ephi.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": 1,
+  "pack_id": "hipaa-ephi",
+  "framework": "hipaa-ephi",
+  "version": "2026.06",
+  "channel": "stable",
+  "runtime_compat": {
+    "min_core_version": "0.1.1"
+  },
+  "depends_on": [
+    "soc2"
+  ],
+  "coverage": {
+    "164.312.a": "covered",
+    "164.312.b": "covered",
+    "164.312.c": "assert_only"
+  },
+  "rules": [
+    {
+      "rule_id": "HIPAA.164.312.b.audit-integrity",
+      "source_standard": "HIPAA 164.312(b)",
+      "control_objective": "Record and examine activity in systems handling ePHI.",
+      "operation_intent": "file_merge",
+      "base_severity": "high",
+      "priority": 220
+    },
+    {
+      "rule_id": "HIPAA.164.312.a.access-isolation",
+      "source_standard": "HIPAA 164.312(a)",
+      "control_objective": "Restrict ePHI access paths to controlled modules.",
+      "operation_intent": "path_move",
+      "base_severity": "high",
+      "priority": 220
+    },
+    {
+      "rule_id": "HIPAA.164.312.c.integrity-guard",
+      "source_standard": "HIPAA 164.312(c)",
+      "control_objective": "Protect ePHI integrity from unauthorized alteration/destruction.",
+      "operation_intent": "assert_only",
+      "base_severity": "high",
+      "priority": 210
+    },
+    {
+      "rule_id": "HIPAA.164.312.b.phi-logging-min",
+      "source_standard": "HIPAA 164.312(b)",
+      "control_objective": "Minimize PHI in logs and auditing sinks.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 210
+    }
+  ],
+  "signature": "managed:local-dev-signature",
+  "rules_sha256": "__PLACEHOLDER__"
+}
+

refactor_core/compliance/packs/iso27001-sdlc.json

@@ -0,0 +1,62 @@
+{
+  "schema_version": 1,
+  "pack_id": "iso27001-sdlc",
+  "framework": "iso27001",
+  "version": "2026.06",
+  "channel": "stable",
+  "runtime_compat": {
+    "min_core_version": "0.1.1"
+  },
+  "depends_on": [],
+  "coverage": {
+    "A.8.24": "covered",
+    "A.8.25": "covered",
+    "A.8.26": "covered",
+    "A.8.28": "covered"
+  },
+  "rules": [
+    {
+      "rule_id": "ISO.A8.25.pipeline-owner-guard",
+      "source_standard": "ISO 27001 Annex A 8.25",
+      "control_objective": "Changes to CI/pipeline definitions require controlled ownership.",
+      "operation_intent": "assert_only",
+      "base_severity": "high",
+      "priority": 210
+    },
+    {
+      "rule_id": "ISO.A8.28.injection-sink-harden",
+      "source_standard": "ISO 27001 Annex A 8.28",
+      "control_objective": "Neutralize common injection sinks.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 200
+    },
+    {
+      "rule_id": "ISO.A8.24.weak-crypto-replace",
+      "source_standard": "ISO 27001 Annex A 8.24",
+      "control_objective": "Replace weak cryptographic primitives.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 200
+    },
+    {
+      "rule_id": "ISO.A8.26.input-validation-guard",
+      "source_standard": "ISO 27001 Annex A 8.26",
+      "control_objective": "Input validation is enforced at system boundaries.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 180
+    },
+    {
+      "rule_id": "ISO.A8.4.source-integrity-name",
+      "source_standard": "ISO 27001 Annex A 8.4",
+      "control_objective": "Security-sensitive symbols have clear, controlled naming.",
+      "operation_intent": "symbol_rename",
+      "base_severity": "medium",
+      "priority": 130
+    }
+  ],
+  "signature": "managed:local-dev-signature",
+  "rules_sha256": "__PLACEHOLDER__"
+}
+

refactor_core/compliance/packs/pci-payments.json

@@ -0,0 +1,63 @@
+{
+  "schema_version": 1,
+  "pack_id": "pci-payments",
+  "framework": "pci-payments",
+  "version": "2026.06",
+  "channel": "stable",
+  "runtime_compat": {
+    "min_core_version": "0.1.1"
+  },
+  "depends_on": [
+    "soc2"
+  ],
+  "coverage": {
+    "6.2.4": "covered",
+    "6.5.1": "covered",
+    "3.x": "covered"
+  },
+  "rules": [
+    {
+      "rule_id": "PCI.6.5.1.cde-isolation",
+      "source_standard": "PCI DSS 6.5.1",
+      "control_objective": "Changes affecting CDE boundaries require controlled handling.",
+      "operation_intent": "assert_only",
+      "base_severity": "critical",
+      "priority": 240
+    },
+    {
+      "rule_id": "PCI.3.x.pan-logging-mask",
+      "source_standard": "PCI DSS 3.x",
+      "control_objective": "Do not expose PAN in application logs.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 220
+    },
+    {
+      "rule_id": "PCI.6.2.4.injection-harden",
+      "source_standard": "PCI DSS 6.2.4",
+      "control_objective": "Bespoke payment code follows secure coding controls.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 220
+    },
+    {
+      "rule_id": "PCI.6.2.4.weak-crypto-replace",
+      "source_standard": "PCI DSS 6.2.4",
+      "control_objective": "Weak cryptography in payment flows is replaced.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 220
+    },
+    {
+      "rule_id": "PCI.6.5.1.change-evidence",
+      "source_standard": "PCI DSS 6.5.1",
+      "control_objective": "Sensitive production changes require approval and rollback evidence.",
+      "operation_intent": "assert_only",
+      "base_severity": "high",
+      "priority": 210
+    }
+  ],
+  "signature": "managed:local-dev-signature",
+  "rules_sha256": "__PLACEHOLDER__"
+}
+

refactor_core/compliance/packs/privacy-gdpr.json

@@ -0,0 +1,71 @@
+{
+  "schema_version": 1,
+  "pack_id": "privacy-gdpr",
+  "framework": "privacy-gdpr",
+  "version": "2026.06",
+  "channel": "stable",
+  "runtime_compat": {
+    "min_core_version": "0.1.1"
+  },
+  "depends_on": [],
+  "coverage": {
+    "Art25.1": "covered",
+    "Art25.2": "covered",
+    "Art5.1.c": "covered",
+    "Art17": "assert_only",
+    "Art32": "covered"
+  },
+  "rules": [
+    {
+      "rule_id": "GDPR.Art25.2.pii-isolation",
+      "source_standard": "GDPR Art.25(2)",
+      "control_objective": "Isolate PII processing by default.",
+      "operation_intent": "file_split",
+      "base_severity": "high",
+      "priority": 200
+    },
+    {
+      "rule_id": "GDPR.Art5.logging-minimization",
+      "source_standard": "GDPR Art.5(1)(c)",
+      "control_objective": "Avoid raw personal data in logs.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 200
+    },
+    {
+      "rule_id": "GDPR.Art32.transport-encryption",
+      "source_standard": "GDPR Art.32",
+      "control_objective": "Personal data transport/storage uses encryption controls.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 190
+    },
+    {
+      "rule_id": "GDPR.Art25.retention-coupling",
+      "source_standard": "GDPR Art.25(2)",
+      "control_objective": "Retention path changes remain coupled to policy updates.",
+      "operation_intent": "assert_only",
+      "base_severity": "high",
+      "priority": 180
+    },
+    {
+      "rule_id": "GDPR.Art17.erasure-workflow-guard",
+      "source_standard": "GDPR Art.17",
+      "control_objective": "Erasure workflow changes require policy-linked review.",
+      "operation_intent": "assert_only",
+      "base_severity": "medium",
+      "priority": 150
+    },
+    {
+      "rule_id": "GDPR.Art25.1.pii-symbol-clarity",
+      "source_standard": "GDPR Art.25(1)",
+      "control_objective": "PII-handling symbols are explicit and reviewable.",
+      "operation_intent": "symbol_rename",
+      "base_severity": "medium",
+      "priority": 120
+    }
+  ],
+  "signature": "managed:local-dev-signature",
+  "rules_sha256": "__PLACEHOLDER__"
+}
+

refactor_core/compliance/packs/soc2-core.json

@@ -0,0 +1,63 @@
+{
+  "schema_version": 1,
+  "pack_id": "soc2-core",
+  "framework": "soc2",
+  "version": "2026.06",
+  "channel": "stable",
+  "runtime_compat": {
+    "min_core_version": "0.1.1"
+  },
+  "depends_on": [],
+  "coverage": {
+    "CC6.1": "covered",
+    "CC6.6": "covered",
+    "CC7.1": "assert_only",
+    "CC7.2": "covered",
+    "CC8.1": "covered"
+  },
+  "rules": [
+    {
+      "rule_id": "SOC2.CC8.1.protected-path-change",
+      "source_standard": "SOC2 CC8.1",
+      "control_objective": "Authorized, tested, traceable change for sensitive paths.",
+      "operation_intent": "assert_only",
+      "base_severity": "high",
+      "priority": 220
+    },
+    {
+      "rule_id": "SOC2.CC6.1.secret-externalize",
+      "source_standard": "SOC2 CC6.1",
+      "control_objective": "No hardcoded credentials in source.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 200
+    },
+    {
+      "rule_id": "SOC2.CC6.6.authz-check-insert",
+      "source_standard": "SOC2 CC6.6",
+      "control_objective": "Authorization checks enforced around sensitive operations.",
+      "operation_intent": "content_patch",
+      "base_severity": "high",
+      "priority": 200
+    },
+    {
+      "rule_id": "SOC2.CC7.2.audit-logging-centralize",
+      "source_standard": "SOC2 CC7.2",
+      "control_objective": "Monitoring and logging are centralized and reviewable.",
+      "operation_intent": "file_merge",
+      "base_severity": "medium",
+      "priority": 140
+    },
+    {
+      "rule_id": "SOC2.CC7.1.config-drift-guard",
+      "source_standard": "SOC2 CC7.1",
+      "control_objective": "Configuration drift-prone paths are explicitly guarded.",
+      "operation_intent": "assert_only",
+      "base_severity": "medium",
+      "priority": 120
+    }
+  ],
+  "signature": "managed:local-dev-signature",
+  "rules_sha256": "__PLACEHOLDER__"
+}
+