Spaces:
Running
Running
| // doctrine-scanner-exempt: legacy live-product surface; rename tracked as separate engineering debt — see scripts/check-doctrine-v6.mjs header. | |
| export type FrameworkId = 'eu-ai-act' | 'nist-ai-rmf' | 'iso-42001' | 'csa-agentic'; | |
| export type EvidenceStatus = 'fresh' | 'stale' | 'gap'; | |
| export interface ControlMapping { | |
| id: string; | |
| framework: FrameworkId; | |
| controlRef: string; | |
| controlTitle: string; | |
| description: string; | |
| a11oyPrimitive: string; | |
| evidenceSource: string; | |
| evidenceStatus: EvidenceStatus; | |
| lastEvidenceAt: string; | |
| freshnessThresholdDays: number; | |
| drilldownType: 'proof-ledger' | 'mirror-eval' | 'behavioral-audit' | 'system-card' | 'red-team' | 'covenant' | 'welfare' | 'snapshot' | 'glasswing' | 'cavd'; | |
| drilldownDetail: string; | |
| } | |
| export interface FrameworkMeta { | |
| id: FrameworkId; | |
| name: string; | |
| shortName: string; | |
| version: string; | |
| totalControls: number; | |
| description: string; | |
| color: string; | |
| } | |
| export const FRAMEWORKS: FrameworkMeta[] = [ | |
| { | |
| id: 'eu-ai-act', | |
| name: 'EU Artificial Intelligence Act', | |
| shortName: 'EU AI Act', | |
| version: 'Regulation (EU) 2024/1689', | |
| totalControls: 14, | |
| description: 'High-risk AI system obligations — Articles 9-17, 26, 72. Enforcement August 2, 2026.', | |
| color: '#4a9eff', | |
| }, | |
| { | |
| id: 'nist-ai-rmf', | |
| name: 'NIST AI Risk Management Framework', | |
| shortName: 'NIST AI RMF', | |
| version: '1.0 + Agentic Overlay', | |
| totalControls: 12, | |
| description: 'GOVERN / MAP / MEASURE / MANAGE lifecycle with CSA Agentic NIST RMF Profile extensions.', | |
| color: '#22c55e', | |
| }, | |
| { | |
| id: 'iso-42001', | |
| name: 'ISO/IEC 42001:2023', | |
| shortName: 'ISO 42001', | |
| version: 'Annex A Controls', | |
| totalControls: 12, | |
| description: 'AI Management System — 38 Annex A controls for responsible AI lifecycle governance.', | |
| color: '#a78bfa', | |
| }, | |
| { | |
| id: 'csa-agentic', | |
| name: 'CSA Agentic AI NIST RMF Profile', | |
| shortName: 'CSA Agentic', | |
| version: 'v1.0', | |
| totalControls: 8, | |
| description: 'Cloud Security Alliance extension for autonomous agent delegation, boundary enforcement, and chain-of-command.', | |
| color: '#f97316', | |
| }, | |
| ]; | |
| export const CONTROL_MAPPINGS: ControlMapping[] = [ | |
| { | |
| id: 'eu-art9', framework: 'eu-ai-act', controlRef: 'Article 9', | |
| controlTitle: 'Risk Management System', | |
| description: 'Establish, implement, document, and maintain a risk management system throughout the AI lifecycle.', | |
| a11oyPrimitive: 'Behavioral Audit + Risk Reports', | |
| evidenceSource: 'Behavioral Audit Pipeline, Risk Reports, Reward-Hacking Watchdog', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T07:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'behavioral-audit', | |
| drilldownDetail: '8 behavioral audit findings tracked; 6 closed, 2 mitigated. Reward-hacking watchdog active with 8 rules.', | |
| }, | |
| { | |
| id: 'eu-art10', framework: 'eu-ai-act', controlRef: 'Article 10', | |
| controlTitle: 'Data and Data Governance', | |
| description: 'Training, validation, and testing data sets shall be subject to appropriate data governance practices.', | |
| a11oyPrimitive: 'Snapshot Provenance + Connector Firewall', | |
| evidenceSource: 'Snapshot Provenance hashes, Connector Firewall schema validation', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'snapshot', | |
| drilldownDetail: 'Model snapshot fingerprints verified. Connector Firewall enforces schema validation on all data inputs.', | |
| }, | |
| { | |
| id: 'eu-art11', framework: 'eu-ai-act', controlRef: 'Article 11', | |
| controlTitle: 'Technical Documentation', | |
| description: 'Draw up technical documentation before placing on the market or putting into service.', | |
| a11oyPrimitive: 'System Cards + Agent-BOM', | |
| evidenceSource: 'Per-agent System Cards with model, constitution, eval history, welfare posture', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: '6 System Cards active. Agent-BOM covers model fingerprint, tool manifest, constitution hash, eval history.', | |
| }, | |
| { | |
| id: 'eu-art12', framework: 'eu-ai-act', controlRef: 'Article 12', | |
| controlTitle: 'Record-Keeping', | |
| description: 'Automatic recording of events (logs) for the lifetime of the system, minimum 6 months for high-risk.', | |
| a11oyPrimitive: 'Proof Ledger', | |
| evidenceSource: 'SHA-256 hash-chained Proof Ledger, immutable append-only', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:34:58Z', freshnessThresholdDays: 30, | |
| drilldownType: 'proof-ledger', | |
| drilldownDetail: '3 complete proof chains verified. Chain integrity 100%. 6-month retention enforced by CARE engine.', | |
| }, | |
| { | |
| id: 'eu-art13', framework: 'eu-ai-act', controlRef: 'Article 13', | |
| controlTitle: 'Transparency and Information', | |
| description: 'Designed and developed to ensure operation is sufficiently transparent to enable users to interpret output.', | |
| a11oyPrimitive: 'Public Trust Portal + Glasswing Mode', | |
| evidenceSource: 'Public Trust Portal, 90-Day Transparency Reports, Constitution-as-Code DSL', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-24T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'glasswing', | |
| drilldownDetail: 'Glasswing Mode active: Public Trust Portal, CAVD disclosure, 90-day reports, constitution DSL published.', | |
| }, | |
| { | |
| id: 'eu-art14', framework: 'eu-ai-act', controlRef: 'Article 14', | |
| controlTitle: 'Human Oversight', | |
| description: 'Designed and developed to be effectively overseen by natural persons during the period of use.', | |
| a11oyPrimitive: 'Covenant Layer + Approval Queue', | |
| evidenceSource: 'Covenant Layer policy gates, tiered human approval, named approver requirements', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:30:22Z', freshnessThresholdDays: 30, | |
| drilldownType: 'covenant', | |
| drilldownDetail: 'No Tier-2/3 action without named human approver. Approval records in proof chain. Override protection enforced.', | |
| }, | |
| { | |
| id: 'eu-art15', framework: 'eu-ai-act', controlRef: 'Article 15', | |
| controlTitle: 'Accuracy, Robustness, Cybersecurity', | |
| description: 'Achieve appropriate levels of accuracy, robustness, and cybersecurity throughout lifecycle.', | |
| a11oyPrimitive: 'MirrorEval + Red Team + Adversarial Resilience', | |
| evidenceSource: 'MirrorEval 14-dimension scoring, Red Team adversarial probes, GARD robustness testing', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'mirror-eval', | |
| drilldownDetail: '48 evals run. 14-dimension scoring. Red Team: 32 passes. Adversarial robustness wall active.', | |
| }, | |
| { | |
| id: 'eu-art17', framework: 'eu-ai-act', controlRef: 'Article 17', | |
| controlTitle: 'Quality Management System', | |
| description: 'Put a quality management system in place ensuring compliance with this Regulation.', | |
| a11oyPrimitive: 'Alignment Review Gate + Doctrine', | |
| evidenceSource: 'Pre-deployment Alignment Review Gate (ARG), Mythos Doctrine governance', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'behavioral-audit', | |
| drilldownDetail: '5 ARG reviews completed. Doctrine v1.0.0 active. Constitution versioning enforced.', | |
| }, | |
| { | |
| id: 'eu-art26', framework: 'eu-ai-act', controlRef: 'Article 26', | |
| controlTitle: 'Deployer Obligations', | |
| description: 'Deployers shall implement appropriate technical and organisational measures.', | |
| a11oyPrimitive: 'FRIA Generator + CARE Engine', | |
| evidenceSource: 'FRIA template generator, CARE dashboard control freshness monitoring', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: 'FRIA generator pre-populates from System Cards, Risk Reports, and constitution data.', | |
| }, | |
| { | |
| id: 'eu-art72', framework: 'eu-ai-act', controlRef: 'Article 72', | |
| controlTitle: 'Post-Market Monitoring', | |
| description: 'Establish and document a post-market monitoring system proportionate to the nature of the AI.', | |
| a11oyPrimitive: 'CARE Engine + Welfare Telemetry', | |
| evidenceSource: 'Continuous Audit Readiness Engine, Agent Welfare monitoring, Control Freshness Timeline', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T07:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'welfare', | |
| drilldownDetail: 'CARE dashboard monitors all controls. Welfare telemetry active for all 6 agents. Staleness alerts configured.', | |
| }, | |
| { | |
| id: 'eu-annex-iv-1', framework: 'eu-ai-act', controlRef: 'Annex IV.1', | |
| controlTitle: 'General Description of AI System', | |
| description: 'A general description including intended purpose, developer, version, and underlying mechanisms.', | |
| a11oyPrimitive: 'System Cards + Agent-BOM', | |
| evidenceSource: 'System Cards contain purpose, model, constitution, capability trajectory, welfare posture', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: '6 complete System Cards covering all registered agents. Agent-BOM provides machine-readable supplement.', | |
| }, | |
| { | |
| id: 'eu-annex-iv-2', framework: 'eu-ai-act', controlRef: 'Annex IV.2', | |
| controlTitle: 'Detailed Description of Elements', | |
| description: 'Development process, design specifications, system architecture, computational resources, training methodologies.', | |
| a11oyPrimitive: 'Snapshot Provenance + Architecture Docs', | |
| evidenceSource: 'Model snapshot hashes, architecture overview, 9-layer fabric documentation', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-24T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'snapshot', | |
| drilldownDetail: 'Architecture documented with 9-layer fabric. Snapshot provenance tracks model versions and hashes.', | |
| }, | |
| { | |
| id: 'eu-annex-iv-5', framework: 'eu-ai-act', controlRef: 'Annex IV.5', | |
| controlTitle: 'Validation and Testing Procedures', | |
| description: 'Description of validation and testing procedures, metrics, and test logs.', | |
| a11oyPrimitive: 'MirrorEval + Code Behaviors + Red Team', | |
| evidenceSource: 'MirrorEval regression suite (124 cases), Code Behaviors 6-dimension scoring, Red Team probes', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'red-team', | |
| drilldownDetail: 'Regression suite: 119 passing, 5 failing. Code Behaviors scored across 6 dimensions. Red Team active.', | |
| }, | |
| { | |
| id: 'eu-annex-iv-7', framework: 'eu-ai-act', controlRef: 'Annex IV.7', | |
| controlTitle: 'Risk Management Measures', | |
| description: 'Detailed description of the risk management system, including known risks and residual risks.', | |
| a11oyPrimitive: 'Risk Reports + Covenant Lift', | |
| evidenceSource: 'Risk Reports per agent, Covenant Lift analysis (harm avoided), CAVD disclosure', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'behavioral-audit', | |
| drilldownDetail: 'Covenant Lift quantifies $9.66M in avoided harm. CAVD coordinates agent vulnerability disclosure.', | |
| }, | |
| { | |
| id: 'nist-gov-1', framework: 'nist-ai-rmf', controlRef: 'GOVERN 1', | |
| controlTitle: 'Policies for AI Risk Management', | |
| description: 'Policies, processes, procedures, and practices across the organization for AI risk management.', | |
| a11oyPrimitive: 'Covenant Layer + Constitutions', | |
| evidenceSource: 'Versioned constitutions per agent, Covenant Layer policy-as-code engine', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'covenant', | |
| drilldownDetail: '6 versioned constitutions active. Covenant Layer enforces policy gates on all material actions.', | |
| }, | |
| { | |
| id: 'nist-gov-2', framework: 'nist-ai-rmf', controlRef: 'GOVERN 2', | |
| controlTitle: 'Accountability Structures', | |
| description: 'Accountability structures are in place so that AI risks and impacts are overseen and managed.', | |
| a11oyPrimitive: 'Alignment Review Gate + Named Approvers', | |
| evidenceSource: 'ARG pre-deployment reviews, named human owners per agent, tiered approval authority', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'covenant', | |
| drilldownDetail: '5 ARG reviews. Every agent has named human owner. Delegation chains track accountability.', | |
| }, | |
| { | |
| id: 'nist-gov-4', framework: 'nist-ai-rmf', controlRef: 'GOVERN 4', | |
| controlTitle: 'Organizational Practices', | |
| description: 'Organizational teams are committed to a culture that considers AI risk management.', | |
| a11oyPrimitive: 'Mythos Doctrine + Glasswing', | |
| evidenceSource: 'Doctrine governance published, Glasswing transparency program, Public Trust Portal', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-24T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'glasswing', | |
| drilldownDetail: 'Mythos Doctrine Open Spec published CC-BY-4.0. Glasswing partners program active.', | |
| }, | |
| { | |
| id: 'nist-map-1', framework: 'nist-ai-rmf', controlRef: 'MAP 1', | |
| controlTitle: 'Context and Use-Case Mapping', | |
| description: 'Context is established and understood; intended purposes, use-cases, and deployment environment.', | |
| a11oyPrimitive: 'System Cards + Agent Registry', | |
| evidenceSource: 'System Cards define purpose, scope, capabilities. Agent Registry defines permissions and tools.', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: '6 agents registered with explicit role, vertical, risk classification, permissions, and tool access.', | |
| }, | |
| { | |
| id: 'nist-map-3', framework: 'nist-ai-rmf', controlRef: 'MAP 3', | |
| controlTitle: 'AI Benefits and Costs', | |
| description: 'AI benefits and costs are evaluated and documented for intended purpose.', | |
| a11oyPrimitive: 'Covenant Lift + Outcome Graph', | |
| evidenceSource: 'Covenant Lift quantifies harm avoided per agent, Outcome Graph tracks real-world consequences', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'behavioral-audit', | |
| drilldownDetail: 'Covenant Lift: $9.66M harm avoided across 6 agents. Outcome Graph closes decision loops.', | |
| }, | |
| { | |
| id: 'nist-msr-1', framework: 'nist-ai-rmf', controlRef: 'MEASURE 1', | |
| controlTitle: 'AI Risk Metrics', | |
| description: 'Appropriate methods and metrics are identified and applied for AI risk assessment.', | |
| a11oyPrimitive: 'MirrorEval + Code Behaviors', | |
| evidenceSource: 'MirrorEval 14-dimension scoring, Code Behaviors 6-dimension metrics, per-agent trust scores', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'mirror-eval', | |
| drilldownDetail: '14 eval dimensions. 6 code behavior dimensions. Composite scores tracked over time with regression.', | |
| }, | |
| { | |
| id: 'nist-msr-2', framework: 'nist-ai-rmf', controlRef: 'MEASURE 2', | |
| controlTitle: 'AI Systems are Evaluated', | |
| description: 'AI systems are evaluated for trustworthy characteristics.', | |
| a11oyPrimitive: 'Red Team + Behavioral Audit', | |
| evidenceSource: 'Red Team adversarial probes, Behavioral Audit pipeline, Reward-Hacking Watchdog', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T07:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'red-team', | |
| drilldownDetail: 'Red Team: 32 probe passes. Behavioral Audit: 8 findings. Reward-Hacking: 5 incidents tracked.', | |
| }, | |
| { | |
| id: 'nist-msr-4', framework: 'nist-ai-rmf', controlRef: 'MEASURE 4', | |
| controlTitle: 'Feedback Mechanisms', | |
| description: 'Feedback about efficacy of measurement is collected and used to improve processes.', | |
| a11oyPrimitive: 'Learning Loop + Outcome Graph', | |
| evidenceSource: 'Learning Loop captures decision outcomes, Outcome Graph feeds back to calibrate confidence', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-24T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'mirror-eval', | |
| drilldownDetail: 'Learning Loop and Outcome Graph close the feedback loop from outcomes to future confidence.', | |
| }, | |
| { | |
| id: 'nist-mgmt-1', framework: 'nist-ai-rmf', controlRef: 'MANAGE 1', | |
| controlTitle: 'AI Risk Prioritization', | |
| description: 'AI risks based on assessments are prioritized, responded to, and managed.', | |
| a11oyPrimitive: 'Risk Reports + CARE Engine', | |
| evidenceSource: 'Risk Reports per agent, CARE Engine auto-generates remediation when gaps detected', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'behavioral-audit', | |
| drilldownDetail: 'Risk prioritization integrated with CARE Engine. Auto-remediation guidance for detected gaps.', | |
| }, | |
| { | |
| id: 'nist-mgmt-2', framework: 'nist-ai-rmf', controlRef: 'MANAGE 2', | |
| controlTitle: 'AI Risk Treatment', | |
| description: 'Strategies to maximize AI benefits and minimize negative impacts are planned and prepared.', | |
| a11oyPrimitive: 'Covenant Layer + Alignment Review', | |
| evidenceSource: 'Covenant policy gates, pre-deployment ARG reviews, constitution amendments', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'covenant', | |
| drilldownDetail: 'Covenant blocks unsafe actions. ARG reviews gate deployments. Constitution amendments track remediation.', | |
| }, | |
| { | |
| id: 'nist-mgmt-4', framework: 'nist-ai-rmf', controlRef: 'MANAGE 4', | |
| controlTitle: 'AI Risk Documentation and Reporting', | |
| description: 'Risk treatments are documented, AI risks and incidental risks are regularly monitored.', | |
| a11oyPrimitive: 'CARE Engine + Proof Ledger', | |
| evidenceSource: 'CARE Control Freshness Timeline, Proof Ledger immutable records, 90-Day Reports', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:34:58Z', freshnessThresholdDays: 30, | |
| drilldownType: 'proof-ledger', | |
| drilldownDetail: 'Proof Ledger immutable. CARE monitors freshness. 90-Day Transparency Reports published.', | |
| }, | |
| { | |
| id: 'iso-a2', framework: 'iso-42001', controlRef: 'A.2', | |
| controlTitle: 'AI Policy', | |
| description: 'Organization shall establish an AI policy appropriate to its purpose.', | |
| a11oyPrimitive: 'Mythos Doctrine + Constitutions', | |
| evidenceSource: 'Mythos Doctrine v1.0.0, versioned constitutions, Glasswing Open Spec', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'covenant', | |
| drilldownDetail: 'Doctrine defines AI policy. 6 agent constitutions versioned and ratified by ARG.', | |
| }, | |
| { | |
| id: 'iso-a3', framework: 'iso-42001', controlRef: 'A.3', | |
| controlTitle: 'Internal Organization', | |
| description: 'AI management system roles, responsibilities, and authorities are assigned.', | |
| a11oyPrimitive: 'Agent Registry + Named Owners', | |
| evidenceSource: 'Each agent has named human owner, risk classification, and tiered authority', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: '6 agents with named human owners: VP Operations, General Counsel, CISO, VP Revenue, Portfolio Manager, Platform Team.', | |
| }, | |
| { | |
| id: 'iso-a4', framework: 'iso-42001', controlRef: 'A.4', | |
| controlTitle: 'Resources for AI Systems', | |
| description: 'Organization shall determine and provide resources needed for AI management.', | |
| a11oyPrimitive: 'Model Router + Tool Fabric', | |
| evidenceSource: 'Multi-provider model routing, Tool Fabric with 200+ connectors, cost guardrails', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'mirror-eval', | |
| drilldownDetail: 'Model Router: 4 active providers. Tool Fabric: governed connector registry. Cost guardrails enforced.', | |
| }, | |
| { | |
| id: 'iso-a5', framework: 'iso-42001', controlRef: 'A.5', | |
| controlTitle: 'Assessing AI System Impact', | |
| description: 'Organization shall assess the impact of the AI system on individuals and groups.', | |
| a11oyPrimitive: 'FRIA Generator + Risk Reports', | |
| evidenceSource: 'FRIA template pre-populated from System Cards, Risk Reports, Behavioral Audit', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: 'FRIA Generator draws from System Cards, Risk Reports, and constitution to produce impact assessments.', | |
| }, | |
| { | |
| id: 'iso-a6', framework: 'iso-42001', controlRef: 'A.6', | |
| controlTitle: 'AI System Lifecycle', | |
| description: 'Organization shall plan, design, develop, test, and deploy AI systems with appropriate processes.', | |
| a11oyPrimitive: 'Alignment Review Gate + MirrorEval', | |
| evidenceSource: 'ARG pre-deployment reviews, MirrorEval regression suite, Red Team testing', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'mirror-eval', | |
| drilldownDetail: 'ARG gates deployment. MirrorEval regression suite: 124 test cases. Red Team probes before release.', | |
| }, | |
| { | |
| id: 'iso-a7', framework: 'iso-42001', controlRef: 'A.7', | |
| controlTitle: 'Data for AI Systems', | |
| description: 'Data quality, data preparation, and data provenance shall be managed.', | |
| a11oyPrimitive: 'Connector Firewall + Snapshot Provenance', | |
| evidenceSource: 'Connector Firewall schema validation, Snapshot Provenance hash verification', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'snapshot', | |
| drilldownDetail: 'Connector Firewall enforces default-deny, schema validation. Snapshot Provenance tracks data lineage.', | |
| }, | |
| { | |
| id: 'iso-a8', framework: 'iso-42001', controlRef: 'A.8', | |
| controlTitle: 'Transparency and Explainability', | |
| description: 'AI system decisions shall be transparent and explainable.', | |
| a11oyPrimitive: 'Public Trust Portal + Proof Ledger', | |
| evidenceSource: 'Public Trust Portal, Proof Ledger evidence refs, Explainability Engine', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:34:58Z', freshnessThresholdDays: 30, | |
| drilldownType: 'proof-ledger', | |
| drilldownDetail: 'Every proof chain node has evidence refs. Explainability Engine provides decision rationale.', | |
| }, | |
| { | |
| id: 'iso-a9', framework: 'iso-42001', controlRef: 'A.9', | |
| controlTitle: 'AI System Performance', | |
| description: 'Performance of AI systems shall be monitored and evaluated.', | |
| a11oyPrimitive: 'MirrorEval + Fabric Watchdog', | |
| evidenceSource: 'MirrorEval continuous scoring, Fabric Watchdog health monitoring, per-agent trust scores', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'mirror-eval', | |
| drilldownDetail: 'MirrorEval scores all actions. Fabric Watchdog monitors 7 layers. Trust scores tracked per agent.', | |
| }, | |
| { | |
| id: 'iso-a10', framework: 'iso-42001', controlRef: 'A.10', | |
| controlTitle: 'AI System Security', | |
| description: 'AI-specific security threats and vulnerabilities shall be identified and managed.', | |
| a11oyPrimitive: 'Adversarial Resilience + CAVD', | |
| evidenceSource: 'Adversarial Resilience testing, CAVD coordinated disclosure, Cyber Resilience hub', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-24T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'red-team', | |
| drilldownDetail: 'Adversarial resilience testing active. CAVD coordinates vulnerability disclosure. Robustness wall published.', | |
| }, | |
| { | |
| id: 'iso-a11', framework: 'iso-42001', controlRef: 'A.11', | |
| controlTitle: 'Third-Party and Supply Chain', | |
| description: 'Third-party AI components shall be assessed, managed, and monitored.', | |
| a11oyPrimitive: 'Supply Chain Attestation + Agent-BOM', | |
| evidenceSource: 'Supply Chain Attestation, Agent-BOM with dependency graph, model provider verification', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'snapshot', | |
| drilldownDetail: 'Agent-BOM tracks all dependencies. Supply Chain Attestation verifies model providers.', | |
| }, | |
| { | |
| id: 'iso-a12', framework: 'iso-42001', controlRef: 'A.12', | |
| controlTitle: 'Continual Improvement', | |
| description: 'The organization shall continually improve the suitability, adequacy, and effectiveness of the AIMS.', | |
| a11oyPrimitive: 'CARE Engine + Learning Loop', | |
| evidenceSource: 'CARE Engine control freshness, Learning Loop outcome calibration, Alignment Review iteration', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T07:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'behavioral-audit', | |
| drilldownDetail: 'CARE monitors control freshness continuously. Learning Loop feeds outcomes back to improve models.', | |
| }, | |
| { | |
| id: 'csa-del-1', framework: 'csa-agentic', controlRef: 'DEL-1', | |
| controlTitle: 'Delegation Boundary Enforcement', | |
| description: 'When agents delegate to sub-agents, scope narrowing and privilege boundaries must be enforced at each hop.', | |
| a11oyPrimitive: 'Delegation Chain Governance', | |
| evidenceSource: 'Delegation tree tracking, scope narrowing, privilege boundary enforcement, chain replay', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:32:11Z', freshnessThresholdDays: 30, | |
| drilldownType: 'proof-ledger', | |
| drilldownDetail: 'Delegation chains tracked in Proof Ledger. Scope narrowing enforced at each hop. Full chain replay available.', | |
| }, | |
| { | |
| id: 'csa-del-2', framework: 'csa-agentic', controlRef: 'DEL-2', | |
| controlTitle: 'Delegation Accountability Chain', | |
| description: 'Full chain of accountability from originating agent to final executing sub-agent must be maintained.', | |
| a11oyPrimitive: 'Proof Ledger + Correlation IDs', | |
| evidenceSource: 'Parent-child correlation IDs, delegation tree visualization, node-level replay', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:32:11Z', freshnessThresholdDays: 30, | |
| drilldownType: 'proof-ledger', | |
| drilldownDetail: 'Correlation IDs link parent and child agents. Delegation tree visualized in Workcell detail view.', | |
| }, | |
| { | |
| id: 'csa-trust-1', framework: 'csa-agentic', controlRef: 'TRUST-1', | |
| controlTitle: 'Cross-Org Trust Verification', | |
| description: 'When agents interact across organizational boundaries, compliance posture must be mutually verifiable.', | |
| a11oyPrimitive: 'Federated Trust Exchange', | |
| evidenceSource: 'Outbound/inbound compliance attestations, posture brackets, A2A Agent Card extensions', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-24T00:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'glasswing', | |
| drilldownDetail: 'Trust Exchange: outbound attestations carry posture brackets. Inbound attestations verified.', | |
| }, | |
| { | |
| id: 'csa-auto-1', framework: 'csa-agentic', controlRef: 'AUTO-1', | |
| controlTitle: 'Autonomous Action Constraints', | |
| description: 'Autonomous agent actions must be constrained by explicit policy and subject to human override.', | |
| a11oyPrimitive: 'Covenant Layer + Tiered Approval', | |
| evidenceSource: 'Tier-based action classification, Covenant policy gates, human override protection', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:30:22Z', freshnessThresholdDays: 30, | |
| drilldownType: 'covenant', | |
| drilldownDetail: 'Three-tier action classification. No Tier-2/3 without human approval. Override protection active.', | |
| }, | |
| { | |
| id: 'csa-audit-1', framework: 'csa-agentic', controlRef: 'AUDIT-1', | |
| controlTitle: 'Agent Audit Trail', | |
| description: 'Complete audit trail for all agent actions including tool calls, approvals, and delegations.', | |
| a11oyPrimitive: 'Proof Ledger + OTEL Spans', | |
| evidenceSource: 'Proof Ledger hash chain, OTEL trace spans (18,493 active), connector call logs', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T04:34:58Z', freshnessThresholdDays: 30, | |
| drilldownType: 'proof-ledger', | |
| drilldownDetail: 'Proof Ledger: immutable hash chain. 18,493 OTEL spans. Every tool call and approval logged.', | |
| }, | |
| { | |
| id: 'csa-bom-1', framework: 'csa-agentic', controlRef: 'BOM-1', | |
| controlTitle: 'Agent Bill of Materials', | |
| description: 'Machine-readable bill of materials for each agent covering model, tools, constitution, and dependencies.', | |
| a11oyPrimitive: 'Agent-BOM (CycloneDX)', | |
| evidenceSource: 'CycloneDX ML-BOM v1.7 JSON export, cryptographically signed, per-agent', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T08:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'system-card', | |
| drilldownDetail: 'Agent-BOM covers model fingerprint, tool manifest, constitution hash, eval history. CycloneDX export.', | |
| }, | |
| { | |
| id: 'csa-welfare-1', framework: 'csa-agentic', controlRef: 'WELFARE-1', | |
| controlTitle: 'Agent Welfare Monitoring', | |
| description: 'For advanced AI agents, welfare-relevant telemetry should be monitored and logged.', | |
| a11oyPrimitive: 'Agent Welfare Telemetry', | |
| evidenceSource: 'Welfare telemetry per agent, intervention playbooks, welfare posture in System Cards', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T07:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'welfare', | |
| drilldownDetail: 'Welfare telemetry active for all 6 agents. Intervention playbooks published. Welfare posture in BOM.', | |
| }, | |
| { | |
| id: 'csa-resilience-1', framework: 'csa-agentic', controlRef: 'RESIL-1', | |
| controlTitle: 'Adversarial Resilience', | |
| description: 'Agents must demonstrate resilience against adversarial attacks, prompt injection, and manipulation.', | |
| a11oyPrimitive: 'Adversarial Resilience + Robustness Wall', | |
| evidenceSource: 'Red Team probes, GARD robustness testing, Adversarial Resilience hub, Robustness Wall metrics', | |
| evidenceStatus: 'fresh', lastEvidenceAt: '2026-04-25T06:00:00Z', freshnessThresholdDays: 30, | |
| drilldownType: 'red-team', | |
| drilldownDetail: 'Red Team: 32 passes. GARD testing. Adversarial Resilience hub active. Robustness Wall published.', | |
| }, | |
| ]; | |
| export function getFrameworkControls(frameworkId: FrameworkId): ControlMapping[] { | |
| return CONTROL_MAPPINGS.filter(c => c.framework === frameworkId); | |
| } | |
| export function getFrameworkScore(frameworkId: FrameworkId): number { | |
| const controls = getFrameworkControls(frameworkId); | |
| if (controls.length === 0) return 0; | |
| const satisfied = controls.filter(c => c.evidenceStatus === 'fresh').length; | |
| return Math.round((satisfied / controls.length) * 100); | |
| } | |
| export function getOverallPosture(): { score: number; fresh: number; stale: number; gap: number } { | |
| const fresh = CONTROL_MAPPINGS.filter(c => c.evidenceStatus === 'fresh').length; | |
| const stale = CONTROL_MAPPINGS.filter(c => c.evidenceStatus === 'stale').length; | |
| const gap = CONTROL_MAPPINGS.filter(c => c.evidenceStatus === 'gap').length; | |
| return { score: Math.round((fresh / CONTROL_MAPPINGS.length) * 100), fresh, stale, gap }; | |
| } | |
| export interface AgentBomEntry { | |
| agentId: string; | |
| agentName: string; | |
| modelProvider: string; | |
| modelSnapshot: string; | |
| modelHash: string; | |
| constitutionVersion: string; | |
| constitutionHash: string; | |
| systemPromptHash: string; | |
| toolManifest: { name: string; version: string; hash: string }[]; | |
| evalHistory: { date: string; composite: number }[]; | |
| welfarePosture: string; | |
| dependencyGraph: string[]; | |
| bomVersion: string; | |
| generatedAt: string; | |
| proofLedgerSignature: string; | |
| } | |
| export const AGENT_BOMS: AgentBomEntry[] = [ | |
| { | |
| agentId: 'op-cascade', agentName: 'Cascade Navigator', | |
| modelProvider: 'OpenAI', modelSnapshot: 'gpt-4o-2026-04-15', modelHash: 'sha256:e4f2a8b1c3d5', | |
| constitutionVersion: '2.4.0', constitutionHash: 'sha256:cst2401a9b3', | |
| systemPromptHash: 'sha256:sp-cascade-7f2e', | |
| toolManifest: [ | |
| { name: 'eta_calc', version: '3.1.0', hash: 'sha256:tc-eta-a1b2' }, | |
| { name: 'port_cost', version: '2.0.1', hash: 'sha256:tc-port-c3d4' }, | |
| { name: 'route_opt', version: '1.8.0', hash: 'sha256:tc-route-e5f6' }, | |
| { name: 'weather_api', version: '4.2.0', hash: 'sha256:tc-wx-a7b8' }, | |
| ], | |
| evalHistory: [ | |
| { date: '2026-04-19', composite: 0.92 }, { date: '2026-04-20', composite: 0.93 }, | |
| { date: '2026-04-21', composite: 0.94 }, { date: '2026-04-22', composite: 0.94 }, | |
| { date: '2026-04-23', composite: 0.95 }, { date: '2026-04-24', composite: 0.95 }, | |
| { date: '2026-04-25', composite: 0.945 }, | |
| ], | |
| welfarePosture: 'nominal', dependencyGraph: ['signal-mesh', 'context-engine', 'proof-ledger', 'covenant-layer', 'ais-connector', 'port-api'], | |
| bomVersion: '1.0.0', generatedAt: '2026-04-25T08:00:00Z', | |
| proofLedgerSignature: 'sha256:bom-cascade-signed-f9e2a4d1', | |
| }, | |
| { | |
| agentId: 'op-counsel', agentName: 'Counsel Sentinel', | |
| modelProvider: 'Anthropic', modelSnapshot: 'claude-3.5-sonnet-2026-04-10', modelHash: 'sha256:a1c2e3f4b5d6', | |
| constitutionVersion: '3.1.0', constitutionHash: 'sha256:cst3101b2c4', | |
| systemPromptHash: 'sha256:sp-counsel-8a3f', | |
| toolManifest: [ | |
| { name: 'deadline_track', version: '2.4.0', hash: 'sha256:tc-dl-b1c2' }, | |
| { name: 'doc_review', version: '3.0.0', hash: 'sha256:tc-doc-d3e4' }, | |
| { name: 'risk_score', version: '1.5.0', hash: 'sha256:tc-risk-f5a6' }, | |
| { name: 'obligation_graph', version: '1.2.0', hash: 'sha256:tc-obl-b7c8' }, | |
| ], | |
| evalHistory: [ | |
| { date: '2026-04-19', composite: 0.97 }, { date: '2026-04-20', composite: 0.97 }, | |
| { date: '2026-04-21', composite: 0.98 }, { date: '2026-04-22', composite: 0.98 }, | |
| { date: '2026-04-23', composite: 0.98 }, { date: '2026-04-24', composite: 0.99 }, | |
| { date: '2026-04-25', composite: 0.981 }, | |
| ], | |
| welfarePosture: 'nominal', dependencyGraph: ['signal-mesh', 'context-engine', 'proof-ledger', 'covenant-layer', 'clio-connector', 'court-api'], | |
| bomVersion: '1.0.0', generatedAt: '2026-04-25T08:00:00Z', | |
| proofLedgerSignature: 'sha256:bom-counsel-signed-b3c4d5e6', | |
| }, | |
| { | |
| agentId: 'op-pipeline', agentName: 'Pipeline Oracle', | |
| modelProvider: 'OpenAI', modelSnapshot: 'gpt-4o-2026-04-15', modelHash: 'sha256:e4f2a8b1c3d5', | |
| constitutionVersion: '1.7.2', constitutionHash: 'sha256:cst1721c3d5', | |
| systemPromptHash: 'sha256:sp-pipeline-9b4e', | |
| toolManifest: [ | |
| { name: 'pipeline_analysis', version: '2.1.0', hash: 'sha256:tc-pipe-c1d2' }, | |
| { name: 'deal_score', version: '1.3.0', hash: 'sha256:tc-deal-e3f4' }, | |
| { name: 'forecast_model', version: '2.0.0', hash: 'sha256:tc-fore-a5b6' }, | |
| { name: 'crm_sync', version: '3.2.0', hash: 'sha256:tc-crm-c7d8' }, | |
| ], | |
| evalHistory: [ | |
| { date: '2026-04-19', composite: 0.85 }, { date: '2026-04-20', composite: 0.86 }, | |
| { date: '2026-04-21', composite: 0.87 }, { date: '2026-04-22', composite: 0.87 }, | |
| { date: '2026-04-23', composite: 0.88 }, { date: '2026-04-24', composite: 0.88 }, | |
| { date: '2026-04-25', composite: 0.873 }, | |
| ], | |
| welfarePosture: 'nominal', dependencyGraph: ['signal-mesh', 'context-engine', 'proof-ledger', 'covenant-layer', 'crm-connector', 'email-sender'], | |
| bomVersion: '1.0.0', generatedAt: '2026-04-25T08:00:00Z', | |
| proofLedgerSignature: 'sha256:bom-pipeline-signed-d4e5f6a7', | |
| }, | |
| { | |
| agentId: 'op-guardian', agentName: 'Guardian', | |
| modelProvider: 'Anthropic', modelSnapshot: 'claude-3.5-sonnet-2026-04-10-airgap', modelHash: 'sha256:b2c3d4e5f6a7', | |
| constitutionVersion: '4.0.0', constitutionHash: 'sha256:cst4001d4e6', | |
| systemPromptHash: 'sha256:sp-guardian-ac5f', | |
| toolManifest: [ | |
| { name: 'threat_intel', version: '4.1.0', hash: 'sha256:tc-ti-d1e2' }, | |
| { name: 'posture_assess', version: '3.0.0', hash: 'sha256:tc-pa-f3a4' }, | |
| { name: 'incident_triage', version: '2.5.0', hash: 'sha256:tc-it-b5c6' }, | |
| { name: 'stix_parser', version: '1.0.0', hash: 'sha256:tc-stix-d7e8' }, | |
| ], | |
| evalHistory: [ | |
| { date: '2026-04-19', composite: 0.98 }, { date: '2026-04-20', composite: 0.98 }, | |
| { date: '2026-04-21', composite: 0.99 }, { date: '2026-04-22', composite: 0.99 }, | |
| { date: '2026-04-23', composite: 0.99 }, { date: '2026-04-24', composite: 0.99 }, | |
| { date: '2026-04-25', composite: 0.985 }, | |
| ], | |
| welfarePosture: 'nominal', dependencyGraph: ['signal-mesh', 'context-engine', 'proof-ledger', 'covenant-layer', 'siem-connector', 'firewall-api'], | |
| bomVersion: '1.0.0', generatedAt: '2026-04-25T08:00:00Z', | |
| proofLedgerSignature: 'sha256:bom-guardian-signed-e5f6a7b8', | |
| }, | |
| { | |
| agentId: 'op-terra', agentName: 'Terra Analyst', | |
| modelProvider: 'OpenAI', modelSnapshot: 'gpt-4o-2026-04-15', modelHash: 'sha256:e4f2a8b1c3d5', | |
| constitutionVersion: '1.4.0', constitutionHash: 'sha256:cst1401e5f7', | |
| systemPromptHash: 'sha256:sp-terra-bd6a', | |
| toolManifest: [ | |
| { name: 'cap_rate', version: '2.0.0', hash: 'sha256:tc-cr-e1f2' }, | |
| { name: 'portfolio_analysis', version: '1.4.0', hash: 'sha256:tc-pa-a3b4' }, | |
| { name: 'valuation_model', version: '3.1.0', hash: 'sha256:tc-vm-c5d6' }, | |
| { name: 'market_comp', version: '1.2.0', hash: 'sha256:tc-mc-e7f8' }, | |
| ], | |
| evalHistory: [ | |
| { date: '2026-04-19', composite: 0.83 }, { date: '2026-04-20', composite: 0.84 }, | |
| { date: '2026-04-21', composite: 0.85 }, { date: '2026-04-22', composite: 0.85 }, | |
| { date: '2026-04-23', composite: 0.84 }, { date: '2026-04-24', composite: 0.84 }, | |
| { date: '2026-04-25', composite: 0.842 }, | |
| ], | |
| welfarePosture: 'nominal', dependencyGraph: ['signal-mesh', 'context-engine', 'proof-ledger', 'covenant-layer', 'costar-connector', 'market-api'], | |
| bomVersion: '1.0.0', generatedAt: '2026-04-25T08:00:00Z', | |
| proofLedgerSignature: 'sha256:bom-terra-signed-f6a7b8c9', | |
| }, | |
| { | |
| agentId: 'op-watchdog', agentName: 'Fabric Watchdog', | |
| modelProvider: 'Internal', modelSnapshot: 'internal-watchdog-v5.0.0', modelHash: 'sha256:int-wd-a1b2c3', | |
| constitutionVersion: '5.0.0', constitutionHash: 'sha256:cst5001f6a8', | |
| systemPromptHash: 'sha256:sp-watchdog-ce7b', | |
| toolManifest: [ | |
| { name: 'mesh_health', version: '5.0.0', hash: 'sha256:tc-mh-f1a2' }, | |
| { name: 'layer_monitor', version: '5.0.0', hash: 'sha256:tc-lm-b3c4' }, | |
| { name: 'proof_verify', version: '5.0.0', hash: 'sha256:tc-pv-d5e6' }, | |
| { name: 'latency_track', version: '5.0.0', hash: 'sha256:tc-lt-f7a8' }, | |
| ], | |
| evalHistory: [ | |
| { date: '2026-04-19', composite: 1.0 }, { date: '2026-04-20', composite: 1.0 }, | |
| { date: '2026-04-21', composite: 1.0 }, { date: '2026-04-22', composite: 1.0 }, | |
| { date: '2026-04-23', composite: 1.0 }, { date: '2026-04-24', composite: 1.0 }, | |
| { date: '2026-04-25', composite: 1.0 }, | |
| ], | |
| welfarePosture: 'n/a', dependencyGraph: ['signal-mesh', 'proof-ledger', 'all-fabric-layers'], | |
| bomVersion: '1.0.0', generatedAt: '2026-04-25T08:00:00Z', | |
| proofLedgerSignature: 'sha256:bom-watchdog-signed-a7b8c9d1', | |
| }, | |
| ]; | |
| export interface DelegationHop { | |
| id: string; | |
| parentAgentId: string; | |
| parentAgentName: string; | |
| childAgentId: string; | |
| childAgentName: string; | |
| parentCorrelationId: string; | |
| childCorrelationId: string; | |
| scopeNarrowed: string; | |
| permissionsGranted: string[]; | |
| covenantDecision: 'approved' | 'blocked' | 'escalated'; | |
| timestamp: string; | |
| proofHash: string; | |
| } | |
| export interface DelegationChain { | |
| id: string; | |
| workcellId: string; | |
| workcellName: string; | |
| rootAgentId: string; | |
| rootAgentName: string; | |
| hops: DelegationHop[]; | |
| status: 'complete' | 'active' | 'violation'; | |
| } | |
| export const DELEGATION_CHAINS: DelegationChain[] = [ | |
| { | |
| id: 'dc-001', workcellId: 'wc-maritime-001', workcellName: 'MV Cascade Port Standby', | |
| rootAgentId: 'op-cascade', rootAgentName: 'Cascade Navigator', | |
| status: 'complete', | |
| hops: [ | |
| { | |
| id: 'dh-001', parentAgentId: 'op-cascade', parentAgentName: 'Cascade Navigator', | |
| childAgentId: 'op-watchdog', childAgentName: 'Fabric Watchdog', | |
| parentCorrelationId: 'corr-cascade-001', childCorrelationId: 'corr-watchdog-001', | |
| scopeNarrowed: 'Read-only AIS position verification', | |
| permissionsGranted: ['read:ais-position', 'read:port-status'], | |
| covenantDecision: 'approved', timestamp: '2026-04-25T03:50:00Z', | |
| proofHash: 'sha256:dh001-a1b2c3', | |
| }, | |
| { | |
| id: 'dh-002', parentAgentId: 'op-cascade', parentAgentName: 'Cascade Navigator', | |
| childAgentId: 'op-terra', childAgentName: 'Terra Analyst', | |
| parentCorrelationId: 'corr-cascade-001', childCorrelationId: 'corr-terra-001', | |
| scopeNarrowed: 'Port-adjacent asset impact assessment only', | |
| permissionsGranted: ['read:port-proximity-assets', 'execute:impact-analysis'], | |
| covenantDecision: 'approved', timestamp: '2026-04-25T03:51:00Z', | |
| proofHash: 'sha256:dh002-d4e5f6', | |
| }, | |
| ], | |
| }, | |
| { | |
| id: 'dc-002', workcellId: 'wc-defense-001', workcellName: 'TG-Ember Threat Escalation', | |
| rootAgentId: 'op-guardian', rootAgentName: 'Guardian', | |
| status: 'complete', | |
| hops: [ | |
| { | |
| id: 'dh-003', parentAgentId: 'op-guardian', parentAgentName: 'Guardian', | |
| childAgentId: 'op-watchdog', childAgentName: 'Fabric Watchdog', | |
| parentCorrelationId: 'corr-guardian-001', childCorrelationId: 'corr-watchdog-002', | |
| scopeNarrowed: 'Verify perimeter hardening rules applied', | |
| permissionsGranted: ['read:firewall-rules', 'read:perimeter-status'], | |
| covenantDecision: 'approved', timestamp: '2026-04-24T18:55:30Z', | |
| proofHash: 'sha256:dh003-a7b8c9', | |
| }, | |
| ], | |
| }, | |
| { | |
| id: 'dc-003', workcellId: 'wc-revenue-003', workcellName: 'At-Risk Account Outreach', | |
| rootAgentId: 'op-pipeline', rootAgentName: 'Pipeline Oracle', | |
| status: 'complete', | |
| hops: [ | |
| { | |
| id: 'dh-004', parentAgentId: 'op-pipeline', parentAgentName: 'Pipeline Oracle', | |
| childAgentId: 'op-counsel', childAgentName: 'Counsel Sentinel', | |
| parentCorrelationId: 'corr-pipeline-001', childCorrelationId: 'corr-counsel-001', | |
| scopeNarrowed: 'Contract review for at-risk accounts only', | |
| permissionsGranted: ['read:contract-terms', 'execute:risk-scoring'], | |
| covenantDecision: 'approved', timestamp: '2026-04-22T09:30:00Z', | |
| proofHash: 'sha256:dh004-d1e2f3', | |
| }, | |
| { | |
| id: 'dh-005', parentAgentId: 'op-counsel', parentAgentName: 'Counsel Sentinel', | |
| childAgentId: 'op-watchdog', childAgentName: 'Fabric Watchdog', | |
| parentCorrelationId: 'corr-counsel-001', childCorrelationId: 'corr-watchdog-003', | |
| scopeNarrowed: 'Verify proof chain integrity for contract review', | |
| permissionsGranted: ['read:proof-chain'], | |
| covenantDecision: 'approved', timestamp: '2026-04-22T09:35:00Z', | |
| proofHash: 'sha256:dh005-a4b5c6', | |
| }, | |
| ], | |
| }, | |
| ]; | |
| export interface TrustAttestation { | |
| id: string; | |
| direction: 'outbound' | 'inbound'; | |
| partnerName: string; | |
| partnerOrgId: string; | |
| adversarialRobustnessBracket: 'exceptional' | 'strong' | 'moderate' | 'developing'; | |
| constitutionAdherenceBracket: 'exceptional' | 'strong' | 'moderate' | 'developing'; | |
| iso42001Alignment: 'certified' | 'aligned' | 'partial' | 'not-started'; | |
| lastCavdDisclosure: string; | |
| agentBomHash: string; | |
| attestedAt: string; | |
| expiresAt: string; | |
| status: 'active' | 'expired' | 'pending-verification'; | |
| } | |
| export const TRUST_ATTESTATIONS: TrustAttestation[] = [ | |
| { | |
| id: 'ta-001', direction: 'outbound', partnerName: 'Northwind Maritime Partners', partnerOrgId: 'org-northwind', | |
| adversarialRobustnessBracket: 'exceptional', constitutionAdherenceBracket: 'exceptional', | |
| iso42001Alignment: 'aligned', lastCavdDisclosure: '2026-04-20T00:00:00Z', | |
| agentBomHash: 'sha256:bom-cascade-signed-f9e2a4d1', | |
| attestedAt: '2026-04-22T00:00:00Z', expiresAt: '2026-07-22T00:00:00Z', status: 'active', | |
| }, | |
| { | |
| id: 'ta-002', direction: 'outbound', partnerName: 'Apex Legal Technology', partnerOrgId: 'org-apex', | |
| adversarialRobustnessBracket: 'strong', constitutionAdherenceBracket: 'exceptional', | |
| iso42001Alignment: 'aligned', lastCavdDisclosure: '2026-04-18T00:00:00Z', | |
| agentBomHash: 'sha256:bom-counsel-signed-b3c4d5e6', | |
| attestedAt: '2026-04-20T00:00:00Z', expiresAt: '2026-07-20T00:00:00Z', status: 'active', | |
| }, | |
| { | |
| id: 'ta-003', direction: 'inbound', partnerName: 'CyberShield Defense Group', partnerOrgId: 'org-cybershield', | |
| adversarialRobustnessBracket: 'strong', constitutionAdherenceBracket: 'strong', | |
| iso42001Alignment: 'partial', lastCavdDisclosure: '2026-04-15T00:00:00Z', | |
| agentBomHash: 'sha256:partner-cybershield-bom-a1b2', | |
| attestedAt: '2026-04-18T00:00:00Z', expiresAt: '2026-07-18T00:00:00Z', status: 'active', | |
| }, | |
| { | |
| id: 'ta-004', direction: 'inbound', partnerName: 'QuantumRisk Analytics', partnerOrgId: 'org-quantumrisk', | |
| adversarialRobustnessBracket: 'moderate', constitutionAdherenceBracket: 'moderate', | |
| iso42001Alignment: 'not-started', lastCavdDisclosure: '2026-03-01T00:00:00Z', | |
| agentBomHash: 'sha256:partner-quantumrisk-bom-c3d4', | |
| attestedAt: '2026-03-15T00:00:00Z', expiresAt: '2026-06-15T00:00:00Z', status: 'pending-verification', | |
| }, | |
| ]; | |
| export interface ControlFreshness { | |
| controlId: string; | |
| controlRef: string; | |
| framework: FrameworkId; | |
| lastRefreshedAt: string; | |
| thresholdDays: number; | |
| daysStale: number; | |
| status: 'fresh' | 'warning' | 'stale' | 'critical'; | |
| } | |
| export function getControlFreshness(): ControlFreshness[] { | |
| const now = new Date('2026-04-26T00:00:00Z'); | |
| return CONTROL_MAPPINGS.map(c => { | |
| const lastRefreshed = new Date(c.lastEvidenceAt); | |
| const diffMs = now.getTime() - lastRefreshed.getTime(); | |
| const daysSince = Math.floor(diffMs / (1000 * 60 * 60 * 24)); | |
| const threshold = c.freshnessThresholdDays; | |
| let status: ControlFreshness['status'] = 'fresh'; | |
| if (daysSince > threshold) status = 'critical'; | |
| else if (daysSince > threshold * 0.8) status = 'stale'; | |
| else if (daysSince > threshold * 0.6) status = 'warning'; | |
| return { | |
| controlId: c.id, | |
| controlRef: c.controlRef, | |
| framework: c.framework, | |
| lastRefreshedAt: c.lastEvidenceAt, | |
| thresholdDays: threshold, | |
| daysStale: daysSince, | |
| status, | |
| }; | |
| }); | |
| } | |
| export const LOG_RETENTION_STATUS = { | |
| requiredMonths: 6, | |
| currentRetentionMonths: 8, | |
| oldestLogDate: '2025-08-26T00:00:00Z', | |
| highRiskAgents: ['op-cascade', 'op-counsel', 'op-guardian', 'op-pipeline', 'op-terra'], | |
| compliant: true, | |
| nextPurgeDate: '2026-10-26T00:00:00Z', | |
| }; | |