CR-010.R3: compliance packs as data — x-sox (SOX/COSO) financial controls first

[quantamixsol]

CR-010.R3 — Compliance packs as data (x-sox financial controls first)

Public cherry-pick of private #331, merged as 7c1cf8b5. Feature commit 3798bb86 → this branch as c9bc6456, branched off the current public head 597a7c49 (public master moved during review — CR-DIST-06 #249 landed in between).

Program context: requirement R3 of CR-010, the 16-requirement Enterprise Enhancement Program. R5 · R4 · R1 · R6 already shipped (PyPI 0.83.0); this is the 5th.

---

What this delivers

GraQle had deep EU AI Act support and no SOX, SOC 2, NIST AI RMF, HIPAA, or ISO 27001 mappings at all. R3 closes that, and — more durably — changes how every future framework gets added.

1. x-sox — the SOX/COSO vocabulary. An AI-assisted financial-close decision can now carry a machine-readable binding to a named internal control, a financial-statement assertion (existence / completeness / accuracy / cutoff / valuation / rights-and-obligations / presentation-and-disclosure), a reporting period, and management-review linkage with an evidence pointer. An external auditor verifies all of it offline — no GraQle instance required.

2. Compliance packs as data. A framework is now two files in a directory — pack.yaml + schema.json — discovered by directory scan over importlib.resources. NIST AI RMF and ISO/IEC 42001 (R3's deliverable 2) become data authoring, not engineering.

Why this needed no engine change

graqle/compliance/claim_limits/taxonomy.py:127 already accepts ^x-[a-z0-9_-]{1,64}$, and is_valid_claim_limit (:135-164) admits any value matching it. So this pack's four x-sox-* claim limits validate with zero taxonomy edit. That verified fact — not a new plugin system — is what makes "authorable as schema + YAML without touching engine code" reachable.

Explicitly NOT built: entry-point / plugin discovery. That is R10. A test asserts the loader imports no importlib.metadata, pkg_resources, or entry_points( machinery.

The Article 14 gate is untouched — by design

git diff --stat -- graqle/compliance/article_14_gate.py → 0 lines, verified on this base.

SOX calls it a management review control; the EU AI Act calls it human oversight. Same mechanics, different vocabulary. The tempting move is to rename the existing type to cover both — the adversarial reviewer proposed exactly that (Article14GateResult → _ReviewGateResult, field confidence → score, old name as an alias). Rejected: four consumers pin that contract (mcp_dev_server.py:9110/9374/12029, two hardcoding "ARTICLE_14_HUMAN_REVIEW_REQUIRED", plus switch_status.py:91-106 republishing the threshold and error code into a public envelope). A rename is a silent 4-module break for zero functional gain. SOX got a sibling module with its own error code (MANAGEMENT_REVIEW_REQUIRED) and result type; regression tests pin the EU surface — field names and order, clauses, error code, threshold, and the switch_status probe envelope.

PII posture

preparer_token / reviewer_token accept a 64-char lowercase-hex HMAC-SHA256 token or the explicit "omit" sentinel, and reject raw identifiers at construction — tested against emails, display names, employee IDs, UUIDs, off-by-one lengths, and uppercase hex. The identity↔token mapping stays with the operator and is never written to a pack, token, or evidence artifact. An auditor can still verify segregation of duties (preparer ≠ reviewer) without learning either identity.

This is not justified by signature immutability. Measured: LEAF_HASH_FIELDS (leaf_input_schema.py:28-34) is a frozen 5-tuple and project_leaf_input() drops every other key, so an x-sox: field cannot enter a leaf hash or signed preimage. The discipline exists because these values live in long-lived, widely-shared audit artifacts.

---

Verified ON THIS PUBLIC BASE (not on the private branch)

A merge commit is a different tree than what was tested; these were re-run against 597a7c49 itself.

Check	Result
R3 tests	133 passed
tests/test_compliance/ + tests/test_pct/	913 passed, 4 skipped
tests/test_governance/ + tests/test_tamper_evidence/	772 passed, 6 skipped
test_shacl.py	Excluded — ModuleNotFoundError: rdflib, proven pre-existing by stashing all R3 changes and reproducing on pristine master
TS-SCREEN	0 ✅
article_14_gate.py diff	0 lines ✅
Public wheel	Builds clean, zero duplicate entries, ships all 4 pack files
Parity with private	All 8 R3 source files byte-identical to private/master

Tests are unit + adversarial/negative (mandatory P0) + property + regression: calendar-impossible dates, raw-identifier rejection, malformed YAML/JSON, invalid and reserved namespaces, a manifest violating its own schema, duplicate namespaces, UTF-8 BOM handling, and the EU-contract regression set.

Sentinel — 2-pass adversarial → APPROVE, 0 BLOCKERs

Every finding was reproduced before fixing; 4 of 8 were refuted by measurement. Three real ones were fixed: calendar-impossible dates ("2026-13-45" was accepted — the regex checks shape, not calendar → now date.fromisoformat()); namespace shadowing (x-ai-eu is a well-formed x- namespace, so a pack could shadow the EU AI Act vocabulary → RESERVED_NAMESPACES guard); and a cross-module private-helper import (→ _gate_helpers public re-exports). A UTF-8 BOM issue that both sentinel passes missed was caught separately: a BOM is fatal to json.loads but tolerated by yaml.safe_load, so a Windows-saved schema.json would have failed as "not valid JSON" while its pack.yaml sibling loaded — now read via read_bytes().decode("utf-8-sig").

Rollback

Revert the single commit. Zero data-loss risk, zero migration: everything is additive (new modules + new package data). No existing record, bundle, or signature changes shape, because x-sox fields cannot enter LEAF_HASH_FIELDS. No previously-issued bundle is invalidated.

Deferred

R3's deliverable 3 — replacing the placeholder review threshold with a calibration-backed value — is deliberately not in this PR. It mutates a live EU AI Act enforcement path whose default is asserted literally at test_article_14_gate.py:27 and republished by switch_status.py:103. Both gates already carry threshold_status, so a calibrated value is a drop-in later.

Ships in 0.84.0.

🤖 Generated with Claude Code

[github-actions]

🛡️ GraQle PR Guardian

💥 Blast Radius: 12 modules affected

Module	Files Changed	Risk Level	Impact Radius
graqle	8	🟡 T2	8
pyproject.toml	1	🟡 T2	1
tests	3	🟢 T1	3

Total blast radius: 12

---

🏛️ Governance Verdict

⚠️ WARN

• T2: Advisory warnings detected. Review recommended.

---

🔍 SHACL Violations

No SHACL violations detected. ✅

---

🔐 Approval Requirements

This PR requires approval from: T2

• A Senior Engineer or above must approve.

❌ Approval requirement NOT yet satisfied.

---

Metric	Value
Blast Radius	12
Files Analyzed	12
Blocked	0
SHACL Violations	0
Verdict	WARN

---

_{🔬 Powered by GraQle PR Guardian v0.1.0 · Scan completed 2026-08-05T20:08:10.657706+00:00}