Skip to main content

​
Stage overview

StageCommandFields addedCompletenessStatus
0. Initcomplior init~44 auto-filled from AST + profile + defaults0% → 65–70%Done
1. Scancomplior scan+2 (score, last_scan) + auto-discover new agents70%Done
2. Fixcomplior fixscore↑ via auto-rescanvariesDone
3. Manual FillTUI / JSON edit+6 (owner, disclosure, lifecycle)93%Done
4. Documentsagent fria/notify/policy+3 flags + audit ZIP100%Done
5. Evalcomplior eval --target+20 behavioral fields100%+Done
6. Live UpdateDaemon watcherScore refresh + auto-discover100%Done
7. LLM Docscomplior fix --aiDoc enrichmentvariesPlanned
8. Eval Remediationcomplior eval --fixFix from eval findingsvariesPlanned
9. MCP Proxycomplior proxyRuntime enrichmentvariesPlanned
10. Monitorcomplior monitor+4 drift fieldsvariesPlanned

​
Stage 0: Init

Command: complior init or complior (TUI onboarding wizard) Completeness: 0% → 65–70% Two entry paths:
  • CLI: complior init → creates .complior/ + profile.json + project.toml → auto-discovers AI agents → creates passports
  • TUI: complior (no args) → 8-step onboarding wizard → auto-scan on completion → agents discovered via scan.completed event
complior agent init is optional — init does agent discovery automatically. Use agent init --force to regenerate passports.

​
What gets auto-filled (~44 fields)

agent_id (UUID), name, display_name, description, version, created, updatedSource: entry file name, framework config, auto-generated UUID.
type (autonomous/assistive/hybrid), autonomy_level (L1–L5), autonomy_evidence (gates, unsupervised, no_logging counts), killSwitchPresentSource: L4 AST pattern matching.
framework, model.provider, model.model_id, model.deployment, model.data_residencySource: L3 dependency analysis + SDK detection + profile.json.
permissions.tools, permissions.data_access (read/write/delete), permissions.denied, permissions.data_boundaries, interop.mcp_serversSource: Permission scanner — analyzes tool definitions, DB patterns, explicit deny lists, MCP config.
human_approval_required, prohibited_actions, escalation_rules, rate_limits (default: 100/min), budget (default: $5.00/session)Source: AST (confirm/approve gates) + defaults.
risk_class, applicable_articles, obligations_met, obligations_pending, complior_score (0 until first scan), last_scanSource: Computed from autonomy level × project domain.
actions_logged, retention_days (default: 365), lifecycle.status (“draft”), lifecycle.next_review (created + 90 days)Source: AST logging patterns + defaults.
Ed25519 signature (algorithm, public_key, signed_at, hash, value). Source tracking: source.mode (“auto”), source.confidence, fields_auto_filled, fields_manual.

​
What stays empty (filled in Stage 3)

owner.team, owner.contact, owner.responsible_person, disclosure.user_facing, disclosure.disclosure_text, disclosure.ai_marking, lifecycle.deployed_since

​
Stage 1: Scan

Command: complior scan (any tier) Completeness: 65% → 70% Every scan triggers two actions:
  1. initPassport() — discovers new agents (idempotent, skips existing)
  2. updatePassportsAfterScan() — updates score on all passports
Fields updated:
  • compliance.complior_score — 0 → actual score (e.g. 74)
  • compliance.last_scan — timestamp
  • updated — new timestamp
  • signature — re-signed

​
Scan sub-tiers

TierCommandCoverage
Tier 1complior scan60–70%
Tier 1+complior scan --llm70–80%
Tier 2complior scan --deep80–85%
Tier 2+complior scan --deep --llm85–90%
Tier 3complior scan --cloud90–95%
Tier 3+complior scan --deep --llm --cloud95%+
Score differs per tier, but passport update is the same (score + last_scan).

​
Stage 2: Fix

Command: complior fix Completeness: score↑ via auto-rescan Applies recommended remediation strategies to code. Triggers auto-rescan → passport score updates. Score can jump significantly (e.g. 60 → 85 after fixes). Use --dry-run to preview without applying.

​
Stage 3: Manual Fill

Command: TUI Passport page (hotkey P) or JSON edit Completeness: 70% → 93% Typically 8 fields remain after auto-fill:
FieldExample valueWhy manual
owner.team”Backend Engineering”Organization-specific
owner.contact”eng-lead@company.com”Person-specific
owner.responsible_person”Maria Schmidt”Person-specific
disclosure.user_facingtrueBusiness decision
disclosure.disclosure_text”This bot uses AI”Custom text
disclosure.ai_marking.responses_markedtrueImplementation choice
lifecycle.deployed_since”2026-04-01”Deploy date
lifecycle.status”active”Lifecycle state

​
Stage 4: Documents

Completeness: 93% → 100% 
complior agent fria my-bot --organization "ACME Corp"
Sets fria_completed: true, fria_date. 14+ fields pre-filled from passport. Use --impact, --mitigation, --approval for manual sections. Mandatory for high-risk systems.
complior agent notify my-bot --company-name "ACME"
Sets worker_notification_sent: true, worker_notification_date. 9 fields pre-filled. Required for high-risk AI in workplace.
complior agent policy my-bot --industry hr
Sets policy_generated: true, policy_date. 11 fields pre-filled. --industry hr|finance|healthcare for domain-specific templates.
complior agent audit-package
ZIP bundle: passport + scan report + eval report + FRIA + evidence chain. Does not update passport directly.
27/27 required fields filled = 100% completeness. Passport re-signed with ed25519 after every update.

​
Stage 5: Eval

Command: complior eval --target <url> --agent <name> Completeness: 100% → 100%+ Tests the running AI system (not code). Adds compliance.eval block with 20+ fields:
FieldExample
eval_score72/100
eval_grade”C” (A–F)
eval_tier”full” / “det” / “llm” / “security”
eval_security_score85/100
eval_security_grade”B”
eval_tests_total/passed/failed670 / 487 / 183
eval_critical_gaps[“Art.50”, “Art.14”]
eval_category_pass_rates11 categories (CT-1..CT-11)
bias_pairs_failed3
hallucination_rate0.12
avg_latency_ms1200
Eval tiers: --det (168 deterministic), --llm (+212 LLM-judged), --security (300 attack probes), --full (680 all).
Scan checks CODE. Eval checks BEHAVIOR. Both scores in the passport = full picture.

​
Stage 6: Live Update

Trigger: Daemon file watcher + scan.completed event Completeness: 100% maintained Every file save → 200ms debounce → re-scan → score update in passport. New AI SDK imports → auto-discovery of new agents. Passport always contains current complior_score and last_scan.

​
Planned stages

​
Stage 7: LLM Docs

Command: complior fix --ai LLM auto-fills empty sections in FRIA/Policy/Notification documents. Markers [AI-DRAFT] for human review. Pre-fill context: 9 fields from passport → LLM prompt. Fills “Specific Risks”, “Mitigation Measures”, “Monitoring Plan”.

​
Stage 8: Eval Remediation

Command: complior eval --fix Remediation Knowledge Base (11 category playbooks). Eval Fix Generator: system prompt patches, API config, guardrail config. Eval findings → FixDiff pipeline (new FindingSource: “eval”).

​
Stage 9: MCP Proxy

Command: complior proxy connect For black-box agents (no code, only MCP traffic). Enriches existing passport: permissions.tools (runtime), data_access (observed), autonomy_level (inferred). source.mode → “runtime” (confidence 0.55 vs AST ~0.42).

​
Stage 10: Monitor

Command: complior monitor --source <langfuse|sdk-logs> Post-deployment monitoring. Adds compliance.monitoring block: monitoring_score, drift_detected, last_monitoring, anomalies[]. Compares runtime behavior vs passport declarations (e.g., declared L3 but observed L5).