Skip to main content

​
Stage overview

​
Stage 0: Init

Command: complior init or complior (TUI onboarding wizard) Completeness: 0% → 65–70% Two entry paths:
  • CLI: complior init → creates .complior/ + profile.json + project.toml → auto-discovers AI agents → creates passports
  • TUI: complior (no args) → 8-step onboarding wizard → auto-scan on completion → agents discovered via scan.completed event
complior agent init is optional — init does agent discovery automatically. Use agent init --force to regenerate passports.

​
What gets auto-filled (~44 fields)

agent_id (UUID), name, display_name, description, version, created, updatedSource: entry file name, framework config, auto-generated UUID.
type (autonomous/assistive/hybrid), autonomy_level (L1–L5), autonomy_evidence (gates, unsupervised, no_logging counts), killSwitchPresentSource: L4 AST pattern matching.
framework, model.provider, model.model_id, model.deployment, model.data_residencySource: L3 dependency analysis + SDK detection + profile.json.
permissions.tools, permissions.data_access (read/write/delete), permissions.denied, permissions.data_boundaries, interop.mcp_serversSource: Permission scanner — analyzes tool definitions, DB patterns, explicit deny lists, MCP config.
human_approval_required, prohibited_actions, escalation_rules, rate_limits (default: 100/min), budget (default: $5.00/session)Source: AST (confirm/approve gates) + defaults.
risk_class, applicable_articles, obligations_met, obligations_pending, complior_score (0 until first scan), last_scanSource: Computed from autonomy level × project domain.
actions_logged, retention_days (default: 365), lifecycle.status (“draft”), lifecycle.next_review (created + 90 days)Source: AST logging patterns + defaults.
Ed25519 signature (algorithm, public_key, signed_at, hash, value). Source tracking: source.mode (“auto”), source.confidence, fields_auto_filled, fields_manual.

​
What stays empty (filled in Stage 3)

owner.team, owner.contact, owner.responsible_person, disclosure.user_facing, disclosure.disclosure_text, disclosure.ai_marking, lifecycle.deployed_since

​
Stage 1: Scan

Command: complior scan (any tier) Completeness: 65% → 70% Every scan triggers two actions:
  1. initPassport() — discovers new agents (idempotent, skips existing)
  2. updatePassportsAfterScan() — updates score on all passports
Fields updated:
  • compliance.complior_score — 0 → actual score (e.g. 74)
  • compliance.last_scan — timestamp
  • updated — new timestamp
  • signature — re-signed

​
Scan sub-tiers

Score differs per tier, but passport update is the same (score + last_scan).

​
Stage 2: Fix

Command: complior fix Completeness: score↑ via auto-rescan Applies recommended remediation strategies to code. Triggers auto-rescan → passport score updates. Score can jump significantly (e.g. 60 → 85 after fixes). Use --dry-run to preview without applying.

​
Stage 3: Manual Fill

Command: TUI Passport page (hotkey P) or JSON edit Completeness: 70% → 93% Typically 8 fields remain after auto-fill:

​
Stage 4: Documents

Completeness: 93% → 100%
Sets fria_completed: true, fria_date. 14+ fields pre-filled from passport. Use --impact, --mitigation, --approval for manual sections. Mandatory for high-risk systems.
Sets worker_notification_sent: true, worker_notification_date. 9 fields pre-filled. Required for high-risk AI in workplace.
Sets policy_generated: true, policy_date. 11 fields pre-filled. --industry hr|finance|healthcare for domain-specific templates.
ZIP bundle: passport + scan report + eval report + FRIA + evidence chain. Does not update passport directly.
27/27 required fields filled = 100% completeness. Passport re-signed with ed25519 after every update.

​
Stage 5: Eval

Command: complior eval --target <url> --agent <name> Completeness: 100% → 100%+ Tests the running AI system (not code). Adds compliance.eval block with 20+ fields: Eval tiers: --det (168 deterministic), --llm (+212 LLM-judged), --security (300 attack probes), --full (680 all).
Scan checks CODE. Eval checks BEHAVIOR. Both scores in the passport = full picture.

​
Stage 6: Live Update

Trigger: Daemon file watcher + scan.completed event Completeness: 100% maintained Every file save → 200ms debounce → re-scan → score update in passport. New AI SDK imports → auto-discovery of new agents. Passport always contains current complior_score and last_scan.

​
Planned stages

​
Stage 7: LLM Docs

Command: complior fix --ai LLM auto-fills empty sections in FRIA/Policy/Notification documents. Markers [AI-DRAFT] for human review. Pre-fill context: 9 fields from passport → LLM prompt. Fills “Specific Risks”, “Mitigation Measures”, “Monitoring Plan”.

​
Stage 8: Eval Remediation

Command: complior eval --fix Remediation Knowledge Base (11 category playbooks). Eval Fix Generator: system prompt patches, API config, guardrail config. Eval findings → FixDiff pipeline (new FindingSource: “eval”).

​
Stage 9: MCP Proxy

Command: complior proxy connect For black-box agents (no code, only MCP traffic). Enriches existing passport: permissions.tools (runtime), data_access (observed), autonomy_level (inferred). source.mode → “runtime” (confidence 0.55 vs AST ~0.42).

​
Stage 10: Monitor

Command: complior monitor --source <langfuse|sdk-logs> Post-deployment monitoring. Adds compliance.monitoring block: monitoring_score, drift_detected, last_monitoring, anomalies[]. Compares runtime behavior vs passport declarations (e.g., declared L3 but observed L5).