Spaces:
Sleeping
Sleeping
| """ | |
| CycloneDX 1.6 AI Bill of Materials (AIBOM) Generator. | |
| Produces machine-readable AI Bill of Materials adhering to OWASP CycloneDX v1.6 | |
| specifications for EU AI Act Annex IV, NIST AI RMF, and enterprise GRC ingestion. | |
| """ | |
| from typing import Dict, Any, List, Optional | |
| import uuid | |
| from datetime import datetime, timezone | |
| import json | |
| from src.core.models import ConformityReport, EntityCategory, AssertionStatus | |
| class AIBOMGenerator: | |
| """Generates official CycloneDX 1.6 AI Bill of Materials (AIBOM) documents.""" | |
| CYCLONEDX_VERSION = "1.6" | |
| SPEC_SCHEMA = f"http://cyclonedx.org/schema/bom-{CYCLONEDX_VERSION}.schema.json" | |
| def generate_bom(cls, report: ConformityReport) -> Dict[str, Any]: | |
| """Translates a ConformityReport into a structured CycloneDX 1.6 AIBOM dictionary.""" | |
| meta = report.system_metadata | |
| prov = report.provenance | |
| serial_uuid = f"urn:uuid:{uuid.uuid4()}" | |
| # Extract datasets and governance components from claims | |
| sub_components: List[Dict[str, Any]] = [] | |
| for idx, claim in enumerate(report.claims_analyzed): | |
| comp_type = "data" if claim.category == EntityCategory.DATA_GOVERNANCE else "framework" | |
| sub_components.append({ | |
| "type": comp_type, | |
| "bom-ref": f"component-{claim.claim_id}", | |
| "name": claim.category.value, | |
| "description": claim.entity_text, | |
| "properties": [ | |
| {"name": "reguai:assertionStatus", "value": claim.assertion_status.value}, | |
| {"name": "reguai:confidence", "value": str(round(claim.confidence, 3))}, | |
| {"name": "reguai:normativeArticle", "value": claim.normative_article}, | |
| {"name": "reguai:evidenceQuote", "value": claim.evidence_quote[:200]}, | |
| ] | |
| }) | |
| # Base CycloneDX 1.6 AI model component | |
| model_component: Dict[str, Any] = { | |
| "type": "machine-learning-model", | |
| "bom-ref": f"model-{meta.system_id}", | |
| "name": meta.name, | |
| "version": meta.version, | |
| "description": meta.intended_purpose, | |
| "supplier": { | |
| "name": meta.developer_name, | |
| }, | |
| "modelCard": { | |
| "modelParameters": { | |
| "task": meta.domain, | |
| "architecture": meta.eu_risk_classification, | |
| }, | |
| "quantitativeAnalysis": { | |
| "performanceMetrics": [ | |
| { | |
| "type": "ConformityScore", | |
| "value": f"{report.conformity_score:.1f}%", | |
| "description": "Deterministic EU AI Act SHACL Normative Conformity Index" | |
| }, | |
| { | |
| "type": "PassedRequirements", | |
| "value": f"{report.passed_requirements_count}/{report.total_requirements_evaluated}", | |
| "description": "Total satisfied legal shape constraints" | |
| } | |
| ] | |
| }, | |
| "considerations": { | |
| "users": [meta.deployment_context], | |
| "useCases": [meta.intended_purpose], | |
| "limitations": [ | |
| v.message for v in report.violations | |
| ] if report.violations else ["None identified under verified constraints."] | |
| } | |
| }, | |
| "properties": [ | |
| {"name": "reguai:riskClassification", "value": meta.eu_risk_classification}, | |
| {"name": "reguai:conformityStatus", "value": "CONFORMS" if report.overall_conforms else "NON_CONFORMANT"}, | |
| {"name": "reguai:digitalSignature", "value": prov.digital_signature}, | |
| {"name": "reguai:inputDocSha256", "value": prov.input_doc_sha256}, | |
| {"name": "reguai:rulesetSha256", "value": prov.ruleset_sha256}, | |
| ] | |
| } | |
| # Regulatory compliance declarations under CycloneDX 1.6 declarations | |
| declarations = { | |
| "standards": [ | |
| { | |
| "name": "Regulation (EU) 2024/1689 (EU AI Act)", | |
| "version": "2024/1689", | |
| "description": "European Union Artificial Intelligence Act", | |
| "status": "passed" if report.overall_conforms else "failed", | |
| "requirements": [ | |
| { | |
| "identifier": v.regulatory_article, | |
| "title": v.regulatory_article, | |
| "conformance": { | |
| "score": 0.0, | |
| "rationale": v.message | |
| } | |
| } for v in report.violations | |
| ] | |
| }, | |
| { | |
| "name": "NIST AI RMF 1.0", | |
| "version": "1.0", | |
| "description": "NIST Artificial Intelligence Risk Management Framework", | |
| "status": "passed" if report.overall_conforms else "warning" | |
| }, | |
| { | |
| "name": "ISO/IEC 42001:2023", | |
| "version": "2023", | |
| "description": "Artificial Intelligence Management System", | |
| "status": "passed" if report.overall_conforms else "warning" | |
| } | |
| ] | |
| } | |
| bom_doc: Dict[str, Any] = { | |
| "$schema": cls.SPEC_SCHEMA, | |
| "bomFormat": "CycloneDX", | |
| "specVersion": cls.CYCLONEDX_VERSION, | |
| "serialNumber": serial_uuid, | |
| "version": 1, | |
| "metadata": { | |
| "timestamp": report.generated_at_utc, | |
| "tools": [ | |
| { | |
| "vendor": "ReguAI Governance", | |
| "name": "ReguAI Neuro-Symbolic GRC Core", | |
| "version": "0.1.0" | |
| } | |
| ], | |
| "component": model_component, | |
| }, | |
| "components": sub_components, | |
| "declarations": declarations, | |
| "vulnerabilities": [ | |
| { | |
| "id": f"EU-AI-ACT-{v.regulatory_article.replace(' ', '-')}", | |
| "description": v.message, | |
| "recommendation": v.remediation_guidance, | |
| "analysis": { | |
| "state": "exploitable" if v.severity == "Violation" else "in_triage", | |
| "detail": v.normative_reference | |
| } | |
| } for v in report.violations | |
| ] | |
| } | |
| return bom_doc | |