Deploy ReguAI: Neuro-Symbolic AI GRC & Automated Conformity Assessment Engine

.github/workflows/reguai-gate.yml

@@ -0,0 +1,70 @@
+name: ReguAI Deterministic Regulatory Gate
+
+on:
+  pull_request:
+    paths:
+      - '**.md'
+      - '**.json'
+      - '**.yaml'
+      - '**.yml'
+      - 'data/**'
+      - 'src/**'
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  regulatory-audit:
+    name: EU AI Act & GRC Normative Verification
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Codebase
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Execute ReguAI Audit Gate
+        id: reguai_audit
+        continue-on-error: true
+        run: |
+          mkdir -p reports
+          python -m src.cli audit data/synthetic_systems/ \
+            --format text \
+            --sarif-out reports/reguai-results.sarif \
+            --fail-on-violation
+
+      - name: Upload SARIF to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: reports/reguai-results.sarif
+          category: ReguAI-EU-AI-Act
+
+      - name: Comment PR Conformity Summary
+        if: github.event_name == 'pull_request' && always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let summary = '### 🏛️ ReguAI Regulatory Conformity Audit Complete\n\nDeterministic W3C SHACL verification results have been uploaded to GitHub Code Scanning.';
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: summary
+            });

README.md

@@ -159,11 +159,28 @@ markdown_report = engine.report_generator.generate_markdown_report(report)
 # Export Machine-Readable JSON-LD Certificate
 json_ld_cert = engine.report_generator.generate_json_ld(report)
 
+# Export CycloneDX 1.6 Machine-Readable AI-BOM
+aibom_json = engine.report_generator.generate_cyclonedx_bom(report)
+
 # Generate Print-Ready HTML Attestation Certificate
 html_cert = engine.report_generator.generate_html_certificate(report)
 ```
 
-### 5. Running the Test Suite
+### 5. Automated CI/CD Regulatory Gate (CLI & SARIF)
+
+```bash
+# Audit a model card or directory with exit code gate
+python -m src.cli audit data/synthetic_systems/compliant_clinical_samd.json \
+  --format text \
+  --sarif-out reports/audit.sarif \
+  --bom-out reports/cyclonedx_aibom.json \
+  --fail-on-violation
+
+# Train active learning triplet metric learner on auditor feedback
+python -m src.triage.train_triplets
+```
+
+### 6. Running the Test Suite
 
 ```bash
 pytest tests/ -v

api.py

@@ -245,6 +245,45 @@ def get_certificate_html(token: str):
     return HTMLResponse(content=html)
 
 
+@app.get("/api/v1/certificates/{token}/bom", tags=["Conformity Assessment"])
+def get_certificate_bom(token: str):
+    """Retrieves machine-readable CycloneDX 1.6 AI Bill of Materials (AIBOM) for an audit."""
+    report = CERTIFICATE_CACHE.get(token)
+    if not report:
+        samd_path = SYNTHETIC_DIR / "compliant_clinical_samd.json"
+        report = engine.evaluate_system(samd_path)
+    
+    return engine.report_generator.generate_cyclonedx_bom(report)
+
+
+@app.get("/api/v1/certificates/{token}/sarif", tags=["Conformity Assessment"])
+def get_certificate_sarif(token: str):
+    """Retrieves OASIS SARIF 2.1.0 security & compliance report for an audit."""
+    from src.triage.sarif_exporter import SarifExporter
+    report = CERTIFICATE_CACHE.get(token)
+    if not report:
+        samd_path = SYNTHETIC_DIR / "compliant_clinical_samd.json"
+        report = engine.evaluate_system(samd_path)
+    
+    return SarifExporter.generate_sarif(report)
+
+
+@app.post("/api/v1/audit/bom", tags=["Conformity Assessment"])
+def generate_audit_bom(request: AuditRequest):
+    """Generates a CycloneDX 1.6 AI-BOM directly from specification text."""
+    if not request.specification_text.strip():
+        raise HTTPException(status_code=400, detail="Specification text cannot be empty.")
+    
+    report = engine.evaluate_system(
+        request.specification_text,
+        auditor_id=request.auditor_id,
+        annual_turnover_eur=request.annual_turnover_eur or 0.0,
+        is_sme=request.is_sme or False,
+    )
+    CERTIFICATE_CACHE[report.provenance.digital_signature] = report
+    return engine.report_generator.generate_cyclonedx_bom(report)
+
+
 @app.post("/api/v1/triage/feedback", tags=["Active Learning"])
 def submit_auditor_feedback(feedback: TripletFeedbackRequest):
     """

app.py

@@ -19,6 +19,7 @@ from src.core.models import AssertionStatus, EntityCategory
 from src.ui.graph_view import RegulatoryGraphView
 
 from src.core.case_catalog import CaseStudyCatalog
+from src.triage.sarif_exporter import SarifExporter
 
 # Initialize ReguAI Engine & Graph Visualizer & Case Study Catalog
 engine = ReguAIEngine()
@@ -96,6 +97,8 @@ def run_assessment(doc_text: str, auditor_id: str, annual_turnover: float = 5000
             [],
             [],
             "<div style='padding:15px;'>No fine liability evaluated.</div>",
+            "{}",
+            "{}",
         )
 
     report = engine.evaluate_system(
@@ -243,6 +246,8 @@ def run_assessment(doc_text: str, auditor_id: str, annual_turnover: float = 5000
     cert_iframe_html = f"""
     <iframe srcdoc="{escaped_cert}" style="width: 100%; height: 680px; border: 1px solid #e2e8f0; border-radius: 8px;" frameborder="0"></iframe>
     """
+    bom_json = json.dumps(engine.report_generator.generate_cyclonedx_bom(report), indent=2)
+    sarif_json = SarifExporter.export_sarif_json(report, indent=2)
 
     return (
         exec_html,
@@ -257,6 +262,8 @@ def run_assessment(doc_text: str, auditor_id: str, annual_turnover: float = 5000
         borderline_data,
         frameworks_data,
         fine_html,
+        bom_json,
+        sarif_json,
     )
 
 
@@ -877,8 +884,12 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
                             report_markdown = gr.Markdown(value=DEFAULT_ASSESSMENT[7])
                         with gr.TabItem("Machine-Readable JSON-LD"):
                             jsonld_display = gr.Code(value=DEFAULT_ASSESSMENT[6], language="json", label="W3C JSON-LD Digital Certificate")
+                        with gr.TabItem("📦 CycloneDX 1.6 AI-BOM"):
+                            bom_display = gr.Code(value=DEFAULT_ASSESSMENT[12], language="json", label="CycloneDX 1.6 Machine-Readable AI-BOM")
+                        with gr.TabItem("🛡️ OASIS SARIF 2.1.0 Report"):
+                            sarif_display = gr.Code(value=DEFAULT_ASSESSMENT[13], language="json", label="OASIS SARIF 2.1.0 Static Analysis Report")
 
-    # Outputs list for 1-click preset execution (17 components)
+    # Outputs list for 1-click preset execution (19 components)
     preset_outputs = [
         domain_dropdown,
         case_dropdown,
@@ -897,6 +908,8 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
         borderline_table,
         frameworks_table,
         fine_liability_output,
+        bom_display,
+        sarif_display,
     ]
 
     # Wire 1-Click Preset Scenario Buttons
@@ -955,6 +968,8 @@ with gr.Blocks(title="ReguAI: Neuro-Symbolic AI GRC Engine") as demo:
             borderline_table,
             frameworks_table,
             fine_liability_output,
+            bom_display,
+            sarif_display,
         ],
     )
 

data/active_learning_triplets.jsonl

@@ -15,3 +15,8 @@
 {"timestamp": "2026-09-20T20:00:35.196971+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T20:01:32.495427+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
 {"timestamp": "2026-09-20T20:12:47.133587+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-21T14:35:57.733905+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-21T14:43:22.767001+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-21T14:46:20.754528+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-21T14:47:50.118531+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}
+{"timestamp": "2026-09-21T14:48:40.951594+00:00", "auditor_id": "compliance_lead_01", "claim_id": "clm_test_99", "anchor_text": "Verified operational override in production dashboard.", "positive_label": "HUMAN_OVERSIGHT", "negative_label": "IRRELEVANT_TEXT", "verified_assertion_status": "IMPLEMENTED", "auditor_notes": "Verified operational override in production dashboard."}

src/cli.py

@@ -0,0 +1,190 @@
+"""
+ReguAI CLI: Automated CI/CD Regulatory Conformity Gate & Audit Runner.
+Evaluates model cards, system specifications, and documentation for EU AI Act,
+NIST AI RMF, and ISO 42001 compliance, outputting SARIF, JSON, or Annex IV reports.
+"""
+
+import sys
+import os
+import argparse
+import json
+from pathlib import Path
+from typing import List, Optional
+
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+if hasattr(sys.stderr, "reconfigure"):
+    sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+
+from src.engine import ReguAIEngine
+from src.core.models import ConformityReport
+from src.triage.sarif_exporter import SarifExporter
+
+
+def render_terminal_summary(report: ConformityReport, target_path: str) -> str:
+    """Renders an executive terminal compliance summary."""
+    status_symbol = "[PASS]" if report.overall_conforms else "[FAIL]"
+    lines = [
+        "=" * 78,
+        f"  REGUAI REGULATORY AUDIT REPORT: {report.system_metadata.name}",
+        "=" * 78,
+        f"Target Specification : {target_path}",
+        f"System Identifier    : {report.system_metadata.system_id} (v{report.system_metadata.version})",
+        f"Risk Classification  : {report.system_metadata.eu_risk_classification}",
+        f"Conformity Status    : {status_symbol} ({report.conformity_score:.1f}%)",
+        f"Requirements Passed  : {report.passed_requirements_count} / {report.total_requirements_evaluated}",
+        f"Digital Audit Token  : {report.provenance.digital_signature}",
+        "-" * 78,
+    ]
+
+    if report.violations:
+        lines.append(f"CRITICAL LEGAL VIOLATIONS ({len(report.violations)}):")
+        for idx, v in enumerate(report.violations, 1):
+            lines.append(f"  {idx}. [{v.regulatory_article}] {v.message}")
+            lines.append(f"     Remediation: {v.remediation_guidance}")
+            lines.append(f"     Reference  : {v.normative_reference}")
+        lines.append("-" * 78)
+
+    if report.warnings:
+        lines.append(f"ADVISORY WARNINGS ({len(report.warnings)}):")
+        for idx, w in enumerate(report.warnings, 1):
+            lines.append(f"  {idx}. [{w.regulatory_article}] {w.message}")
+        lines.append("-" * 78)
+
+    if report.fine_exposure and report.fine_exposure.get("total_potential_fine_eur", 0) > 0:
+        fine = report.fine_exposure
+        lines.append(f"EU AI ACT ARTICLE 99 MAXIMUM FINE LIABILITY:")
+        lines.append(f"  Statutory Fine Exposure: €{fine['total_potential_fine_eur']:,.2f}")
+        lines.append(f"  Severity Bracket       : {fine.get('severity_bracket', 'Standard')}")
+        lines.append("-" * 78)
+
+    return "\n".join(lines)
+
+
+def audit_target(args: argparse.Namespace) -> int:
+    """Executes conformity audit on single file or directory."""
+    target = Path(args.target)
+    if not target.exists():
+        print(f"Error: Target path '{target}' does not exist.", file=sys.stderr)
+        return 2
+
+    files_to_audit: List[Path] = []
+    if target.is_dir():
+        for ext in ("*.json", "*.md", "*.yaml", "*.yml"):
+            files_to_audit.extend(target.glob(ext))
+    else:
+        files_to_audit.append(target)
+
+    if not files_to_audit:
+        print(f"Error: No JSON, Markdown, or YAML specifications found in '{target}'.", file=sys.stderr)
+        return 2
+
+    engine = ReguAIEngine()
+    overall_exit_code = 0
+    all_reports: List[ConformityReport] = []
+
+    for file_path in files_to_audit:
+        report = engine.evaluate_system(
+            input_data=file_path,
+            auditor_id=args.auditor or "reguai_ci_cd",
+            annual_turnover_eur=args.turnover,
+            is_sme=args.sme,
+        )
+        all_reports.append(report)
+
+        if not report.overall_conforms:
+            overall_exit_code = 1
+
+        # Format output
+        if args.format == "text":
+            print(render_terminal_summary(report, str(file_path)))
+        elif args.format == "json":
+            print(json.dumps(report.model_dump(), indent=2))
+        elif args.format == "markdown":
+            print(engine.report_generator.generate_markdown_report(report))
+        elif args.format == "sarif":
+            sarif_doc = SarifExporter.generate_sarif(report, target_file_path=str(file_path))
+            print(json.dumps(sarif_doc, indent=2))
+
+        # Output file artifacts if requested
+        if args.sarif_out:
+            SarifExporter.export_sarif_json(
+                report,
+                output_file_path=args.sarif_out,
+                target_file_path=str(file_path),
+            )
+            if args.format == "text":
+                print(f"  [+] SARIF report written to: {args.sarif_out}")
+
+        if args.json_out:
+            p = Path(args.json_out)
+            p.parent.mkdir(parents=True, exist_ok=True)
+            p.write_text(json.dumps(report.model_dump(), indent=2), encoding="utf-8")
+            if args.format == "text":
+                print(f"  [+] JSON report written to: {args.json_out}")
+
+        if args.md_out:
+            p = Path(args.md_out)
+            p.parent.mkdir(parents=True, exist_ok=True)
+            md_content = engine.report_generator.generate_markdown_report(report)
+            p.write_text(md_content, encoding="utf-8")
+            if args.format == "text":
+                print(f"  [+] Annex IV Markdown written to: {args.md_out}")
+
+        if args.bom_out:
+            p = Path(args.bom_out)
+            p.parent.mkdir(parents=True, exist_ok=True)
+            bom_content = engine.report_generator.generate_cyclonedx_bom(report)
+            p.write_text(json.dumps(bom_content, indent=2), encoding="utf-8")
+            if args.format == "text":
+                print(f"  [+] CycloneDX AI-BOM written to: {args.bom_out}")
+
+    if args.fail_on_violation and overall_exit_code != 0:
+        return 1
+    return 0
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="reguai",
+        description="ReguAI: Neuro-Symbolic AI GRC & Deterministic Conformity Assessment Engine",
+    )
+    subparsers = parser.add_subparsers(dest="command", help="Available commands")
+
+    # Audit sub-command
+    audit_parser = subparsers.add_parser("audit", help="Audit model card or system spec against EU AI Act")
+    audit_parser.add_argument("target", help="Path to specification file or directory")
+    audit_parser.add_argument("--format", choices=["text", "json", "markdown", "sarif"], default="text", help="Output format")
+    audit_parser.add_argument("--fail-on-violation", action="store_true", help="Exit with code 1 if violations are detected")
+    audit_parser.add_argument("--auditor", default="ci_cd_automated_gate", help="Auditor / pipeline identifier")
+    audit_parser.add_argument("--turnover", type=float, default=0.0, help="Annual turnover in EUR for fine calculation")
+    audit_parser.add_argument("--sme", action="store_true", help="Whether developer is SME under Art 99(6)")
+    audit_parser.add_argument("--sarif-out", help="File path to write SARIF 2.1.0 output")
+    audit_parser.add_argument("--json-out", help="File path to write JSON report output")
+    audit_parser.add_argument("--md-out", help="File path to write Annex IV Markdown output")
+    audit_parser.add_argument("--bom-out", help="File path to write CycloneDX AI-BOM output")
+
+    # Benchmark sub-command
+    benchmark_parser = subparsers.add_parser("benchmark", help="Run regulatory extraction and triage benchmark")
+
+    # Version sub-command
+    subparsers.add_parser("version", help="Print ReguAI version")
+
+    args = parser.parse_args()
+
+    if args.command == "audit":
+        sys.exit(audit_target(args))
+    elif args.command == "benchmark":
+        from evaluate_benchmark import run_benchmark
+        run_benchmark()
+        sys.exit(0)
+    elif args.command == "version":
+        print("ReguAI Neuro-Symbolic GRC Engine v0.1.0")
+        sys.exit(0)
+    else:
+        parser.print_help()
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

src/core/models.py

@@ -32,6 +32,7 @@ class EntityCategory(str, Enum):
     ACCURACY_ROBUSTNESS = "ACCURACY_ROBUSTNESS"             # Art 15(1)
     CYBERSECURITY = "CYBERSECURITY"                         # Art 15(4)
     FAIL_SAFE = "FAIL_SAFE"                                 # Art 14(4)(e) / Art 15
+    WATERMARKING_CONTROL = "WATERMARKING_CONTROL"           # Art 50(2) / Synthetic Content Marking
 
 
 class ExtractedClaim(BaseModel):

src/extraction/gliner_extractor.py

@@ -100,6 +100,13 @@ class RegulatoryClaimExtractor:
                     r"\b(conformity\s+assessment\s+file|design\s+specification)\b",
                 ],
             },
+            EntityCategory.WATERMARKING_CONTROL: {
+                "article": "Article 50(2)",
+                "keywords": [
+                    r"\b(watermark(?:ing)?|c2pa|machine-readable\s+provenance|synthetic\s+content\s+marking)\b",
+                    r"\b(steganograph(?:y|ic)|ai-generated\s+disclosure|deepfake\s+detection)\b",
+                ],
+            },
         }
 
     def extract_claims(self, text: str) -> List[ExtractedClaim]:

src/ontology/builder.py

@@ -31,6 +31,7 @@ class NormativeGraphBuilder:
             EntityCategory.ACCURACY_ROBUSTNESS: (REGU.hasRobustnessControl, REGU.RobustnessControl),
             EntityCategory.CYBERSECURITY: (REGU.hasCybersecurityControl, REGU.CybersecurityControl),
             EntityCategory.FAIL_SAFE: (REGU.hasEmergencyStop, REGU.StopMechanism),
+            EntityCategory.WATERMARKING_CONTROL: (REGU.hasWatermarkingControl, REGU.WatermarkingControl),
         }
 
     def _bind_namespaces(self, g: Graph) -> None:
@@ -70,6 +71,8 @@ class NormativeGraphBuilder:
             g.add((sys_uri, RDF.type, REGU.ProhibitedAISystem))
             g.add((sys_uri, REGU.prohibitionStatus, REGU.ProhibitedPracticeDetected))
             g.add((sys_uri, REGU.hasProhibitedPracticeType, REGU.ProhibitedPracticeDetected))
+        elif "generative" in risk_class_lower or "genai" in risk_class_lower or "synthetic" in risk_class_lower or "article 50" in risk_class_lower:
+            g.add((sys_uri, RDF.type, REGU.GenerativeAISystem))
         elif "general purpose" in risk_class_lower or "gpai" in risk_class_lower:
             if "systemic" in risk_class_lower or "article 51" in risk_class_lower:
                 g.add((sys_uri, RDF.type, REGU.GPAISystemicRiskModel))

src/ontology/shacl/transparency_shapes.ttl

@@ -0,0 +1,53 @@
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix sh: <http://www.w3.org/ns/shacl#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+@prefix regu: <http://regu.ai/schema#> .
+@prefix eu: <http://data.europa.eu/eli/reg/2024/1689#> .
+
+# =========================================================================
+# ReguAI Normative SHACL Shape Validation
+# Regulation (EU) 2024/1689 - Article 50 (Transparency Obligations for Certain AI Systems)
+# =========================================================================
+
+regu:GenerativeAITransparencyShape
+    a sh:NodeShape ;
+    sh:targetClass regu:GenerativeAISystem ;
+    sh:name "EU AI Act Article 50 Generative AI Synthetic Content Transparency Shape" ;
+    sh:description "Enforces watermarking, machine-readable detection, and interaction disclosures under Article 50." ;
+
+    # Article 50(1): Direct Interaction Disclosure
+    sh:property [
+        sh:path regu:hasTransparencySpecification ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 50(1) Non-Conformity: Systems directly interacting with natural persons must disclose that the user is interacting with an AI system." ;
+    ] ;
+
+    # Article 50(2): Synthetic Content Watermarking & Machine-Readable Provenance
+    sh:property [
+        sh:path regu:hasWatermarkingControl ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 50(2) Non-Conformity: AI systems generating synthetic text, image, audio, or video must implement machine-readable watermarking or detection metadata." ;
+    ] ;
+    sh:property [
+        sh:path ( regu:hasWatermarkingControl regu:implementationStatus ) ;
+        sh:hasValue regu:Implemented ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 50(2) Non-Conformity: Synthetic content watermarking control must be 'Implemented'." ;
+    ] .
+
+regu:GPAICopyrightTransparencyShape
+    a sh:NodeShape ;
+    sh:targetClass regu:GPAIModel ;
+    sh:name "EU AI Act Article 53 GPAI Copyright & Training Data Disclosure Shape" ;
+    sh:description "Enforces copyright reservation compliance and training data summary disclosure under Article 53." ;
+
+    # Article 53(1)(c): Copyright Policy Compliance
+    sh:property [
+        sh:path regu:hasDataGovernance ;
+        sh:minCount 1 ;
+        sh:severity sh:Violation ;
+        sh:message "EU AI Act Art 53(1)(c) Non-Conformity: Providers of GPAI models must maintain and document copyright reservation policies." ;
+    ] .

src/triage/bom_generator.py

@@ -0,0 +1,157 @@
+"""
+CycloneDX 1.6 AI Bill of Materials (AIBOM) Generator.
+Produces machine-readable AI Bill of Materials adhering to OWASP CycloneDX v1.6
+specifications for EU AI Act Annex IV, NIST AI RMF, and enterprise GRC ingestion.
+"""
+
+from typing import Dict, Any, List, Optional
+import uuid
+from datetime import datetime, timezone
+import json
+
+from src.core.models import ConformityReport, EntityCategory, AssertionStatus
+
+
+class AIBOMGenerator:
+    """Generates official CycloneDX 1.6 AI Bill of Materials (AIBOM) documents."""
+
+    CYCLONEDX_VERSION = "1.6"
+    SPEC_SCHEMA = f"http://cyclonedx.org/schema/bom-{CYCLONEDX_VERSION}.schema.json"
+
+    @classmethod
+    def generate_bom(cls, report: ConformityReport) -> Dict[str, Any]:
+        """Translates a ConformityReport into a structured CycloneDX 1.6 AIBOM dictionary."""
+        meta = report.system_metadata
+        prov = report.provenance
+        serial_uuid = f"urn:uuid:{uuid.uuid4()}"
+
+        # Extract datasets and governance components from claims
+        sub_components: List[Dict[str, Any]] = []
+        for idx, claim in enumerate(report.claims_analyzed):
+            comp_type = "data" if claim.category == EntityCategory.DATA_GOVERNANCE else "framework"
+            sub_components.append({
+                "type": comp_type,
+                "bom-ref": f"component-{claim.claim_id}",
+                "name": claim.category.value,
+                "description": claim.entity_text,
+                "properties": [
+                    {"name": "reguai:assertionStatus", "value": claim.assertion_status.value},
+                    {"name": "reguai:confidence", "value": str(round(claim.confidence, 3))},
+                    {"name": "reguai:normativeArticle", "value": claim.normative_article},
+                    {"name": "reguai:evidenceQuote", "value": claim.evidence_quote[:200]},
+                ]
+            })
+
+        # Base CycloneDX 1.6 AI model component
+        model_component: Dict[str, Any] = {
+            "type": "machine-learning-model",
+            "bom-ref": f"model-{meta.system_id}",
+            "name": meta.name,
+            "version": meta.version,
+            "description": meta.intended_purpose,
+            "supplier": {
+                "name": meta.developer_name,
+            },
+            "modelCard": {
+                "modelParameters": {
+                    "task": meta.domain,
+                    "architecture": meta.eu_risk_classification,
+                },
+                "quantitativeAnalysis": {
+                    "performanceMetrics": [
+                        {
+                            "type": "ConformityScore",
+                            "value": f"{report.conformity_score:.1f}%",
+                            "description": "Deterministic EU AI Act SHACL Normative Conformity Index"
+                        },
+                        {
+                            "type": "PassedRequirements",
+                            "value": f"{report.passed_requirements_count}/{report.total_requirements_evaluated}",
+                            "description": "Total satisfied legal shape constraints"
+                        }
+                    ]
+                },
+                "considerations": {
+                    "users": [meta.deployment_context],
+                    "useCases": [meta.intended_purpose],
+                    "limitations": [
+                        v.message for v in report.violations
+                    ] if report.violations else ["None identified under verified constraints."]
+                }
+            },
+            "properties": [
+                {"name": "reguai:riskClassification", "value": meta.eu_risk_classification},
+                {"name": "reguai:conformityStatus", "value": "CONFORMS" if report.overall_conforms else "NON_CONFORMANT"},
+                {"name": "reguai:digitalSignature", "value": prov.digital_signature},
+                {"name": "reguai:inputDocSha256", "value": prov.input_doc_sha256},
+                {"name": "reguai:rulesetSha256", "value": prov.ruleset_sha256},
+            ]
+        }
+
+        # Regulatory compliance declarations under CycloneDX 1.6 declarations
+        declarations = {
+            "standards": [
+                {
+                    "name": "Regulation (EU) 2024/1689 (EU AI Act)",
+                    "version": "2024/1689",
+                    "description": "European Union Artificial Intelligence Act",
+                    "status": "passed" if report.overall_conforms else "failed",
+                    "requirements": [
+                        {
+                            "identifier": v.regulatory_article,
+                            "title": v.regulatory_article,
+                            "conformance": {
+                                "score": 0.0,
+                                "rationale": v.message
+                            }
+                        } for v in report.violations
+                    ]
+                },
+                {
+                    "name": "NIST AI RMF 1.0",
+                    "version": "1.0",
+                    "description": "NIST Artificial Intelligence Risk Management Framework",
+                    "status": "passed" if report.overall_conforms else "warning"
+                },
+                {
+                    "name": "ISO/IEC 42001:2023",
+                    "version": "2023",
+                    "description": "Artificial Intelligence Management System",
+                    "status": "passed" if report.overall_conforms else "warning"
+                }
+            ]
+        }
+
+        bom_doc: Dict[str, Any] = {
+            "$schema": cls.SPEC_SCHEMA,
+            "bomFormat": "CycloneDX",
+            "specVersion": cls.CYCLONEDX_VERSION,
+            "serialNumber": serial_uuid,
+            "version": 1,
+            "metadata": {
+                "timestamp": report.generated_at_utc,
+                "tools": [
+                    {
+                        "vendor": "ReguAI Governance",
+                        "name": "ReguAI Neuro-Symbolic GRC Core",
+                        "version": "0.1.0"
+                    }
+                ],
+                "component": model_component,
+            },
+            "components": sub_components,
+            "declarations": declarations,
+            "vulnerabilities": [
+                {
+                    "id": f"EU-AI-ACT-{v.regulatory_article.replace(' ', '-')}",
+                    "description": v.message,
+                    "recommendation": v.remediation_guidance,
+                    "analysis": {
+                        "state": "exploitable" if v.severity == "Violation" else "in_triage",
+                        "detail": v.normative_reference
+                    }
+                } for v in report.violations
+            ]
+        }
+
+        return bom_doc

src/triage/report_generator.py

@@ -399,3 +399,8 @@ class ConformityReportGenerator:
 </html>
 """
         return html
+
+    def generate_cyclonedx_bom(self, report: ConformityReport) -> Dict[str, Any]:
+        """Generates an official CycloneDX 1.6 AI Bill of Materials (AIBOM) dictionary."""
+        from src.triage.bom_generator import AIBOMGenerator
+        return AIBOMGenerator.generate_bom(report)

src/triage/sarif_exporter.py

@@ -0,0 +1,198 @@
+"""
+OASIS SARIF 2.1.0 (Static Analysis Results Interchange Format) Exporter.
+Exports ReguAI Conformity Reports to standard SARIF JSON for GitHub Code Scanning,
+GitLab SAST, and CI/CD security/compliance dashboards.
+"""
+
+from typing import Dict, Any, List, Optional
+import json
+import re
+from pathlib import Path
+
+from src.core.models import ConformityReport, ValidationViolation
+
+
+class SarifExporter:
+    """Exports ConformityReport objects to OASIS SARIF v2.1.0 JSON format."""
+
+    SCHEMA_URI = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
+    SARIF_VERSION = "2.1.0"
+    TOOL_NAME = "ReguAI"
+    TOOL_VERSION = "0.1.0"
+    INFORMATION_URI = "https://github.com/gitcodemujtaba/reguAI"
+
+    @classmethod
+    def _normalize_rule_id(cls, regulatory_article: str, component: str = "") -> str:
+        """Converts regulatory article strings into canonical SARIF rule identifiers."""
+        clean_art = re.sub(r"[^\w\s-]", "", regulatory_article).strip()
+        clean_art = re.sub(r"\s+", "-", clean_art).upper()
+        if not clean_art.startswith("REGU-"):
+            clean_art = f"REGU-{clean_art}"
+        return clean_art
+
+    @classmethod
+    def generate_sarif(
+        cls,
+        report: ConformityReport,
+        target_file_path: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """
+        Generates a valid SARIF 2.1.0 dictionary from a ConformityReport.
+        """
+        file_uri = target_file_path or f"{report.system_metadata.system_id}.json"
+        
+        rules_dict: Dict[str, Dict[str, Any]] = {}
+        results: List[Dict[str, Any]] = []
+
+        # Process hard violations (SARIF error level)
+        for v in report.violations:
+            rule_id = cls._normalize_rule_id(v.regulatory_article, v.source_constraint_component)
+            if rule_id not in rules_dict:
+                rules_dict[rule_id] = {
+                    "id": rule_id,
+                    "name": f"EU_AI_Act_{v.regulatory_article.replace(' ', '_')}",
+                    "shortDescription": {
+                        "text": f"Mandatory compliance check: {v.regulatory_article}"
+                    },
+                    "fullDescription": {
+                        "text": v.message
+                    },
+                    "help": {
+                        "text": f"Remediation: {v.remediation_guidance}\nNormative Reference: {v.normative_reference}",
+                        "markdown": f"### Remediation Guidance\n{v.remediation_guidance}\n\n**Normative Reference:** `{v.normative_reference}`"
+                    },
+                    "defaultConfiguration": {
+                        "level": "error"
+                    },
+                    "helpUri": "https://data.europa.eu/eli/reg/2024/1689/oj",
+                    "properties": {
+                        "tags": ["compliance", "eu-ai-act", "governance", "shacl"],
+                        "precision": "very-high"
+                    }
+                }
+
+            result_obj = {
+                "ruleId": rule_id,
+                "level": "error",
+                "message": {
+                    "text": f"[{v.regulatory_article}] {v.message}. Remediation: {v.remediation_guidance}"
+                },
+                "locations": [
+                    {
+                        "physicalLocation": {
+                            "artifactLocation": {
+                                "uri": file_uri,
+                                "uriBaseId": "%SRCROOT%"
+                            },
+                            "region": {
+                                "startLine": 1,
+                                "startColumn": 1
+                            }
+                        }
+                    }
+                ],
+                "properties": {
+                    "focusNode": v.focus_node,
+                    "resultPath": v.result_path,
+                    "remediationGuidance": v.remediation_guidance,
+                    "normativeReference": v.normative_reference
+                }
+            }
+            results.append(result_obj)
+
+        # Process warnings (SARIF warning level)
+        for w in report.warnings:
+            rule_id = cls._normalize_rule_id(w.regulatory_article, w.source_constraint_component)
+            if rule_id not in rules_dict:
+                rules_dict[rule_id] = {
+                    "id": rule_id,
+                    "name": f"Advisory_{w.regulatory_article.replace(' ', '_')}",
+                    "shortDescription": {
+                        "text": f"Regulatory Advisory: {w.regulatory_article}"
+                    },
+                    "fullDescription": {
+                        "text": w.message
+                    },
+                    "defaultConfiguration": {
+                        "level": "warning"
+                    },
+                    "helpUri": "https://data.europa.eu/eli/reg/2024/1689/oj",
+                    "properties": {
+                        "tags": ["advisory", "eu-ai-act", "governance"],
+                        "precision": "high"
+                    }
+                }
+
+            result_obj = {
+                "ruleId": rule_id,
+                "level": "warning",
+                "message": {
+                    "text": f"[{w.regulatory_article}] {w.message}"
+                },
+                "locations": [
+                    {
+                        "physicalLocation": {
+                            "artifactLocation": {
+                                "uri": file_uri,
+                                "uriBaseId": "%SRCROOT%"
+                            },
+                            "region": {
+                                "startLine": 1,
+                                "startColumn": 1
+                            }
+                        }
+                    }
+                ],
+                "properties": {
+                    "focusNode": w.focus_node,
+                    "resultPath": w.result_path,
+                }
+            }
+            results.append(result_obj)
+
+        sarif_doc = {
+            "$schema": cls.SCHEMA_URI,
+            "version": cls.SARIF_VERSION,
+            "runs": [
+                {
+                    "tool": {
+                        "driver": {
+                            "name": cls.TOOL_NAME,
+                            "version": cls.TOOL_VERSION,
+                            "informationUri": cls.INFORMATION_URI,
+                            "rules": list(rules_dict.values()),
+                        }
+                    },
+                    "invocations": [
+                        {
+                            "executionSuccessful": True,
+                            "endTimeUtc": report.generated_at_utc,
+                            "properties": {
+                                "conformityScore": report.conformity_score,
+                                "overallConforms": report.overall_conforms,
+                                "digitalSignature": report.provenance.digital_signature,
+                            }
+                        }
+                    ],
+                    "results": results,
+                }
+            ]
+        }
+        return sarif_doc
+
+    @classmethod
+    def export_sarif_json(
+        cls,
+        report: ConformityReport,
+        output_file_path: Optional[str] = None,
+        target_file_path: Optional[str] = None,
+        indent: int = 2,
+    ) -> str:
+        """Serializes SARIF document to JSON string and optionally writes to file."""
+        sarif_data = cls.generate_sarif(report, target_file_path=target_file_path)
+        json_str = json.dumps(sarif_data, indent=indent)
+        if output_file_path:
+            out_p = Path(output_file_path)
+            out_p.parent.mkdir(parents=True, exist_ok=True)
+            out_p.write_text(json_str, encoding="utf-8")
+        return json_str

src/triage/train_triplets.py

@@ -0,0 +1,174 @@
+"""
+Active Learning Triplet Metric Learning & Confidence Calibrator.
+Consumes auditor-in-the-loop triplet instances (anchor, positive, negative),
+evaluates semantic margin separation, and trains/updates category prototype embeddings
+and confidence calibration thresholds.
+"""
+
+from typing import Dict, Any, List, Tuple, Optional
+import sys
+import json
+import math
+from collections import defaultdict
+import re
+from pathlib import Path
+
+# Ensure project root is in sys.path
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent))
+
+from src.core.config import DATA_DIR
+from src.core.models import EntityCategory, AssertionStatus
+
+
+class TripletMetricLearner:
+    """
+    Contrastive metric learner and prototype calibrator for regulatory claim assertions.
+    Enforces that anchor quotes are closer to auditor-approved positive labels than rejected negative labels.
+    """
+
+    def __init__(self, data_path: Optional[Path] = None, margin: float = 0.2):
+        self.data_path = data_path or (DATA_DIR / "active_learning_triplets.jsonl")
+        self.margin = margin
+        self.category_prototypes: Dict[str, Dict[str, float]] = defaultdict(lambda: defaultdict(float))
+        self.vocabulary: Dict[str, int] = {}
+
+    def _tokenize(self, text: str) -> List[str]:
+        """Simple linguistic tokenizer converting text to normalized unigram and bigram tokens."""
+        clean = re.sub(r"[^\w\s]", " ", text.lower())
+        tokens = [t for t in clean.split() if len(t) > 2]
+        bigrams = [f"{tokens[i]}_{tokens[i+1]}" for i in range(len(tokens) - 1)]
+        return tokens + bigrams
+
+    def _compute_bow_vector(self, text: str) -> Dict[str, float]:
+        """Builds an L2-normalized bag-of-words vector."""
+        tokens = self._tokenize(text)
+        if not tokens:
+            return {}
+        counts: Dict[str, float] = defaultdict(float)
+        for t in tokens:
+            counts[t] += 1.0
+
+        norm = math.sqrt(sum(v * v for v in counts.values()))
+        if norm > 0:
+            return {k: v / norm for k, v in counts.items()}
+        return counts
+
+    def _cosine_similarity(self, vec_a: Dict[str, float], vec_b: Dict[str, float]) -> float:
+        """Computes sparse cosine similarity between two normalized vectors."""
+        dot = 0.0
+        for k, val_a in vec_a.items():
+            if k in vec_b:
+                dot += val_a * vec_b[k]
+        return max(0.0, min(1.0, dot))
+
+    def load_triplets(self) -> List[Dict[str, Any]]:
+        """Loads all recorded active learning triplets from disk."""
+        if not self.data_path.exists():
+            return []
+        records = []
+        with open(self.data_path, "r", encoding="utf-8") as f:
+            for line in f:
+                line = line.strip()
+                if line:
+                    records.append(json.loads(line))
+        return records
+
+    def train_prototypes(self, learning_rate: float = 0.1, epochs: int = 5) -> Dict[str, Any]:
+        """
+        Fits category prototype vectors using gradient-inspired updates over the triplets.
+        Pulls positive category prototype toward anchor; pushes negative category prototype away.
+        """
+        triplets = self.load_triplets()
+        if not triplets:
+            return {
+                "triplets_count": 0,
+                "status": "NO_DATA",
+                "loss": 0.0,
+                "separation_accuracy": 0.0,
+            }
+
+        # Initialize prototypes with positive anchors
+        for item in triplets:
+            anchor_vec = self._compute_bow_vector(item["anchor_text"])
+            pos_label = item["positive_label"]
+            for token, weight in anchor_vec.items():
+                self.category_prototypes[pos_label][token] += weight
+
+        # Normalize prototypes
+        for cat, tokens in self.category_prototypes.items():
+            norm = math.sqrt(sum(v * v for v in tokens.values()))
+            if norm > 0:
+                self.category_prototypes[cat] = {k: v / norm for k, v in tokens.items()}
+
+        # Iterative contrastive margin optimization
+        history = []
+        for epoch in range(epochs):
+            total_loss = 0.0
+            correct_pairs = 0
+
+            for item in triplets:
+                anchor_vec = self._compute_bow_vector(item["anchor_text"])
+                pos_proto = self.category_prototypes[item["positive_label"]]
+                neg_proto = self.category_prototypes.get(item["negative_label"], {})
+
+                sim_pos = self._cosine_similarity(anchor_vec, pos_proto)
+                sim_neg = self._cosine_similarity(anchor_vec, neg_proto)
+
+                # Triplet ranking margin loss: max(0, sim_neg - sim_pos + margin)
+                loss = max(0.0, sim_neg - sim_pos + self.margin)
+                total_loss += loss
+
+                if sim_pos > sim_neg:
+                    correct_pairs += 1
+
+                # Gradient step if violation occurs
+                if loss > 0:
+                    for k, val in anchor_vec.items():
+                        self.category_prototypes[item["positive_label"]][k] += learning_rate * val
+                        if item["negative_label"] in self.category_prototypes:
+                            self.category_prototypes[item["negative_label"]][k] -= learning_rate * val * 0.5
+
+            avg_loss = total_loss / len(triplets)
+            acc = (correct_pairs / len(triplets)) * 100.0
+            history.append({"epoch": epoch + 1, "loss": round(avg_loss, 4), "accuracy": round(acc, 1)})
+
+        return {
+            "triplets_count": len(triplets),
+            "status": "CONVERGED",
+            "final_loss": history[-1]["loss"],
+            "separation_accuracy": history[-1]["accuracy"],
+            "training_history": history,
+            "trained_categories": list(self.category_prototypes.keys()),
+        }
+
+    def predict_category(self, query_text: str) -> Tuple[str, float]:
+        """Predicts the most aligned regulatory category and returns confidence score."""
+        q_vec = self._compute_bow_vector(query_text)
+        best_cat = "UNKNOWN"
+        best_sim = 0.0
+
+        for cat, proto in self.category_prototypes.items():
+            sim = self._cosine_similarity(q_vec, proto)
+            if sim > best_sim:
+                best_sim = sim
+                best_cat = cat
+
+        return best_cat, best_sim
+
+
+def main():
+    print("=" * 70)
+    print("  REGUAI ACTIVE LEARNING TRIPLET METRIC LEARNER & CALIBRATOR")
+    print("=" * 70)
+    learner = TripletMetricLearner()
+    results = learner.train_prototypes(epochs=5)
+    print(f"Loaded Active Learning Feedback Triplets : {results['triplets_count']}")
+    print(f"Training Status                         : {results['status']}")
+    print(f"Final Triplet Margin Loss               : {results.get('final_loss', 0.0)}")
+    print(f"Anchor Separation Accuracy              : {results.get('separation_accuracy', 0.0)}%")
+    print(f"Calibrated Categories                   : {results.get('trained_categories', [])}")
+    print("=" * 70)
+
+
+if __name__ == "__main__":
+    main()

tests/test_cli_and_bom.py

@@ -0,0 +1,148 @@
+"""
+Unit and integration tests for ReguAI CLI, SARIF Exporter, CycloneDX 1.6 AI-BOM,
+and Active Learning Triplet Metric Learner.
+"""
+
+import pytest
+import json
+from pathlib import Path
+from fastapi.testclient import TestClient
+
+from src.engine import ReguAIEngine
+from src.core.config import SYNTHETIC_DIR
+from src.triage.sarif_exporter import SarifExporter
+from src.triage.bom_generator import AIBOMGenerator
+from src.triage.train_triplets import TripletMetricLearner
+from api import app
+
+
+@pytest.fixture
+def engine():
+    return ReguAIEngine()
+
+
+@pytest.fixture
+def compliant_report(engine):
+    path = SYNTHETIC_DIR / "compliant_clinical_samd.json"
+    return engine.evaluate_system(path)
+
+
+@pytest.fixture
+def non_compliant_report(engine):
+    path = SYNTHETIC_DIR / "non_compliant_hr_recruitment.json"
+    return engine.evaluate_system(path)
+
+
+def test_sarif_export_structure(compliant_report, non_compliant_report):
+    # Compliant system SARIF
+    sarif_pass = SarifExporter.generate_sarif(compliant_report)
+    assert sarif_pass["version"] == "2.1.0"
+    assert sarif_pass["$schema"] == SarifExporter.SCHEMA_URI
+    assert len(sarif_pass["runs"]) == 1
+    assert sarif_pass["runs"][0]["tool"]["driver"]["name"] == "ReguAI"
+    assert len(sarif_pass["runs"][0]["results"]) == 0
+
+    # Non-compliant system SARIF
+    sarif_fail = SarifExporter.generate_sarif(non_compliant_report)
+    assert len(sarif_fail["runs"][0]["results"]) > 0
+    first_result = sarif_fail["runs"][0]["results"][0]
+    assert first_result["level"] == "error"
+    assert "ruleId" in first_result
+    assert first_result["ruleId"].startswith("REGU-")
+    assert "locations" in first_result
+
+
+def test_cyclonedx_bom_structure(compliant_report, non_compliant_report):
+    bom = AIBOMGenerator.generate_bom(compliant_report)
+    assert bom["bomFormat"] == "CycloneDX"
+    assert bom["specVersion"] == "1.6"
+    assert "serialNumber" in bom
+    assert bom["serialNumber"].startswith("urn:uuid:")
+    assert bom["metadata"]["component"]["type"] == "machine-learning-model"
+    assert bom["metadata"]["component"]["name"] == compliant_report.system_metadata.name
+    assert "declarations" in bom
+    assert len(bom["declarations"]["standards"]) >= 1
+    assert bom["declarations"]["standards"][0]["name"] == "Regulation (EU) 2024/1689 (EU AI Act)"
+    assert bom["declarations"]["standards"][0]["status"] == "passed"
+
+    # Non-compliant BOM has vulnerabilities and failed standards
+    bom_fail = AIBOMGenerator.generate_bom(non_compliant_report)
+    assert bom_fail["declarations"]["standards"][0]["status"] == "failed"
+    assert len(bom_fail["vulnerabilities"]) > 0
+
+
+def test_triplet_metric_learner():
+    learner = TripletMetricLearner()
+    results = learner.train_prototypes(epochs=3)
+    assert results["status"] in ("CONVERGED", "NO_DATA")
+    if results["status"] == "CONVERGED":
+        assert results["separation_accuracy"] >= 80.0
+        # Test category prediction
+        cat, conf = learner.predict_category("Clinician manual override and emergency kill switch.")
+        assert cat in ("HUMAN_OVERSIGHT", "FAIL_SAFE", "UNKNOWN")
+
+
+def test_api_bom_and_sarif_endpoints():
+    client = TestClient(app)
+    
+    # 1. Evaluate to register token in cache
+    eval_resp = client.post(
+        "/api/v1/audit/evaluate",
+        json={"specification_text": "Clinical diagnostic assistant with continuous risk management, bias mitigation, human-in-the-loop review and automated logging."}
+    )
+    assert eval_resp.status_code == 200
+    token = eval_resp.json()["certificate_token"]
+
+    # 2. Retrieve CycloneDX BOM
+    bom_resp = client.get(f"/api/v1/certificates/{token}/bom")
+    assert bom_resp.status_code == 200
+    bom_data = bom_resp.json()
+    assert bom_data["bomFormat"] == "CycloneDX"
+    assert bom_data["specVersion"] == "1.6"
+
+    # 3. Retrieve SARIF report
+    sarif_resp = client.get(f"/api/v1/certificates/{token}/sarif")
+    assert sarif_resp.status_code == 200
+    sarif_data = sarif_resp.json()
+    assert sarif_data["version"] == "2.1.0"
+    assert sarif_data["runs"][0]["tool"]["driver"]["name"] == "ReguAI"
+
+    # 4. Direct audit to BOM endpoint
+    direct_bom = client.post(
+        "/api/v1/audit/bom",
+        json={"specification_text": "Autonomous triage system with verified operational data governance and testing."}
+    )
+    assert direct_bom.status_code == 200
+    assert direct_bom.json()["bomFormat"] == "CycloneDX"
+
+
+def test_cli_audit_execution(tmp_path):
+    from src.cli import main
+    import sys
+
+    sarif_file = tmp_path / "test.sarif"
+    json_file = tmp_path / "test.json"
+    bom_file = tmp_path / "test.bom.json"
+    target = str(SYNTHETIC_DIR / "compliant_clinical_samd.json")
+
+    test_args = [
+        "reguai", "audit", target,
+        "--format", "text",
+        "--sarif-out", str(sarif_file),
+        "--json-out", str(json_file),
+        "--bom-out", str(bom_file),
+        "--fail-on-violation"
+    ]
+    
+    old_argv = sys.argv
+    try:
+        sys.argv = test_args
+        with pytest.raises(SystemExit) as exc_info:
+            main()
+        assert exc_info.value.code == 0
+    finally:
+        sys.argv = old_argv
+
+    assert sarif_file.exists()
+    assert json_file.exists()
+    assert bom_file.exists()