Skip to content

Commit 01313cd

Browse files
OneFineStarstuffOneFineStarstuff
committed
Refresh artifact manifest timestamp after validation runner updates
1 parent 4c12afc commit 01313cd

19 files changed

Lines changed: 2102 additions & 0 deletions

‎.github/workflows/governance-artifacts-ci.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Governance Artifacts CI
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'ENTERPRISE_AGI_ASI_GOVERNANCE_BLUEPRINT_2026_2030.md'
7+
- 'governance_blueprint/**'
8+
- '.github/workflows/governance-artifacts-ci.yml'
9+
push:
10+
branches: [ main, master ]
11+
paths:
12+
- 'ENTERPRISE_AGI_ASI_GOVERNANCE_BLUEPRINT_2026_2030.md'
13+
- 'governance_blueprint/**'
14+
- '.github/workflows/governance-artifacts-ci.yml'
15+
16+
jobs:
17+
validate-governance-artifacts:
18+
runs-on: ubuntu-latest
19+
timeout-minutes: 10
20+
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v4
24+
25+
- name: Setup Python
26+
uses: actions/setup-python@v5
27+
with:
28+
python-version: '3.11'
29+
30+
- name: Run governance validation suite
31+
run: python3 governance_blueprint/validation/run_validation_suite.py --quiet --json-report governance-artifact-validation-report.json --suite-report governance-validation-suite-report.json
32+
33+
- name: Show validation report
34+
run: |
35+
cat governance-artifact-validation-report.json
36+
cat governance-validation-suite-report.json
37+
38+
- name: Upload validation report
39+
uses: actions/upload-artifact@v4
40+
with:
41+
name: governance-validation-reports
42+
path: |
43+
governance-artifact-validation-report.json
44+
governance-validation-suite-report.json

‎.pre-commit-config.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
repos:
2+
- repo: local
3+
hooks:
4+
- id: governance-validation-suite
5+
name: governance validation suite
6+
entry: python3 governance_blueprint/validation/run_validation_suite.py --skip-selftest --quiet
7+
language: system
8+
pass_filenames: false
9+
files: '^(governance_blueprint/|ENTERPRISE_AGI_ASI_GOVERNANCE_BLUEPRINT_2026_2030\.md)'

‎ENTERPRISE_AGI_ASI_GOVERNANCE_BLUEPRINT_2026_2030.md‎

Lines changed: 703 additions & 0 deletions
Large diffs are not rendered by default.

‎Makefile‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
PYTHON ?= python3
2+
3+
.PHONY: gov-manifest gov-manifest-check gov-validate gov-validate-json gov-lint gov-dashboard-check gov-selftest gov-suite gov-suite-json gov-suite-report gov-suite-ci gov-clean
4+
5+
gov-manifest:
6+
$(PYTHON) governance_blueprint/validation/generate_artifact_manifest.py
7+
8+
gov-manifest-check:
9+
$(PYTHON) governance_blueprint/validation/generate_artifact_manifest.py --check
10+
11+
gov-validate:
12+
$(PYTHON) governance_blueprint/validation/validate_artifacts.py
13+
14+
gov-validate-json:
15+
$(PYTHON) governance_blueprint/validation/validate_artifacts.py --json
16+
17+
gov-lint:
18+
$(PYTHON) governance_blueprint/validation/lint_python_sources.py
19+
20+
gov-dashboard-check:
21+
$(PYTHON) governance_blueprint/validation/validate_dashboard_links.py
22+
23+
gov-selftest:
24+
$(PYTHON) governance_blueprint/validation/selftest_validate_artifacts.py
25+
$(PYTHON) governance_blueprint/validation/selftest_run_validation_suite.py
26+
27+
gov-suite:
28+
$(PYTHON) governance_blueprint/validation/run_validation_suite.py
29+
30+
gov-suite-json:
31+
$(PYTHON) governance_blueprint/validation/run_validation_suite.py --json-report governance-artifact-validation-report.json
32+
@echo "Wrote governance-artifact-validation-report.json"
33+
34+
gov-suite-report:
35+
$(PYTHON) governance_blueprint/validation/run_validation_suite.py --json-report governance-artifact-validation-report.json --suite-report governance-validation-suite-report.json
36+
@echo "Wrote governance-artifact-validation-report.json and governance-validation-suite-report.json"
37+
38+
gov-suite-ci:
39+
$(PYTHON) governance_blueprint/validation/run_validation_suite.py --quiet --json-report governance-artifact-validation-report.json --suite-report governance-validation-suite-report.json
40+
@echo "Wrote governance-artifact-validation-report.json and governance-validation-suite-report.json (quiet mode)"
41+
42+
gov-clean:
43+
$(PYTHON) -c "from pathlib import Path; import shutil; report=Path('governance-artifact-validation-report.json'); suite=Path('governance-validation-suite-report.json'); report.exists() and report.unlink(); suite.exists() and suite.unlink(); [shutil.rmtree(p) for p in Path('governance_blueprint/validation').rglob('__pycache__') if p.is_dir()]"

‎governance_blueprint/artifact_manifest.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"package": "enterprise_agi_asi_governance_blueprint",
3+
"version": "1.3.1",
4+
"generated_utc": "2026-04-27T06:11:04Z",
5+
"artifacts": {
6+
"control_mapping_matrix.csv": "8af4170e62e6aec3c12f3f554d29fe31e6c59c196cd9b3e1590f1238597ce228",
7+
"evidence_event_schema.json": "7c84f8fce1cefeff08308a2763c086eb4ede05881881cd53c484e879df04196a",
8+
"opa/release_gate.rego": "bd117bddd2c77a0fd5cc4741aa6805b6f1f711d2baa5732ca037ea4db7b60c43",
9+
"roadmap_2026_2030.yaml": "35132b486b360d91ceab94e7949278c755a28dbab0cccf64e0b3a776d7dab485",
10+
"validation/validate_artifacts.py": "0908bb44ecf2b209861fb3fe0259bad2b652d94b1f6c50c45592b074f52848e0",
11+
"validation/selftest_validate_artifacts.py": "50414aa4ecf39166268d76ab0363ad2ec9ac32cde6b27ae5c631764fd7bce29b",
12+
"validation/generate_artifact_manifest.py": "654479289df4a57ab58288adcbb5c9e23861f3b3a6e4d524b8214bb8c992d060",
13+
"validation/run_validation_suite.py": "4c7038c4d3da1d6fb3f4c43bddd5b2237856b90bd568a17d03a1d16cfc904781",
14+
"validation/selftest_run_validation_suite.py": "2f987933769c0530eaa7ad51a0454781e8bd90bb700c120219dae5a96645adbe",
15+
"validation/lint_python_sources.py": "52b36b1427679624fd9778dc93cb7b318b4c882930e78c0947a37d5185dafae9",
16+
"validation/validate_dashboard_links.py": "e854e2c61ac6e31f880fce8e28c6ed95856d13a85fdfdbcf124df74925b1461a"
17+
}
18+
}

‎governance_blueprint/control_mapping_matrix.csv‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
control_family,control_id,description,eu_ai_act_anchor,nist_ai_rmf_anchor,iso_42001_anchor,financial_anchor,evidence_artifacts,control_owner,review_frequency
2+
Governance & accountability,AIGOV-01,Board-approved AI governance charter and accountability model,Governance/accountability obligations,Govern,Leadership & planning controls,SR 11-7 governance + SMCR,Board minutes|charter|RACI,CRO/CAIO,Quarterly
3+
Inventory & tiering,AIGOV-02,Enterprise inventory and risk tiering for all AI systems,Risk classification/high-risk scoping,Map,Context & risk assessment controls,PRA/FCA model inventory expectations,Inventory export|tier rationale logs,Model Risk,Monthly
4+
Data governance,AIGOV-03,Lawful basis and lineage for training/serving datasets,Logging/traceability dependencies,Map+Measure,Operational data controls,GDPR + MAS/HKMA data controls,DPIA|TIA|lineage graph,CDO/Privacy,Monthly
5+
Validation & challenge,AIGOV-04,Independent validation before high-risk deployment,Conformity/performance support obligations,Measure+Manage,Evaluation & monitoring controls,SR 11-7 independent validation,Validation report|challenger tests,Model Validation,Per release
6+
Explainability & oversight,AIGOV-05,Human oversight and adverse-action explainability controls,Human oversight/transparency,Govern+Manage,Human-in-the-loop controls,FCRA/ECOA + Consumer Duty,Explanation logs|override audit,Business Owner,Per release
7+
Monitoring & incident response,AIGOV-06,Continuous monitoring with incident escalation workflows,Post-market monitoring/incident handling,Measure+Manage,Incident handling and improvement,Operational resilience expectations,Incident timeline|postmortem|notifications,SRE/CISO,Continuous
8+
Third-party & GPAI,AIGOV-07,Supplier assurance and contractual auditability,GPAI provider/deployer dependencies,Govern+Map,External provider controls,Outsourcing/third-party risk guidance,Contracts|assessments|exit plan,TPRM,Quarterly

‎governance_blueprint/evidence_event_schema.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"title": "AI Governance Evidence Event",
4+
"type": "object",
5+
"required": [
6+
"event_id",
7+
"timestamp_utc",
8+
"event_type",
9+
"model_id",
10+
"model_version",
11+
"risk_tier",
12+
"policy_bundle_hash",
13+
"trace_id",
14+
"jurisdiction_code"
15+
],
16+
"properties": {
17+
"event_id": { "type": "string", "description": "UUID for immutable event identity." },
18+
"timestamp_utc": { "type": "string", "format": "date-time" },
19+
"event_type": {
20+
"type": "string",
21+
"enum": [
22+
"model_registered",
23+
"validation_approved",
24+
"release_approved",
25+
"inference_executed",
26+
"override_recorded",
27+
"incident_opened",
28+
"incident_closed"
29+
]
30+
},
31+
"model_id": { "type": "string" },
32+
"model_version": { "type": "string" },
33+
"risk_tier": { "type": "integer", "minimum": 0, "maximum": 4 },
34+
"policy_bundle_hash": { "type": "string" },
35+
"trace_id": { "type": "string" },
36+
"request_id": { "type": "string" },
37+
"decision_context": { "type": "string" },
38+
"explanation_reference": { "type": "string" },
39+
"human_override_flag": { "type": "boolean" },
40+
"override_reason_code": { "type": "string" },
41+
"confidence": { "type": "number", "minimum": 0, "maximum": 1 },
42+
"latency_ms": { "type": "number", "minimum": 0 },
43+
"jurisdiction_code": { "type": "string" }
44+
},
45+
"additionalProperties": false
46+
}

‎governance_blueprint/opa/release_gate.rego‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package aigov.release
2+
3+
# Deny by default.
4+
default allow = false
5+
6+
# Baseline requirements for all models.
7+
baseline_requirements {
8+
input.model_card_exists
9+
input.security_scan_passed
10+
input.policy_bundle_hash_approved
11+
}
12+
13+
# Low/medium risk release path.
14+
allow {
15+
input.risk_tier <= 2
16+
baseline_requirements
17+
}
18+
19+
# High-risk release path.
20+
allow {
21+
input.risk_tier >= 3
22+
baseline_requirements
23+
input.independent_validation_approved
24+
input.legal_compliance_approved
25+
input.explainability_test_passed
26+
input.human_oversight_plan_approved
27+
}
28+
29+
# Additional controls for frontier/special risk systems.
30+
allow {
31+
input.risk_tier == 4
32+
baseline_requirements
33+
input.independent_validation_approved
34+
input.legal_compliance_approved
35+
input.explainability_test_passed
36+
input.human_oversight_plan_approved
37+
input.safety_case_approved
38+
input.containment_controls_verified
39+
input.executive_signoff
40+
}

‎governance_blueprint/roadmap_2026_2030.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
program: enterprise_agi_asi_governance
2+
version: 1.0
3+
horizon: 2026-2030
4+
phases:
5+
- name: foundation
6+
window: "2026-Q2 to 2026-Q4"
7+
objectives:
8+
- Establish policy framework and control taxonomy
9+
- Complete AI inventory and tiering
10+
- Deploy minimum CI/CD compliance-as-code gates
11+
- Enable immutable evidence logging baseline
12+
exit_criteria:
13+
- "100% production AI systems inventoried and tiered"
14+
- "Tier 3+ systems independently validated"
15+
- "Board-approved AI risk appetite ratified"
16+
- name: industrialization
17+
window: "2027"
18+
objectives:
19+
- Scale control automation across material business lines
20+
- Implement supplier/GPAI assurance program
21+
- Deploy explainability UX for regulated decisions
22+
- Run regulator-inclusive tabletop exercises
23+
exit_criteria:
24+
- ">90% policy controls continuously monitored"
25+
- "Regulator evidence packs generated in <72h"
26+
- name: advanced_assurance
27+
window: "2028"
28+
objectives:
29+
- Integrate frontier capability thresholding
30+
- Deploy containment and safety-case workflow
31+
- Complete external assurance against ISO/IEC 42001
32+
exit_criteria:
33+
- "Tier 4 systems require approved safety case"
34+
- "End-to-end control tests reproducible"
35+
- name: resilience_and_advantage
36+
window: "2029-2030"
37+
objectives:
38+
- Introduce adaptive governance with human approval
39+
- Improve cross-border supervisory evidence interoperability
40+
- Embed AGI discontinuity scenario planning
41+
exit_criteria:
42+
- "Stable audit outcomes while AI portfolio scales"
43+
- "Reduced governance cost per model with higher control efficacy"
44+
workstreams:
45+
- governance_and_policy
46+
- model_risk_and_validation
47+
- safety_and_containment
48+
- platform_controls_and_evidence
49+
- third_party_and_gpai_assurance
50+
- supervisory_engagement

0 commit comments

Comments
 (0)