feat(AGMB-GSIFI-WP-016): AGI Governance Master Blueprint + fix PMR metadata endpoint#49
Merged
Merged
Conversation
…tadata endpoint - Add AGI Governance Master Blueprint (AGMB-GSIFI-WP-016) markdown report docs/reports/AGI_GOVERNANCE_MASTER_BLUEPRINT.md (1,184 lines) - Add AGMB interactive HTML dashboard rag-agentic-dashboard/public/agi-governance-master-blueprint.html (438 lines) - Add AGMB data object and 45 API endpoints in server.js under /api/agi-governance-master-blueprint/* including metadata, KPIs, pillars, regulatory, architectures, trust-stack, global-governance, financial-services, AGI safety, autonomous agents, rollout, risk-register, investment, metrics, summary, dashboard, and artifacts endpoints - Add static governance artifacts: - JSON Schema: artifacts/schemas/ai-system-registration.schema.json - OPA policies: eu_ai_act_high_risk.rego, sr_11_7_model_validation.rego - Data files: risk-register.csv, compliance-matrix.csv, implementation-timeline.csv - Fix: Add /api/practitioner-master-reference/metadata alias endpoint (was only /meta, test expected /metadata) - resolves regression test failure Regression: 57/57 endpoints PASS, 0 FAIL
|
The files' contents are under analysis for test generation. |
|
Review changes with Changed Files
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Review these changes at https://app.gitnotebooks.com/OneFineStarstuff/OneFineStarstuff.github.io/pull/49 |
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
Reviewer's GuideImplements the AGI Governance Master Blueprint (AGMB-GSIFI-WP-016) as a structured in-memory object with a full REST API surface, public dashboard HTML, and static governance artifacts, while also wiring artifacts into the dashboard server and fixing a Practitioner Master Reference metadata endpoint regression. Sequence diagram for loading the AGMB dashboard and datasequenceDiagram
actor BoardUser
participant Browser
participant ExpressApp
participant AGMBObject
BoardUser->>Browser: Open /agi-governance-master-blueprint.html
Browser->>ExpressApp: GET /agi-governance-master-blueprint.html
ExpressApp-->>Browser: 200 HTML
Browser->>Browser: Parse HTML, initialize dashboard script
Browser->>ExpressApp: GET /api/agi-governance-master-blueprint/dashboard
ExpressApp->>AGMBObject: Read metadata, kpis, pillars, regulatoryAlignment,
ExpressApp->>AGMBObject: trustStack, globalGovernance, financialServices,
ExpressApp->>AGMBObject: agiSafety, agiReadinessLayers, autonomousAgents,
ExpressApp->>AGMBObject: eightWeekPlan, investment, keyMetrics
AGMBObject-->>ExpressApp: Aggregated dashboard data
ExpressApp-->>Browser: 200 JSON (dashboard payload)
Browser->>Browser: Populate KPI table, pillars, regulatory,
Browser->>Browser: architectures, trust stack, ICGC, risks,
Browser->>Browser: rollout and 8-week plan sections
BoardUser->>Browser: Navigate tabs, inspect metrics
Class diagram for AGMB in-memory governance data modelclassDiagram
class AGMB {
+Metadata metadata
+KPI kpis[*]
+GovernancePillar governancePillars[*]
+RegulatoryAlignment regulatoryAlignment
+ReferenceArchitecture referenceArchitectures[*]
+TrustStackLayer trustStack[*]
+GlobalGovernance globalGovernance
+FinancialServices financialServices
+AGISafety agiSafety
+AGIReadinessLayer agiReadinessLayers[*]
+AutonomousAgents autonomousAgents
+Rollout rollout
+WeekPlan eightWeekPlan[*]
+number totalEngineeringHours
+number requiredFTE
+RiskItem riskRegister[*]
+InvestmentPlan investment
+KeyMetrics keyMetrics
}
class Metadata {
+string docRef
+string title
+string version
+string date
+string classification
+string supersedes[*]
+string audience[*]
+Scope scope
+CompanionDoc companionDocs[*]
}
class Scope {
+string organizations
+number regulatoryFrameworks
+number jurisdictions
+AISystemCounts aiSystems
+string timeHorizon
+string budgetEnvelope
+number governancePillars
+number globalComponents
+number opaRules
+number sentinelRules
+string dailyPolicyEvaluations
+number apiEndpoints
+number implementationWeeks
}
class AISystemCounts {
+number production
+number development
+string agiClassProjected
}
class CompanionDoc {
+string ref
+string title
}
class KPI {
+string name
+string current
+string target2027
+string target2030
}
class GovernancePillar {
+string id
+string name
+string objective
+Role roles[*]
+AuthorityDecision authorityMatrix[*]
+PolicyGroup policyGroups[*]
+number totalRules
+RiskDimension riskTaxonomy[*]
+ARSScore weightedARS
+DataStackLayer dataStack[*]
+PipelineGate pipelineGates[*]
+number totalGateOpaRules
+number totalGateSentinelRules
+ObservabilityLayer observabilityStack[*]
+AlertTier alertEscalation[*]
+string regulatoryAlignment
}
class Role {
+string role
+string reportsTo
+string mandate
+string budget24mo
}
class AuthorityDecision {
+string decision
+string authority
+string escalation
}
class PolicyGroup {
+string group
+number rules
+string scope
+string framework
}
class RiskDimension {
+number dim
+string name
+number weight
+number current
+number target2028
}
class ARSScore {
+number current
+number target2028
}
class DataStackLayer {
+string layer
+string components
+string metric
+string datasets
+number rules
+string entityTypes
+string records
+string pipelines
+string policies
+boolean sccs
}
class PipelineGate {
+number stage
+string name
+string gate
+number opaRules
+number sentinelRules
+string criteria
}
class ObservabilityLayer {
+string layer
+string technology
+string throughput
+string retention
}
class AlertTier {
+string tier
+string severity
+string responseTime
+string responder
+string example
}
class RegulatoryAlignment {
+RegFramework frameworks[*]
+ComplianceMilestone complianceCalendar[*]
}
class RegFramework {
+string name
+string jurisdiction
+string articles
+number opaRules
+number compliance
}
class ComplianceMilestone {
+string quarter
+string milestone
+string action
}
class ReferenceArchitecture {
+string id
+string name
+string purpose
+ArchitectureMetrics metrics
}
class ArchitectureMetrics {
+number rules
+number systems
+string evalsPerDay
+string p99Latency
+string availability
+string throughput
+string identity
+string authorization
+string killSwitch
+string handoffReliability
+number workflowsPerDay
+string governance
+string humanInLoop
+string auditTrail
+string f1
+number queriesPerWeek
+string costPerQuery
+string hallucinationRate
+string citationAccuracy
+string csat
+string containmentRate
+string complianceInterventions
+string monitoring
}
class TrustStackLayer {
+number layer
+string name
+string tech
+string detail
}
class GlobalGovernance {
+ICGC icgc
+ComputeRegistry computeRegistry
+SentinelIntegration sentinelGlobalIntegration[*]
}
class ICGC {
+string name
+string model
+number totalStaff
+ICGCComponent components[*]
}
class ICGCComponent {
+string acronym
+string name
+string function
+number staff
}
class ComputeRegistry {
+ComputeProjection projections[*]
}
class ComputeProjection {
+number year
+number facilities
+number computeEFLOPS
+string crossBorderFlows
+number certifications
}
class SentinelIntegration {
+string module
+string icgcIntegration
+string dataFlow
}
class FinancialServices {
+string regulations[*]
+FSRisk riskTaxonomy[*]
+number financialServicesARS
+string gsifiPremium
+EARLLevel earl[*]
+number currentEARL
+EARLTarget targetEARL
}
class FSRisk {
+string id
+string category
+string sr117Section
+number weight
+number score
}
class EARLLevel {
+number level
+string name
+string description
}
class EARLTarget {
+number level
+string date
}
class AGISafety {
+EvolutionStage evolutionModel[*]
+CognitiveResonance cognitiveResonance
+CrisisSimulation crisisSimulations[*]
+MVAGS mvags
}
class EvolutionStage {
+string stage
+string name
+string capability
+string governance
+string timeline
}
class CognitiveResonance {
+string version
+CRComponent components[*]
+CRMetrics metrics
}
class CRComponent {
+string name
+string function
+string implementation
}
class CRMetrics {
+string valueAlignment
+string driftDetection
+string overrideAcceptance
+string culturalCalibration
}
class CrisisSimulation {
+string id
+string scenario
+string participants
+string duration
+string frequency
}
class MVAGS {
+string deploymentTime
+string monthlyCost
+MVAGSComponent components[*]
}
class MVAGSComponent {
+string component
+string tool
+number hours
+string cost
}
class AGIReadinessLayer {
+string level
+string name
+string requirements
+string investment
}
class AutonomousAgents {
+DepthsLevel depthsClassification[*]
+string cardinalInvariant
+SelfMultiplyingControl selfMultiplyingControls[*]
+TierAdmin tieredAdministration[*]
+CognitiveOrchestratorRole cognitiveOrchestratorRoles[*]
}
class DepthsLevel {
+string level
+string name
+string autonomy
+string governance
+string killSwitch
}
class SelfMultiplyingControl {
+string control
+string implementation
}
class TierAdmin {
+number tier
+string assets
+string access
+number admins
}
class CognitiveOrchestratorRole {
+string role
+string function
+string authority
}
class Rollout {
+RolloutPhase days1to30
+RolloutPhase days31to60
+RolloutPhase days61to90
}
class RolloutPhase {
+string name
+RolloutTask tasks[*]
+string successCriteria[*]
}
class RolloutTask {
+number week
+string deliverable
+string owner
}
class WeekPlan {
+number week
+string phase
+number totalHours
+number tasks
}
class RiskItem {
+string id
+string risk
+string likelihood
+string impact
+string score
+string mitigation
+string owner
}
class InvestmentPlan {
+InvestmentPhase phases[*]
+string totalInvestment
+string npv
+string irr
+string paybackPeriod
+string annualSavings
+string riskReductionValue
+string steadyStateOpex
+ROICategory roiBreakdown[*]
}
class InvestmentPhase {
+number phase
+string period
+string amount
+string focus
}
class ROICategory {
+string category
+string annual
}
class KeyMetrics {
+GovMetrics governance
+RegMetrics regulatory
+PolicyMetrics policy
+OpsMetrics operations
+RAGMetrics rag
+FinancialMetrics financial
+TimelineMetrics timeline
+DashboardMetrics dashboard
}
class GovMetrics {
+number pillars
+number globalComponents
}
class RegMetrics {
+number frameworksAligned
+number jurisdictions
}
class PolicyMetrics {
+number opaRules
+number opaGroups
+number sentinelRules
+string dailyEvaluations
}
class OpsMetrics {
+number productionSystems
+string eaipThroughput
+string killSwitchLatency
}
class RAGMetrics {
+string f1Score
+number queriesPerWeek
+string costPerQuery
}
class FinancialMetrics {
+string totalInvestment
+string npv
+string irr
+string payback
}
class TimelineMetrics {
+string implementation
+string fullMaturity
}
class DashboardMetrics {
+number endpoints
+number tabs
}
AGMB --> Metadata
AGMB --> KPI
AGMB --> GovernancePillar
AGMB --> RegulatoryAlignment
AGMB --> ReferenceArchitecture
AGMB --> TrustStackLayer
AGMB --> GlobalGovernance
AGMB --> FinancialServices
AGMB --> AGISafety
AGMB --> AGIReadinessLayer
AGMB --> AutonomousAgents
AGMB --> Rollout
AGMB --> WeekPlan
AGMB --> RiskItem
AGMB --> InvestmentPlan
AGMB --> KeyMetrics
Metadata --> Scope
Metadata --> CompanionDoc
Scope --> AISystemCounts
GovernancePillar --> Role
GovernancePillar --> AuthorityDecision
GovernancePillar --> PolicyGroup
GovernancePillar --> RiskDimension
GovernancePillar --> ARSScore
GovernancePillar --> DataStackLayer
GovernancePillar --> PipelineGate
GovernancePillar --> ObservabilityLayer
GovernancePillar --> AlertTier
RegulatoryAlignment --> RegFramework
RegulatoryAlignment --> ComplianceMilestone
ReferenceArchitecture --> ArchitectureMetrics
GlobalGovernance --> ICGC
GlobalGovernance --> ComputeRegistry
GlobalGovernance --> SentinelIntegration
ICGC --> ICGCComponent
ComputeRegistry --> ComputeProjection
FinancialServices --> FSRisk
FinancialServices --> EARLLevel
FinancialServices --> EARLTarget
AGISafety --> EvolutionStage
AGISafety --> CognitiveResonance
AGISafety --> CrisisSimulation
AGISafety --> MVAGS
CognitiveResonance --> CRComponent
CognitiveResonance --> CRMetrics
MVAGS --> MVAGSComponent
AutonomousAgents --> DepthsLevel
AutonomousAgents --> SelfMultiplyingControl
AutonomousAgents --> TierAdmin
AutonomousAgents --> CognitiveOrchestratorRole
Rollout --> RolloutPhase
RolloutPhase --> RolloutTask
InvestmentPlan --> InvestmentPhase
InvestmentPlan --> ROICategory
KeyMetrics --> GovMetrics
KeyMetrics --> RegMetrics
KeyMetrics --> PolicyMetrics
KeyMetrics --> OpsMetrics
KeyMetrics --> RAGMetrics
KeyMetrics --> FinancialMetrics
KeyMetrics --> TimelineMetrics
KeyMetrics --> DashboardMetrics
Flow diagram for AGMB REST API surface and related endpointsflowchart TD
Root[/api/agi-governance-master-blueprint/]
Root --> Meta[metadata]
Root --> KPIs[kpis]
Root --> Pillars[pillars]
Root --> Regulatory[regulatory]
Root --> Architectures[architectures]
Root --> TrustStack[trust-stack]
Root --> GlobalGov[global-governance]
Root --> FinSvcs[financial-services]
Root --> AGISafety[agi-safety]
Root --> AGIReadiness[agi-readiness]
Root --> Agents[autonomous-agents]
Root --> Rollout[rollout]
Root --> WeekPlan[8-week-plan]
Root --> RiskRegister[risk-register]
Root --> Investment[investment]
Root --> Metrics[metrics]
Root --> Summary[summary]
Root --> Dashboard[dashboard]
Root --> Artifacts[artifacts]
Pillars --> PillarById[pillars/:id]
Regulatory --> RegFrameworks[regulatory/frameworks]
Regulatory --> RegCalendar[regulatory/calendar]
Architectures --> ArchById[architectures/:id]
GlobalGov --> ICGC[global-governance/icgc]
GlobalGov --> ICGCComponents[global-governance/icgc/components]
GlobalGov --> ComputeReg[global-governance/compute-registry]
GlobalGov --> SentinelInt[global-governance/sentinel-integration]
FinSvcs --> FSRiskTaxonomy[financial-services/risk-taxonomy]
FinSvcs --> EARL[financial-services/earl]
AGISafety --> EvolutionModel[agi-safety/evolution-model]
AGISafety --> CognitiveResonance[agi-safety/cognitive-resonance]
AGISafety --> CrisisSimulations[agi-safety/crisis-simulations]
AGISafety --> MVAGS[agi-safety/mvags]
Agents --> Depths[autonomous-agents/depths]
Agents --> AgentControls[autonomous-agents/controls]
Agents --> OrchestratorRoles[autonomous-agents/orchestrator-roles]
Rollout --> Rollout30[rollout/30-day]
Rollout --> Rollout60[rollout/60-day]
Rollout --> Rollout90[rollout/90-day]
Artifacts --> SchemaList[schemas]
Artifacts --> PolicyList[policies]
Artifacts --> DataList[data]
subgraph PMR_regression_fix
PMRRoot[/api/practitioner-master-reference/]
PMRMeta[meta]
PMRMetadataAlias[metadata]
end
PMRRoot --> PMRMeta
PMRRoot --> PMRMetadataAlias
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
View changes in DiffLens |
1 similar comment
|
View changes in DiffLens |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 4 issues, and left some high level feedback:
- The AGMB data structure embedded directly in server.js is extremely large and static; consider moving it into separate JSON/module files (e.g., under artifacts or docs) and importing it so the server code remains focused on routing logic and is easier to maintain.
- There is duplicated domain content between the markdown report and the in-code AGMB object; if possible, generate one from the other (e.g., build the JSON from structured markdown frontmatter or vice versa) to avoid future drift between the documentation and the API payloads.
- The AGMB routes are all hand-defined and repetitive; defining a small routing helper that maps keys in the AGMB object to GET endpoints would reduce boilerplate and make it easier to add or modify sections consistently.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The AGMB data structure embedded directly in server.js is extremely large and static; consider moving it into separate JSON/module files (e.g., under artifacts or docs) and importing it so the server code remains focused on routing logic and is easier to maintain.
- There is duplicated domain content between the markdown report and the in-code AGMB object; if possible, generate one from the other (e.g., build the JSON from structured markdown frontmatter or vice versa) to avoid future drift between the documentation and the API payloads.
- The AGMB routes are all hand-defined and repetitive; defining a small routing helper that maps keys in the AGMB object to GET endpoints would reduce boilerplate and make it easier to add or modify sections consistently.
## Individual Comments
### Comment 1
<location path="rag-agentic-dashboard/server.js" line_range="29" />
<code_context>
// ── Static Files ─────────────────────────────────────────────────────────────
app.use(express.static(path.join(__dirname, 'public')));
+app.use('/artifacts', express.static(path.join(__dirname, '..', 'artifacts')));
app.use(express.json());
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Limit which artifact files are exposed and consider tightening static serving configuration.
Mounting the entire `artifacts` directory at `/artifacts` makes everything in that folder web-accessible, including any future sensitive files added there. If you only need the schema, policy, and CSV assets, consider either serving a narrower path (e.g., an `artifacts/public` subfolder) or adding middleware/`setHeaders` to control what’s exposed (e.g., no directory listing, correct content types, safer caching). This limits the impact if unintended files are later placed under `artifacts/`.
Suggested implementation:
```javascript
app.use(
'/artifacts',
express.static(path.join(__dirname, '..', 'artifacts', 'public'), {
dotfiles: 'ignore',
index: false,
fallthrough: false,
maxAge: '1h',
setHeaders: (res, filePath) => {
// Ensure safer defaults for downloadable artifacts
if (filePath.endsWith('.csv')) {
res.type('text/csv; charset=utf-8');
} else if (filePath.endsWith('.json')) {
res.type('application/json; charset=utf-8');
}
// Avoid overly aggressive caching by intermediaries
res.setHeader('Cache-Control', 'public, max-age=3600, must-revalidate');
},
})
);
```
This change assumes you’ll place only public, non-sensitive assets (e.g., schemas, policies, CSVs) under `artifacts/public`. If you currently store these directly under `artifacts/`, move them into the `public` subdirectory or adjust the path accordingly (e.g., `artifacts/static` or a different subfolder name) to match your project layout.
</issue_to_address>
### Comment 2
<location path="rag-agentic-dashboard/public/agi-governance-master-blueprint.html" line_range="73-77" />
<code_context>
+<span>AGMB-GSIFI-WP-016 v1.0.0</span>
+<span>2026-04-01</span>
+<span>CONFIDENTIAL</span>
+<span>8 Pillars</span>
+<span>15 ICGC Components</span>
+<span>7 Frameworks</span>
+<span>312 OPA Rules</span>
+<span>$62.8M Investment</span>
+</div>
+</div>
</code_context>
<issue_to_address>
**suggestion:** Avoid hard-coding summary numbers that are also available from the backend to prevent drift.
These counts (pillars, ICGC components, frameworks, OPA rules, investment) are already provided by the AGMB dashboard API. If we hard-code them here, the header will become incorrect as soon as the backend data changes (e.g., an additional pillar).
Since you’re already calling `/api/agi-governance-master-blueprint/dashboard`, please bind these chips to the corresponding fields in `keyMetrics` / `pillars` / `icgcSummary` instead of hard-coding them in the HTML so they stay in sync with the API.
Suggested implementation:
```
<div class="meta">
<span>AGMB-GSIFI-WP-016 v1.0.0</span>
<span>2026-04-01</span>
<span>CONFIDENTIAL</span>
<span id="meta-pillars"></span>
<span id="meta-icgc-components"></span>
<span id="meta-frameworks"></span>
<span id="meta-opa-rules"></span>
<span id="meta-investment"></span>
</div>
```
To complete this change, update the existing JavaScript that calls `/api/agi-governance-master-blueprint/dashboard` to populate these header chips from the API response, for example:
```js
// after fetching dashboard data into `data`
document.getElementById('meta-pillars').textContent =
`${data.keyMetrics.pillars} Pillars`;
document.getElementById('meta-icgc-components').textContent =
`${data.icgcSummary.components} ICGC Components`;
document.getElementById('meta-frameworks').textContent =
`${data.keyMetrics.frameworks} Frameworks`;
document.getElementById('meta-opa-rules').textContent =
`${data.keyMetrics.opaRules} OPA Rules`;
document.getElementById('meta-investment').textContent =
`${data.keyMetrics.investment} Investment`;
```
You may need to adjust the property names (`keyMetrics`, `icgcSummary`, field names like `pillars`, `components`, etc.) to match the actual shape of the dashboard API response already used elsewhere in the file.
</issue_to_address>
### Comment 3
<location path="artifacts/policies/eu_ai_act_high_risk.rego" line_range="30-39" />
<code_context>
+}
+
+# Compliance checks for high-risk systems
+compliant {
+ high_risk
+ input.documentation.technical_file_complete == true
+ input.system.human_oversight_mechanism == true
+ input.system.risk_management_system == true
+ input.system.data_governance_measures == true
+ input.system.transparency_provisions == true
+ input.system.accuracy_robustness_cybersecurity == true
+ input.system.bias_di >= 0.80
+}
+
+compliant {
+ not high_risk
+}
+
</code_context>
<issue_to_address>
**question (bug_risk):** The `compliant` rule treats all non-high-risk systems as compliant, which may be too permissive.
Currently, `compliant` is true for any case where `not high_risk`, even if key requirements (documentation, governance, DPIA, etc.) are missing. This allows `compliant` to be true when some `deny` conditions (or future non–high-risk requirements) indicate non-compliance.
If `compliant` is intended to represent overall EU AI Act compliance, consider either:
- Making `compliant` require `count(deny) == 0`, or
- Introducing a `low_risk_compliant` rule and reserving `compliant` for fully compliant high-risk systems.
Otherwise, callers may treat "not high-risk" as equivalent to "fully compliant," which is misleading.
</issue_to_address>
### Comment 4
<location path="docs/reports/AGI_GOVERNANCE_MASTER_BLUEPRINT.md" line_range="91-100" />
<code_context>
+### 2.1 Six Governance Pillars
</code_context>
<issue_to_address>
**issue:** Number of governance pillars is inconsistent between Section 2.1 and the metrics summary.
Section 2.1 is titled "Six Governance Pillars" and lists six items, but the metrics summary in 16.1 shows "Governance | Pillars | 8". Please align these—either correct the count in the metrics table or add the missing pillars if there are actually eight—to avoid confusion about the framework’s structure.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
|
||
| // ── Static Files ───────────────────────────────────────────────────────────── | ||
| app.use(express.static(path.join(__dirname, 'public'))); | ||
| app.use('/artifacts', express.static(path.join(__dirname, '..', 'artifacts'))); |
There was a problem hiding this comment.
🚨 suggestion (security): Limit which artifact files are exposed and consider tightening static serving configuration.
Mounting the entire artifacts directory at /artifacts makes everything in that folder web-accessible, including any future sensitive files added there. If you only need the schema, policy, and CSV assets, consider either serving a narrower path (e.g., an artifacts/public subfolder) or adding middleware/setHeaders to control what’s exposed (e.g., no directory listing, correct content types, safer caching). This limits the impact if unintended files are later placed under artifacts/.
Suggested implementation:
app.use(
'/artifacts',
express.static(path.join(__dirname, '..', 'artifacts', 'public'), {
dotfiles: 'ignore',
index: false,
fallthrough: false,
maxAge: '1h',
setHeaders: (res, filePath) => {
// Ensure safer defaults for downloadable artifacts
if (filePath.endsWith('.csv')) {
res.type('text/csv; charset=utf-8');
} else if (filePath.endsWith('.json')) {
res.type('application/json; charset=utf-8');
}
// Avoid overly aggressive caching by intermediaries
res.setHeader('Cache-Control', 'public, max-age=3600, must-revalidate');
},
})
);This change assumes you’ll place only public, non-sensitive assets (e.g., schemas, policies, CSVs) under artifacts/public. If you currently store these directly under artifacts/, move them into the public subdirectory or adjust the path accordingly (e.g., artifacts/static or a different subfolder name) to match your project layout.
Comment on lines
+73
to
+77
| <span>8 Pillars</span> | ||
| <span>15 ICGC Components</span> | ||
| <span>7 Frameworks</span> | ||
| <span>312 OPA Rules</span> | ||
| <span>$62.8M Investment</span> |
There was a problem hiding this comment.
suggestion: Avoid hard-coding summary numbers that are also available from the backend to prevent drift.
These counts (pillars, ICGC components, frameworks, OPA rules, investment) are already provided by the AGMB dashboard API. If we hard-code them here, the header will become incorrect as soon as the backend data changes (e.g., an additional pillar).
Since you’re already calling /api/agi-governance-master-blueprint/dashboard, please bind these chips to the corresponding fields in keyMetrics / pillars / icgcSummary instead of hard-coding them in the HTML so they stay in sync with the API.
Suggested implementation:
<div class="meta">
<span>AGMB-GSIFI-WP-016 v1.0.0</span>
<span>2026-04-01</span>
<span>CONFIDENTIAL</span>
<span id="meta-pillars"></span>
<span id="meta-icgc-components"></span>
<span id="meta-frameworks"></span>
<span id="meta-opa-rules"></span>
<span id="meta-investment"></span>
</div>
To complete this change, update the existing JavaScript that calls /api/agi-governance-master-blueprint/dashboard to populate these header chips from the API response, for example:
// after fetching dashboard data into `data`
document.getElementById('meta-pillars').textContent =
`${data.keyMetrics.pillars} Pillars`;
document.getElementById('meta-icgc-components').textContent =
`${data.icgcSummary.components} ICGC Components`;
document.getElementById('meta-frameworks').textContent =
`${data.keyMetrics.frameworks} Frameworks`;
document.getElementById('meta-opa-rules').textContent =
`${data.keyMetrics.opaRules} OPA Rules`;
document.getElementById('meta-investment').textContent =
`${data.keyMetrics.investment} Investment`;You may need to adjust the property names (keyMetrics, icgcSummary, field names like pillars, components, etc.) to match the actual shape of the dashboard API response already used elsewhere in the file.
Comment on lines
+30
to
+39
| compliant { | ||
| high_risk | ||
| input.documentation.technical_file_complete == true | ||
| input.system.human_oversight_mechanism == true | ||
| input.system.risk_management_system == true | ||
| input.system.data_governance_measures == true | ||
| input.system.transparency_provisions == true | ||
| input.system.accuracy_robustness_cybersecurity == true | ||
| input.system.bias_di >= 0.80 | ||
| } |
There was a problem hiding this comment.
question (bug_risk): The compliant rule treats all non-high-risk systems as compliant, which may be too permissive.
Currently, compliant is true for any case where not high_risk, even if key requirements (documentation, governance, DPIA, etc.) are missing. This allows compliant to be true when some deny conditions (or future non–high-risk requirements) indicate non-compliance.
If compliant is intended to represent overall EU AI Act compliance, consider either:
- Making
compliantrequirecount(deny) == 0, or - Introducing a
low_risk_compliantrule and reservingcompliantfor fully compliant high-risk systems.
Otherwise, callers may treat "not high-risk" as equivalent to "fully compliant," which is misleading.
Comment on lines
+91
to
+100
| ### 2.1 Six Governance Pillars | ||
|
|
||
| The framework establishes six interconnected governance pillars, each with defined accountability, tooling, and regulatory alignment. | ||
|
|
||
| #### Pillar 1: Accountability & Roles | ||
|
|
||
| **Objective:** Establish clear ownership, decision rights, and escalation paths for all AI-related activities. | ||
|
|
||
| | Role | Reports To | Mandate | Budget (24 mo) | | ||
| |---|---|---|---| |
There was a problem hiding this comment.
issue: Number of governance pillars is inconsistent between Section 2.1 and the metrics summary.
Section 2.1 is titled "Six Governance Pillars" and lists six items, but the metrics summary in 16.1 shows "Governance | Pillars | 8". Please align these—either correct the count in the metrics table or add the missing pillars if there are actually eight—to avoid confusion about the framework’s structure.
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| BestPractice | 5 minor |
| CodeStyle | 45 minor |
TIP This summary will be updated as you push new changes. Give us feedback
❌ Deploy Preview for onefinestarstuff failed.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds the AGI Governance Master Blueprint (AGMB-GSIFI-WP-016) — a comprehensive 6-pillar governance framework for AGI/ASI readiness at Fortune 500 and G-SIFI institutions — and fixes a regression in the Practitioner Master Reference API.
Changes
New Deliverables
docs/reports/AGI_GOVERNANCE_MASTER_BLUEPRINT.md(1,184 lines, ~85 KB)rag-agentic-dashboard/public/agi-governance-master-blueprint.html(438 lines)/api/agi-governance-master-blueprint/*including metadata, KPIs, pillars (P1-P6), regulatory frameworks, architectures, trust stack, global governance (ICGC, compute registry, sentinel), financial services (SR 11-7, EARL, credit scoring), AGI safety (evolution model, CRP, MVAGS, crisis simulations), autonomous agents (DEPTHS, kill-switch, tiered admin, cognitive orchestrator), rollout (30/60/90-day), risk register, investment, metrics, summary, dashboard data, and artifactsartifacts/schemas/ai-system-registration.schema.jsoneu_ai_act_high_risk.rego,sr_11_7_model_validation.regorisk-register.csv,compliance-matrix.csv,implementation-timeline.csvBug Fix
/metadata404: Added/api/practitioner-master-reference/metadataalias endpoint (previously only/metaexisted, causing regression test failure)Regression Testing
Key Metrics (AGMB)
Summary by Sourcery
Add an AGI Governance Master Blueprint dataset with a rich API and dashboard, expose governance artifacts statically, and fix the Practitioner Master Reference metadata endpoint regression.
New Features:
Bug Fixes:
Enhancements: