MREF-GSIFI-WP-023 — Institutional-Grade AGI/ASI Governance Master Reference 2026-2030

artifacts/data/cicd-governance-gates.json

@@ -0,0 +1,120 @@
+{
+  "pipelineName": "7-Stage AI/ML Governance Pipeline",
+  "platform": "GitHub Actions Enterprise + ArgoCD + Tekton",
+  "version": "2.0.0",
+  "totalGates": 7,
+  "totalOpaRules": 102,
+  "stages": [
+    {
+      "stage": 1,
+      "name": "Code Quality & Security Gate",
+      "trigger": "PR opened",
+      "opaRules": 12,
+      "checks": [
+        {"check": "SAST (Semgrep)", "type": "security", "blocking": true},
+        {"check": "Dependency Scan (Snyk)", "type": "security", "blocking": true},
+        {"check": "License Compliance", "type": "legal", "blocking": true},
+        {"check": "Secrets Detection (TruffleHog)", "type": "security", "blocking": true},
+        {"check": "Code Review (2 approvals)", "type": "quality", "blocking": true}
+      ],
+      "blockingPolicy": "ANY failure blocks merge",
+      "avgDuration": "3 min"
+    },
+    {
+      "stage": 2,
+      "name": "Data Validation Gate",
+      "trigger": "merge to develop",
+      "opaRules": 18,
+      "checks": [
+        {"check": "Training Data Schema Validation", "type": "data", "blocking": true},
+        {"check": "Data Drift Detection (PSI < 0.1)", "type": "drift", "blocking": "soft"},
+        {"check": "Feature Distribution Check", "type": "data", "blocking": "soft"},
+        {"check": "Data Lineage Verification", "type": "governance", "blocking": true},
+        {"check": "PII Scan (Presidio)", "type": "privacy", "blocking": true},
+        {"check": "Consent Verification", "type": "privacy", "blocking": true}
+      ],
+      "blockingPolicy": "PII or consent failure is HARD BLOCK; drift warning is SOFT BLOCK",
+      "avgDuration": "8 min"
+    },
+    {
+      "stage": 3,
+      "name": "Model Training & Validation Gate",
+      "trigger": "data-gate-pass",
+      "opaRules": 24,
+      "checks": [
+        {"check": "Hyperparameter Governance", "type": "model", "blocking": true},
+        {"check": "Training Reproducibility", "type": "model", "blocking": true},
+        {"check": "Performance Threshold (AUROC >= 0.80)", "type": "performance", "blocking": true},
+        {"check": "Bias Metrics (DI >= 0.80, SPD <= 0.10)", "type": "fairness", "blocking": true},
+        {"check": "Explainability (SHAP >= 95%)", "type": "explainability", "blocking": true},
+        {"check": "Adversarial Robustness Test", "type": "security", "blocking": true}
+      ],
+      "blockingPolicy": "Bias or performance failure is HARD BLOCK",
+      "avgDuration": "12 min"
+    },
+    {
+      "stage": 4,
+      "name": "Model Risk Review Gate",
+      "trigger": "training-gate-pass",
+      "opaRules": 16,
+      "checks": [
+        {"check": "SR 11-7 Independent Validation", "type": "regulatory", "blocking": true},
+        {"check": "Model Documentation Completeness", "type": "governance", "blocking": true},
+        {"check": "Challenger Model Comparison", "type": "model", "blocking": true},
+        {"check": "Stress Testing (10 scenarios)", "type": "resilience", "blocking": true},
+        {"check": "Regulatory Classification Check", "type": "regulatory", "blocking": true},
+        {"check": "Risk Tier Assignment", "type": "governance", "blocking": true}
+      ],
+      "blockingPolicy": "Tier-1 requires MRM sign-off; Tier-2 automated",
+      "avgDuration": "8 min + manual review"
+    },
+    {
+      "stage": 5,
+      "name": "Pre-Production Governance Gate",
+      "trigger": "mrm-approval",
+      "opaRules": 14,
+      "checks": [
+        {"check": "Canary Deployment Simulation", "type": "deployment", "blocking": true},
+        {"check": "Load Testing (100x production)", "type": "resilience", "blocking": true},
+        {"check": "Failover Verification", "type": "resilience", "blocking": true},
+        {"check": "Kill-Switch Test", "type": "safety", "blocking": true},
+        {"check": "Monitoring Instrumentation", "type": "observability", "blocking": true},
+        {"check": "Alert Configuration Validation", "type": "observability", "blocking": true}
+      ],
+      "blockingPolicy": "Kill-switch failure is HARD BLOCK",
+      "avgDuration": "6 min"
+    },
+    {
+      "stage": 6,
+      "name": "Production Deployment Gate",
+      "trigger": "pre-prod-pass + change-board-approval",
+      "opaRules": 10,
+      "checks": [
+        {"check": "Blue-Green Readiness", "type": "deployment", "blocking": true},
+        {"check": "Rollback Plan Documented", "type": "governance", "blocking": true},
+        {"check": "Evidence Bundle Generated", "type": "compliance", "blocking": true},
+        {"check": "WORM Archive Confirmed", "type": "compliance", "blocking": true},
+        {"check": "Stakeholder Notification", "type": "governance", "blocking": false},
+        {"check": "Kafka Governance Event Published", "type": "audit", "blocking": true}
+      ],
+      "blockingPolicy": "Evidence or WORM failure is HARD BLOCK",
+      "avgDuration": "4 min"
+    },
+    {
+      "stage": 7,
+      "name": "Post-Deployment Monitoring Gate",
+      "trigger": "24h/7d/30d checkpoints",
+      "opaRules": 8,
+      "checks": [
+        {"check": "Performance Drift Detection (PSI)", "type": "drift", "blocking": true},
+        {"check": "Prediction Distribution Monitoring", "type": "drift", "blocking": "soft"},
+        {"check": "Fairness Metric Tracking", "type": "fairness", "blocking": true},
+        {"check": "Latency SLA Compliance", "type": "operational", "blocking": true},
+        {"check": "Error Rate Threshold", "type": "operational", "blocking": true},
+        {"check": "Business KPI Correlation", "type": "business", "blocking": false}
+      ],
+      "blockingPolicy": "PSI > 0.25 triggers automatic rollback",
+      "avgDuration": "continuous"
+    }
+  ]
+}

artifacts/data/data-quality-gates.csv

@@ -0,0 +1,21 @@
+gate_id,dimension,gate_name,threshold,check_type,opa_rule,enforcement,pipeline_stage,tier_applicability
+DQG-001,Completeness,Null Rate Check,< 2% per required field,automated,dq.completeness.null-rate,BLOCK (Tier-1) / WARN (Tier-2),ingestion,All
+DQG-002,Completeness,Required Field Coverage,≥ 98% fields present,automated,dq.completeness.field-coverage,BLOCK,ingestion,All
+DQG-003,Completeness,Record Count Variance,< 5% from expected,automated,dq.completeness.record-count,WARN,ingestion,All
+DQG-004,Accuracy,Cross-Source Validation,≥ 95% match rate,automated,dq.accuracy.cross-source,BLOCK,transformation,Tier-1
+DQG-005,Accuracy,Business Rule Compliance,100% pass rate,automated,dq.accuracy.business-rules,BLOCK,transformation,All
+DQG-006,Accuracy,Outlier Detection (IQR),< 0.5% extreme outliers,automated,dq.accuracy.outlier-iqr,WARN,transformation,All
+DQG-007,Accuracy,Outlier Detection (Z-score),Z-score < 4 for all fields,automated,dq.accuracy.outlier-zscore,WARN,transformation,Tier-2
+DQG-008,Consistency,Schema Version Match,exact match required,automated,dq.consistency.schema-version,BLOCK,ingestion,All
+DQG-009,Consistency,Referential Integrity,100% FK resolution,automated,dq.consistency.ref-integrity,BLOCK,transformation,All
+DQG-010,Consistency,Temporal Consistency,monotonic timestamps,automated,dq.consistency.temporal,WARN,ingestion,All
+DQG-011,Timeliness,Freshness SLA (Real-time),< 15 min staleness,automated,dq.timeliness.freshness-rt,BLOCK,serving,Tier-1
+DQG-012,Timeliness,Batch Delivery Window,within ±30 min of schedule,automated,dq.timeliness.batch-window,WARN,ingestion,All
+DQG-013,Timeliness,Event Timestamp Skew,< 500ms skew,automated,dq.timeliness.timestamp-skew,WARN,ingestion,All
+DQG-014,Uniqueness,Deduplication Rate,< 0.1% duplicates,automated,dq.uniqueness.dedup,BLOCK,transformation,All
+DQG-015,Uniqueness,Entity Resolution Confidence,≥ 0.90 confidence,automated,dq.uniqueness.entity-resolution,WARN,transformation,Tier-1
+DQG-016,Uniqueness,Primary Key Uniqueness,100% unique,automated,dq.uniqueness.pk,BLOCK,ingestion,All
+DQG-017,Validity,Format Compliance,100% valid formats,automated,dq.validity.format,BLOCK,ingestion,All
+DQG-018,Validity,Range Validation,within defined ranges,automated,dq.validity.range,WARN,transformation,All
+DQG-019,Validity,Enumeration Check,all values in allowed set,automated,dq.validity.enumeration,BLOCK,ingestion,All
+DQG-020,Validity,Business Domain Rules,100% compliance,automated,dq.validity.domain-rules,BLOCK,transformation,Tier-1

artifacts/data/model-inventory.csv

@@ -0,0 +1,9 @@
+Model_ID,Model_Name,Type,Category,Risk_Tier,Population,Production_Since,Last_Validation,AUROC,Gini,KS,PSI,DI_Ratio,SR117_Status,Owner
+CS-XGB-001,FICO-Alternative ML Score,XGBoost + SHAP,Credit Scoring,Tier-1,42M consumers,2024-Q3,2026-03-15,0.87,0.74,0.48,0.04,0.91,CURRENT,MRM-Credit
+CS-LGB-002,Small Business Lending Score,LightGBM + Monotonic,Credit Scoring,Tier-1,3.2M businesses,2025-Q1,2026-02-28,0.84,0.69,0.44,0.03,0.87,CURRENT,MRM-SME
+CS-ENS-003,Mortgage Underwriting Model,Ensemble (GBM+LR),Credit Scoring,Tier-1,8.7M apps/yr,2024-Q1,2026-01-30,0.86,0.72,0.46,0.05,0.89,CURRENT,MRM-Mortgage
+FR-SEQ-012,Transaction Fraud Detector,LSTM + Attention,Fraud Detection,Tier-1,120M txn/day,2025-Q2,2026-03-01,0.96,0.92,0.71,0.02,N/A,CURRENT,MRM-Fraud
+AML-GNN-004,AML Network Analyzer,Graph Neural Network,AML/KYC,Tier-1,8.4M accounts,2025-Q3,2026-03-20,0.91,0.82,0.58,0.06,N/A,CURRENT,MRM-Compliance
+MR-VAR-005,VaR Estimation Model,Monte Carlo + ML,Market Risk,Tier-1,Portfolio-wide,2024-Q2,2026-02-15,N/A,N/A,N/A,0.03,N/A,CURRENT,MRM-Market
+CS-NLP-006,Customer Support Chatbot,GPT-4o + RAG,Chatbot/NLP,Tier-3,2.1M interactions/mo,2025-Q4,2026-03-30,N/A,N/A,N/A,N/A,N/A,CURRENT,AI-Platform
+OP-CLU-007,Collections Priority Scorer,XGBoost,Collections,Tier-2,1.8M accounts,2025-Q1,2026-01-15,0.81,0.62,0.38,0.07,0.84,OVERDUE,MRM-Collections

artifacts/data/sentinel-rules-catalog.csv

@@ -0,0 +1,31 @@
+rule_id,category,name,severity,condition_summary,action,framework_alignment,status
+SENT-PERF-001,Model Performance,AUROC Degradation,P1,AUROC < baseline - 0.03 for 4h,Page + MRM review,SR 11-7 §3,ACTIVE
+SENT-PERF-002,Model Performance,Accuracy Below Threshold,P2,accuracy < 0.80,Alert MLOps + flag model,NIST MEASURE,ACTIVE
+SENT-PERF-003,Model Performance,F1 Score Drop,P2,F1 < baseline - 0.05,Retrain recommendation,ISO 42001 A.6,ACTIVE
+SENT-BIAS-001,Fairness & Bias,Disparate Impact Violation,P1,DI < 0.80 any protected class,Hard block + page CCO,FCRA/ECOA,ACTIVE
+SENT-BIAS-002,Fairness & Bias,SPD Threshold Breach,P1,|SPD| > 0.10,Hard block decisions,FCRA/ECOA,ACTIVE
+SENT-BIAS-003,Fairness & Bias,EOD Deviation,P2,|EOD| > 0.08,Alert + enhanced monitoring,EU AI Act Art 10,ACTIVE
+SENT-BIAS-004,Fairness & Bias,Calibration Drift by Segment,P2,predicted-observed > 0.05,Recalibrate + notify MRM,SR 11-7 §5,ACTIVE
+SENT-DQ-001,Data Quality,Schema Drift Detected,P2,Schema hash mismatch,Block pipeline + notify data team,ISO 42001 A.7,ACTIVE
+SENT-DQ-002,Data Quality,Null Rate Spike,P2,null rate > 2% on required field,Alert + soft block,NIST GOVERN,ACTIVE
+SENT-DQ-003,Data Quality,Feature Staleness,P3,Feature refresh > 2x expected,Alert data engineering,ISO 42001 A.7,ACTIVE
+SENT-DRIFT-001,Drift Detection,PSI Warning,P2,0.10 < PSI ≤ 0.25,Enhanced monitoring + MRM alert,SR 11-7 §4,ACTIVE
+SENT-DRIFT-002,Drift Detection,PSI Critical / Auto-Rollback,P1,PSI > 0.25 sustained 1h,Auto-rollback + evidence bundle,SR 11-7 §4,ACTIVE
+SENT-DRIFT-003,Drift Detection,Concept Drift (Page-Hinkley),P1,Page-Hinkley test positive,Immediate investigation,NIST MEASURE,ACTIVE
+SENT-DRIFT-004,Drift Detection,Label Distribution Shift,P2,Chi-squared p < 0.05,Retrain evaluation triggered,ISO 42001 A.8,ACTIVE
+SENT-OPS-001,Operational Health,Latency SLA Breach,P2,P95 > SLA target,Scale infrastructure + alert,Internal SLA,ACTIVE
+SENT-OPS-002,Operational Health,Availability Below SLA,P1,Availability < SLA %,Failover + incident response,Internal SLA,ACTIVE
+SENT-OPS-003,Operational Health,Error Rate Spike,P1,Error rate > 5%,Circuit breaker + investigation,Internal SLA,ACTIVE
+SENT-OPS-004,Operational Health,GPU Memory Pressure,P2,GPU memory > 90%,Scale + batch scheduling adjust,Internal,ACTIVE
+SENT-SEC-001,Security & Access,Anomalous API Access,P1,Access pattern deviation > 3σ,Block + security investigation,ISO 27001,ACTIVE
+SENT-SEC-002,Security & Access,Privilege Escalation Attempt,P1,Unauthorized role assumption,Block + CISO alert,NIST CSF,ACTIVE
+SENT-REG-001,Regulatory Compliance,SR 11-7 Validation Overdue,P1,Validation date > frequency,Alert MRM + escalate CRO,SR 11-7 §6,ACTIVE
+SENT-REG-002,Regulatory Compliance,Consent Expiring Soon,P2,Consent expiry < 30 days,"Renewal notification campaign",GDPR Art 7,ACTIVE
+SENT-REG-003,Regulatory Compliance,EU AI Act Documentation Gap,P1,High-risk model lacking docs,Block deployment,EU AI Act Art 11,ACTIVE
+SENT-REG-004,Regulatory Compliance,GDPR Erasure SLA Breach,P1,Erasure request > 72h open,Immediate processing + legal alert,GDPR Art 17,ACTIVE
+SENT-AGI-001,AGI Safety,Capability Emergence,P1,Benchmark > prior * 1.15,Containment review + safety board,Internal AGI Safety,ACTIVE
+SENT-AGI-002,AGI Safety,Containment Integrity Breach,P1,Containment < 100%,Emergency shutdown protocol,Internal AGI Safety,ACTIVE
+SENT-AGI-003,AGI Safety,Autonomy Creep Detection,P1,Actions > approved level,Restrict + safety review,Internal AGI Safety,ACTIVE
+SENT-AGI-004,AGI Safety,Alignment Score Deviation,P1,Score < threshold,Pause + realignment protocol,Internal AGI Safety,ACTIVE
+SENT-BIZ-001,Business KPI,Revenue Impact Deviation,P3,Revenue correlation < 0.7,Business review + model audit,Internal,ACTIVE
+SENT-BIZ-002,Business KPI,Customer Satisfaction Drop,P3,CSAT correlation decline > 10%,Product team alert,Internal,ACTIVE