Regulatory freshness, OWASP ASI reconciliation + 13th framework, MITRE ATLAS agentic

.claim-allowlist

@@ -21,10 +21,10 @@
 \b419\s+Risikomuster
 \b419\s+padr
 \b57\s+risk\s+pattern\s+categor
-\b12\s+compliance\s+frameworks?
-\b12\s+Framework
-\b12\s+frameworks
-\b12\s+Konformit
+\b13\s+compliance\s+frameworks?
+\b13\s+[Ff]ramework
+\b13\s+frameworks
+\b13\s+Konformit
 \b8\s+(programming\s+)?languages?
 \b8\s+Sprachen
 \b8\s+linguagens

SECURITY.md

@@ -82,7 +82,9 @@ disclosure, etc.), include that in your initial report.
 | `semgrep --config p/security-audit --config p/python` | Each release | 0 findings on 200 rules / 129 files |
 | `pip-audit` | Each release | 0 vulnerabilities (zero runtime deps) |
 | `regula self-test` | Each commit | 6 / 6 |
-| Custom regression suite | Each commit | 2,468 unique / 2,468 pytest-collected |
+| Custom regression suite | Each commit | 2,789 pytest-collected tests |
+| PyPI provenance attestation (PEP 740, Trusted Publishing) | Each release | ✅ attached to wheel + sdist, Sigstore-backed |
+| CodeQL static analysis | Each push | workflow green; open alerts triaged below, never suppressed |
 
 The full posture is in [`docs/TRUST.md`](docs/TRUST.md), Section 7.
 
@@ -96,14 +98,43 @@ Honest list, also recorded in `docs/TRUST.md`:
 - **No third-party penetration test.** The attack surface is the user's
   local machine + opt-in network calls. Open for review at
   <https://github.com/kuzivaai/getregula>.
-- **Sigstore release signing — on the roadmap, not yet shipped.**
-  Current method: reproducible builds from `python3 -m build` against
-  the published commit hash. Sigstore-keyless signing via PyPI's
-  trusted publishing flow is planned but has not yet been implemented.
 - **No formal CVE program (yet).** The next public CVE we receive will
   also be the moment we register as a CNA. Until then, GitHub Security
   Advisory + email.
 
+## CodeQL static-analysis alerts (open, triaged, not suppressed)
+
+CodeQL runs on every push. As of 2026-07-22 it reports **42 open high-severity
+alerts** (live list: <https://github.com/kuzivaai/getregula/security/code-scanning>).
+They are listed here in full, with the reasoning for each, and left open in the
+GitHub Security tab. We do not dismiss or suppress security alerts:
+a compliance tool that clears its own dashboard by waving alerts away is not one
+you should trust. The CodeQL *workflow* passes; these alerts do not gate it.
+
+**37 × `py/path-injection` (across 8 files).** A code scanner's job is to read
+files from a folder the user points it at, so its file-reading paths are tainted
+by design. Every scanning command routes through `walk_project_files()` /
+`is_safe_to_scan()`, which reject named pipes, out-of-root symlinks and `.git`;
+the optional REST API (`api_server.py`) additionally rejects any path outside the
+current working directory (`Path.resolve().relative_to(cwd)`) and caps request
+bodies at 1 MB. CodeQL does not model these containment checks as sanitisers, so
+the taint path is reported even though the guard is present. `tests/test_hostile_sweep.py`
+exercises this whole class against a deliberately hostile directory tree.
+
+**5 × other rules, each reviewed individually:**
+
+| Alert | Location | Assessment |
+|---|---|---|
+| `py/polynomial-redos` | `classify_risk.py` | Reachable only via *user-supplied* custom-rule patterns, which already pass `_compile_custom_pattern` (rejects nested quantifiers and patterns over 500 chars; unit-tested). Polynomial, not exponential; self-inflicted. Low risk, mitigated. |
+| `py/bad-tag-filter` | `claim_auditor.py` | A genuine minor robustness gap in an internal docs-audit tool — **fixed**: the `<script>` / `<style>` blanking regex now tolerates whitespace and attributes in the closing tag. |
+| `py/clear-text-logging-sensitive-data` | `tests/helpers.py` | Test helper that prints an assertion failure; the "secret" is a synthetic, char-code-constructed test credential. Test-only false positive. |
+| `py/redos` | `tests/test_classification.py` | A regex inside the test that *asserts* ReDoS protection works. Test-only. |
+| `py/incomplete-url-substring-sanitization` | `tests/test_build_regulations.py` | A test asserting rendered HTML contains a URL substring, not a security check. Test-only false positive. |
+
+If you are evaluating Regula: its own scanner is held to the same standard it
+applies to your code. Every alert is visible, triaged in public, and either
+explained or fixed — never silenced.
+
 ## How to verify a release independently
 
 ```bash
@@ -117,6 +148,10 @@ sha256sum dist/regula_ai-1.7.3-py3-none-any.whl
 # Compare against the wheel served by PyPI
 pip download --no-deps -d /tmp/verify regula-ai==1.7.3
 sha256sum /tmp/verify/regula_ai-1.7.3-py3-none-any.whl
+
+# Verify PyPI provenance attestations (PEP 740, Sigstore-backed)
+python3 -m pip install pypi-attestation-models
+python3 -m pypi_attestations verify /tmp/verify/regula_ai-1.7.3-py3-none-any.whl
 ```
 
 The two SHA-256 hashes should match. If they do not, **stop and report

content/regulations/united-kingdom.py

@@ -228,7 +228,7 @@
             "a": (
                 "Yes. Regula's framework crosswalk includes the UK DSIT/ICO principles "
                 "alongside the EU AI Act, NIST AI RMF, NIST AI 600-1, ISO 42001, ISO 27001, "
-                "SOC 2, OWASP LLM Top 10, MITRE ATLAS, CRA, LGPD and Marco Legal IA. A "
+                "SOC 2, OWASP LLM Top 10, OWASP Top 10 for Agentic Applications, MITRE ATLAS, CRA, LGPD and Marco Legal IA. A "
                 "single regula check run reports findings against all of them."
             ),
         },

data/site_facts.json

@@ -1,5 +1,5 @@
 {
-  "generated_at": "2026-07-22T08:38:32.311290+00:00",
+  "generated_at": "2026-07-23T08:39:58.213240+00:00",
   "source_of_truth": {
     "commands": "scripts/cli*.py (grep '^def cmd_' across all topic modules)",
     "patterns": "scripts/risk_patterns.py + scripts/code_analysis.py + scripts/credential_check.py",
@@ -24,7 +24,7 @@
       "composite_tier_cred_agentic": 447,
       "historical_330_bucket": 479
     },
-    "frameworks": 12,
+    "frameworks": 13,
     "languages": 8,
     "tests": {
       "total_collected": 2789,
@@ -105,6 +105,6 @@
   },
   "notes": {
     "pattern_count_methodology": "Regula's landing pages cite 'tier_regexes risk patterns'. That figure is the total individual regexes in risk_patterns.py across all tiered groups (prohibited, high-risk, limited-risk, AI security, bias, governance, GPAI training). The `historical_330_bucket` adds architecture, credential, and oversight patterns from code_analysis.py. The `grand_total` also includes AI_INDICATORS.",
-    "frameworks_vs_claim": "Regula's landing pages cite '12 compliance frameworks'. 12 have full crosswalk data; 5 additional frameworks (Colorado SB-189 [replaced SB-205], Canada AIDA, Singapore AI, OECD AI, South Korea AI) accepted as filter keys with partial coverage."
+    "frameworks_vs_claim": "Regula's landing pages cite '13 compliance frameworks'. All 13 are in _FRAMEWORK_KEYS with crosswalk data (OWASP ASI added 2026-07). Colorado SB-189, Canada AIDA, Singapore AI, OECD AI and South Korea AI have display handlers only (no filter keys, no crosswalk)."
   }
 }

data/site_facts.md

@@ -2,7 +2,7 @@
 
 *Canonical source of truth for every numeric claim on the landing pages. Regenerate by running `python3 scripts/site_facts.py`.*
 
-Generated: `2026-07-22T08:38:32.311290+00:00`
+Generated: `2026-07-23T08:39:58.213240+00:00`
 
 ## Top-line counts
 
@@ -12,7 +12,7 @@ Generated: `2026-07-22T08:38:32.311290+00:00`
 | Detection patterns (historical bucket) | **479** | see breakdown below |
 | Detection patterns (grand total, inclusive) | **722** | see breakdown below |
 | Tiered risk pattern groups | 57 | `scripts/risk_patterns.py` |
-| Compliance frameworks | **12** | `references/framework_crosswalk.yaml` + EU AI Act |
+| Compliance frameworks | **13** | `references/framework_crosswalk.yaml` + EU AI Act |
 | Programming languages | 8 | `scripts/ast_engine.py` |
 | Test functions (all files) | 1726 | `tests/test_*.py` |
 

docs/architecture.md

@@ -25,7 +25,7 @@ regula/
 │   ├── ast_engine.py              # Multi-language AST engine (Python + JS/TS tree-sitter + Java/Go/Rust/C/C++ regex)
 │   ├── compliance_check.py        # Compliance gap assessment (Articles 9-15)
 │   ├── dependency_scan.py         # AI dependency supply chain security
-│   ├── framework_mapper.py        # Cross-framework compliance mapping (12 frameworks)
+│   ├── framework_mapper.py        # Cross-framework compliance mapping (13 frameworks)
 │   ├── remediation.py             # Inline fix suggestions per Annex III category
 │   ├── agent_monitor.py           # Agentic AI governance (autonomy scoring, MCP config)
 │   ├── sbom.py                    # CycloneDX 1.7 AI SBOM generation
@@ -85,7 +85,7 @@ regula/
 - **Compliance gap assessment, not just risk flagging.** Checks whether Articles 9-15 compliance infrastructure actually exists in the codebase.
 - **AI-specific supply chain security.** Dependency pinning checks focus on AI libraries, not general packages.
 - **Cross-platform.** Unix/macOS (`fcntl`) and Windows (`msvcrt`) file locking. No platform restrictions.
-- **Multi-framework mapping.** 12 frameworks with full crosswalk data (EU AI Act, NIST AI RMF, ISO 42001, NIST CSF, SOC 2, ISO 27001, OWASP LLM Top 10, MITRE ATLAS, EU CRA, LGPD, Marco Legal IA, UK ICO) mapped via [references/framework_crosswalk.yaml](../references/framework_crosswalk.yaml). 5 additional frameworks have display handlers but no crosswalk data and no filter keys (Colorado SB-205, Canada AIDA, Singapore AI, OECD AI, South Korea AI) — filter keys removed in commit 7d93fed to prevent silent empty results.
+- **Multi-framework mapping.** 13 frameworks with full crosswalk data (EU AI Act, NIST AI RMF, ISO 42001, NIST CSF, SOC 2, ISO 27001, OWASP LLM Top 10, OWASP Top 10 for Agentic Applications, MITRE ATLAS, EU CRA, LGPD, Marco Legal IA, UK ICO) mapped via [references/framework_crosswalk.yaml](../references/framework_crosswalk.yaml). 5 additional frameworks have display handlers but no crosswalk data and no filter keys (Colorado SB-205, Canada AIDA, Singapore AI, OECD AI, South Korea AI) — filter keys removed in commit 7d93fed to prevent silent empty results.
 
 
 ## Site integrity guard

docs/cli-reference.md

@@ -276,7 +276,7 @@ Checks: pinning quality (hash > exact > range > unpinned), lockfile presence, AI
 
 ### Cross-Framework Compliance Mapping
 
-Regula maps findings to 12 compliance frameworks internally: EU AI Act, NIST AI RMF 1.0, ISO 42001:2023, NIST CSF 2.0, SOC 2, ISO 27001:2022, OWASP Top 10 for LLMs, MITRE ATLAS, LGPD (Brazil), Marco Legal da IA (Brazil), EU Cyber Resilience Act, and UK ICO AI Guidance. Framework mappings appear in check findings and gap assessments automatically.
+Regula maps findings to 13 compliance frameworks internally: EU AI Act, NIST AI RMF 1.0, ISO 42001:2023, NIST CSF 2.0, SOC 2, ISO 27001:2022, OWASP Top 10 for LLMs, OWASP Top 10 for Agentic Applications, MITRE ATLAS, LGPD (Brazil), Marco Legal da IA (Brazil), EU Cyber Resilience Act, and UK ICO AI Guidance. Framework mappings appear in check findings and gap assessments automatically.
 
 ### Real-World Validation Benchmark
 

docs/course/10-custom-patterns.md

@@ -88,7 +88,7 @@ You've learned to:
 - Detect AI-specific security vulnerabilities
 - Integrate into CI/CD pipelines
 - Generate compliance documentation
-- Map findings across 12 frameworks (see `references/framework_crosswalk.yaml`)
+- Map findings across 13 frameworks (see `references/framework_crosswalk.yaml`)
 - Build custom detection patterns
 
 **What's next:**

references/framework_crosswalk.yaml

@@ -77,6 +77,10 @@ mappings:
         - "AML.T0031: Erode ML Model Integrity"
         - "AML.T0043: Craft Adversarial Data"
         - "AML.T0047: Evade ML Model"
+    owasp_agentic:
+      items:
+        - "ASI08: Cascading Failures"
+        - "ASI10: Rogue Agents"
     lgpd:
       articles:
         - "Art. 6 (prevenção): Sistema de prevenção de danos ao titular"
@@ -156,6 +160,10 @@ mappings:
         - "AML.T0019: Publish Poisoned Datasets"
         - "AML.T0020: Poison Training Data"
         - "AML.T0043: Craft Adversarial Data"
+    owasp_agentic:
+      items:
+        - "ASI04: Agentic Supply Chain Vulnerabilities"
+        - "ASI06: Memory & Context Poisoning"
     lgpd:
       articles:
         - "Art. 6 (qualidade): Dados devem ser exatos, claros, relevantes e atualizados"
@@ -363,6 +371,9 @@ mappings:
       techniques:
         - "AML.T0040: ML Model Inference API Access"
         - "AML.T0048: Prompt Injection"
+    owasp_agentic:
+      items:
+        - "ASI09: Human-Agent Trust Exploitation"
     lgpd:
       articles:
         - "Art. 6 (transparência): Informações claras e adequadas sobre o tratamento"
@@ -428,6 +439,12 @@ mappings:
         - "LLM06: Excessive Agency"
     mitre_atlas:
       techniques: []
+    owasp_agentic:
+      items:
+        - "ASI01: Agent Goal Hijack"
+        - "ASI02: Tool Misuse"
+        - "ASI09: Human-Agent Trust Exploitation"
+        - "ASI10: Rogue Agents"
     lgpd:
       articles:
         - "Art. 20: O titular tem direito a solicitar revisão de decisões tomadas unicamente com base em tratamento automatizado"
@@ -523,6 +540,22 @@ mappings:
         - "AML.T0043: Craft Adversarial Data"
         - "AML.T0047: Evade ML Model"
         - "AML.T0048: Prompt Injection"
+        - "AML.T0086: Exfiltration via AI Agent Tool Invocation"
+        - "AML.T0101: Data Destruction via AI Agent Tool Invocation"
+        - "AML.T0108: AI Agent Tool Poisoning"
+        - "AML.T0109: AI Supply Chain Rug Pull"
+        - "AML.T0054: LLM Jailbreak"
+        - "AML.T0112: Machine Compromise"
+    owasp_agentic:
+      items:
+        - "ASI01: Agent Goal Hijack"
+        - "ASI02: Tool Misuse"
+        - "ASI03: Identity & Privilege Abuse"
+        - "ASI04: Agentic Supply Chain Vulnerabilities"
+        - "ASI05: Unexpected Code Execution"
+        - "ASI06: Memory & Context Poisoning"
+        - "ASI07: Insecure Inter-Agent Communication"
+        - "ASI08: Cascading Failures"
     lgpd:
       articles:
         - "Art. 6 (qualidade): Dados utilizados devem ser exatos e atualizados"

references/gpai_code_of_practice.yaml

@@ -1,9 +1,11 @@
 # EU AI Act — General-Purpose AI Code of Practice (Chapter Mapping)
 #
-# STATUS AS OF 2026-04-08: The Code of Practice was published in its final form
-# on 10 July 2025 by the European AI Office, and endorsed by the Commission and
-# the AI Board on 1 August 2025 via adequacy decisions. GPAI rules took effect
-# on 2 August 2025. Commission enforcement actions begin 2 August 2026.
+# STATUS AS OF 2026-07-22 (re-verified; facts unchanged since publication): The
+# Code of Practice was published in its final form on 10 July 2025 by the
+# European AI Office, and endorsed by the Commission and the AI Board on
+# 1 August 2025 via adequacy decisions. GPAI rules took effect on 2 August 2025.
+# Commission enforcement actions begin 2 August 2026. The three-chapter
+# structure (Transparency, Copyright, Safety & Security) below is current.
 #
 # This file is a plumbing stub. It breaks the three Code of Practice chapters
 # into concrete, code-detectable obligations that future Regula commands can
@@ -19,7 +21,7 @@
 #   - EU AI Act Articles 53, 55
 
 schema_version: "1.0"
-last_verified: "2026-04-08"
+last_verified: "2026-07-22"
 code_status: "final"
 code_published_date: "2025-07-10"
 commission_endorsement_date: "2025-08-01"

references/gpai_signatories.yaml

@@ -11,8 +11,10 @@
 #
 # Last updated: 2026-07-22 (re-verified the tracked SDK vendors against the
 # Commission list on 2026-07-22: Amazon, Google, Microsoft, Anthropic, OpenAI,
-# Mistral, Cohere all remain signatories. Hugging Face was not present on the
-# Commission's July 2026 published list — re-confirm before the next release.)
+# Mistral, Cohere all remain signatories. Hugging Face is confirmed NOT a
+# signatory — verified against the Commission's published signatory list and
+# the Wikipedia GPAI Code of Practice article (edited 15 Jul 2026); its entry
+# below was corrected from signed:true to signed:false this pass.)
 # Maintenance: this list changes infrequently. Re-verify against the
 # Commission's published list before each Regula release.
 #
@@ -29,10 +31,13 @@ last_verified: "2026-07-22"
 total_signatories: 26
 source_url: "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai"
 
-# Each entry maps Python/JS package names to the legal entity that signed
-# the GPAI Code of Practice. `signed: true` is the strict claim — only
-# include vendors with verifiable public sign-on. Anyone whose status is
-# uncertain or who has only signalled intent without signing is omitted.
+# Each entry maps Python/JS package names to the legal entity, with a VERIFIED
+# `signed` status. `signed: true` is the strict claim (verifiable public
+# sign-on). `signed: false` is used only for a detectable major vendor whose
+# NON-signing is verified against the Commission's published list (currently
+# Hugging Face); this lets the SBOM annotate it as a known non-signatory
+# rather than "unknown". Vendors whose status is uncertain, or who have only
+# signalled intent, are omitted entirely (the SBOM then reports "unknown").
 #
 # Format:
 #   - sdk_packages: list of import names that detect this vendor
@@ -102,10 +107,21 @@ vendors:
   - id: huggingface
     sdk_packages: ["transformers", "huggingface_hub", "datasets", "diffusers"]
     legal_entity: "Hugging Face, Inc."
-    signed: true
+    signed: false
     signed_date: null
     source: "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai"
-    notes: "Hugging Face is a hub, not a model provider per se. Detection of `transformers` import does not necessarily mean a Hugging Face hosted model is being called — could be a locally-loaded model from any provider."
+    notes: >-
+      NOT a signatory of the GPAI Code of Practice. Re-verified 2026-07-22
+      against the European Commission's published signatory list (26 orgs,
+      1 Aug 2025 baseline: Amazon, Anthropic, Google, IBM, Microsoft, Mistral,
+      OpenAI, Cohere, Aleph Alpha, ServiceNow, Writer et al.; Meta and Chinese
+      providers are the other notable absences) and the Wikipedia GPAI Code of
+      Practice article (edited 15 Jul 2026) — Hugging Face appears on neither.
+      A prior version of this file marked it signed:true in error. Hugging Face
+      is a hub, not a model provider per se: a `transformers` import does not by
+      itself mean a Hugging Face hosted model is being called (it may be a
+      locally-loaded model from any provider), so signed:false annotates the
+      vendor's own status, not the model actually loaded.
 
 # Vendors NOT in the GPAI Code of Practice signatory list as of 2026-04-07.
 # Listed here for completeness so the absence is intentional, not an