PRD-010: AI Governance Runtime

1
2
3
4
5
6
Given evaluation artifacts exist in the artifacts/ directory
When the developer runs the pre-commit governance check
Then the system validates each metric against its threshold
And blocks the merge if any metric exceeds its threshold
And returns a detailed violation report
And INV-GS-003 (fail-closed) holds

1
2
3
4
5
Given a prompt containing PII without lawful basis
When the prompt is submitted to POST /filter/prompt
Then the system returns {"allowed": false, "action": "block", "reasons": ["PII without lawful basis"]}
And the decision is logged for audit
And INV-GS-001 (sidecar enforcement) holds

1
2
3
4
5
6
Given a valid evaluation artifact JSON
When the artifact is submitted to POST /evidence
Then the system computes SHA256 hash of the content
And stores the artifact with timestamp and hash prefix "sha256:"
And returns a unique artifact ID
And INV-GS-002 (SHA256 hashing) holds

1
2
3
4
Given the Risk & Evidence Service is running
When GET /metrics is called
Then the response includes llm_pass_at_5, fairness_subgroup_delta, harmful_output_rate, drift_psi gauges
And the response format is OpenTelemetry-compatible (OTLP or Prometheus text)

1
2
3
4
5
Given model monitoring is active
When PSI metric exceeds 0.2
Then the system emits a DriftDetected alert
And logs the drift event with model version and PSI value
And INV-GS-007 (drift threshold) holds