"use strict";
/**
 * SR 11-7 Compliance Pack (Federal Reserve Model Risk Management)
 *
 * Federal Reserve SR 11-7 / OCC 2011-12 / FDIC FIL-22-2017 (2011)
 * supervisory guidance on model risk management. Reinforced by the
 * 2024 interagency AI/ML supervisory statements from the Fed, OCC,
 * and FDIC, which treat every AI/ML system used in banking decisions
 * as a "model" under SR 11-7.
 *
 * Three pillars:
 *   1. Robust model development, implementation, and use.
 *   2. Sound model validation (independent of developer).
 *   3. Governance, policies, and controls.
 *
 * Model tiers and validation cadence:
 *   - CRITICAL: at least monthly
 *   - HIGH: at least monthly (validation) / weekly (monitoring)
 *   - MEDIUM: quarterly
 *   - LOW: annually
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.SR117_PACK = exports.SR117_CATEGORY_CLASSIFIERS = void 0;
const _base_classifiers_1 = require("./_base-classifiers");
/**
 * SR 11-7 (Federal Reserve / OCC Model Risk Management) category classifiers.
 * SR 11-7 governs model risk management process flows for banking institutions.
 * This pack governs process flows (inventory, validation, governance reporting).
 * Classification targets model I/O logging, PII in model data, and credential protection.
 */
exports.SR117_CATEGORY_CLASSIFIERS = {
    MODEL_INPUT: {
        references: ['SR 11-7 -- model inputs require logging and validation; conceptual soundness'],
        classifier: (input) => {
            if (/\b(?:model\s+input|feature\s+(?:vector|set|data)|training\s+(?:data|set|sample)|inference\s+input)\b/i.test(input))
                return true;
            return false;
        },
    },
    MODEL_OUTPUT: {
        references: ['SR 11-7 -- model outputs require logging; outcome monitoring and back-testing'],
        classifier: (input) => {
            if (/\b(?:model\s+(?:output|prediction|score|result)|predicted\s+(?:value|probability|score))\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['SR 11-7 -- data governance; PII in model training or inference data'],
        classifier: _base_classifiers_1.sharedPiiClassifier,
    },
    CREDENTIALS: {
        references: ['SR 11-7 -- access controls for model systems; credential exposure'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    MODEL_VALIDATION_GAP: {
        references: ['SR 11-7 Section III -- independent model validation; effective challenge'],
        classifier: (input) => {
            if (/\bmodel\s+validation\s+(gap|missing|overdue|not\s+performed)\b/i.test(input))
                return true;
            if (/\bindependent\s+(model\s+)?validation\b/i.test(input))
                return true;
            if (/\bsr\s*11[\s-]?7\s+section\s+iii\b/i.test(input))
                return true;
            if (/\beffective\s+challenge\b/i.test(input))
                return true;
            if (/\bmodel\s+validation\s+report\b/i.test(input))
                return true;
            if (/\bannual\s+model\s+validation\b/i.test(input))
                return true;
            if (/\bunresolved\s+findings\s+on\s+conceptual\s+soundness\b/i.test(input))
                return true;
            return false;
        },
    },
    MODEL_INVENTORY_GAP: {
        references: ['SR 11-7 Section II -- comprehensive model inventory'],
        classifier: (input) => {
            if (/\bmodel\s+(?:risk\s+)?inventory\s+(gap|incomplete|missing)/i.test(input))
                return true;
            if (/\bnot\s+registered\s+with\s+model\s+risk\b/i.test(input))
                return true;
            if (/\bmodel\s+registry\s+gap\b/i.test(input))
                return true;
            if (/\bshadow\s+model\s+deployed\b/i.test(input))
                return true;
            if (/\bunregistered\s+model\s+in\s+production\b/i.test(input))
                return true;
            if (/\boff[\s-]?registry\s+model\b/i.test(input))
                return true;
            if (/\bsr\s*11[\s-]?7\s+section\s+ii\b/i.test(input))
                return true;
            if (/\b(?:production\s+)?models?\s+not\s+registered\b/i.test(input))
                return true;
            return false;
        },
    },
    BACK_TESTING_FAILURE: {
        references: ['SR 11-7 Section III -- ongoing monitoring, outcome analysis, back-testing'],
        classifier: (input) => {
            if (/\bback[\s-]?test(?:ing)?\s+(failure|results?|review)\b/i.test(input))
                return true;
            if (/\boutcome\s+monitoring\b/i.test(input) && /\b(threshold|breach|fail)/i.test(input))
                return true;
            if (/\bmodel\s+performance\s+degradation\b/i.test(input))
                return true;
            if (/\bcalibration\s+drift\b/i.test(input))
                return true;
            if (/\bongoing[\s-]monitoring\s+threshold\b/i.test(input))
                return true;
            if (/\b(pd|lgd|ead)\s+prediction\s+diverged\b/i.test(input))
                return true;
            if (/\bmodel\s+accuracy\s+below\b/i.test(input) && /\b(sr\s*11[\s-]?7|ongoing[\s-]monitoring|threshold)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.SR117_PACK = {
    categoryClassifiers: exports.SR117_CATEGORY_CLASSIFIERS,
    id: 'sr11-7',
    name: 'SR 11-7',
    version: '1.0.0',
    contentHash: '33a3dd0248a4f34f2351d8b4ce73b33bdc517c93e77eed3a1b326eb02cabbf93',
    description: 'Federal Reserve SR 11-7 / OCC 2011-12 / FDIC FIL-22-2017 Model Risk Management guidance, reinforced by 2024 interagency AI/ML supervisory statements. Covers model inventory, validation independence, tier-based cadence, challenger models, ongoing monitoring, and governance controls.',
    authority: 'Federal Reserve Board, OCC, FDIC',
    industries: ['banking', 'bank-holding-company', 'credit-union', 'investment-firm', 'broker-dealer', 'insurance-carrier'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Gate model activation on inventory registration, validation status, retirement date',
            reference: 'SR 11-7 §III (lifecycle)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of model validation evidence and ongoing monitoring',
            reference: 'SR 11-7 §IV (record-keeping)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify MODEL_INPUT / MODEL_OUTPUT for logging and drift analysis',
            reference: 'SR 11-7 §V.1',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Ongoing model performance drift detection',
            reference: 'SR 11-7 §V.1 (ongoing monitoring)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Validator-separation enforcement; challenger-disagreement review',
            reference: 'SR 11-7 §V.2 (effective challenge)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Model inventory registry; validation attestations per tier cadence; retirement records',
            reference: 'SR 11-7 §III, §V.2',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Developer statement with documented assumptions, limitations, intended use',
            reference: 'SR 11-7 §IV.1',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream model invocations, challenger disagreements, drift alerts, retirement events',
            reference: 'SR 11-7 §VI',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Persist model-state across sessions for monitoring continuity',
            reference: 'SR 11-7 §V.1',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Developer and validator identity tracked for independence check',
            reference: 'SR 11-7 §V.2',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            modelInventoryRegistrationRequired: true,
            validationStatusGateRequired: true,
            retirementEnforcementRequired: true,
        },
        'approval-queue': {
            validatorSeparationRequired: true, // developer != validator
            challengerDisagreementReviewRequired: true,
            materialChangeRevalidationRequired: true,
        },
        'attestation-manager': {
            validationCadenceByTierDays: {
                CRITICAL: 30,
                HIGH: 30,
                MEDIUM: 90,
                LOW: 365,
            },
            challengerModelRequiredForCriticalTier: true,
            modelInventoryRequired: true,
        },
        'anomaly-detector': {
            driftDetectionActive: true,
            tierBasedMonitoringCadence: true,
        },
        'supply-chain': {
            developerStatementRequired: true,
            developerStatementFields: [
                'assumptions',
                'limitations',
                'intended_use',
                'known_good_data_ranges',
                'training_data_characterisation',
            ],
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['MODEL-DOCUMENTATION'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['MODEL_INPUT', 'MODEL_OUTPUT', 'PII', 'CREDENTIALS', 'MODEL_VALIDATION_GAP', 'MODEL_INVENTORY_GAP', 'BACK_TESTING_FAILURE'],
        categoryActions: {
            MODEL_INPUT: 'LOG',
            MODEL_OUTPUT: 'LOG',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
            MODEL_VALIDATION_GAP: 'WARN',
            MODEL_INVENTORY_GAP: 'WARN',
            BACK_TESTING_FAILURE: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 7 years aligned with banking-agency exam cycle + model retirement tail
        auditLogRetentionDays: 2555,
        sessionRetentionDays: 730,
        incidentRetentionDays: 2555,
        reference: 'Banking-agency examination cycle (usually 12-18 months) + retained model decision evidence for 7 years',
    },
    incidentPolicy: {
        // 30 days external to CMO / CRO / model risk committee; 24h internal escalation
        notificationDeadlineHours: 720,
        reference: 'No statutory deadline. Pax1 default 30-day external escalation to Chief Model Risk Officer, Chief Risk Officer, and model-risk committee; 24-hour internal escalation for material model-risk incidents.',
        requiredRecipients: ['chief-model-risk-officer', 'chief-risk-officer', 'model-risk-committee'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'sr117-model-inventory',
            description: 'Every model-risk agent registered in enterprise model inventory',
            reference: 'SR 11-7 §III',
            check: 'sr117_inventory_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sr117-validation-independence',
            description: 'Developer and validator are distinct identities',
            reference: 'SR 11-7 §V.2',
            check: 'sr117_validation_independence_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sr117-validation-cadence',
            description: 'Tier-based validation cadence tracked (CRITICAL/HIGH monthly, MEDIUM quarterly, LOW annually)',
            reference: 'SR 11-7 §V.2',
            check: 'sr117_validation_cadence_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sr117-challenger',
            description: 'Challenger/benchmark model registered for CRITICAL-tier agents',
            reference: 'SR 11-7 §V.2',
            check: 'sr117_challenger_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sr117-drift-monitoring',
            description: 'Ongoing drift monitoring enabled for every model-risk agent',
            reference: 'SR 11-7 §V.1',
            check: 'sr117_drift_monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sr117-retirement',
            description: 'Retirement date enforced; post-retirement invocation blocked',
            reference: 'SR 11-7 §III',
            check: 'sr117_retirement_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sr117-documentation',
            description: 'Developer statement with assumptions, limitations, intended use, data ranges on file',
            reference: 'SR 11-7 §IV.1',
            check: 'sr117_documentation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sr117-material-change',
            description: 'Material change triggers revalidation before production',
            reference: 'SR 11-7 §V.2',
            check: 'sr117_material_change_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sr117-governance-report',
            description: 'Enterprise model-risk dashboard updated (tier counts, validation overdue, drift anomalies)',
            reference: 'SR 11-7 §VI',
            check: 'sr117_governance_report_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'sr117-audit-trail',
            description: 'Tamper-evident audit trail of model decisions, validations, and changes',
            reference: 'SR 11-7 §IV',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=sr117.js.map