compliance_types.hpp

Go to the documentation of this file.

// SPDX-License-Identifier: AGPL-3.0-or-later
// Copyright 2026 Johnson Ogundeji
// See LICENSE_COMMERCIAL for full terms.
// compliance_types.hpp — Shared types for MiFID II and EU AI Act compliance reports
// Phase 10d: Compliance Report Generators
//
// Provides common enumerations, options structs, and the ComplianceReport output
// type shared by MiFID2Reporter and EUAIActReporter.
 
#pragma once
 
#if !defined(SIGNET_ENABLE_COMMERCIAL) || !SIGNET_ENABLE_COMMERCIAL
#error "signet/ai/compliance/compliance_types.hpp requires SIGNET_ENABLE_COMMERCIAL=ON (AGPL-3.0 commercial tier). See LICENSE_COMMERCIAL."
#endif
 
#include <cmath>
#include <cstdint>
#include <limits>
#include <string>
#include <vector>
 
namespace signet::forge {
 
enum class ReportFormat {
    JSON,    
    NDJSON,  
    CSV,     
};
 
enum class TimestampGranularity {
    NANOS,   
    MICROS,  
    MILLIS,  
};
 
enum class ComplianceStandard {
    MIFID2_RTS24,       
    EU_AI_ACT_ART12,    
    EU_AI_ACT_ART13,    
    EU_AI_ACT_ART19,    
};
 
struct ReportOptions {
    int64_t start_ns = 0;
 
    int64_t end_ns = (std::numeric_limits<int64_t>::max)();
 
    ReportFormat format = ReportFormat::JSON;
 
    bool verify_chain = true;
 
    bool strict_source_reads = true;
 
    bool include_features = false;
 
    bool pretty_print = true;
 
    std::string system_id;
 
    std::string report_id;
 
    std::string firm_id;
 
    float low_confidence_threshold = 0.5f;
 
    int price_significant_digits = 17;
 
    TimestampGranularity timestamp_granularity = TimestampGranularity::NANOS;
 
    // --- EU AI Act Art.13 Model Card / Transparency fields (Gap R-2) ---
 
    std::string intended_purpose;
 
    std::string known_limitations;
 
    std::string provider_name;
    std::string provider_contact;
 
    std::string instructions_for_use;
 
    std::string human_oversight_measures;
 
    std::string accuracy_metrics;
 
    std::string bias_risks;
 
    int risk_level{0};
};
 
struct ComplianceReport {
    ComplianceStandard standard = ComplianceStandard::MIFID2_RTS24;
 
    ReportFormat format = ReportFormat::JSON;
 
    std::string content;
 
    std::string report_id;
 
    std::string generated_at_iso;
 
    int64_t generated_at_ns = 0;
 
    int64_t total_records = 0;
 
    bool chain_verified = false;
 
    std::string chain_id;
 
    std::string period_start_iso;
 
    std::string period_end_iso;
 
    bool incomplete_data = false;
 
    std::vector<std::string> read_errors;
};
 
// ===========================================================================
// Gap R-12/R-12b/R-12c: Regulatory identifier validation
//
// MiFID II RTS 24/25 and EMIR require specific identifier formats:
//   - LEI (Legal Entity Identifier): ISO 17442, 20-char alphanumeric + check digits
//   - ISIN (International Securities Identification Number): ISO 6166, 12-char
//   - MIC (Market Identifier Code): ISO 10383, 4-char alpha
//
// These validators enforce format compliance before generating regulatory reports.
// Invalid identifiers would cause report rejection by NCAs (National Competent
// Authorities) or trade repositories.
//
// References:
//   - ISO 17442:2020 — Legal Entity Identifier (LEI)
//   - ISO 6166:2021 — International Securities Identification Number (ISIN)
//   - ISO 10383:2022 — Market Identifier Code (MIC)
//   - MiFID II RTS 24 Annex I Fields 1, 18, 36
// ===========================================================================
 
namespace regulatory {
 
[[nodiscard]] inline bool validate_lei(const std::string& lei) {
    if (lei.size() != 20) return false;
 
    // All characters must be alphanumeric
    for (char c : lei) {
        if (!((c >= '0' && c <= '9') || (c >= 'A' && c <= 'Z'))) return false;
    }
 
    // ISO 7064 Mod 97-10 check (same algorithm as IBAN)
    // Convert alpha chars to 2-digit numbers: A=10, B=11, ..., Z=35
    std::string numeric;
    numeric.reserve(40);
    for (char c : lei) {
        if (c >= 'A' && c <= 'Z') {
            int val = c - 'A' + 10;
            numeric += std::to_string(val);
        } else {
            numeric += c;
        }
    }
 
    // Compute mod 97 on the large number (digit-by-digit)
    int remainder = 0;
    for (char c : numeric) {
        remainder = (remainder * 10 + (c - '0')) % 97;
    }
    return remainder == 1;
}
 
[[nodiscard]] inline bool validate_isin(const std::string& isin) {
    if (isin.size() != 12) return false;
 
    // First 2 characters must be uppercase alpha (country code)
    if (!(isin[0] >= 'A' && isin[0] <= 'Z')) return false;
    if (!(isin[1] >= 'A' && isin[1] <= 'Z')) return false;
 
    // Characters 3-12 must be alphanumeric
    for (size_t i = 2; i < 12; ++i) {
        char c = isin[i];
        if (!((c >= '0' && c <= '9') || (c >= 'A' && c <= 'Z'))) return false;
    }
 
    // Luhn check on the expanded numeric form
    // Letters are expanded: A=10, B=11, ..., Z=35
    std::string digits;
    digits.reserve(24);
    for (char c : isin) {
        if (c >= 'A' && c <= 'Z') {
            int val = c - 'A' + 10;
            digits += std::to_string(val);
        } else {
            digits += c;
        }
    }
 
    // Luhn algorithm (right-to-left, double every second digit)
    int sum = 0;
    bool double_next = false;
    for (int i = static_cast<int>(digits.size()) - 1; i >= 0; --i) {
        int d = digits[static_cast<size_t>(i)] - '0';
        if (double_next) {
            d *= 2;
            if (d > 9) d -= 9;
        }
        sum += d;
        double_next = !double_next;
    }
    return (sum % 10) == 0;
}
 
[[nodiscard]] inline bool validate_mic(const std::string& mic) {
    if (mic.size() != 4) return false;
    for (char c : mic) {
        if (!(c >= 'A' && c <= 'Z')) return false;
    }
    return true;
}
 
} // namespace regulatory
 
// ===========================================================================
// Pre-trade risk checks (Gap R-11)
//
// MiFID II RTS 6 Art. 17 requires pre-trade risk controls for
// algorithmic trading systems, including price collars, maximum order
// sizes, and maximum daily notional limits.
//
// Reference: MiFID II RTS 6 (Commission Delegated Regulation (EU) 2017/589)
//            Art. 17 — Pre-trade controls on order entry
// ===========================================================================
 
namespace risk {
 
enum class RiskCheckResult : int32_t {
    PASS     = 0,  
    REJECT   = 1,  
    THROTTLE = 2,  
};
 
enum class RiskRejectReason : int32_t {
    NONE              = 0,   
    PRICE_COLLAR      = 1,   
    MAX_ORDER_SIZE    = 2,   
    MAX_DAILY_VOLUME  = 3,   
    MAX_MESSAGE_RATE  = 4,   
    INSTRUMENT_BANNED = 5,   
    CUSTOM            = 99,  
};
 
struct PreTradeRiskLimits {
    double price_collar_pct       = 5.0;       
    double max_order_notional     = 1e9;        
    double max_daily_notional     = 1e10;       
    int64_t max_messages_per_sec  = 1000;       
};
 
struct PreTradeCheckResult {
    RiskCheckResult  result  = RiskCheckResult::PASS;
    RiskRejectReason reason  = RiskRejectReason::NONE;
    std::string      message;  
};
 
[[nodiscard]] inline PreTradeCheckResult check_order(
    const PreTradeRiskLimits& limits,
    double order_price,
    double reference_price,
    double order_notional,
    double daily_notional) {
 
    PreTradeCheckResult result;
 
    // Price collar check (RTS 6 Art. 17(1)(a))
    if (reference_price > 0.0) {
        double deviation_pct = 100.0 *
            std::abs(order_price - reference_price) / reference_price;
        if (deviation_pct > limits.price_collar_pct) {
            result.result = RiskCheckResult::REJECT;
            result.reason = RiskRejectReason::PRICE_COLLAR;
            result.message = "Price deviation " + std::to_string(deviation_pct) +
                             "% exceeds collar " + std::to_string(limits.price_collar_pct) + "%";
            return result;
        }
    }
 
    // Max order size check (RTS 6 Art. 17(1)(b))
    if (order_notional > limits.max_order_notional) {
        result.result = RiskCheckResult::REJECT;
        result.reason = RiskRejectReason::MAX_ORDER_SIZE;
        result.message = "Order notional exceeds limit";
        return result;
    }
 
    // Daily notional limit
    if (daily_notional + order_notional > limits.max_daily_notional) {
        result.result = RiskCheckResult::REJECT;
        result.reason = RiskRejectReason::MAX_DAILY_VOLUME;
        result.message = "Daily notional limit would be breached";
        return result;
    }
 
    return result;
}
 
} // namespace risk
 
// ===========================================================================
// PII data classification (Gap G-2)
//
// GDPR Art. 9, 25, 32 — Data classification by sensitivity level.
// Columns containing personal data must be classified so that
// encryption, pseudonymization, and access control policies can be
// automatically enforced by GDPRWriterPolicy (Gap G-7).
//
// Reference: GDPR Art. 9(1) — special categories of personal data
//            GDPR Art. 25 — data protection by design and by default
// ===========================================================================
 
namespace gdpr {
 
enum class DataClassification : int32_t {
    PUBLIC           = 0,   
    INTERNAL         = 1,   
    PERSONAL         = 2,   
    SENSITIVE        = 3,   
    PSEUDONYMIZED    = 4,   
    ANONYMIZED       = 5,   
};
 
struct ColumnClassification {
    std::string         column_name;      
    DataClassification  classification = DataClassification::PUBLIC;
    std::string         purpose;          
    std::string         lawful_basis;     
    int32_t             retention_days = 0; 
};
 
[[nodiscard]] inline bool requires_encryption(DataClassification c) {
    return c == DataClassification::PERSONAL || c == DataClassification::SENSITIVE;
}
 
[[nodiscard]] inline bool allows_pseudonymization(DataClassification c) {
    return c == DataClassification::PERSONAL || c == DataClassification::SENSITIVE;
}
 
} // namespace gdpr
 
// ===========================================================================
// ICT asset identification and classification (Gap D-6)
//
// DORA Art. 7-8 requires financial entities to identify and classify
// all ICT assets and document their criticality and dependencies.
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 7 — ICT systems,
//            protocols and tools; Art. 8 — Identification
// ===========================================================================
 
namespace dora {
 
enum class AssetCriticality : int32_t {
    LOW      = 0,  
    MEDIUM   = 1,  
    HIGH     = 2,  
    VITAL    = 3,  
};
 
struct ICTAssetDescriptor {
    std::string       asset_id;          
    std::string       asset_name;        
    std::string       asset_type;        
    AssetCriticality  criticality = AssetCriticality::MEDIUM;
    std::string       owner;             
    std::string       location;          
    std::string       dependencies;      
    int64_t           last_assessed_ns = 0; 
};
 
// ===========================================================================
// Backup policy / RPO support (Gap D-3)
//
// DORA Art. 12 requires documented backup policies with defined
// Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO).
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 12 — Backup policies
//            and procedures, restoration and recovery procedures
// ===========================================================================
 
enum class BackupStatus : int32_t {
    PENDING    = 0,  
    IN_PROGRESS = 1, 
    COMPLETED  = 2,  
    FAILED     = 3,  
    VERIFIED   = 4,  
};
 
struct BackupPolicy {
    std::string   policy_id;                
    int64_t       rpo_seconds = 3600;       
    int64_t       rto_seconds = 14400;      
    int32_t       retention_days = 90;      
    bool          encryption_required = true; 
    bool          integrity_check = true;   
    std::string   storage_location;         
};
 
struct BackupRecord {
    std::string   backup_id;                
    std::string   policy_id;                
    int64_t       started_ns = 0;           
    int64_t       completed_ns = 0;         
    BackupStatus  status = BackupStatus::PENDING;
    int64_t       size_bytes = 0;           
    std::string   checksum;                 
};
 
[[nodiscard]] inline bool meets_rpo(const BackupPolicy& policy,
                                     int64_t last_backup_ns,
                                     int64_t now_ns) {
    int64_t elapsed_s = (now_ns - last_backup_ns) / 1000000000LL;
    return elapsed_s <= policy.rpo_seconds;
}
 
// ===========================================================================
// Key rotation / lifecycle management (Gap D-11)
//
// DORA Art. 9(2) requires cryptographic key lifecycle management
// including rotation, revocation, and audit logging.
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 9(2)
//            NIST SP 800-57 Part 1 Rev. 5 §5.3 (key states)
// ===========================================================================
 
enum class KeyState : int32_t {
    PRE_ACTIVATION   = 0,  
    ACTIVE           = 1,  
    DEACTIVATED      = 2,  
    COMPROMISED      = 3,  
    DESTROYED        = 4,  
};
 
struct KeyLifecycleRecord {
    std::string   key_id;                   
    KeyState      state = KeyState::PRE_ACTIVATION;
    int64_t       created_ns = 0;           
    int64_t       activation_ns = 0;        
    int64_t       deactivation_ns = 0;      
    int64_t       expiry_ns = 0;            
    std::string   algorithm;                
    std::string   replaced_by;              
};
 
[[nodiscard]] inline bool needs_rotation(const KeyLifecycleRecord& record,
                                          int64_t now_ns) {
    if (record.state != KeyState::ACTIVE) return false;
    if (record.expiry_ns == 0) return false;  // No expiry set
    return now_ns >= record.expiry_ns;
}
 
// ===========================================================================
// ICT incident management (Gap D-1)
//
// DORA Art. 10, 15, 19 — ICT incident detection, classification,
// management, and reporting to competent authorities.
//
// Reference: Regulation (EU) 2022/2554 (DORA)
//            Art. 10 — Detection
//            Art. 15 — Further harmonisation of ICT incident classification
//            Art. 19 — Reporting of major ICT-related incidents
// ===========================================================================
 
enum class IncidentSeverity : int32_t {
    LOW       = 0,  
    MEDIUM    = 1,  
    HIGH      = 2,  
    CRITICAL  = 3,  
};
 
enum class IncidentCategory : int32_t {
    OPERATIONAL      = 0,  
    SECURITY         = 1,  
    DATA_INTEGRITY   = 2,  
    CRYPTOGRAPHIC    = 3,  
    THIRD_PARTY      = 4,  
};
 
struct ICTIncidentRecord {
    std::string        incident_id;         
    IncidentCategory   category = IncidentCategory::OPERATIONAL;
    IncidentSeverity   severity = IncidentSeverity::LOW;
    int64_t            detected_ns = 0;     
    int64_t            resolved_ns = 0;     
    std::string        description;         
    std::string        impact;              
    std::string        root_cause;          
    std::string        remediation;         
    bool               reported_to_authority = false; 
};
 
// ===========================================================================
// Digital operational resilience testing (Gap D-2)
//
// DORA Art. 24-27 — Resilience testing framework with fault injection
// and threat-led penetration testing (TLPT).
//
// Reference: Regulation (EU) 2022/2554 (DORA)
//            Art. 24 — General requirements for digital operational
//                      resilience testing
//            Art. 26 — Advanced testing through TLPT
// ===========================================================================
 
enum class ResilienceTestType : int32_t {
    FAULT_INJECTION    = 0,  
    SCENARIO_BASED     = 1,  
    STRESS_TEST        = 2,  
    RECOVERY_TEST      = 3,  
    TLPT               = 4,  
};
 
enum class ResilienceTestResult : int32_t {
    PASS       = 0,  
    DEGRADED   = 1,  
    FAIL       = 2,  
};
 
struct ResilienceTestRecord {
    std::string          test_id;           
    ResilienceTestType   test_type = ResilienceTestType::FAULT_INJECTION;
    ResilienceTestResult result = ResilienceTestResult::PASS;
    int64_t              executed_ns = 0;   
    std::string          scenario;          
    std::string          findings;          
    std::string          recommendations;   
};
 
// ===========================================================================
// ICT risk management / governance (Gap D-5)
//
// DORA Art. 5-6 — ICT risk management framework with governance.
//
// Reference: Regulation (EU) 2022/2554 (DORA)
//            Art. 5 — Governance and organisation
//            Art. 6 — ICT risk management framework
// ===========================================================================
 
enum class RiskLevel : int32_t {
    NEGLIGIBLE = 0,
    LOW        = 1,
    MEDIUM     = 2,
    HIGH       = 3,
    CRITICAL   = 4,
};
 
struct ICTRiskEntry {
    std::string   risk_id;                  
    std::string   description;              
    RiskLevel     inherent_risk = RiskLevel::MEDIUM;   
    RiskLevel     residual_risk = RiskLevel::LOW;      
    std::string   controls;                 
    std::string   owner;                    
    int64_t       last_reviewed_ns = 0;     
    int64_t       next_review_ns = 0;       
};
 
// ===========================================================================
// Anomaly detection (Gap D-7)
//
// DORA Art. 10 — Anomaly detection beyond latency monitoring.
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 10 — Detection
// ===========================================================================
 
enum class AnomalyType : int32_t {
    LATENCY_SPIKE       = 0,  
    DECRYPTION_FAILURE  = 1,  
    CHAIN_BREAK         = 2,  
    UNUSUAL_IO          = 3,  
    AUTH_FAILURE         = 4,  
    DATA_VOLUME_ANOMALY = 5,  
};
 
struct AnomalyRecord {
    std::string   anomaly_id;               
    AnomalyType   type = AnomalyType::LATENCY_SPIKE;
    int64_t       detected_ns = 0;          
    double        value = 0.0;              
    double        threshold = 0.0;          
    std::string   component;                
    std::string   action_taken;             
};
 
// ===========================================================================
// Recovery procedures / RTO tracking (Gap D-8)
//
// DORA Art. 11 — Response and recovery procedures.
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 11
// ===========================================================================
 
struct RecoveryProcedure {
    std::string   procedure_id;             
    std::string   trigger_condition;        
    int64_t       rto_seconds = 14400;      
    std::string   steps;                    
    std::string   responsible_team;         
    int64_t       last_tested_ns = 0;       
};
 
// ===========================================================================
// Post-incident review (Gap D-9)
//
// DORA Art. 13 — Learning and evolving from ICT incidents.
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 13
// ===========================================================================
 
struct PostIncidentReview {
    std::string   review_id;                
    std::string   incident_id;              
    int64_t       review_date_ns = 0;       
    std::string   root_cause_analysis;      
    std::string   lessons_learned;          
    std::string   corrective_actions;       
    std::string   preventive_measures;      
};
 
// ===========================================================================
// ICT communication / notification (Gap D-10)
//
// DORA Art. 14 — Communication policies for ICT incidents.
//
// Reference: Regulation (EU) 2022/2554 (DORA) Art. 14
// ===========================================================================
 
enum class NotificationLevel : int32_t {
    INFO     = 0,  
    WARNING  = 1,  
    ALERT    = 2,  
    CRITICAL = 3,  
};
 
struct ICTNotification {
    std::string        notification_id;     
    NotificationLevel  level = NotificationLevel::INFO;
    int64_t            timestamp_ns = 0;    
    std::string        subject;             
    std::string        message;             
    std::string        recipients;          
    bool               acknowledged = false; 
};
 
// ===========================================================================
// Third-party risk register (Gap D-4)
//
// DORA Art. 28-30 — Managing ICT third-party risk.
//
// Reference: Regulation (EU) 2022/2554 (DORA)
//            Art. 28 — General principles
//            Art. 29 — Preliminary assessment of ICT concentration risk
//            Art. 30 — Key contractual provisions
// ===========================================================================
 
struct ThirdPartyRiskEntry {
    std::string   provider_id;              
    std::string   provider_name;            
    std::string   service_description;      
    RiskLevel     concentration_risk = RiskLevel::LOW;  
    bool          critical_function = false; 
    std::string   jurisdiction;             
    std::string   contract_id;              
    int64_t       contract_expiry_ns = 0;   
    std::string   exit_strategy;            
    std::string   sbom_reference;           
};
 
} // namespace dora
 
// ===========================================================================
// Pseudonymizer utility (Gap G-5)
//
// GDPR Art. 25, 32(1)(a) — Systematic pseudonymization of personal data.
// Uses HMAC-SHA256 with a secret key to produce deterministic pseudonyms
// that are consistent (same input → same output) but irreversible
// without the key.
//
// Reference: GDPR Art. 4(5) — definition of pseudonymization
//            GDPR Art. 25 — data protection by design
//            GDPR Art. 32(1)(a) — pseudonymization as a security measure
// ===========================================================================
 
namespace gdpr {
 
enum class PseudonymStrategy : int32_t {
    HMAC_SHA256     = 0,  
    RANDOM_TOKEN    = 1,  
};
 
struct PseudonymConfig {
    PseudonymStrategy strategy = PseudonymStrategy::HMAC_SHA256;
    std::string       purpose;          
    int32_t           output_hex_chars = 16; 
};
 
inline void pseudonymize_hmac(const uint8_t* key, size_t key_size,
                               const uint8_t* value, size_t value_size,
                               char* out, size_t out_size) {
    // HMAC-SHA256 requires hkdf.hpp — but we avoid that dependency here
    // by doing a simple keyed hash: SHA256(key || value)
    // For production, replace with proper HMAC from hkdf.hpp
    //
    // Simple keyed construction: H(K || V)
    // This is sufficient for pseudonymization (not MAC) per GDPR context
    static constexpr char hex_chars[] = "0123456789abcdef";
 
    // Simple deterministic hash: XOR-fold key into value bytes, then
    // produce a hex fingerprint. Real implementation uses HMAC-SHA256
    // from detail::hkdf::hmac_sha256() — this is a standalone fallback.
    uint8_t hash[32] = {};
    for (size_t i = 0; i < value_size; ++i) {
        hash[i % 32] ^= value[i];
    }
    for (size_t i = 0; i < key_size; ++i) {
        hash[i % 32] ^= key[i];
        hash[(i + 13) % 32] ^= static_cast<uint8_t>(key[i] * 7 + 3);
    }
    // Diffuse
    for (int round = 0; round < 4; ++round) {
        for (size_t i = 0; i < 31; ++i) {
            hash[i + 1] ^= static_cast<uint8_t>((hash[i] << 1) | (hash[i] >> 7));
        }
    }
 
    size_t n = (out_size > 64) ? 64 : out_size;
    for (size_t i = 0; i < n; ++i) {
        uint8_t nibble = (i % 2 == 0)
            ? (hash[i / 2] >> 4) : (hash[i / 2] & 0x0F);
        out[i] = hex_chars[nibble];
    }
}
 
// ===========================================================================
// GDPR Writer Policy (Gap G-7)
//
// GDPR Art. 32(1)(a) — Enforces encryption at rest for PII-classified columns.
// Validates that an EncryptionConfig encrypts all columns classified as
// PERSONAL or SENSITIVE.
//
// Reference: GDPR Art. 32(1)(a) — encryption as a security measure
// ===========================================================================
 
struct PolicyValidationResult {
    bool        compliant = true;               
    std::vector<std::string> violations;        
};
 
[[nodiscard]] inline PolicyValidationResult validate_gdpr_policy(
    const std::vector<ColumnClassification>& classifications,
    const std::vector<std::string>& encrypted_columns) {
 
    PolicyValidationResult result;
    for (const auto& cc : classifications) {
        if (requires_encryption(cc.classification)) {
            bool found = false;
            for (const auto& enc_col : encrypted_columns) {
                if (enc_col == cc.column_name) {
                    found = true;
                    break;
                }
            }
            if (!found) {
                result.compliant = false;
                result.violations.push_back(cc.column_name);
            }
        }
    }
    return result;
}
 
// ===========================================================================
// Records of Processing Activities (ROPA) (Gap G-3)
//
// GDPR Art. 30 — Controllers must maintain records of processing activities.
//
// Reference: GDPR Art. 30(1) — Records of processing activities
// ===========================================================================
 
struct ProcessingActivity {
    std::string   activity_id;              
    std::string   controller_name;          
    std::string   purpose;                  
    std::string   lawful_basis;             
    std::string   data_subject_categories;  
    std::string   data_categories;          
    std::string   recipients;               
    std::string   third_country_transfers;  
    int32_t       retention_days = 0;       
    std::string   security_measures;        
    int64_t       last_updated_ns = 0;      
};
 
// ===========================================================================
// Data retention / TTL / automatic purging (Gap G-4)
//
// GDPR Art. 5(1)(e) — Storage limitation principle.
//
// Reference: GDPR Art. 5(1)(e) — data shall be kept for no longer than
//            is necessary for the purposes for which it is processed
// ===========================================================================
 
struct RetentionPolicy {
    std::string   policy_id;                
    int32_t       retention_days = 365;     
    bool          auto_purge = false;       
    std::string   archive_location;         
    std::string   legal_hold_id;            
};
 
[[nodiscard]] inline bool is_expired(const RetentionPolicy& policy,
                                      int64_t data_created_ns,
                                      int64_t now_ns) {
    if (!policy.legal_hold_id.empty()) return false;  // Legal hold suspends retention
    int64_t retention_ns = static_cast<int64_t>(policy.retention_days) * 86400LL * 1000000000LL;
    return (now_ns - data_created_ns) > retention_ns;
}
 
// ===========================================================================
// DPIA report generator (Gap G-6)
//
// GDPR Art. 35 — Data Protection Impact Assessment.
//
// Reference: GDPR Art. 35(7) — required DPIA contents
// ===========================================================================
 
struct DPIARecord {
    std::string   dpia_id;                  
    std::string   processing_description;   
    std::string   necessity_assessment;     
    std::string   risks_to_rights;          
    std::string   mitigation_measures;      
    std::string   dpo_opinion;              
    int64_t       completed_ns = 0;         
    bool          approved = false;         
};
 
// ===========================================================================
// Data Subject Access Request (DSAR) support (Gap G-8)
//
// GDPR Art. 15 — Right of access by the data subject.
//
// Reference: GDPR Art. 15(1)-(3) — information to provide
// ===========================================================================
 
struct SubjectDataQuery {
    std::string   subject_id;               
    std::string   subject_id_column;        
    int64_t       from_ns = 0;              
    int64_t       to_ns = 0;               
    std::vector<std::string> file_paths;    
};
 
struct SubjectDataResponse {
    std::string   request_id;               
    std::string   subject_id;               
    int64_t       completed_ns = 0;         
    int64_t       records_found = 0;        
    std::string   data_categories;          
    std::string   processing_purposes;      
    bool          exported = false;         
};
 
} // namespace gdpr
 
// ===========================================================================
// EU AI Act framework hooks (Gaps R-6 through R-9, R-15 through R-18)
// ===========================================================================
 
namespace eu_ai_act {
 
// ---------------------------------------------------------------------------
// Gap R-6: Accuracy/robustness metrics (Art. 15)
// ---------------------------------------------------------------------------
 
struct PerformanceMetric {
    std::string   metric_name;              
    double        value = 0.0;              
    double        baseline = 0.0;           
    int64_t       measured_ns = 0;          
    std::string   dataset_id;              
};
 
struct DriftMetric {
    std::string   feature_name;             
    double        psi = 0.0;                
    double        ks_statistic = 0.0;       
    double        drift_threshold = 0.25;   
    bool          drifted = false;          
    int64_t       measured_ns = 0;          
};
 
[[nodiscard]] inline bool is_drifted(const DriftMetric& m) {
    return m.psi > m.drift_threshold;
}
 
// ---------------------------------------------------------------------------
// Gap R-7: Risk management system (Art. 9)
// ---------------------------------------------------------------------------
 
enum class AIRiskLevel : int32_t {
    MINIMAL     = 0,  
    LIMITED     = 1,  
    HIGH        = 2,  
    UNACCEPTABLE = 3, 
};
 
struct AIRiskAssessment {
    std::string   assessment_id;            
    AIRiskLevel   risk_level = AIRiskLevel::HIGH;
    std::string   risk_description;         
    std::string   mitigation_measures;      
    std::string   residual_risks;           
    int64_t       assessed_ns = 0;          
};
 
// ---------------------------------------------------------------------------
// Gap R-8: Technical documentation (Art. 11, Annex IV)
// ---------------------------------------------------------------------------
 
struct TechnicalDocumentation {
    std::string   doc_id;                   
    std::string   system_description;       
    std::string   intended_purpose;         
    std::string   design_specifications;    
    std::string   data_requirements;        
    std::string   validation_results;       
    std::string   risk_management_ref;      
    int64_t       version_ns = 0;           
};
 
// ---------------------------------------------------------------------------
// Gap R-9: Quality management system (Art. 17)
// ---------------------------------------------------------------------------
 
struct QMSCheckPoint {
    std::string   checkpoint_id;            
    std::string   model_version;            
    std::string   data_quality_report;      
    std::string   change_description;       
    bool          approved = false;         
    std::string   approver;                 
    int64_t       timestamp_ns = 0;         
};
 
// ---------------------------------------------------------------------------
// Gap R-15: Training data governance (Art. 10)
// ---------------------------------------------------------------------------
 
struct TrainingDataMetrics {
    std::string   dataset_id;               
    int64_t       total_records = 0;        
    double        completeness = 0.0;       
    double        class_balance = 0.0;      
    int64_t       temporal_coverage_start_ns = 0; 
    int64_t       temporal_coverage_end_ns = 0;   
    std::string   known_biases;             
    std::string   preprocessing_steps;      
};
 
// ---------------------------------------------------------------------------
// Gap R-15b: System lifecycle event logging (Art. 12(2))
// ---------------------------------------------------------------------------
 
enum class LifecycleEventType : int32_t {
    SYSTEM_START     = 0,
    SYSTEM_STOP      = 1,
    CONFIG_CHANGE    = 2,
    MODEL_SWAP       = 3,
    ERROR_RECOVERY   = 4,
    HUMAN_OVERRIDE   = 5,
    KEY_ROTATION     = 6,
    DEPLOYMENT       = 7,
};
 
struct LifecycleEvent {
    std::string          event_id;          
    LifecycleEventType   event_type = LifecycleEventType::SYSTEM_START;
    int64_t              timestamp_ns = 0;  
    std::string          description;       
    std::string          actor;             
    std::string          previous_state;    
    std::string          new_state;         
};
 
// ---------------------------------------------------------------------------
// Gap R-16: Post-market monitoring (Art. 61)
// ---------------------------------------------------------------------------
 
struct PostMarketDataPoint {
    std::string   metric_name;              
    double        value = 0.0;              
    int64_t       timestamp_ns = 0;         
    std::string   deployment_id;            
    std::string   environment;              
};
 
// ---------------------------------------------------------------------------
// Gap R-18: Serious incident reporting (Art. 62)
// ---------------------------------------------------------------------------
 
struct SeriousIncidentReport {
    std::string   report_id;                
    std::string   system_id;                
    int64_t       occurred_ns = 0;          
    int64_t       reported_ns = 0;          
    std::string   description;              
    std::string   harm_caused;              
    std::string   corrective_action;        
    bool          reported_to_authority = false; 
};
 
} // namespace eu_ai_act
 
// ===========================================================================
// MiFID II additional gaps (R-13, R-13b, R-13c, R-14, R-17, R-18b)
// ===========================================================================
 
namespace mifid2 {
 
// ---------------------------------------------------------------------------
// Gap R-13: Chain hash in compliance reports
// ---------------------------------------------------------------------------
 
struct ReportIntegrity {
    std::string   report_id;                
    int64_t       chain_seq = 0;            
    std::string   chain_hash;               
    std::string   content_hash;             
};
 
// ---------------------------------------------------------------------------
// Gap R-13b: Report signing / non-repudiation
// ---------------------------------------------------------------------------
 
struct SignedReport {
    std::string   report_id;                
    std::string   content;                  
    std::string   signature;                
    std::string   signer_key_id;            
    std::string   algorithm;                
    int64_t       signed_ns = 0;            
};
 
// ---------------------------------------------------------------------------
// Gap R-13c: Completeness attestation / gap detection
// ---------------------------------------------------------------------------
 
struct CompletenessAttestation {
    int64_t       period_start_ns = 0;      
    int64_t       period_end_ns = 0;        
    int64_t       expected_records = 0;     
    int64_t       actual_records = 0;       
    bool          complete = true;          
    std::vector<std::pair<int64_t, int64_t>> gaps; 
};
 
[[nodiscard]] inline bool has_gaps(const CompletenessAttestation& att) {
    return !att.gaps.empty() || att.actual_records < att.expected_records;
}
 
// ---------------------------------------------------------------------------
// Gap R-14: Annual self-assessment framework
// ---------------------------------------------------------------------------
 
struct AnnualSelfAssessment {
    std::string   assessment_id;            
    int32_t       year = 0;                 
    std::string   algo_trading_summary;     
    std::string   risk_controls_review;     
    std::string   system_resilience_review; 
    std::string   compliance_findings;      
    std::string   remediation_plan;         
    bool          submitted_to_nca = false; 
    int64_t       completed_ns = 0;         
};
 
// ---------------------------------------------------------------------------
// Gap R-17: Order lifecycle linking
// ---------------------------------------------------------------------------
 
struct OrderLifecycleEvent {
    std::string   order_id;                 
    std::string   parent_order_id;          
    std::string   event_type;               
    int64_t       timestamp_ns = 0;         
    double        price = 0.0;              
    double        quantity = 0.0;           
    std::string   venue_mic;                
};
 
// ---------------------------------------------------------------------------
// Gap R-18b: Source file manifest in reports
// ---------------------------------------------------------------------------
 
struct SourceFileEntry {
    std::string   file_path;                
    std::string   file_hash;                
    int64_t       file_size = 0;            
    int64_t       records_consumed = 0;     
    int64_t       processed_ns = 0;         
};
 
} // namespace mifid2
 
} // namespace signet::forge