How we hold ComplyEdge to its own standard

Install TrustLint from PyPI and score a prohibited-practice prompt:

pip install trustlint
trustlint check --verbose --text "implement a social credit score for all citizens"

A real engine returns a rule ID and a statute cite, not a vague score. --verbose prints citation + remediation; without it you still see the rule ID and severity summary.

From a checkout of the public repo:

python scripts/benchmark/benchmark_runner.py \
  --providers providers/ \
  --schema scripts/benchmark/provider_schema.yaml \
  --output /tmp/out.json

The public sample export verifies with the same hash-chain helper we ship — and fails if you flip one field:

python3 - <<'PY'
import sys, json
sys.path.insert(0, "services/api")
import audit_export

e = json.load(open("docs/dd/sample-audit-export.json"))
print("verify:", audit_export.verify_audit_export_chain(e))   # True

e["events"][42]["allowed"] ^= True
print("tampered:", audit_export.verify_audit_export_chain(e)) # False
PY

Three public surfaces — pick any:

• uses: complyedge/trustlint-action@v1 — published Action with compliant / violating fixtures in-repo.
• leocelis/ivd — required CI job TrustLint (EU AI Act) runs pip install 'trustlint>=2.0.1' then scripts/compliance/check.sh (build fails on violation).
• leocelis/horizon — same TrustLint gate pattern on LLM-facing artifacts.

ComplyEdge is built with heavy AI assistance — and we measure it in git. In the engineering monorepo, over 40% of commits carry a Co-Authored-By: Claude trailer (224 of 534 commits as of this verification).

That AI-touched code still goes through:

• intent artifacts (IVD) before implementation
• required human / code-owner review
• 1,500+ automated tests in the engineering suite
• deterministic rules with their own tests