How we hold ComplyEdge to its own standard

Install TrustLint from PyPI and score a prohibited-practice prompt:

pip install trustlint
trustlint check --verbose --text "implement a social credit score for all citizens"

A real engine returns a rule ID and a statute cite, not a vague score. --verbose prints citation + remediation; without it you still see the rule ID and severity summary.

From a checkout of the public repo:

python scripts/benchmark/benchmark_runner.py \
  --providers providers/ \
  --schema scripts/benchmark/provider_schema.yaml \
  --output /tmp/out.json

The public sample export verifies with the same hash-chain helper we ship, and fails if you flip one field:

python3 - <<'PY'
import sys, json
sys.path.insert(0, "services/api")
import audit_export

e = json.load(open("examples/audit/sample-audit-export.json"))
print("verify:", audit_export.verify_audit_export_chain(e))   # True

e["events"][42]["allowed"] ^= True
print("tampered:", audit_export.verify_audit_export_chain(e)) # False
PY

Three public surfaces: pick any:

• uses: complyedge/trustlint-action@v1: published Action with compliant / violating fixtures in-repo.
• leocelis/ivd: CI job TrustLint (EU AI Act) runs pip install 'trustlint>=2.0.1' then scripts/compliance/check.sh on every workflow run (IVD sets continue-on-error so a remote corpus fetch failure does not block merges).
• leocelis/horizon: same TrustLint CI job name and check.sh scan on LLM-facing artifacts (no continue-on-error on that job).

ComplyEdge is built with heavy AI assistance, and we measure it in git. In the engineering monorepo, over 40% of commits carry a Co-Authored-By: Claude trailer (324 of 686 commits as of this verification, ~47%).

That AI-touched code still goes through:

• intent artifacts (IVD) before implementation
• human / code-owner review on the paths that require it
• 2,700+ automated tests in the engineering suite (pytest --collect-only)
• deterministic rules with their own tests