Source code for governance.compliance

"""
Script
------
compliance.py

Path
----
python/hillstar/governance/compliance.py

Purpose
-------
Compliance enforcement module for Hillstar.

Enforce Hillstar's compliance architecture and prevent prohibited modifications.
This module verifies that only API-based orchestration is used, preventing
CLI/SDK access that would violate provider terms of service.

Providers Covered
-----------------
- Anthropic (Claude)
- Mistral AI (Le Chat)
- OpenAI (GPT, Codex)
- Google (Vertex AI, Gemini)
- Amazon (Bedrock)
- Microsoft (Azure AI)
- Meta (Llama)
- Cohere
- Ollama

Compliance Rules
----------------
1. API-only authentication for cloud providers
2. No CLI/SDK access methods
3. No mixing of access patterns
4. Proper provider attribution
5. User responsibility documentation

Author: Julen Gamboa <julen.gamboa.ds@gmail.com>

Created
-------
2026-02-14

Last Edited
-----------
2026-02-17
"""

import inspect
from typing import List, Any


[docs] class ComplianceError(Exception): """Raised when compliance violations are detected.""" pass
[docs] class ComplianceEnforcer: """Enforce Hillstar's compliance architecture.""" # Providers that require API-only access for orchestration PROTECTED_PROVIDERS = { "anthropic": { "name": "Anthropic", "prohibited_methods": ["use_cli", "claude_pro", "sdk_auth", "manual_access"], "prohibited_attributes": ["cli_mode", "pro_subscription", "sdk_client"], "tos_violation": "Violates Anthropic's automation restrictions" }, "mistral": { "name": "Mistral AI", "prohibited_methods": ["use_le_chat", "pro_access", "chat_cli", "manual_mode"], "prohibited_attributes": ["le_chat_client", "pro_credentials", "cli_session"], "tos_violation": "Violates Mistral's Le Chat Pro terms" }, "openai": { "name": "OpenAI", "prohibited_methods": ["use_codex_pro", "chatgpt_plus", "sdk_login", "cli_access"], "prohibited_attributes": ["pro_session", "codex_cli", "plus_subscription"], "tos_violation": "Violates OpenAI's automation policies" }, "google": { "name": "Google", "prohibited_methods": ["vertex_cli", "gemini_pro", "sdk_console", "manual_access"], "prohibited_attributes": ["console_client", "pro_credentials", "cli_mode"], "tos_violation": "Violates Google Cloud's API requirements" }, "amazon": { "name": "Amazon Bedrock", "prohibited_methods": ["bedrock_cli", "console_access", "sdk_manual", "pro_mode"], "prohibited_attributes": ["console_session", "cli_credentials", "manual_client"], "tos_violation": "Violates AWS's IAM requirements" }, "microsoft": { "name": "Microsoft Azure AI", "prohibited_methods": ["azure_cli", "portal_access", "sdk_manual", "pro_console"], "prohibited_attributes": ["portal_session", "cli_credentials", "manual_mode"], "tos_violation": "Violates Azure's enterprise requirements" }, "meta": { "name": "Meta Llama", "prohibited_methods": ["local_cli", "manual_llama", "sdk_direct", "pro_access"], "prohibited_attributes": ["cli_session", "direct_access", "pro_credentials"], "tos_violation": "Violates Llama's usage policies" }, "cohere": { "name": "Cohere", "prohibited_methods": ["cohere_cli", "manual_access", "sdk_pro", "console_mode"], "prohibited_attributes": ["console_client", "cli_credentials", "pro_session"], "tos_violation": "Violates Cohere's API terms" }, "ollama": { "name": "Ollama", "prohibited_methods": ["ollama_cli_mix", "pro_access", "sdk_manual"], "prohibited_attributes": ["cli_mixed", "pro_credentials"], "tos_violation": "Violates Ollama's local model terms" } }
[docs] def __init__(self): self.violations = []
[docs] def check_provider_class(self, provider_name: str, provider_class: Any) -> bool: """Check a provider class for compliance violations.""" if provider_name not in self.PROTECTED_PROVIDERS: return True provider_rules = self.PROTECTED_PROVIDERS[provider_name] # Check for prohibited methods for method_name in provider_rules["prohibited_methods"]: if hasattr(provider_class, method_name): self.violations.append( f" {provider_rules['name']}: Found prohibited method '{method_name}' - " f"{provider_rules['tos_violation']}" ) # Check for prohibited attributes for attr_name in provider_rules["prohibited_attributes"]: if hasattr(provider_class, attr_name): self.violations.append( f" {provider_rules['name']}: Found prohibited attribute '{attr_name}' - " f"{provider_rules['tos_violation']}" ) return len(self.violations) == 0
[docs] def check_all_providers(self) -> bool: """Check all provider implementations for compliance.""" from ..models import ( AnthropicModel, OpenAIMCPModel, DevstralLocalModel, AnthropicOllamaAPIModel, ) providers_to_check = [ ("anthropic", AnthropicModel), ("anthropic_ollama", AnthropicOllamaAPIModel), ("openai_mcp", OpenAIMCPModel), ("devstral", DevstralLocalModel), ] all_compliant = True for provider_name, provider_class in providers_to_check: if not self.check_provider_class(provider_name, provider_class): all_compliant = False return all_compliant
[docs] def check_model_selector(self) -> bool: """Check ModelSelector for compliance violations.""" from ..config.model_selector import ModelSelector # Check that use_api_key parameter doesn't exist select_sig = inspect.signature(ModelSelector.select) if 'use_api_key' in select_sig.parameters: self.violations.append( " ModelSelector: Found prohibited 'use_api_key' parameter - " "enables non-compliant authentication mixing" ) return False # Check select_new (if it has use_api_key parameter) if hasattr(ModelSelector, 'select_new'): select_new_sig = inspect.signature(ModelSelector.select_new) if 'use_api_key' in select_new_sig.parameters: self.violations.append( " ModelSelector: Found prohibited 'use_api_key' parameter in select_new - " "enables non-compliant authentication mixing" ) return False return True
[docs] def verify_compliance(self) -> bool: """Run all compliance checks.""" self.violations = [] # Check all provider implementations providers_ok = self.check_all_providers() # Check model selector selector_ok = self.check_model_selector() return providers_ok and selector_ok
[docs] def get_violations(self) -> List[str]: """Get list of compliance violations.""" return self.violations
[docs] def print_compliance_report(self) -> None: """Print compliance verification report.""" if not self.violations: print(" COMPLIANCE VERIFICATION PASSED") print(" All provider implementations comply with terms of service") print(" Only API-based orchestration is enabled") print(" No prohibited CLI/SDK access methods detected") else: print(" COMPLIANCE VERIFICATION FAILED") print(" Prohibited modifications detected:") for violation in self.violations: print(f" • {violation}") print("\n IMPORTANT: Remove all prohibited modifications") print(" Hillstar must use API-only authentication for compliance")
[docs] def verify_hillstar_compliance() -> None: """Verify Hillstar compliance at import time.""" enforcer = ComplianceEnforcer() if not enforcer.verify_compliance(): enforcer.print_compliance_report() raise ComplianceError( "Hillstar compliance verification failed. " "Prohibited modifications detected. " "See compliance report above for details." )