Build EU AI Act Article 12 reference implementation

[dkitchell]

Summary

Public reference implementation showing a high-risk AI system logging EU AI Act Article 12 evidence into a hash-chained Decision Ledger and certifying its training dataset via @certifieddata/verify.

The whole demo is a credit-decisioning service that:

1. Refuses to boot unless its training-data cert.v1 document verifies (createApp calls verifyCertificate and throws if verdict !== "VALID").
2. Appends an Article 12 event to the ledger on every /decide call, with decision_id, training_cert_id, model_version, input_hash, output, and timestamp.
3. Exports a hash-chained evidence bundle on /evidence/:id and re-verifies the chain locally before returning it.

What's in the repo

File	Purpose
src/app.ts	The headline 50-line example. 51 total / 33 meaningful lines.
src/ledger.ts	MemoryLedger + HttpLedger behind a common Ledger interface; public verifyChain() helper.
src/article12.ts	Maps Article 12(2)(a–d) onto concrete event fields.
src/server.ts	npm start entry point — boots the app and serves on :3000.
src/smoke.test.ts	3 tests: boot-or-refuse, chain integrity, multi-decision sequencing.
src/examples/01-log-decision.ts	Log a single Article 12 event.
src/examples/02-verify-training-data.ts	Run the same verification the app does at startup.
src/examples/03-export-evidence.ts	Replay decisions, export an evidence bundle, re-verify the chain.
ARTICLE_12_MAPPING.md	Field-by-field map of Article 12 → ledger event with explicit "what this is not" non-claims.
docker-compose.yml + Dockerfile	One-command local stack with Postgres scaffold for a future real ledger.
fixtures/generate.mjs	Regenerates a real Ed25519 keypair, signs a cert.v1, writes matching keys + decisions sample.

Quality gate

• npm run typecheck — clean
• npm test — 3/3 smoke tests passing
• All three examples run end-to-end against the committed fixtures
• src/app.ts is 33 meaningful lines (well under the 50-line ceiling)

Test plan

• Reviewer reads src/app.ts and ARTICLE_12_MAPPING.md together — the field-by-field map should exactly match the event shape emitted by article12Event.
• Reviewer runs npm run example:02 and confirms the verifier catches a tampered training cert (mutate rows in fixtures/training-cert.json and re-run).
• Drew creates the GitHub repo certifieddata/reference-impl and pushes there; pin to top of org page.

Pre-publish caveats (deferred follow-ups)

• package.json declares @certifieddata/verify as file:../verify. After verify@0.1.0 lands on npm, switch to a published version range (e.g. ^0.1.0) and switch CI from npm install to npm ci.
• CI checks out certifieddata/verify as a sibling repo to satisfy the file: dep. Drop that step after publish.
• Dockerfile already pins to the published @certifieddata/verify (no file:.. reference); it will start working once v0.1.0 is on npm. Until then, use npm install && npm start directly.
• npm + CI badges to be added to the README after the first successful publish/CI run.

---

Generated by Claude Code