《互联网产品的 AI 架构·平台化与治理》8.3 供应商合规与模型变更通知

// file: src/gov/provider-compliance.ts
// tier: L2
// verify: node --test test/gov/compliance.test.ts

import { DATA_CLASS_RANK } from "./compliance.ts";
import type { DataClass, TrainingUse } from "./compliance.ts";
import { DAY_MS } from "./retention.ts";

export type ProviderChangeKind = "model-version" | "pricing" | "deprecation" | "region" | "training-policy" | "security";
export type Certification = "soc2-type2" | "iso27001" | "iso42001" | "pci-dss";

export interface ProviderRecord {
  id: string;
  dpaSigned: boolean;
  regions: readonly string[];
  retentionDays: number;
  trainingUse: TrainingUse;
  changeNoticeDays: number;
  breachNoticeHours: number;
  certifications: readonly Certification[];
  subprocessors: readonly string[];
  subprocessorsReviewed: boolean;
}

export interface ProviderRequirement {
  maxRetentionDays: number;
  allowedRegions: readonly string[];
  requireNoTrain: boolean;
  minChangeNoticeDays: number;
  minBreachNoticeHours: number;
  requiredCertifications: readonly Certification[];
  requireDpa: boolean;
}

/** 示例要求，按数据级别收紧；生产值由采购与合规共同确认。 */
export const PROVIDER_REQUIREMENTS: Record<DataClass, ProviderRequirement> = {
  public: { maxRetentionDays: 365, allowedRegions: ["*"], requireNoTrain: false, minChangeNoticeDays: 15, minBreachNoticeHours: 72, requiredCertifications: [], requireDpa: true },
  internal: { maxRetentionDays: 180, allowedRegions: ["*"], requireNoTrain: false, minChangeNoticeDays: 30, minBreachNoticeHours: 48, requiredCertifications: ["soc2-type2"], requireDpa: true },
  sensitive: { maxRetentionDays: 30, allowedRegions: ["cn", "sg"], requireNoTrain: true, minChangeNoticeDays: 30, minBreachNoticeHours: 24, requiredCertifications: ["soc2-type2", "iso27001"], requireDpa: true },
  restricted: { maxRetentionDays: 7, allowedRegions: ["cn"], requireNoTrain: true, minChangeNoticeDays: 60, minBreachNoticeHours: 12, requiredCertifications: ["soc2-type2", "iso27001", "iso42001"], requireDpa: true },
};

export type ProviderIssueCode =
  | "dpa-missing" | "region-missing" | "retention-too-long" | "training-not-allowed"
  | "change-notice-too-short" | "breach-notice-too-slow" | "certification-missing" | "subprocessor-unreviewed";

export interface ProviderIssue { providerId: string; code: ProviderIssueCode; detail: string }

export interface ProviderAssessment {
  providerId: string;
  dataClass: DataClass;
  ok: boolean;
  issues: ProviderIssue[];
  missingCertifications: Certification[];
}

export function assessProvider(provider: ProviderRecord, dataClass: DataClass): ProviderAssessment {
  const requirement = PROVIDER_REQUIREMENTS[dataClass];
  const issues: ProviderIssue[] = [];
  const push = (code: ProviderIssueCode, detail: string): void => { issues.push({ providerId: provider.id, code, detail }); };
  if (requirement.requireDpa && !provider.dpaSigned) push("dpa-missing", "data processing agreement is not signed");
  const regionsCovered = requirement.allowedRegions.includes("*")
    ? provider.regions.length > 0
    : requirement.allowedRegions.every((region) => provider.regions.includes(region));
  if (!regionsCovered) push("region-missing", `provider regions ${provider.regions.join(",")} do not cover ${requirement.allowedRegions.join(",")}`);
  if (provider.retentionDays > requirement.maxRetentionDays) push("retention-too-long", `${provider.retentionDays}d exceeds ${requirement.maxRetentionDays}d`);
  if (requirement.requireNoTrain && provider.trainingUse !== "no-train") push("training-not-allowed", `${provider.trainingUse} is not allowed for ${dataClass}`);
  if (provider.changeNoticeDays < requirement.minChangeNoticeDays) push("change-notice-too-short", `${provider.changeNoticeDays}d is below ${requirement.minChangeNoticeDays}d`);
  if (provider.breachNoticeHours > requirement.minBreachNoticeHours) push("breach-notice-too-slow", `${provider.breachNoticeHours}h exceeds ${requirement.minBreachNoticeHours}h`);
  const missingCertifications = requirement.requiredCertifications.filter((certification) => !provider.certifications.includes(certification));
  for (const certification of missingCertifications) push("certification-missing", `${certification} is required for ${dataClass}`);
  if (provider.subprocessors.length > 0 && !provider.subprocessorsReviewed) push("subprocessor-unreviewed", `${provider.subprocessors.length} subprocessors are unreviewed`);
  return { providerId: provider.id, dataClass, ok: issues.length === 0, issues, missingCertifications };
}

export interface ChangeRule { minNoticeDays: number; requiresReview: boolean; bufferDays: number }

export const CHANGE_RULES: Record<ProviderChangeKind, ChangeRule> = {
  "model-version": { minNoticeDays: 30, requiresReview: true, bufferDays: 14 },
  pricing: { minNoticeDays: 30, requiresReview: false, bufferDays: 7 },
  deprecation: { minNoticeDays: 90, requiresReview: true, bufferDays: 30 },
  region: { minNoticeDays: 60, requiresReview: true, bufferDays: 14 },
  "training-policy": { minNoticeDays: 60, requiresReview: true, bufferDays: 30 },
  security: { minNoticeDays: 7, requiresReview: true, bufferDays: 0 },
};

export interface ProviderChange {
  providerId: string;
  kind: ProviderChangeKind;
  breaking: boolean;
  announcedAt: number;
  effectiveAt: number;
  affects: readonly string[];
  migrationPlanReady: boolean;
}

export type ChangeVerdict = "accept" | "conditional" | "reject";

export interface ChangeAssessment {
  providerId: string;
  kind: ProviderChangeKind;
  verdict: ChangeVerdict;
  noticeDays: number;
  requiredDays: number;
  remainingDays: number;
  issues: string[];
  actions: string[];
}

/**
 * 通知时限按 announcedAt 到 effectiveAt 计算；安全变更允许短通知，
 * 但必须转为事后评审，不能静默生效。
 */
export function assessChange(change: ProviderChange, now: number): ChangeAssessment {
  const rule = CHANGE_RULES[change.kind];
  const noticeDays = Math.floor((change.effectiveAt - change.announcedAt) / DAY_MS);
  const remainingDays = Math.floor((change.effectiveAt - now) / DAY_MS);
  const base = { providerId: change.providerId, kind: change.kind, noticeDays, requiredDays: rule.minNoticeDays, remainingDays };
  const issues: string[] = [];
  const actions: string[] = [];
  if (change.effectiveAt <= now && change.kind !== "security") {
    issues.push("already-effective");
    actions.push("回滚到已评估版本，或切换到备用供应商");
    return { ...base, verdict: "reject", issues, actions };
  }
  if (noticeDays < rule.minNoticeDays) {
    if (change.kind !== "security") {
      issues.push("late-notice");
      actions.push(`通知期 ${noticeDays}d 少于要求的 ${rule.minNoticeDays}d，拒绝本次变更`);
      return { ...base, verdict: "reject", issues, actions };
    }
    issues.push("security-notice-short");
    actions.push("按安全例外处理，48 小时内补一次事后评审");
  }
  if (rule.requiresReview && change.breaking && !change.migrationPlanReady) {
    issues.push("migration-plan-missing");
    actions.push("提交受影响能力清单、替代版本与回滚开关");
  }
  if (change.kind !== "security" && change.breaking && noticeDays < rule.minNoticeDays + rule.bufferDays) {
    issues.push("no-buffer");
    actions.push("推迟生效日到缓冲窗口之后，或准备双版本并行");
  }
  if (change.affects.length === 0) {
    issues.push("no-affected-capabilities");
    actions.push("补齐受影响能力列表后再放行");
  }
  return { ...base, verdict: issues.length === 0 ? "accept" : "conditional", issues, actions };
}

export interface ProviderDecision {
  providerId: string;
  dataClass: DataClass;
  status: "approved" | "approved-with-conditions" | "blocked";
  blockers: string[];
  assessment: ProviderAssessment;
  change: ChangeAssessment;
}

/** 供应商准入与变更评估合并成一个可判定结果，阻塞项必须显式列出。 */
export function decideProviderChange(provider: ProviderRecord, change: ProviderChange, dataClass: DataClass, now: number): ProviderDecision {
  const assessment = assessProvider(provider, dataClass);
  const changeResult = assessChange(change, now);
  const blockers = [
    ...assessment.issues.map((issue) => `provider:${issue.code}`),
    ...(changeResult.verdict === "reject" ? changeResult.issues.map((issue) => `change:${issue}`) : []),
  ];
  const status = blockers.length > 0 ? "blocked" : changeResult.verdict === "conditional" ? "approved-with-conditions" : "approved";
  return { providerId: provider.id, dataClass, status, blockers, assessment, change: changeResult };
}

/** 最晚可接受的通知日：生效日减去监管要求与内部缓冲。 */
export function latestNoticeDate(change: ProviderChange): number {
  const rule = CHANGE_RULES[change.kind];
  return change.effectiveAt - (rule.minNoticeDays + rule.bufferDays) * DAY_MS;
}

/** 数据级别越高，允许的供应商集合越小；用于采购前的快速筛选。 */
export function providersForClass(providers: readonly ProviderRecord[], dataClass: DataClass): ProviderRecord[] {
  return providers.filter((provider) => assessProvider(provider, dataClass).ok);
}

export function compareProviderStrictness(a: DataClass, b: DataClass): number {
  return DATA_CLASS_RANK[a] - DATA_CLASS_RANK[b];
}