EU AI Act coverage (Articles 9/10/11/13/14/15 + Annex IV) via cubie-tf crates/cubie-eu-*

Scoped

Scope boundary: A compiling Rust evidence-mapping + Annex IV generation SCAFFOLD (per-article structs + AnnexIvBuilder + /api/v1/annex-iv), NOT a fully populated conformity pack — modules carry placeholder values (e.g. kill_switch_url=example.com, some proof counts hardcoded 0).

Claim

cubie-tf implements EU AI Act coverage as a Rust evidence-mapping + Annex IV generation scaffold under `crates/cubie-eu-*`, plus a separate documented compliance surface under `apps/trustfortress/docs/eu-ai-act-compliance/`. IMPLEMENTED (Rust, verified to compile + tests pass): `cubie-eu-articles` provides per-article Serde structs that map cubie-core runtime facts to EU AI Act evidence types — one module each for Art 9 (risk register from 17 cubie-core denial codes), Art 10 (data governance + DataProvenanceTag), Art 13 (transparency), Art 14 (human-oversight escalation hooks), Art 15 (accuracy/robustness → ISO 24029-2), Art 16+17 (QMS), Art 19 (registration record), Art 50 (transparency), Art 73 (incident reporting, typed 15-day deadline), plus a NIST RMF module. Article 11 (technical documentation) is realized by the separate `cubie-eu-annex-iv` crate — the `AnnexIv` struct + `AnnexIvBuilder` + JSON Schema ARE the Annex IV technical documentation Art 11 requires; Article 12 (record-keeping) maps to the builder's `with_article_12`→`monitoring` field and to `cubie-eu-ledger`. The `cubie-eu-api` crate exposes the Annex IV generator as `GET /api/v1/annex-iv` (axum, binds 0.0.0.0:8443). ACCURACY SCOPING: (1) These crates are a mapping/generation SCAFFOLD, not a fully populated conformity pack — they carry placeholder values (`kill_switch_url`=example.com, `incident_reporting_email`="TO_BE_CONFIGURED", Art 15 lean/coq/verus proof counts hardcoded to 0, `single_bit_flip_closure_verified`/`constant_time_validator_verified` hardcoded `true`). (2) Only 2 of the 9 article modules have Rust unit tests (article_09, article_73); the annex-iv crate has 2 builder tests — 4 EU tests total, all passing. (3) The V8/V9 master whitepaper's regulatory-mapping chapter (ch14_regulatory_mapping.tex) scopes the mapping MORE NARROWLY than the crate set: it maps only bare-metal/→Art 9, cubie-platform/→Art 15, cubie-eu-ledger/→Art 12 & 13, verus/consent_spec/→Art 14. (4) The richer per-article coverage with high test counts (Art 5:29, Art 6:88, Art 72:53, Art 73:85, Art 86:65, Art 14:24) and the 98/100 readiness score live in the DOCUMENTED surface `apps/trustfortress/docs/eu-ai-act-compliance/` and refer to TypeScript modules in the trustfortress app — NOT the Rust crates; that TS is marked deprecated for new logic per apps/trustfortress/CLAUDE.md (2026-07-01 boundary). The crate-description discrepancy (cubie-eu-articles Cargo.toml lists Art 9/10/11/12/13/14/15/16/17/19/50/73 but has no article_11.rs or article_12.rs) is explained by Art 11=annex-iv crate and Art 12=builder monitoring field, NOT a gap.

Source evidence (pinned)

Public source pack — cubie-eu-source.zip (git-archive of cubie-eu-articles + cubie-eu-annex-iv + cubie-eu-api: per-article evidence-mapping structs, AnnexIvBuilder = Article 11 tech documentation, /api/v1/annex-iv generator). Enables source inspection without repo access; build/test requires placing the pack in a matching cubie-tf workspace checkout. Bytes and regeneration notes are tracked in docs/resource-library/2026-07-04-source-packs.md.

Locked IPemail-gated IPsha256 acc5178bfc39ba6677a5c9efb40e71c52426f4777e77a0985423f75544358688

cubie-eu-articles crate — per-article EU AI Act evidence-mapping structs (Art 9/10/13/14/15/16-17/19/50/73 + NIST RMF); lib.rs declares 9 article modules (no article_11/article_12 files by design)

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/lib.rs@88ef7e83private repo

Article 9 risk management — build_from_denial_cert() maps 17 cubie-core deny codes to Risk structs; test risk_register_has_17_deny_codes passes

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/article_09.rs@88ef7e83private repo

Article 10 data governance — DataGovernance + DataProvenanceTag (RTMR[2] anchor)

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/article_10.rs@88ef7e83private repo

Article 13 transparency — Transparency struct wiring denial_cert + dual-ledger receipt (no unit test in module)

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/article_13.rs@88ef7e83private repo

Article 14 human oversight — HumanOversight escalation hooks (placeholder kill_switch_url=example.com; no unit test in module)

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/article_14.rs@88ef7e83private repo

Article 15 accuracy/robustness — AccuracyRobustness → ISO 24029-2; lean/coq/verus proof counts hardcoded 0, *_verified flags hardcoded true (no unit test in module)

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/article_15.rs@88ef7e83private repo

Article 73 incident reporting — typed INCIDENT_REPORT_DEADLINE_DAYS=15 const; test deadline_is_exactly_15_days_after_detection passes

🔒 Sourcecubie-tf/crates/cubie-eu-articles/src/article_73.rs@88ef7e83private repo

cubie-eu-annex-iv builder — AnnexIv struct + AnnexIvBuilder (= Article 11 technical documentation); with_article_12→monitoring, with_article_13→transparency; 2 tests pass

🔒 Sourcecubie-tf/crates/cubie-eu-annex-iv/src/builder.rs@88ef7e83private repo

cubie-eu-annex-iv JSON Schema (draft 2020-12) for Annex IV technical documentation

🔒 Sourcecubie-tf/crates/cubie-eu-annex-iv/src/schema.rs@88ef7e83private repo

cubie-eu-api — Annex IV generator route GET /api/v1/annex-iv (annex_iv handler builds AnnexIv doc, returns JSON); crate builds clean (exit 0)

🔒 Sourcecubie-tf/crates/cubie-eu-api/src/lib.rs@88ef7e83private repo

cubie-eu-api main — axum server binds 0.0.0.0:8443 (Annex IV generator entrypoint)

🔒 Sourcecubie-tf/crates/cubie-eu-api/src/main.rs@88ef7e83private repo

Whitepaper regulatory-mapping chapter (V8/V9 master) — authoritative narrower scoping: bare-metal/→Art9, cubie-platform/→Art15, cubie-eu-ledger/→Art12&13, verus/consent_spec/→Art14

🔒 Sourcecubie-tf/docs/whitepaper/chapters/ch14_regulatory_mapping.tex@88ef7e83private repo

DOCUMENTED surface (separate from Rust crates) — EU AI Act compliance readiness scorecard 98/100, per-article RED/YELLOW/GREEN; cites TypeScript modules (human-override.ts etc.), deprecated for new logic per 2026-07-01 boundary

🔒 Sourcecubie-tf/apps/trustfortress/docs/eu-ai-act-compliance/evidence/compliance-readiness-scorecard.md@88ef7e83private repo

DOCUMENTED surface — existing-compliance-evidence.md: file/line evidence matrix mapping TS components to Art 5/10/12/14/15/50/72/73/86

🔒 Sourcecubie-tf/apps/trustfortress/docs/eu-ai-act-compliance/evidence/existing-compliance-evidence.md@88ef7e83private repo

Resource library search for a published Annex IV artifact: https://lib.trustfortress.ai/api/search?q=annex-iv returned [] (no published Annex IV document); ?q=eu%20annex returned only docs/resource-library/CLOUDFLARE_KNOWLEDGEBASE_PLAN.md

Locked IPemail-gated IP

Reproduce this result

# Public source inspection: download the EU crates source pack.
curl -sL -o cubie-eu-source.zip 'https://lib.trustfortress.ai/objects/cubie-tf%2Fsource-packs%2F2026-07-04%2Fcubie-eu-source.zip'   # hashes in https://lib.trustfortress.ai/objects/cubie-tf%2Fsource-packs%2F2026-07-04%2FMANIFEST.md
# This partial workspace pack is not standalone-buildable: unzip into a matching cubie-tf checkout to build/test (`cargo test -p cubie-eu-annex-iv`), or read crates/cubie-eu-articles/src/*.rs for the article-to-runtime mappings.
Clone + enter repo: git clone https://github.com/iamdatanick/cubie-tf && cd cubie-tf (local: C:\Users\NickV\cubie-tf)
Run the EU crate tests: `cargo test -p cubie-eu-articles -p cubie-eu-annex-iv` — EXPECTED (verified 2026-07-04): cubie-eu-annex-iv 2 passed (build_fails_without_identifier, minimal_build_succeeds); cubie-eu-articles 2 passed (article_09::tests::risk_register_has_17_deny_codes, article_73::tests::deadline_is_exactly_15_days_after_detection); 0 failed
Confirm the Annex IV generator compiles: `cargo build -p cubie-eu-api` — EXPECTED: `Finished dev profile` exit 0 (verified 2026-07-04, ~45s cold)
Run the Annex IV generator (code-read of handler; not executed in this session): `cargo run -p cubie-eu-api` starts axum on 0.0.0.0:8443, then `curl http://localhost:8443/api/v1/annex-iv` — EXPECTED JSON body with system_identifier="CUBIE-EU-v0.1", provider.name="Centillion AI" (override via CUBIE_EU_PROVIDER_NAME), provider.country="US" (override via CUBIE_EU_PROVIDER_COUNTRY), intended_purpose="High-risk AI inference admission with TDX-rooted attestation", plus Annex IV fields (risk_management, data_governance, human_oversight, accuracy_robustness, monitoring, transparency_disclosures, logs, conformity_declaration)
Confirm the crate-description vs file discrepancy is intentional: `rg -n "article_11|article_12" crates/cubie-eu-articles/src` returns no dedicated files; Art 11=annex-iv crate, Art 12=cubie-eu-annex-iv builder with_article_12→monitoring + cubie-eu-ledger

Verification checks

cargo test -p cubie-eu-articles -p cubie-eu-annex-iv # 4 tests pass, 0 fail (verified)
cargo build -p cubie-eu-api # exit 0, generator endpoint compiles (verified)
rg -c '#\[test\]' crates/cubie-eu-articles/src/*.rs # only article_09.rs=1, article_73.rs=1 → 7 of 9 article modules have NO Rust test
rg -n 'TO_BE_CONFIGURED|example.com|lean_proof_count: 0|_verified: true' crates/cubie-eu-articles/src # confirms placeholder/scaffold values
gh api repos/iamdatanick/cubie-tf/contents/crates/cubie-eu-articles/src/lib.rs?ref=88ef7e8303ed82b4e0af398960be172f8bb560db --jq .path # confirms the evidence path resolves at the pinned commit

Known boundaries / open gaps

No published Annex IV output artifact in the resource library: `/api/search?q=annex-iv` returns [] and `?q=eu%20annex` returns only docs/resource-library/CLOUDFLARE_KNOWLEDGEBASE_PLAN.md — so no /objects/ library URL exists for a generated Annex IV document (checked: library /api/search). The generator exists in code (cubie-eu-api) but no rendered sample output is published.
Per-article Rust test coverage is thin: 7 of 9 cubie-eu-articles modules (10,13,14,15,16-17,19,50) have NO unit test; only article_09 and article_73 are tested. The high per-article test counts (Art 6:88, Art 73:85, etc.) belong to the DOCUMENTED TypeScript surface, not the Rust crates.
Scaffold placeholders unresolved in the Rust crates: Art 14 kill_switch_url=example.com, Art 16-17 incident_reporting_email="TO_BE_CONFIGURED", Art 15 lean/coq/verus proof counts hardcoded 0 and *_verified flags hardcoded true — these are static defaults, not populated from live cubie-core proof/config state.
No formal proof (Verus/Coq/Lean CUB spec) binds the EU article mapping structs to cubie-core runtime behavior; the whitepaper references verus/consent_spec/ for Art 14 but the cubie-eu-articles structs themselves are unproven plain Rust. (Not searched exhaustively across the full 1800+ CUB corpus for an EU-specific spec.)

Fact-checked 2026-08-03 · status Scoped · source pins cubie-tf 88ef7e8303ed / cubie-research 1e8c3e2690c0 · canonical JSON at /api/claims · registry index