Skip to content
Venturalítica

Migrating to v0.6.0

Companion to the arXiv preprint Making AI Compliance Evidence Machine-Readable (Cilla Ugarte et al., 2026).

Why this version

Section titled “Why this version”

Single-document OSCAL: every AssuranceMeasure now lives in one assessment-plan envelope, matching the paper’s Listing 1. The split emission of model_policy.oscal.yaml + data_policy.oscal.yaml is deprecated; assessment_plan.oscal.yaml is the new source of truth.

Breaking changes

Section titled “Breaking changes”

1. OSCALMapper.toMultiSSP / toSSP / buildSSP removed

Section titled “1. OSCALMapper.toMultiSSP / toSSP / buildSSP removed”

Before (v0.5):

mapper = OSCALMapper()
docs = mapper.toMultiSSP(ai_system)
ssp = mapper.toSSP(ai_system, target_type="model")

After (v0.6):

from venturalitica.oscal import build_assessment_plan


plan = build_assessment_plan(ai_system)

The OSCALMapper.toAssessmentPlan(ai_system, options?) method is also available if you prefer the class form.

2. model_policy.oscal.yaml / data_policy.oscal.yaml deprecated

Section titled “2. model_policy.oscal.yaml / data_policy.oscal.yaml deprecated”

vl pull still emits these files for one release as filtered views of assessment_plan.oscal.yaml, but they are no longer authoritative. Update any tooling that parses the legacy files to read the unified one instead.

3. system-security-plan no longer emitted internally

Section titled “3. system-security-plan no longer emitted internally”

The SaaS and SDK no longer produce system-security-plan documents. The vl-fairness-gate (Rust proxy) parser still accepts SSPs from external, customer-authored policies for backwards compatibility.

New features (in scope of the paper)

Section titled “New features (in scope of the paper)”

vl export-annex-iv --agentic

Section titled “vl export-annex-iv --agentic”

Generates the narrative sections of EU AI Act Annex IV (Article 11) through a local Ollama model (default mistral) or Mistral managed (--provider cloud). Sections §4 (performance metrics), §6 (POA&M) and §7 (standards) remain deterministically derived from OSCAL Assessment Results — never overwritten by the LLM.

Terminal window
vl export-annex-iv --agentic                     # local Ollama
vl export-annex-iv --agentic --provider cloud    # Mistral managed
vl export-annex-iv --agentic --force-regenerate  # bypass cache

The cache lives at .venturalitica/annex_iv.cache.json and is keyed on (language, model, run_id, policy_hash).

Section titled “Recommended upgrade steps”
Terminal window
pip install --upgrade venturalitica==0.6.0
rm -f .venturalitica/model_policy.oscal.yaml .venturalitica/data_policy.oscal.yaml
vl pull                       # regenerates assessment_plan.oscal.yaml

Update CI scripts that read OSCAL artefacts to point at .venturalitica/assessment_plan.oscal.yaml.

References

Section titled “References”