attest regulatory ingest <url> — manual notice ingestion

[scttfrdmn]

Summary

attest regulatory ingest is the primary user-facing command for ad-hoc ingestion of a specific regulatory notice when you encounter it.

Command

# Ingest a URL
attest regulatory ingest https://grants.nih.gov/grants/guide/notice-files/NOT-OD-25-081.html

# Ingest a local PDF
attest regulatory ingest ./federal-register-cmmc-final-rule.pdf

# Skip issue creation (dry run)
attest regulatory ingest <url> --dry-run

# Specify target repo for issue
attest regulatory ingest <url> --repo provabl/attest

Output

Fetching document...           ✓
Triage (relevance check)...    → RELEVANT
Deep analysis...               ✓

Notice: NOT-OD-25-081
Source: NIH Guide for Grants & Contracts
Published: 2025-04-15

Impact:    new-control
Frameworks: nih-gds
Action:    Add nih-gds-2.3 — AI/ML model parameters trained on controlled-access 
           data are derivatives subject to DUA use restrictions

Proposed issue title: "AI/ML derivative data tracking (NOT-OD-25-081)"
Issue preview:
  [summary of issue body]

Create issue on provabl/attest? [y/N]

Acceptance Criteria

• Fetches URL with SSRF protection (https only, no private IPs)
• Accepts local file path as alternative to URL
• Two-stage AI pipeline: triage first, skip deep analysis if not relevant
• --dry-run: analyze and print but don't create issue
• --repo: target repo for issue creation (default: read from .attest/sre.yaml or prompt)
• Checks for duplicate issues (GitHub search) before creating
• Saves notice to .attest/regulatory/notices/ after analysis
• Interactive confirm before issue creation (skip with --yes)

Blocked by

#, #

[scttfrdmn]

Implemented in cmd/attest/main.go (commit ddd28e4). attest regulatory ingest fetches, triages, and analyzes notices with --dry-run and --repo flags.