examples: NIST AI RMF evaluator — deterministic core, LLM narrates 🤖🤖🤖

[CSOAI-ORG]

What

Adds examples/nist_rmf_eval/ — a NistRmfEvaluator NOOA agent that evaluates a natural-language AI deployment scenario against a built-in corpus of 8 real NIST AI RMF 1.0 subcategories spanning all four Core functions (GOVERN, MAP, MEASURE, MANAGE) and emits a signed, tamper-evident verdict record, entirely deterministically. An optional explain_verdict generation method lets an LLM narrate the verdict in plain English; the verdict itself never depends on a model.

This follows the exact architecture established in #75 (gspc_provision_eval/), which is the pattern precedent: same deterministic-core / LLM-narrated split, same HMAC-SHA256 signed verdict record, same UNMEASURED discipline, same strict_narration flag (included from the start here), same hermetic test structure. Where #75 anchored on statute (EU AI Act / GDPR), this anchors on the voluntary NIST AI RMF — the two are complementary demonstration surfaces of the same idea: Python decides, the LLM only narrates.

Why

Audit-grade AI evaluation needs a deterministic, replayable evidence layer. The AI RMF is the most widely adopted voluntary AI risk framework, so it is the natural second anchor set after statute. The example shows the pattern generalises to any framework corpus without design changes.

Honest scope

• The corpus is 8 subcategories (two per function: GOVERN-1.1, GOVERN-2.1, MAP-1.1, MAP-5.1, MEASURE-1.1, MEASURE-2.7, MANAGE-1.3, MANAGE-2.4) — every ID is a real NIST AI RMF 1.0 subcategory (NIST AI 100-1, Appendix A) with a faithful plain-language restatement. It is not the full 72-subcategory crosswalk, and keyword anchoring is a demonstration matcher, not a conformity assessment.
• FULL_FUNCTION_COVERAGE means the scenario mentions anchored practices in all four functions — evidence of mention, not evidence of adequacy.
• One framework-declared attachment edge is modelled: MANAGE-1.3's own text addresses risks "as identified by the MAP function", so a matched MANAGE-1.3 attaches MAP-5.1. No invented dependencies.
• Note: this PR and examples: GSPC provision-anchored evaluator — deterministic core, LLM narrates 🤖🤖🤖  #75 both append a ### Community examples section to examples/README.md. Whichever lands second will need a trivial rebase of that section; happy to do it.

Tests

Hermetic — FakeLLMClient, no network, no API key:

uv run pytest examples/nist_rmf_eval/ -v
# 7 passed

Covers: GOVERN anchor matching, MEASURE/MANAGE matching with the MAP-5.1 attachment chain, full-function coverage verdict, UNMEASURED on unrelated input, signature determinism across agent instances, tamper detection (hash change + forged verdict rejected), and strict-mode refusal on UNMEASURED.

Also verified: ruff check, ruff format --check, and scripts/check_license_headers.py all clean; the demo script runs offline.

Checklist

• Commits signed off (DCO)
• SPDX headers on all new files
• ruff check / ruff format --check clean
• scripts/check_license_headers.py passes
• Hermetic tests, all passing (7)
• examples/README.md index updated (Community examples section, as in examples: GSPC provision-anchored evaluator — deterministic core, LLM narrates 🤖🤖🤖  #75)
• Honest-scope note in the example README

[CSOAI-ORG]

Update: CSOAI is now a Contributor Member of C2PA (Coalition for Content Provenance and Authenticity, Linux Foundation) as of 2026-08-06.

This PR is relevant: the deterministic-core evaluator pattern with HMAC-signed verdicts aligns with C2PA's emerging provenance standards for AI-generated content. We're participating in the C2PA Technical Working Group and would welcome feedback on how this evaluator pattern could inform C2PA's assertion types for AI agent decisions.

The signed manifest shape (deterministic verdict + HMAC + content binding) maps directly onto C2PA manifests (assertion + claim_generator + signature) and is a candidate reference implementation for the "AI decision provenance" assertion the Working Group is exploring.

Verified: C2PA Docusign Envelope ID 7C9592DB-D7C7-8C0F-8012-AFC90FD84F1E, contributor member level, signed by Jim Zemlin (Linux Foundation Executive Director).