Split forgelm/compliance.py into a sub-package (_audit_log, _annex_iv, _provenance, _gdpr) — deferred until Phase 16 S9 has landed #906

Deferred work · F-PR29-A1-06 / A1-07 / A1-08: compliance.py · severity Low · cost ~4-8 h · recorded in docs/roadmap/risks-and-decisions.md:80

Summary

forgelm/compliance.py is a deferred module split: the EU AI Act Art. 9-17 surface, Annex IV, the hash-chained audit log, provenance and the GDPR primitives live in one file. The module-size guard holds it to a fatal no-growth budget, but nothing pays the debt down until someone takes the split.

Condition or budget

Phase 16 S9 has landed and its audit-chain fixtures are re-verified; S9 is #895

State today (re-checked 2026-10-09)

2492 code lines against a budget of 2492 at 08f2426 (deferred at 2147; ~1500 at PR #29).

Related

#667 and #668 track how the module-size guard counts lines and accepts budget raises; decide them before relying on a module's budget.

Acceptance criteria

• The module becomes a sub-package along the recorded seams, behaviour-neutral, with every public name still importable from its current path.
• Its _DEFERRED_SPLITS entry is removed from tools/check_module_size.py and every resulting module is under the normal ceiling.
• Test patch targets that named the old module are retargeted to the module that resolves the name at call time (the forgelm/verify.py split found five that silently moved).
• The row is removed from the deferral table and the CHANGELOG names its ID (the table's removal contract).

_{Recorded in docs/roadmap/risks-and-decisions.md (read at f94595f) and re-checked against the code on 2026-10-09. The row leaves that table only when the fix is on main, the CHANGELOG names its ID and any promised guard exists.}