@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/profiles/detection.py

@@ -1,842 +0,0 @@
-"""Project profile detection from repository analysis.
-
-This module provides functionality to detect project profiles from repository content,
-either by matching known patterns or heuristically analyzing files.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import json
-from dataclasses import dataclass
-from fnmatch import fnmatch
-from pathlib import Path
-from typing import Any
-
-import yaml
-
-from .models import (
-    ChangeVelocity,
-    DataSensitivity,
-    Domain,
-    Exposure,
-    FeatureFlags,
-    ProjectProfile,
-    ProjectType,
-    RiskLevel,
-    ServiceType,
-    TechStack,
-    WeightOverrides,
-)
-
-# Note: Domain is imported directly from .models above for runtime use
-
-
-# Centralized profile map - stores string values to avoid importing enums at module level
-# The actual enum instances are created lazily in _get_known_profile_with_enums()
-_KNOWN_PROFILES: dict[str, dict[str, str]] = {
-    # Insurance project services
-    "insurance-policy-service": {
-        "domain": "INSURANCE",
-        "project_type": "MICROSERVICE",
-        "risk_level": "HIGH",
-        "data_sensitivity": "PII",
-    },
-    "insurance-claim-service": {
-        "domain": "INSURANCE",
-        "project_type": "MICROSERVICE",
-        "risk_level": "CRITICAL",
-        "data_sensitivity": "PII",
-    },
-    # Lending project services
-    "lep-loan-service": {
-        "domain": "LENDING",
-        "project_type": "MICROSERVICE",
-        "risk_level": "CRITICAL",
-        "data_sensitivity": "FINANCIAL",
-    },
-    # Common patterns
-    "*-bff": {
-        "project_type": "BFF",
-    },
-    "*-lib": {
-        "project_type": "LIBRARY",
-    },
-    "*-frontend": {
-        "project_type": "FRONTEND",
-    },
-}
-
-
-def _get_known_profile_with_enums(repo_name: str) -> dict | None:
-    """Get known profile for a repository with enum instances.
-
-    Args:
-        repo_name: Repository name
-
-    Returns:
-        Profile dict with enum instances if found, None otherwise
-    """
-
-    # Exact match first
-    if repo_name in _KNOWN_PROFILES:
-        profile_dict = _KNOWN_PROFILES[repo_name]
-        return {
-            "domain": getattr(Domain, profile_dict.get("domain", "UNKNOWN")),
-            "project_type": getattr(ProjectType, profile_dict.get("project_type", "MICROSERVICE")),
-            "risk_level": getattr(RiskLevel, profile_dict.get("risk_level", "MEDIUM")),
-            "data_sensitivity": getattr(DataSensitivity, profile_dict.get("data_sensitivity", "INTERNAL")),
-        }
-
-    # Pattern match
-    for pattern, profile_dict in _KNOWN_PROFILES.items():
-        if pattern.startswith("*-"):
-            suffix = pattern[1:]  # Remove *
-            if repo_name.endswith(suffix):
-                return {
-                    "project_type": getattr(ProjectType, profile_dict.get("project_type", "MICROSERVICE")),
-                }
-        elif pattern.endswith("-*"):
-            prefix = pattern[:-1]  # Remove *
-            if repo_name.startswith(prefix):
-                return {
-                    "project_type": getattr(ProjectType, profile_dict.get("project_type", "MICROSERVICE")),
-                }
-
-    return None
-
-
-def get_known_profile(repo_name: str) -> dict | None:
-    """Get known profile for a repository.
-
-    Args:
-        repo_name: Repository name
-
-    Returns:
-        Profile dict if found, None otherwise
-    """
-    return _get_known_profile_with_enums(repo_name)
-
-
-class ProfileDetector:
-    """Detect project profile from repository analysis."""
-
-    def __init__(self, repo_path: Path) -> None:
-        """Initialize the detector with a repository path.
-
-        Args:
-            repo_path: Path to the repository to analyze
-        """
-        self.repo_path = repo_path
-        self._profile: ProjectProfile | None = None
-
-    async def detect(self, project_id: str, cli_profile: str | None = None) -> ProjectProfile:
-        """Detect profile with priority: CLI > repo-local > profile-map > heuristics.
-
-        The detection follows a priority order:
-        1. CLI override (highest priority) - explicit profile from command line
-        2. Repo-local profile file - audit_profile.yaml in repository root
-        3. Centralized profile map - (future: remote profile mapping service)
-        4. Heuristic detection - analyzes directory structure and files
-
-        Args:
-            project_id: The ID of the project being audited.
-            cli_profile: Optional profile name from CLI override
-
-        Returns:
-            Detected ProjectProfile instance
-        """
-        # 1. Highest priority: CLI override
-        if cli_profile:
-            return self._load_named_profile(project_id, cli_profile, source="cli")
-
-        # 2. Repo-local profile file
-        repo_local = self.repo_path / "audit_profile.yaml"
-        if repo_local.exists():
-            try:
-                return self._load_repo_profile(project_id, repo_local)
-            except Exception:
-                # Fall through to heuristic detection if loading fails
-                pass
-
-        # 3. Centralized profile map
-        repo_name = self.repo_path.name
-        known = _get_known_profile_with_enums(repo_name)
-        if known:
-            # Use known profile as base, fill in with heuristics
-            heuristic_profile = await self._detect_heuristic(project_id)
-            return self._merge_known_profile(heuristic_profile, known)
-
-        # 4. Fallback: heuristic detection
-        return await self._detect_heuristic(project_id)
-
-    def _load_named_profile(self, project_id: str, name: str, source: str = "cli") -> ProjectProfile:
-        """Load a predefined profile by name.
-
-        Args:
-            project_id: The ID of the project.
-            name: Profile name to load
-            source: Source identifier for provenance tracking
-
-        Returns:
-            ProjectProfile instance
-        """
-
-        profiles: dict[str, ProjectProfile] = {
-            "insurance-microservice": ProjectProfile(
-                repository=self.repo_path.name,
-                project_id=project_id,
-                name=project_id,
-                domain=Domain.INSURANCE,
-                project_type=ProjectType.MICROSERVICE,
-                risk_level=RiskLevel.HIGH,
-                data_sensitivity=DataSensitivity.PII,
-                exposure=Exposure.INTERNAL_API,
-                profile_source=source,
-                confidence=1.0,
-            ),
-            "insurance-critical": ProjectProfile(
-                repository=self.repo_path.name,
-                project_id=project_id,
-                name=project_id,
-                domain=Domain.INSURANCE,
-                project_type=ProjectType.MICROSERVICE,
-                risk_level=RiskLevel.CRITICAL,
-                data_sensitivity=DataSensitivity.PII,
-                exposure=Exposure.PUBLIC_INTERNET,
-                profile_source=source,
-                confidence=1.0,
-            ),
-            "lending-service": ProjectProfile(
-                repository=self.repo_path.name,
-                project_id=project_id,
-                name=project_id,
-                domain=Domain.LENDING,
-                project_type=ProjectType.MICROSERVICE,
-                risk_level=RiskLevel.HIGH,
-                data_sensitivity=DataSensitivity.FINANCIAL,
-                exposure=Exposure.PUBLIC_INTERNET,
-                profile_source=source,
-                confidence=1.0,
-            ),
-            "frontend": ProjectProfile(
-                repository=self.repo_path.name,
-                project_id=project_id,
-                name=project_id,
-                domain=Domain.UNKNOWN,
-                project_type=ProjectType.FRONTEND,
-                risk_level=RiskLevel.LOW,
-                data_sensitivity=DataSensitivity.PUBLIC,
-                exposure=Exposure.PUBLIC_INTERNET,
-                profile_source=source,
-                confidence=1.0,
-            ),
-            "library": ProjectProfile(
-                repository=self.repo_path.name,
-                project_id=project_id,
-                name=project_id,
-                domain=Domain.UNKNOWN,
-                project_type=ProjectType.LIBRARY,
-                risk_level=RiskLevel.MEDIUM,
-                data_sensitivity=DataSensitivity.INTERNAL,
-                exposure=Exposure.INTERNAL_API,
-                profile_source=source,
-                confidence=1.0,
-            ),
-        }
-
-        # Get the requested profile or return default
-        if name in profiles:
-            return profiles[name]
-
-        # Import default_profile at runtime
-        from .models import default_profile
-
-        return default_profile(project_id=project_id, name=self.repo_path.name)
-
-    def _load_repo_profile(self, project_id: str, profile_path: Path) -> ProjectProfile:
-        """Load profile from repo-local audit_profile.yaml.
-
-        Args:
-            project_id: The ID of the project.
-            profile_path: Path to the audit_profile.yaml file
-
-        Returns:
-            ProjectProfile instance
-
-        Raises:
-            ValueError: If YAML parsing fails
-            FileNotFoundError: If file doesn't exist (should be checked before calling)
-        """
-
-        try:
-            with open(profile_path, encoding="utf-8") as f:
-                data = yaml.safe_load(f) or {}
-        except yaml.YAMLError as e:
-            raise ValueError(f"Invalid YAML in {profile_path}: {e}") from e
-
-        if not isinstance(data, dict):
-            data = {}
-
-        # Resolve enums and map old fields to new
-        resolved_data: dict[str, Any] = {}
-        for key, value in data.items():
-            if key == "domain":
-                resolved_data[key] = Domain(value)
-            elif key == "project_type":
-                resolved_data[key] = ProjectType(value)
-            elif key == "tech_stack":
-                resolved_data[key] = TechStack(value)
-            elif key == "risk_level":
-                resolved_data[key] = RiskLevel(value)
-            elif key == "data_sensitivity":
-                resolved_data[key] = DataSensitivity(value)
-            elif key == "exposure":
-                resolved_data[key] = Exposure(value)
-            # Handle old field names
-            elif key == "business_criticality":
-                # Map old BusinessCriticality to new RiskLevel if necessary, or just ignore for now
-                pass
-            elif key == "service_type":
-                # Map old ServiceType to ProjectType if necessary, or just ignore
-                pass
-            else:
-                resolved_data[key] = value
-
-        # Ensure required fields are set
-        resolved_data["repository"] = resolved_data.get("repository", self.repo_path.name)
-        resolved_data["project_id"] = resolved_data.get("project_id", resolved_data.get("project_key", project_id))
-        resolved_data["name"] = resolved_data.get("name", resolved_data.get("service_name", project_id))
-        resolved_data["profile_source"] = resolved_data.get("profile_source", "repo_local")
-        resolved_data["confidence"] = resolved_data.get("confidence", 1.0)
-
-        # Explicitly handle features and weight_overrides if present in YAML
-        if "features" in data:
-            resolved_data["features"] = FeatureFlags(**data["features"])
-        if "weight_overrides" in data:
-            # Assuming WeightOverrides is handled by ProjectProfile.from_yaml for now
-            pass
-
-        return ProjectProfile(**resolved_data)
-
-    async def _detect_heuristic(self, project_id: str) -> ProjectProfile:
-        """Detect profile from directory structure and manifest files.
-
-        Analyzes the repository to infer project characteristics:
-        - Detects domain from parent directory names
-        - Detects project type and tech stack from manifest files
-        - Detects features from code patterns
-        - Infers risk level from domain and features
-
-        Args:
-            project_id: The ID of the project.
-
-        Returns:
-            ProjectProfile instance based on heuristic analysis
-        """
-
-        # Detect domain from parent directory
-        domain = self._detect_domain()
-
-        # Detect project type and tech stack
-        project_type, tech_stack = await self._detect_type_and_stack()
-
-        # Detect features
-        features = await self._detect_features()
-
-        # Infer risk level
-        risk_level = self._infer_risk_level(domain, features)
-
-        # Infer exposure from detected features
-        exposure = self._infer_exposure(features)
-
-        # Infer change velocity (still uses int)
-        change_velocity = self._infer_change_velocity()
-
-        return ProjectProfile(
-            repository=self.repo_path.name,
-            project_id=project_id,
-            name=project_id,
-            domain=domain,
-            project_type=project_type,
-            tech_stack=tech_stack,
-            risk_level=risk_level,
-            data_sensitivity=self._infer_data_sensitivity(domain, features),
-            exposure=exposure,
-            change_velocity=change_velocity,
-            features=features,
-            profile_source="heuristic",
-            confidence=0.6,
-        )
-
-    def _detect_domain(self) -> Domain:
-        """Detect domain from directory path.
-
-        Analyzes the repository path to infer the business domain
-        based on directory naming patterns.
-
-        Returns:
-            Detected Domain enum value
-        """
-
-        path_str = str(self.repo_path).lower()
-
-        if "insurance" in path_str:
-            return Domain.INSURANCE
-        elif "lending" in path_str or "lep" in path_str:
-            return Domain.LENDING
-        elif "saving" in path_str:
-            return Domain.SAVINGS
-        elif "ekyc" in path_str:
-            return Domain.EKYC
-        elif "platform" in path_str or "common" in path_str:
-            return Domain.PLATFORM
-
-        return Domain.UNKNOWN
-
-    async def _detect_type_and_stack(self) -> tuple[ProjectType, TechStack]:
-        """Detect project type and tech stack from manifest files.
-
-        Checks for build configuration files to identify the
-        technology stack and architectural pattern.
-
-        Returns:
-            Tuple of (ProjectType, TechStack)
-        """
-        # Check for Java/Spring
-        if (self.repo_path / "pom.xml").exists():
-            return ProjectType.MICROSERVICE, TechStack.JAVA_SPRING
-
-        # Check for Python/FastAPI
-        if (self.repo_path / "pyproject.toml").exists():
-            try:
-                with open(self.repo_path / "pyproject.toml", encoding="utf-8") as f:
-                    content = f.read().lower()
-                    if "fastapi" in content:
-                        return ProjectType.MICROSERVICE, TechStack.PYTHON_FASTAPI
-                    return ProjectType.LIBRARY, TechStack.PYTHON_FASTAPI
-            except Exception:
-                return ProjectType.LIBRARY, TechStack.PYTHON_FASTAPI
-
-        # Check for Node.js
-        if (self.repo_path / "package.json").exists():
-            try:
-                with open(self.repo_path / "package.json", encoding="utf-8") as f:
-                    content = f.read().lower()
-                    if "react" in content:
-                        return ProjectType.FRONTEND, TechStack.REACT
-                    elif "angular" in content:
-                        return ProjectType.FRONTEND, TechStack.ANGULAR
-                    return ProjectType.MICROSERVICE, TechStack.NODE_JS
-            except Exception:
-                return ProjectType.MICROSERVICE, TechStack.NODE_JS
-
-        return ProjectType.MICROSERVICE, TechStack.UNKNOWN
-
-    async def _detect_features(self) -> FeatureFlags:
-        """Detect project features from codebase.
-
-        Searches for characteristic patterns in source files
-        to identify project capabilities and integrations.
-
-        Returns:
-            FeatureFlags with detected capabilities
-        """
-        features = FeatureFlags()
-
-        # Look for API indicators
-        api_indicators = ["@app.", "@router.", "RestController", "@Controller", "router.", "app.route"]
-        for indicator in api_indicators:
-            if self._search_code(indicator):
-                features.has_api = True
-                break
-
-        # Look for database
-        db_indicators = ["sqlalchemy", "psycopg", "jpa", "mongodb", "postgresql", "mysql", "hibernate"]
-        for indicator in db_indicators:
-            if self._search_code(indicator):
-                features.has_database = True
-                break
-
-        # Look for authentication
-        auth_indicators = ["oauth", "jwt", "security", "authentication", "@oauth2"]
-        for indicator in auth_indicators:
-            if self._search_code(indicator):
-                features.has_authentication = True
-                break
-
-        # Look for message queues
-        mq_indicators = ["kafka", "rabbitmq", "sqs", "pubsub", "activemq"]
-        for indicator in mq_indicators:
-            if self._search_code(indicator):
-                features.has_message_queue = True
-                break
-
-        # Look for cache
-        cache_indicators = ["redis", "memcached", "@cacheable"]
-        for indicator in cache_indicators:
-            if self._search_code(indicator):
-                features.has_cache = True
-                break
-
-        # Look for scheduled jobs
-        job_indicators = ["@scheduled", "cron", "celery", "apscheduler"]
-        for indicator in job_indicators:
-            if self._search_code(indicator):
-                features.has_scheduled_jobs = True
-                break
-
-        # Look for external integrations (http clients, etc)
-        integration_indicators = ["resttemplate", "requests.", "axios", "feign"]
-        for indicator in integration_indicators:
-            if self._search_code(indicator):
-                features.has_external_integrations = True
-                break
-
-        # Look for frontend indicators (if not already set by project_type heuristic)
-        if features.has_frontend is False and (self.repo_path / "package.json").exists():
-            try:
-                with open(self.repo_path / "package.json", encoding="utf-8") as f:
-                    pkg_data = json.load(f)
-                    deps = {
-                        **pkg_data.get("dependencies", {}),
-                        **pkg_data.get("devDependencies", {}),
-                    }
-                    if any(fw in deps for fw in ["react", "vue", "angular", "next", "nuxt", "svelte"]):
-                        features.has_frontend = True
-            except Exception:
-                pass
-
-        return features
-
-    def _search_code(self, pattern: str) -> bool:
-        """Search for pattern in source files.
-
-        Args:
-            pattern: Text pattern to search for
-
-        Returns:
-            True if pattern found in any source file
-        """
-        extensions = [".py", ".java", ".ts", ".js", ".tsx", ".jsx", ".go", ".kt"]
-
-        for ext in extensions:
-            try:
-                for file_path in self.repo_path.rglob(f"*{ext}"):
-                    if any(
-                        skip in str(file_path)
-                        for skip in ["node_modules", ".venv", "__pycache__", ".git", "target", "build"]
-                    ):
-                        continue
-
-                    try:
-                        content = file_path.read_text(encoding="utf-8", errors="ignore")
-                        if pattern.lower() in content.lower():
-                            return True
-                    except Exception:
-                        continue
-            except Exception:
-                continue
-
-        return False
-
-    def _infer_risk_level(self, domain: Domain, features: FeatureFlags) -> RiskLevel:
-        """Infer risk level based on domain and features.
-
-        Args:
-            domain: Detected domain
-            features: Detected feature flags
-
-        Returns:
-            Inferred RiskLevel
-        """
-        if domain == Domain.INSURANCE:
-            if features.has_pii_data or features.has_financial_data:
-                return RiskLevel.CRITICAL
-            return RiskLevel.HIGH
-
-        if domain in [Domain.LENDING, Domain.SAVINGS]:
-            if features.has_financial_data:
-                return RiskLevel.CRITICAL
-            return RiskLevel.HIGH
-
-        if features.has_pii_data:
-            return RiskLevel.HIGH
-
-        return RiskLevel.MEDIUM
-
-    def _infer_exposure(self, features: FeatureFlags) -> Exposure:
-        """Infer exposure based on features.
-
-        Args:
-            features: Detected feature flags
-
-        Returns:
-            Inferred Exposure
-        """
-        if features.has_api and features.has_authentication:
-            return Exposure.PUBLIC_INTERNET
-        elif features.has_api:
-            return Exposure.INTERNAL_API
-        else:
-            return Exposure.INTERNAL_API
-
-    def _infer_data_sensitivity(self, domain: Domain, features: FeatureFlags) -> DataSensitivity:
-        """Infer data sensitivity from domain and features.
-
-        Args:
-            domain: Detected domain
-            features: Detected feature flags
-
-        Returns:
-            Inferred DataSensitivity
-        """
-
-        if (features.has_pii_data and features.has_financial_data) or features.has_pii_data:
-            return DataSensitivity.PII
-        elif features.has_financial_data or domain in [Domain.LENDING, Domain.SAVINGS]:
-            return DataSensitivity.FINANCIAL
-        else:
-            return DataSensitivity.INTERNAL
-
-    def _infer_change_velocity(self) -> ChangeVelocity:
-        """Infer change velocity from repository structure.
-
-        Currently uses file count and structure as a proxy for development activity.
-
-        Note: For accurate velocity metrics, integrate with:
-        - Git commit history (commits per week)
-        - PR/MR frequency from Bitbucket API
-        - Jira velocity from sprint data
-
-        Returns:
-            Inferred change velocity as ChangeVelocity enum
-        """
-        try:
-            src_files = (
-                list(self.repo_path.rglob("*.java"))
-                + list(self.repo_path.rglob("*.py"))
-                + list(self.repo_path.rglob("*.ts"))
-            )
-
-            src_files = [
-                f
-                for f in src_files
-                if not any(
-                    skip in str(f) for skip in ["node_modules", ".venv", "__pycache__", ".git", "target", "build"]
-                )
-            ]
-
-            file_count = len(src_files)
-
-            if file_count > 200:
-                return ChangeVelocity.HIGH
-            elif file_count > 50:
-                return ChangeVelocity.MEDIUM
-            else:
-                return ChangeVelocity.STABLE
-        except Exception:
-            return ChangeVelocity.MEDIUM
-
-    def _merge_known_profile(self, heuristic: ProjectProfile, known: dict) -> ProjectProfile:
-        """Merge known profile overrides with heuristic detection.
-
-        Args:
-            heuristic: Profile detected via heuristics
-            known: Known profile overrides from KNOWN_PROFILES
-
-        Returns:
-            ProjectProfile with known values applied
-        """
-
-        kwargs: dict[str, Any] = heuristic.model_dump()
-
-        for field_name, value in known.items():
-            if field_name == "domain":
-                kwargs[field_name] = Domain(value)
-            elif field_name == "project_type":
-                kwargs[field_name] = ProjectType(value)
-            elif field_name == "risk_level":
-                kwargs[field_name] = RiskLevel(value)
-            elif field_name == "data_sensitivity":
-                kwargs[field_name] = DataSensitivity(value)
-            elif field_name == "exposure":
-                kwargs[field_name] = Exposure(value)
-            elif field_name == "tech_stack":
-                kwargs[field_name] = TechStack(value)
-            else:
-                kwargs[field_name] = value
-
-        kwargs["profile_source"] = "profile_map"
-        kwargs["confidence"] = 0.9
-
-        return ProjectProfile(**kwargs)
-
-    def _default_profile(self, project_id: str) -> ProjectProfile:
-        """Return default profile when nothing detected.
-
-        Args:
-            project_id: The ID of the project.
-
-        Returns:
-            ProjectProfile with safe default values
-        """
-        # Import default_profile at runtime to avoid circular dependency
-        from .models import default_profile
-
-        return default_profile(project_id=project_id, name=self.repo_path.name)
-
-
-@dataclass(slots=True)
-class ProfileResolution:
-    """Resolved profile with provenance metadata."""
-
-    profile: ProjectProfile
-    source: str
-    matched_rule: dict[str, Any] | None = None
-
-
-def _load_profile_map_rules(profile_map_path: Path | None) -> list[dict[str, Any]]:
-    if profile_map_path is None:
-        return []
-    if not profile_map_path.exists():
-        return []
-    raw_text = profile_map_path.read_text(encoding="utf-8")
-    data: Any
-    if profile_map_path.suffix.lower() in {".yml", ".yaml"}:
-        data = yaml.safe_load(raw_text) or {}
-    else:
-        data = json.loads(raw_text)
-
-    if isinstance(data, list):
-        return [rule for rule in data if isinstance(rule, dict)]
-    if isinstance(data, dict):
-        rules = data.get("rules") or data.get("profiles") or data.get("items") or []
-        if isinstance(rules, list):
-            return [rule for rule in rules if isinstance(rule, dict)]
-    return []
-
-
-def _extract_rule_patterns(rule: dict[str, Any]) -> list[str]:
-    patterns: list[str] = []
-    match_block = rule.get("match")
-    if isinstance(match_block, dict):
-        for key in ("repo", "repository", "project_id", "name", "pattern", "path", "path_pattern"):
-            value = match_block.get(key)
-            if isinstance(value, list):
-                patterns.extend([str(v) for v in value])
-            elif value:
-                patterns.append(str(value))
-    for key in ("repo", "repository", "project_id", "name", "pattern", "path", "path_pattern"):
-        value = rule.get(key)
-        if isinstance(value, list):
-            patterns.extend([str(v) for v in value])
-        elif value:
-            patterns.append(str(value))
-    return [p for p in patterns if p]
-
-
-def _rule_matches(rule: dict[str, Any], repo_name: str, repo_path: Path) -> bool:
-    patterns = _extract_rule_patterns(rule)
-    if not patterns:
-        return False
-    repo_path_str = str(repo_path)
-    return any(fnmatch(repo_name, pattern) or fnmatch(repo_path_str, pattern) for pattern in patterns)
-
-
-def _extract_profile_overrides(rule: dict[str, Any]) -> dict[str, Any]:
-    if isinstance(rule.get("profile"), dict):
-        return dict(rule["profile"])
-    skip_keys = {"match", "repo", "repository", "project_id", "name", "pattern", "path", "path_pattern", "id"}
-    return {k: v for k, v in rule.items() if k not in skip_keys}
-
-
-def _apply_profile_overrides(profile: ProjectProfile, overrides: dict[str, Any]) -> ProjectProfile:
-    payload: dict[str, Any] = profile.model_dump()
-    for key, value in overrides.items():
-        if value is None:
-            continue
-        if key == "domain":
-            payload[key] = Domain(str(value))
-        elif key == "project_type":
-            payload[key] = ProjectType(str(value))
-        elif key == "tech_stack":
-            payload[key] = TechStack(str(value))
-        elif key == "risk_level":
-            payload[key] = RiskLevel(str(value))
-        elif key == "data_sensitivity":
-            payload[key] = DataSensitivity(str(value))
-        elif key == "exposure":
-            payload[key] = Exposure(str(value))
-        elif key == "service_type":
-            payload[key] = ServiceType(str(value))
-        elif key == "features" and isinstance(value, dict):
-            payload[key] = FeatureFlags(**value)
-        elif key == "weight_overrides" and isinstance(value, dict):
-            payload[key] = WeightOverrides(**value)
-        elif key == "tags":
-            payload[key] = value if isinstance(value, list) else [str(value)]
-        else:
-            payload[key] = value
-    payload["profile_source"] = "profile_map"
-    payload["confidence"] = float(payload.get("confidence", 0.8))
-    return ProjectProfile(**payload)
-
-
-async def resolve_profile_async(
-    *,
-    repo_path: Path,
-    project_id: str,
-    cli_profile: str | Path | None = None,
-    profile_map_path: Path | None = None,
-) -> ProfileResolution:
-    """Resolve profile with precedence: CLI > repo-local > profile-map > heuristics."""
-    detector = ProfileDetector(repo_path=repo_path)
-
-    if cli_profile:
-        profile_path = Path(cli_profile)
-        if profile_path.exists():
-            profile = detector._load_repo_profile(project_id, profile_path)
-            profile.profile_source = "cli"
-            return ProfileResolution(profile=profile, source="cli")
-        profile = await detector.detect(project_id=project_id, cli_profile=str(cli_profile))
-        profile.profile_source = "cli"
-        return ProfileResolution(profile=profile, source="cli")
-
-    repo_local = repo_path / "audit_profile.yaml"
-    if repo_local.exists():
-        profile = detector._load_repo_profile(project_id, repo_local)
-        return ProfileResolution(profile=profile, source="repo_local")
-
-    rules = _load_profile_map_rules(profile_map_path)
-    for rule in rules:
-        if _rule_matches(rule, repo_path.name, repo_path):
-            base_profile = await detector.detect(project_id=project_id, cli_profile=None)
-            overrides = _extract_profile_overrides(rule)
-            profile = _apply_profile_overrides(base_profile, overrides)
-            return ProfileResolution(profile=profile, source="profile_map", matched_rule=rule)
-
-    profile = await detector.detect(project_id=project_id, cli_profile=None)
-    return ProfileResolution(profile=profile, source=profile.profile_source or "heuristic")
-
-
-def resolve_profile(
-    *,
-    repo_path: Path,
-    project_id: str,
-    cli_profile: str | Path | None = None,
-    profile_map_path: Path | None = None,
-) -> ProfileResolution:
-    """Synchronous wrapper for resolve_profile_async."""
-    try:
-        asyncio.get_running_loop()
-    except RuntimeError:
-        return asyncio.run(
-            resolve_profile_async(
-                repo_path=repo_path,
-                project_id=project_id,
-                cli_profile=cli_profile,
-                profile_map_path=profile_map_path,
-            )
-        )
-    raise RuntimeError("resolve_profile() cannot be used inside a running event loop.")