drydock-cli 3.1.4__tar.gz → 3.1.6__tar.gz

{drydock_cli-3.1.4/drydock_cli.egg-info → drydock_cli-3.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.1.4
+Version: 3.1.6
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -267,6 +267,22 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
+### FIAR audit-readiness (DoD financial-statement audit)
+
+Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
+matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
+assertions, a deterministic **evidence-chain validator** (a control can't be called
+effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
+CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
+`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
+
+**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
+an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
+status → evidence-chain completeness → findings — and **collects the actual evidence files
+each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
+in the evidence *and* the manifest for a releasable version (verified via the Document
+Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
+
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,

{drydock_cli-3.1.4 → drydock_cli-3.1.6}/README.md

@@ -243,6 +243,22 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
+### FIAR audit-readiness (DoD financial-statement audit)
+
+Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
+matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
+assertions, a deterministic **evidence-chain validator** (a control can't be called
+effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
+CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
+`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
+
+**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
+an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
+status → evidence-chain completeness → findings — and **collects the actual evidence files
+each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
+in the evidence *and* the manifest for a releasable version (verified via the Document
+Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
+
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,

{drydock_cli-3.1.4 → drydock_cli-3.1.6}/drydock/fiar.py

@@ -20,6 +20,9 @@ not render an audit judgement.
 from __future__ import annotations
 
 import json
+import re
+import shutil
+import zipfile
 from dataclasses import dataclass, field, asdict
 from datetime import date
 from pathlib import Path
@@ -466,6 +469,139 @@ def new_engagement(name: str, cycle: str, wave: int | None = None) -> Engagement
     })
 
 
+# ── KSD evidence package (audit binder) ────────────────────────────────────
+# Assemble the Key Supporting Documents behind an engagement into a reviewable
+# package: a manifest (control → assertion → KSDs → status → evidence chain →
+# findings) plus the actual evidence files, zipped. Optionally red-box text
+# evidence for a releasable version. Deterministic, stdlib only.
+_FILENAME_RE = re.compile(r"[\w][\w./-]*\.[A-Za-z0-9]{1,6}")
+
+
+def _referenced_files(control: dict, evidence_dir: Path | None) -> list[str]:
+    """Filenames named in the control's evidence / chain text that actually exist
+    in evidence_dir (so the binder collects the KSDs the test cited)."""
+    if not evidence_dir or not evidence_dir.is_dir():
+        return []
+    avail = {p.name: p for p in evidence_dir.iterdir() if p.is_file()}
+    text = " ".join([str(control.get("evidence", "")),
+                     *[str(v) for v in (control.get("evidence_chain") or {}).values()]])
+    found: list[str] = []
+    for m in _FILENAME_RE.findall(text):
+        name = Path(m).name
+        if name in avail and name not in found:
+            found.append(name)
+    return found
+
+
+def build_ksd_package(engagement_path: str | Path, out_dir: str | Path, *,
+                      evidence_dir: str | Path | None = None, cycle: str | None = None,
+                      status: str | None = None, redact: list[str] | None = None) -> dict:
+    """Build a KSD evidence package from an engagement. Collects the cited evidence
+    files (from evidence_dir), writes index.json + index.md, optionally red-boxes
+    text evidence, and zips the binder. Returns a summary dict."""
+    eng = Engagement.load(engagement_path)
+    out = Path(out_dir)
+    (out / "evidence").mkdir(parents=True, exist_ok=True)
+    ev_dir = Path(evidence_dir) if evidence_dir else None
+    redact_terms = [t for t in (redact or []) if t.strip()]
+
+    findings_by_control: dict[str, list] = {}
+    for f in eng._d.get("findings", []):
+        findings_by_control.setdefault(f.get("control_id", ""), []).append(f)
+
+    controls = list(eng._d.get("controls", []))
+    if cycle:
+        controls = [c for c in controls if str(c.get("cycle", "")).upper() == cycle.upper()]
+    if status:
+        controls = [c for c in controls if c.get("status") == status]
+
+    entries = []
+    collected = 0
+    redactions = []
+    for c in controls:
+        cid = c["id"]
+        copied = []
+        for name in _referenced_files(c, ev_dir):
+            dest = out / "evidence" / cid
+            dest.mkdir(parents=True, exist_ok=True)
+            dst = dest / name
+            shutil.copy(ev_dir / name, dst)  # type: ignore[arg-type]
+            if redact_terms and dst.suffix.lower() in (".txt", ".md", ".markdown"):
+                from drydock import doccanvas as dc
+                fmt = "text" if dst.suffix.lower() == ".txt" else "markdown"
+                doc = dc.parse(dst.read_text("utf-8", "replace"), fmt, str(dst))
+                n = 0
+                for term in redact_terms:
+                    try:
+                        n += dc.redact(doc, query=term)["redacted"]
+                    except dc.PatchError:
+                        pass
+                if n:
+                    dst.write_text(dc.render(doc), "utf-8")
+                    redactions.append({"file": f"{cid}/{name}", "redacted": n})
+            copied.append(name)
+            collected += 1
+        entries.append({
+            "id": cid, "cycle": c.get("cycle"), "objective": c.get("objective"),
+            "assertions": c.get("assertions"), "status": c.get("status", "not_tested"),
+            "ksds": c.get("ksds", []), "evidence": c.get("evidence", ""),
+            "evidence_chain": validate_chain(c.get("evidence_chain")),
+            "evidence_files": copied,
+            "findings": [{"id": f.get("id"), "severity": f.get("severity"),
+                          "condition": f.get("condition")} for f in findings_by_control.get(cid, [])],
+        })
+
+    # For a releasable package, scrub the redaction terms from the MANIFEST too
+    # (not just the collected files) so a name/secret can't leak via the binder.
+    if redact_terms:
+        marker = "[REDACTED]"
+        for e in entries:
+            for term in redact_terms:
+                e["evidence"] = e["evidence"].replace(term, marker)
+                for f in e["findings"]:
+                    f["condition"] = (f.get("condition") or "").replace(term, marker)
+
+    manifest = {
+        "engagement": eng.name, "assessable_unit": eng.cycle, "wave": eng.wave,
+        "generated": date.today().isoformat(), "source": Path(engagement_path).name,
+        "control_count": len(entries), "evidence_files_collected": collected,
+        "redactions": redactions, "controls": entries,
+    }
+    (out / "index.json").write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+    (out / "index.md").write_text(_ksd_index_md(manifest), encoding="utf-8")
+
+    zip_path = str(out) + ".zip"
+    with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as z:
+        for p in sorted(out.rglob("*")):
+            if p.is_file():
+                z.write(p, p.relative_to(out.parent))
+    return {"package": str(out), "zip": zip_path, "controls": len(entries),
+            "files_collected": collected, "redactions": len(redactions),
+            "missing_evidence": [e["id"] for e in entries if not e["evidence_files"]]}
+
+
+def _ksd_index_md(m: dict) -> str:
+    lines = [f"# KSD Evidence Package — {m['engagement']}",
+             f"Assessable unit: {m['assessable_unit']} · Wave {m['wave']} · "
+             f"generated {m['generated']} from {m['source']}",
+             f"Controls: {m['control_count']} · evidence files collected: "
+             f"{m['evidence_files_collected']} · redactions: {len(m['redactions'])}", ""]
+    for e in m["controls"]:
+        lines.append(f"## {e['id']} — {e['objective']}")
+        lines.append(f"- Cycle: {e['cycle']}  ·  Assertions: {', '.join(e['assertions'] or [])}"
+                     f"  ·  Status: **{e['status']}**")
+        lines.append(f"- KSDs required: {', '.join(e['ksds']) or '(none listed)'}")
+        ch = e["evidence_chain"]
+        lines.append(f"- Evidence chain: {'COMPLETE' if ch['complete'] else 'INCOMPLETE — missing ' + ', '.join(ch['missing'])}")
+        if e["evidence"]:
+            lines.append(f"- Evidence examined: {e['evidence']}")
+        lines.append(f"- Evidence files: {', '.join('evidence/'+e['id']+'/'+f for f in e['evidence_files']) or '⚠ NONE collected'}")
+        for f in e["findings"]:
+            lines.append(f"- FINDING {f['id']} ({f['severity']}): {f['condition']}")
+        lines.append("")
+    return "\n".join(lines)
+
+
 # ── CLI ───────────────────────────────────────────────────────────────────
 def _main(argv: list[str]) -> int:
     import argparse
@@ -482,6 +618,9 @@ def _main(argv: list[str]) -> int:
     q = sub.add_parser("reconcile"); q.add_argument("entity", type=float)
     q.add_argument("source", type=float); q.add_argument("--tolerance", type=float, default=0.0)
     q = sub.add_parser("cycles")
+    q = sub.add_parser("package"); q.add_argument("path"); q.add_argument("out")
+    q.add_argument("--evidence-dir"); q.add_argument("--cycle"); q.add_argument("--status")
+    q.add_argument("--redact", action="append", default=[])
     a = p.parse_args(argv)
 
     if a.cmd == "cycles":
@@ -491,10 +630,23 @@ def _main(argv: list[str]) -> int:
     if a.cmd == "reconcile":
         r = reconcile(a.entity, a.source, tolerance=a.tolerance)
         print(json.dumps(r, indent=2)); return 0 if r["reconciled"] else 1
+    if a.cmd == "package":
+        r = build_ksd_package(a.path, a.out, evidence_dir=a.evidence_dir,
+                              cycle=a.cycle, status=a.status, redact=a.redact)
+        print(f"KSD package: {r['controls']} controls, {r['files_collected']} evidence file(s)"
+              + (f", {r['redactions']} file(s) redacted" if r["redactions"] else "")
+              + f" → {r['package']}/  (+ {Path(r['zip']).name})")
+        if r["missing_evidence"]:
+            print(f"⚠ no evidence file collected for: {', '.join(r['missing_evidence'])}")
+        return 0
     if a.cmd == "new":
         eng = new_engagement(a.name, a.cycle, wave=a.wave); eng.save(a.path)
         print(f"created {a.path}: {eng.name} / {eng.cycle} (Wave {eng.wave}) "
-              f"— {len(eng.controls)} controls"); return 0
+              f"— {len(eng.controls)} controls")
+        if not eng.controls and a.cycle.strip().upper() not in ("*", "ALL"):
+            print(f"⚠ 0 controls seeded — '{a.cycle}' is not a known cycle. Valid cycles: "
+                  f"{', '.join(CYCLES)}, or ALL. (See: python -m drydock.fiar cycles)")
+        return 0
 
     eng = Engagement.load(a.path)
     if a.cmd == "controls":

{drydock_cli-3.1.4 → drydock_cli-3.1.6}/drydock/tools/__init__.py

@@ -654,6 +654,31 @@ SCHEMAS = [
             "required": ["entity", "source"],
         },
     },
+    {
+        "name": "FiarPackage",
+        "description": (
+            "Assemble a KSD AUDIT EVIDENCE PACKAGE from a FIAR engagement: a binder "
+            "(index.md + index.json mapping each control → assertions → KSDs → status → "
+            "evidence-chain completeness → findings) plus the actual evidence files it "
+            "cited (collected from `evidence_dir`), zipped. Pass `redact` (one or a list "
+            "of terms) to red-box names/secrets in the text evidence AND the manifest for "
+            "a releasable version — the original engagement is untouched. Optionally filter "
+            "by `cycle` or `status`."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string", "description": "Engagement JSON path."},
+                "out": {"type": "string", "description": "Output package directory (a .zip is written beside it)."},
+                "evidence_dir": {"type": "string", "description": "Directory holding the KSD evidence files to collect."},
+                "cycle": {"type": "string", "description": "Only include this cycle (e.g. FBWT)."},
+                "status": {"type": "string", "description": "Only include controls with this status."},
+                "redact": {"type": "array", "items": {"type": "string"},
+                           "description": "Terms to red-box in evidence files + manifest for release."},
+            },
+            "required": ["path", "out"],
+        },
+    },
     {
         "name": "GraphQuery",
         "description": (
@@ -973,6 +998,13 @@ def _file_index(lines: list[str], fp: str) -> str:
         f"offset/limit (e.g. {{\"file_path\": ..., \"offset\": <line-1>, "
         f"\"limit\": 120}}).\n"
     )
+    if is_doc:
+        head += (
+            "To SEARCH or EDIT this document, prefer the DOCUMENT CANVAS: DocOpen, then "
+            "DocSearch/DocRead a region and DocPatch/DocReplace/DocRedact by block id → "
+            "DocValidate → DocCommit — it edits precisely without loading the whole file "
+            "(don't rewrite a large document with Write/Edit).\n"
+        )
     if not anchors:
         return head + "(no def/class/header anchors found — read ranges with offset/limit.)"
     body = "\n".join(anchors[:400])
@@ -2186,6 +2218,35 @@ def tool_fiarreconcile(params: dict, config: dict) -> str:
             f"difference {r['difference']:,.2f} (tolerance {r['tolerance']:,.2f}).")
 
 
+def tool_fiarpackage(params: dict, config: dict) -> str:
+    """Assemble a KSD audit evidence package (binder + files, zipped) from an engagement."""
+    from drydock import fiar
+    path = _as_str_arg(params.get("path") or "")
+    out = _as_str_arg(params.get("out") or params.get("out_dir") or "")
+    if not path or not out:
+        return "Error: FiarPackage needs `path` (engagement JSON) and `out` (package directory)."
+    redact = params.get("redact")
+    if isinstance(redact, str):
+        redact = [redact]
+    try:
+        r = fiar.build_ksd_package(
+            path, out,
+            evidence_dir=_as_str_arg(params.get("evidence_dir") or "") or None,
+            cycle=_as_str_arg(params.get("cycle") or "") or None,
+            status=_as_str_arg(params.get("status") or "") or None,
+            redact=[str(x) for x in redact] if isinstance(redact, list) else None)
+    except FileNotFoundError:
+        return f"Error: engagement not found: {path}"
+    except Exception as e:
+        return f"Error building KSD package: {e}"
+    msg = (f"KSD package built: {r['controls']} control(s), {r['files_collected']} evidence file(s)"
+           + (f", {r['redactions']} file(s) red-boxed" if r["redactions"] else "")
+           + f" → {r['package']}/ (index.md + index.json + evidence/, zipped as {Path(r['zip']).name}).")
+    if r["missing_evidence"]:
+        msg += f" ⚠ no evidence file collected for: {', '.join(r['missing_evidence'])}."
+    return msg
+
+
 def tool_graphquery(params: dict, config: dict) -> str:
     """Traverse the RMF typed ontology graph (read-only)."""
     rmf_graph, g, _ = _rmf_graph(config)
@@ -2618,6 +2679,7 @@ _TOOLS = [
     ("FiarAssess", tool_fiarassess, False),
     ("FiarFinding", tool_fiarfinding, False),
     ("FiarReconcile", tool_fiarreconcile, True),
+    ("FiarPackage", tool_fiarpackage, False),
     ("WebSearch", tool_websearch, True),
     ("WebFetch", tool_webfetch, True),
     ("GitStatus", tool_gitstatus, True),
@@ -2653,7 +2715,7 @@ def register_all():
             "StigRules": tool_stigrules, "StigRule": tool_stigrule, "StigSet": tool_stigset,
             "FiarControls": tool_fiarcontrols, "FiarControl": tool_fiarcontrol,
             "FiarAssess": tool_fiarassess, "FiarFinding": tool_fiarfinding,
-            "FiarReconcile": tool_fiarreconcile,
+            "FiarReconcile": tool_fiarreconcile, "FiarPackage": tool_fiarpackage,
             "WebSearch": tool_websearch, "WebFetch": tool_webfetch,
             "GitStatus": tool_gitstatus, "GitDiff": tool_gitdiff,
             "GitLog": tool_gitlog, "GitCommit": tool_gitcommit,

{drydock_cli-3.1.4 → drydock_cli-3.1.6/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.1.4
+Version: 3.1.6
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0
@@ -267,6 +267,22 @@ exports the open findings to a deterministic **eMASS POA&M CSV** — Control (fr
 the CCI map), Vulnerability Description, `POA&M Status=Ongoing`, Milestone (the
 Fix Text), and Severity (CAT I/II/III → High/Moderate/Low) — no LLM, stdlib only.
 
+### FIAR audit-readiness (DoD financial-statement audit)
+
+Model a Financial Improvement and Audit Readiness engagement — a seeded key-control
+matrix per business cycle (FBWT, P2P, PP&E, INV, CIVPAY, REIM, FR, ITGC), the five FS
+assertions, a deterministic **evidence-chain validator** (a control can't be called
+effective on an incomplete population→sample→…→GL→assertion trace), findings (NFRs), and
+CAPs. `python -m drydock.fiar new|controls|control|assess|reconcile|package`; skills
+`/fiar-assess /fiar-evidence /fiar-readiness /fiar-cap`.
+
+**KSD evidence packaging.** `fiar package <engagement> <out> --evidence-dir <dir>` assembles
+an audit binder — `index.md` + `index.json` mapping every control → assertions → KSDs →
+status → evidence-chain completeness → findings — and **collects the actual evidence files
+each test cited**, zipped. Add `--redact "<term>"` (repeatable) to **red-box** names/secrets
+in the evidence *and* the manifest for a releasable version (verified via the Document
+Canvas); the original engagement is never touched. Also exposed as the `FiarPackage` tool.
+
 ### Document Canvas — editing documents far larger than the context window
 
 Edit a 300-, 800-, 1000-page document the way you edit a large codebase: **search,

{drydock_cli-3.1.4 → drydock_cli-3.1.6}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.1.4"
+version = "3.1.6"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

{drydock_cli-3.1.4 → drydock_cli-3.1.6}/tests/test_fiar.py

@@ -209,3 +209,60 @@ def test_effective_without_chain_advises(tmp_path):
 def test_control_detail_shows_chain_state(tmp_path):
     p = _mk(tmp_path)
     assert "not traced" in tool_fiarcontrol({"path": p, "id": "FBWT-01"}, {})
+
+
+# ── KSD evidence packaging ────────────────────────────────────────────────
+def _mk_assessed(tmp_path):
+    """Engagement with FBWT-01 effective (evidence cites recon.txt + full chain)
+    and FBWT-02 deficient with a finding; plus an evidence dir holding recon.txt."""
+    p = _mk(tmp_path)
+    ev = tmp_path / "evidence"
+    ev.mkdir()
+    (ev / "recon.txt").write_text("Recon: preparer J. Smith; GL ties to Treasury 0.00.\n")
+    e = fiar.Engagement.load(p)
+    e.assess("FBWT-01", status="effective",
+             evidence="Examined recon.txt: ties out, preparer J. Smith signed.",
+             chain={k: f"ev-{k}" for k in fiar.EVIDENCE_CHAIN})
+    e.assess("FBWT-02", status="deficient", evidence="No aging report provided.")
+    e.add_finding(control_id="FBWT-02", condition="UDO aging not maintained",
+                  severity="significant_deficiency")
+    e.save(p)
+    return p, str(ev)
+
+
+def test_ksd_package_builds_binder_and_zip(tmp_path):
+    p, ev = _mk_assessed(tmp_path)
+    out = tmp_path / "pkg"
+    r = fiar.build_ksd_package(p, out, evidence_dir=ev)
+    assert (out / "index.json").exists() and (out / "index.md").exists()
+    assert (tmp_path / "pkg.zip").exists()
+    assert (out / "evidence" / "FBWT-01" / "recon.txt").exists()  # cited file collected
+    assert r["files_collected"] == 1
+    assert "FBWT-02" in r["missing_evidence"]                     # no file cited
+    man = json.loads((out / "index.json").read_text())
+    by_id = {c["id"]: c for c in man["controls"]}
+    assert by_id["FBWT-01"]["evidence_chain"]["complete"] is True
+    assert by_id["FBWT-02"]["evidence_chain"]["complete"] is False
+    assert by_id["FBWT-02"]["findings"][0]["severity"] == "significant_deficiency"
+
+
+def test_ksd_package_redaction_no_leak(tmp_path):
+    p, ev = _mk_assessed(tmp_path)
+    out = tmp_path / "rel"
+    fiar.build_ksd_package(p, out, evidence_dir=ev, redact=["J. Smith"])
+    # the name must be gone from BOTH the collected file AND the manifest
+    assert "J. Smith" not in (out / "evidence" / "FBWT-01" / "recon.txt").read_text()
+    assert "J. Smith" not in (out / "index.json").read_text()
+    assert "J. Smith" not in (out / "index.md").read_text()
+    assert "[REDACTED]" in (out / "index.md").read_text()
+    # original engagement + evidence dir are untouched
+    assert "J. Smith" in fiar.Engagement.load(p).control("FBWT-01").evidence
+
+
+def test_ksd_package_cycle_filter(tmp_path):
+    p = _mk(tmp_path, cycle="ALL")
+    out = tmp_path / "fbwt_only"
+    r = fiar.build_ksd_package(p, out, cycle="FBWT")
+    man = json.loads((out / "index.json").read_text())
+    assert r["controls"] >= 1
+    assert all(c["cycle"] == "FBWT" for c in man["controls"])