icdev 0.0.3__py3-none-any.whl

args/agent_config.yaml

@@ -0,0 +1,113 @@
+application: sparkpilot
+classification: CUI
+agents:
+  orchestrator:
+    port: 9443
+    role: Task routing, workflow management
+    health_endpoint: https://localhost:9443/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-orchestrator.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  architect:
+    port: 9444
+    role: ATLAS A/T phases, system design
+    health_endpoint: https://localhost:9444/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-architect.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  builder:
+    port: 9445
+    role: TDD code gen (RED->GREEN->REFACTOR)
+    health_endpoint: https://localhost:9445/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-builder.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  knowledge:
+    port: 9449
+    role: Self-healing patterns, recommendations
+    health_endpoint: https://localhost:9449/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-knowledge.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  monitor:
+    port: 9450
+    role: Log analysis, metrics, alerts, health checks
+    health_endpoint: https://localhost:9450/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-monitor.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  compliance:
+    port: 9446
+    role: ATO artifacts, 9-framework compliance
+    health_endpoint: https://localhost:9446/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-compliance.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  security:
+    port: 9447
+    role: SAST, dep audit, secret detection
+    health_endpoint: https://localhost:9447/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-security.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  requirements_analyst:
+    port: 9453
+    role: Conversational intake, gap detection, SAFe decomposition
+    health_endpoint: https://localhost:9453/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-requirements_analyst.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  supply_chain:
+    port: 9454
+    role: Dependency graph, SBOM aggregation, ISA lifecycle, CVE triage
+    health_endpoint: https://localhost:9454/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-supply_chain.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  simulation:
+    port: 9455
+    role: Digital Program Twin, Monte Carlo, COA generation
+    health_endpoint: https://localhost:9455/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-simulation.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0
+  devsecops_zta:
+    port: 9457
+    role: DevSecOps pipeline security, Zero Trust, policy-as-code
+    health_endpoint: https://localhost:9457/health
+    tls:
+      enabled: true
+      cert_path: /etc/ssl/certs/sparkpilot-devsecops_zta.crt
+    model:
+      provider: bedrock
+      model_id: anthropic.claude-sonnet-4-5-20250929-v1:0

args/audit_regimes/cisa_sbd.json

@@ -0,0 +1,381 @@
+{
+  "regime": {
+    "id": "cisa_sbd",
+    "name": "CISA Secure by Design",
+    "version": "1.0",
+    "last_updated": "2026-03-09",
+    "description": "CISA Secure by Design pledge — shifting security burden from customers to manufacturers",
+    "authority": "CISA / DHS"
+  },
+  "categories": [
+    {
+      "id": "MS",
+      "name": "Memory Safety",
+      "controls": [
+        {
+          "id": "SBD-MS-01",
+          "title": "Memory-Safe Languages",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "rust|go|java|python|memory_safe|bounds_check"
+            },
+            {
+              "type": "tool",
+              "tool": "sast"
+            }
+          ],
+          "scoring": {
+            "pass": "Codebase uses memory-safe languages or mitigations",
+            "partial": "Mixed languages with partial memory safety coverage",
+            "fail": "No memory safety measures detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SA-8"
+            }
+          ]
+        },
+        {
+          "id": "SBD-MS-02",
+          "title": "Memory Safety Roadmap",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "memory_safety|migration_plan|safe_coding|AddressSanitizer"
+            }
+          ],
+          "scoring": {
+            "pass": "Memory safety roadmap documented",
+            "fail": "No memory safety roadmap"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SA-15"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "DS",
+      "name": "Default Security",
+      "controls": [
+        {
+          "id": "SBD-DS-01",
+          "title": "No Default Passwords",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "secrets"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "default_password|hardcoded_pass|admin123|password123"
+            }
+          ],
+          "scoring": {
+            "pass": "No default or hardcoded passwords found",
+            "fail": "Default or hardcoded passwords detected"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IA-5"
+            }
+          ]
+        },
+        {
+          "id": "SBD-DS-02",
+          "title": "MFA by Default",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "mfa|multi_factor|two_factor|totp|fido|webauthn"
+            }
+          ],
+          "scoring": {
+            "pass": "Multi-factor authentication enabled by default",
+            "partial": "MFA available but not default",
+            "fail": "No MFA capability"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "IA-2(1)"
+            }
+          ]
+        },
+        {
+          "id": "SBD-DS-03",
+          "title": "Least Privilege by Default",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "least_privilege|minimal_permissions|non.?root|default_deny"
+            },
+            {
+              "type": "tool",
+              "tool": "file_permissions"
+            }
+          ],
+          "scoring": {
+            "pass": "Least privilege enforced as default configuration",
+            "fail": "Over-permissive default configuration"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AC-6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SD",
+      "name": "Secure by Default",
+      "controls": [
+        {
+          "id": "SBD-SD-01",
+          "title": "Encryption Enabled by Default",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "TLS|https|encrypt_default|force_ssl|HSTS"
+            }
+          ],
+          "scoring": {
+            "pass": "Encryption enabled by default for data in transit and at rest",
+            "partial": "Encryption available but not default",
+            "fail": "No default encryption"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SC-8"
+            },
+            {
+              "framework": "nist_800_53",
+              "control": "SC-28"
+            }
+          ]
+        },
+        {
+          "id": "SBD-SD-02",
+          "title": "Secure Logging by Default",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "logging|audit_trail|security_log|event_log"
+            },
+            {
+              "type": "tool",
+              "tool": "code_patterns"
+            }
+          ],
+          "scoring": {
+            "pass": "Security-relevant logging enabled by default",
+            "fail": "No default security logging"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "AU-2"
+            }
+          ]
+        },
+        {
+          "id": "SBD-SD-03",
+          "title": "Hardened Default Configuration",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "stig"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "hardened|secure_default|disable_debug|production_mode"
+            }
+          ],
+          "scoring": {
+            "pass": "Default configuration meets hardening baselines",
+            "fail": "Default configuration not hardened"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "CM-6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "TR",
+      "name": "Transparency",
+      "controls": [
+        {
+          "id": "SBD-TR-01",
+          "title": "Vulnerability Disclosure Policy",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "security\\.txt|vulnerability_disclosure|responsible_disclosure|SECURITY\\.md"
+            }
+          ],
+          "scoring": {
+            "pass": "Vulnerability disclosure policy published",
+            "fail": "No vulnerability disclosure policy"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SA-11"
+            }
+          ]
+        },
+        {
+          "id": "SBD-TR-02",
+          "title": "CVE Issuance and Timely Patching",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "code_pattern",
+              "pattern": "cve|patch|advisory|security_bulletin"
+            }
+          ],
+          "scoring": {
+            "pass": "CVE tracking active with timely patch delivery",
+            "partial": "CVE tracking active but patches delayed",
+            "fail": "No CVE tracking or patching process"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-2"
+            }
+          ]
+        },
+        {
+          "id": "SBD-TR-03",
+          "title": "Security Advisories",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "security_advisory|changelog|release_notes|vuln_announce"
+            }
+          ],
+          "scoring": {
+            "pass": "Security advisories published with releases",
+            "fail": "No security advisory process"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SI-5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "SUP",
+      "name": "Supply Chain",
+      "controls": [
+        {
+          "id": "SBD-SUP-01",
+          "title": "SBOM Generation",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "sbom"
+            }
+          ],
+          "scoring": {
+            "pass": "SBOM generated in standard format (CycloneDX/SPDX)",
+            "fail": "No SBOM generated"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SA-4"
+            },
+            {
+              "framework": "nist_800_53",
+              "control": "SR-3"
+            }
+          ]
+        },
+        {
+          "id": "SBD-SUP-02",
+          "title": "Dependency Provenance",
+          "severity": "medium",
+          "evidence_sources": [
+            {
+              "type": "tool",
+              "tool": "dependencies"
+            },
+            {
+              "type": "tool",
+              "tool": "sbom"
+            }
+          ],
+          "scoring": {
+            "pass": "All dependencies have verified provenance",
+            "partial": "Most dependencies have provenance data",
+            "fail": "No dependency provenance tracking"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SR-4"
+            }
+          ]
+        },
+        {
+          "id": "SBD-SUP-03",
+          "title": "Build Integrity",
+          "severity": "high",
+          "evidence_sources": [
+            {
+              "type": "code_pattern",
+              "pattern": "sigstore|cosign|slsa|reproducible_build|build_provenance"
+            }
+          ],
+          "scoring": {
+            "pass": "Build integrity and provenance attestation present",
+            "fail": "No build integrity verification"
+          },
+          "crosswalk": [
+            {
+              "framework": "nist_800_53",
+              "control": "SA-15"
+            },
+            {
+              "framework": "nist_800_53",
+              "control": "SR-3"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}