icdev 0.0.3__py3-none-any.whl

args/control_inheritance.yaml

@@ -0,0 +1,177 @@
+# CUI // SP-CTI
+# Control Inheritance Configuration
+# Three-tier inheritance model for FedRAMP/NIST 800-53 controls
+# ADR: D-ARCH-11 — Three-tier control inheritance with AWS GovCloud base
+
+tiers:
+  tier1:
+    name: "AWS GovCloud"
+    description: "Infrastructure-level controls inherited from AWS us-gov-west-1"
+    provider: "aws-govcloud"
+    controls:
+      # Physical & Environmental Protection — fully inherited from AWS
+      - PE-1
+      - PE-2
+      - PE-3
+      - PE-4
+      - PE-5
+      - PE-6
+      - PE-8
+      - PE-9
+      - PE-10
+      - PE-11
+      - PE-12
+      - PE-13
+      - PE-14
+      - PE-15
+      - PE-16
+      - PE-17
+      - PE-18
+      # System & Communications Protection — partially inherited
+      - SC-7   # Boundary protection (AWS VPC, security groups)
+      - SC-39  # Process isolation (hypervisor)
+      - SC-12  # Cryptographic key establishment (KMS)
+      # Contingency Planning — data center level
+      - CP-2   # Contingency plan (AWS multi-AZ)
+      - CP-6   # Alternate storage site
+      - CP-7   # Alternate processing site
+      - CP-8   # Telecommunications services
+      # Media Protection
+      - MP-4   # Media storage
+      - MP-5   # Media transport
+      - MP-6   # Media sanitization
+      # Maintenance
+      - MA-2   # Controlled maintenance
+      - MA-3   # Maintenance tools
+      - MA-4   # Nonlocal maintenance
+      - MA-5   # Maintenance personnel
+      - MA-6   # Timely maintenance
+      # Personnel Security
+      - PS-1
+      - PS-2
+      - PS-3
+      - PS-4
+      - PS-5
+      - PS-6
+      - PS-7
+      - PS-8
+      # System & Information Integrity (hardware/infra)
+      - SI-13  # Predictable failure prevention
+      # Supply Chain (AWS side)
+      - SR-1
+      - SR-2
+      - SR-3
+
+  tier2:
+    name: "ICDEV Platform"
+    description: "Platform-level controls implemented by ICDEV tools and agents"
+    controls:
+      # Access Control
+      - AC-1   # Policy & procedures (CLAUDE.md + goals/)
+      - AC-2   # Account management (auth system)
+      - AC-3   # Access enforcement (RBAC)
+      - AC-4   # Information flow (event bus, A2A mTLS)
+      - AC-6   # Least privilege (agent trust tiers)
+      - AC-7   # Unsuccessful logon attempts
+      - AC-8   # System use notification (CUI banners)
+      - AC-11  # Session lock
+      - AC-14  # Permitted actions without ID
+      - AC-17  # Remote access (mTLS, VPN)
+      # Audit & Accountability
+      - AU-1   # Policy & procedures
+      - AU-2   # Audit events (audit_trail table)
+      - AU-3   # Content of audit records
+      - AU-4   # Audit storage capacity
+      - AU-5   # Response to audit failures
+      - AU-6   # Audit review/analysis (monitor agent)
+      - AU-7   # Audit reduction/report
+      - AU-8   # Time stamps
+      - AU-9   # Protection of audit info (append-only D6)
+      - AU-11  # Audit record retention
+      - AU-12  # Audit generation
+      # Configuration Management
+      - CM-1   # Policy & procedures
+      - CM-2   # Baseline configuration (args/ YAML)
+      - CM-3   # Configuration change control
+      - CM-4   # Security impact analysis (boundary_analyzer)
+      - CM-5   # Access restrictions for change
+      - CM-6   # Configuration settings
+      - CM-7   # Least functionality
+      - CM-8   # Information system component inventory (SBOM)
+      # Identification & Authentication
+      - IA-1   # Policy & procedures
+      - IA-2   # User identification (API key + session)
+      - IA-4   # Identifier management
+      - IA-5   # Authenticator management
+      - IA-8   # Non-organizational users
+      # System & Information Integrity
+      - SI-1   # Policy & procedures
+      - SI-2   # Flaw remediation (dependency_auditor)
+      - SI-3   # Malicious code protection (sast_runner)
+      - SI-4   # System monitoring (monitor agent)
+      - SI-5   # Security alerts (event bus)
+      - SI-10  # Information input validation (prompt_injection_detector)
+      - SI-16  # Memory protection
+      # Risk Assessment
+      - RA-1   # Policy & procedures
+      - RA-3   # Risk assessment
+      - RA-5   # Vulnerability scanning (sast, dep audit, container scan)
+      # Security Assessment
+      - CA-1   # Policy & procedures
+      - CA-2   # Security assessments (fedramp_assessor, stig_checker)
+      - CA-5   # Plan of action & milestones (poam_generator)
+      - CA-7   # Continuous monitoring (cato_live_engine)
+      # Planning
+      - PL-1   # Policy & procedures
+      - PL-2   # System security plans (ssp_generator)
+      - PL-4   # Rules of behavior
+
+  tier3:
+    name: "Child Applications"
+    description: "Application-specific controls inherited via Golden Path scaffolding"
+    controls:
+      # Application-level access control
+      - AC-5   # Separation of duties (app-specific roles)
+      - AC-10  # Concurrent session control
+      - AC-12  # Session termination
+      # Application-level audit
+      - AU-10  # Non-repudiation
+      # Application-level configuration
+      - CM-9   # Configuration management plan
+      - CM-11  # User-installed software
+      # Application-level IA
+      - IA-3   # Device identification (embedded/IoT)
+      - IA-6   # Authenticator feedback
+      # Application-level SA
+      - SA-3   # System development lifecycle
+      - SA-4   # Acquisition process
+      - SA-8   # Security engineering principles
+      - SA-10  # Developer configuration management
+      - SA-11  # Developer security testing
+      # Application-level SC
+      - SC-8   # Transmission confidentiality (app-level TLS)
+      - SC-13  # Cryptographic protection (app-level)
+      - SC-28  # Protection of information at rest
+
+shared_responsibilities:
+  # Controls split across multiple tiers
+  - control: SC-7
+    tiers: [tier1, tier2]
+    tier1_responsibility: "VPC, security groups, NACLs"
+    tier2_responsibility: "Application firewall rules, A2A mTLS, NetworkPolicy"
+  - control: SC-8
+    tiers: [tier2, tier3]
+    tier2_responsibility: "Platform-level TLS termination"
+    tier3_responsibility: "Application-level encryption in transit"
+  - control: CM-2
+    tiers: [tier2, tier3]
+    tier2_responsibility: "Platform baseline (args/ YAML configs)"
+    tier3_responsibility: "Application baseline (app-specific configs)"
+  - control: IA-2
+    tiers: [tier2, tier3]
+    tier2_responsibility: "Platform authentication (API key, session)"
+    tier3_responsibility: "Application-level user authentication"
+  - control: SI-4
+    tiers: [tier1, tier2]
+    tier1_responsibility: "CloudWatch, GuardDuty, CloudTrail"
+    tier2_responsibility: "Monitor agent, OTel tracing, event bus"

args/csp_mcp_config.yaml

@@ -0,0 +1,41 @@
+# CSP MCP Configuration for sparkpilot
+provider: aws
+region: us-gov-west-1
+govcloud: false
+mcp_servers:
+  - name: "@aws/core-mcp-server"
+    category: "core"
+    transport: stdio
+  - name: "@aws/aws-api-mcp-server"
+    category: "core"
+    transport: stdio
+  - name: "@aws/cdk-mcp-server"
+    category: "iac"
+    transport: stdio
+  - name: "@aws/terraform-mcp-server"
+    category: "iac"
+    transport: stdio
+  - name: "@aws/cloudformation-mcp-server"
+    category: "iac"
+    transport: stdio
+  - name: "@aws/iam-mcp-server"
+    category: "security"
+    transport: stdio
+  - name: "@aws/well-architected-security-mcp-server"
+    category: "security"
+    transport: stdio
+  - name: "@aws/cloudwatch-mcp-server"
+    category: "monitoring"
+    transport: stdio
+  - name: "@aws/cloudtrail-mcp-server"
+    category: "monitoring"
+    transport: stdio
+  - name: "@aws/cost-explorer-mcp-server"
+    category: "monitoring"
+    transport: stdio
+  - name: "@aws/aws-documentation-mcp-server"
+    category: "docs"
+    transport: stdio
+  - name: "@aws/aws-knowledge-mcp-server"
+    category: "docs"
+    transport: stdio

args/cui_markings.yaml

@@ -0,0 +1,35 @@
+# CUI Classification Marking Configuration
+# Applied to all ICDEV-generated artifacts per DoD CUI Program
+
+enabled: false
+
+banner_top: "CUI // SP-CTI"
+banner_bottom: "CUI // SP-CTI"
+
+designation_indicator:
+  controlled_by: "Department of Defense"
+  categories: "CTI"
+  distribution: "Distribution D"
+  poc: "ICDEV System Administrator"
+
+portion_marking: "(CUI)"
+decontrol_instructions: "Decontrol on: 10 years from creation date"
+
+# File-type specific templates
+code_header: |
+  CUI // SP-CTI
+  Controlled by: Department of Defense
+  CUI Category: CTI
+  Distribution: D
+  POC: ICDEV System Administrator
+
+document_header: |
+  //////////////////////////////////////////////////////////////////
+  CONTROLLED UNCLASSIFIED INFORMATION (CUI) // SP-CTI
+  Distribution: Distribution D — Authorized DoD Personnel Only
+  //////////////////////////////////////////////////////////////////
+
+document_footer: |
+  //////////////////////////////////////////////////////////////////
+  CUI // SP-CTI | Department of Defense
+  //////////////////////////////////////////////////////////////////

args/databridge_config.yaml

@@ -0,0 +1,232 @@
+# CUI // SP-CTI
+# DataBridge Configuration (D-DB-1 through D-DB-20)
+# Universal Data & Storage Connector for ICDEV
+
+databridge:
+  enabled: true
+  version: "1.0.0"
+
+  # ------------------------------------------------------------------
+  # Marketplace tier limits (D-DB-11)
+  # ------------------------------------------------------------------
+  tiers:
+    free:
+      max_connections: 3
+      connectors:
+        - sqlite
+        - csv
+        - json
+      streaming_enabled: false
+      on_prem_enabled: false
+      max_rows_per_sync: 10000
+      max_mappings: 5
+      analytics_enabled: false
+    paid:
+      max_connections: -1          # unlimited
+      connectors: all
+      streaming_enabled: true
+      on_prem_enabled: true
+      max_rows_per_sync: -1        # unlimited
+      max_mappings: -1             # unlimited
+      analytics_enabled: true
+
+  # ------------------------------------------------------------------
+  # Apache Arrow pipeline (D-DB-3)
+  # ------------------------------------------------------------------
+  arrow:
+    default_batch_size: 10000
+    max_batch_size: 100000
+    memory_limit_mb: 512
+
+  # ------------------------------------------------------------------
+  # DuckDB analytics engine (D-DB-5)
+  # ------------------------------------------------------------------
+  duckdb:
+    enabled: true
+    memory_limit_mb: 256
+    threads: 4
+    max_query_rows: 100000
+
+  # ------------------------------------------------------------------
+  # Schema inference (D-DB-14)
+  # ------------------------------------------------------------------
+  schema:
+    auto_infer: true
+    sample_rows: 1000
+    version_on_change: true
+
+  # ------------------------------------------------------------------
+  # PII detection via Microsoft Presidio (D-DB-9)
+  # ------------------------------------------------------------------
+  pii:
+    enabled: true
+    provider: presidio
+    entities:
+      - PERSON
+      - EMAIL_ADDRESS
+      - PHONE_NUMBER
+      - CREDIT_CARD
+      - US_SSN
+      - IP_ADDRESS
+      - US_PASSPORT
+      - US_BANK_NUMBER
+    action: mask                    # mask, redact, encrypt, flag_only
+    confidence_threshold: 0.7
+
+  # ------------------------------------------------------------------
+  # CUI field-level marking (D-DB-8)
+  # ------------------------------------------------------------------
+  cui:
+    enabled: true
+    il4_field_marking: true         # IL4+ gets field-level CUI tags
+    commercial_skip: true           # IL2 / commercial / demo skips marking
+    default_marking: "CUI // SP-CTI"
+
+  # ------------------------------------------------------------------
+  # Sync defaults
+  # ------------------------------------------------------------------
+  sync:
+    default_cadence_minutes: 60
+    retry_count: 3
+    retry_delay_seconds: 30
+    timeout_seconds: 300
+    max_concurrent_syncs: 5
+
+  # ------------------------------------------------------------------
+  # FIPS 140-3 TLS (D-DB-20)
+  # ------------------------------------------------------------------
+  fips:
+    enabled: false                  # Activate at IL4+ if required
+    tls_min_version: "1.2"
+    cipher_suites:
+      - TLS_AES_256_GCM_SHA384
+      - TLS_AES_128_GCM_SHA256
+      - TLS_CHACHA20_POLY1305_SHA256
+
+  # ------------------------------------------------------------------
+  # RAG integration (D-DB-17)
+  # ------------------------------------------------------------------
+  rag:
+    enabled: false                  # Off by default; toggled per connection
+    auto_register_sources: true
+    source_types:
+      - db_sync_log
+      - db_schemas
+
+  # ------------------------------------------------------------------
+  # On-prem agent (D-DB-10)
+  # ------------------------------------------------------------------
+  agent:
+    heartbeat_interval_seconds: 60
+    reconnect_delay_seconds: 30
+    max_reconnect_attempts: 10
+    websocket_url: "wss://relay.icdev.example.com/ws/agent"
+
+  # ------------------------------------------------------------------
+  # Microservice mode (D-DB-19)
+  # ------------------------------------------------------------------
+  server:
+    enabled: false
+    port: 5060
+    host: "0.0.0.0"
+    workers: 2
+
+  # ------------------------------------------------------------------
+  # Data mapping
+  # ------------------------------------------------------------------
+  mapping:
+    max_lookup_table_rows: 50000
+    preview_sample_rows: 10
+    auto_map_similarity_threshold: 0.7
+
+  # ------------------------------------------------------------------
+  # Messaging (Phase 71, D-DB-21 through D-DB-30)
+  # ------------------------------------------------------------------
+  messaging:
+    enabled: true
+    daemon:
+      heartbeat_interval_seconds: 30
+      reconnect_delay_seconds: 15
+      max_reconnect_attempts: 20
+      auto_start_on_dashboard: false
+    agent_bridge:
+      default_agent: orchestrator
+      default_agent_url: "http://localhost:9443"
+      response_timeout_seconds: 30
+    message_logging:
+      pii_auto_scan: true
+      pii_action: flag_only
+      max_content_length: 32000
+    oauth2:
+      callback_base_url: "http://localhost:5050"
+      state_ttl_seconds: 600
+    webhooks:
+      signature_validation: true
+      max_payload_bytes: 1048576
+
+  # ------------------------------------------------------------------
+  # Connector Forge (Phase 78, D-CF-1 through D-CF-10)
+  # Dynamic connector generation, validation, sandbox, promotion
+  # ------------------------------------------------------------------
+  forge:
+    enabled: true
+    llm_function: connector_code_generation
+    sandbox:
+      primary: docker
+      fallback: subprocess
+      docker_image: "python:3.11-slim"
+      docker_timeout_seconds: 60
+      docker_memory_limit: "256m"
+      docker_cpus: "0.5"
+      docker_network: "none"
+      subprocess_timeout_seconds: 30
+      allowed_imports:
+        - requests
+        - urllib
+        - ssl
+        - socket
+        - json
+        - xml.etree.ElementTree
+        - zeep
+        - hl7
+        - fhirclient
+        - pyarrow
+        - sqlalchemy
+        - oauthlib
+    validation:
+      run_py_compile: true
+      run_ruff: true
+      run_ast_abc_check: true
+      run_bandit: true
+      run_secret_scan: true
+      run_import_whitelist: true
+    promotion:
+      require_human_review: true
+      auto_promote_on_all_pass: false
+    marketplace:
+      asset_type: databridge_connector
+      install_dir: tools/databridge/connectors
+
+  # ------------------------------------------------------------------
+  # Scale Engine (D-SC-1 through D-SC-7)
+  # Horizontal scaling: worker pool, connection pool, write batcher
+  # ------------------------------------------------------------------
+  scale:
+    enabled: false
+    worker_pool:
+      max_workers: 10
+      max_concurrent_syncs: 5
+      sync_timeout_seconds: 300
+    connection_pool:
+      max_per_type: 5
+      idle_timeout_seconds: 300
+      health_check_on_acquire: false
+    write_batcher:
+      flush_interval_ms: 500
+      max_buffer_size: 100
+    backpressure:
+      memory_threshold_mb: 400
+      pause_on_threshold: true
+    chunked_pipeline:
+      chunk_size: 10000
+      enabled: true

args/db_config.yaml

@@ -0,0 +1,116 @@
+# SPARKPILOT Database Configuration
+# SQLite operational database settings for all three primary databases
+# Classification: CUI // SP-CTI
+
+classification: "CUI // SP-CTI"
+distribution: "Distribution D: Authorized DoD Personnel Only"
+
+databases:
+  # Primary operational database — 32 tables covering devices, firmware, fleet,
+  # compliance, agents, missions, simulator, edge AI, and audit trail
+  primary:
+    path: "data/icdev.db"
+    label: sparkpilot
+    description: "Main operational DB: projects, agents, audit trail, compliance, MBSE, RICOAS"
+
+  # Memory system database — entries, daily logs, access log, embeddings
+  memory:
+    path: "data/memory.db"
+    label: memory
+    description: "Memory system: entries, daily logs, access log, embeddings (text-embedding-3-small)"
+
+  # Task tracking database
+  activity:
+    path: "data/activity.db"
+    label: activity
+    description: "Task tracking: tasks table"
+
+connection:
+  # WAL (Write-Ahead Logging) mode improves concurrent read performance and
+  # reduces lock contention. Required for multi-agent workloads.
+  wal_mode: true
+
+  # Milliseconds to wait when a database is locked before raising an error.
+  # Covers bursts of concurrent agent writes without failing immediately.
+  busy_timeout_ms: 5000
+
+  # Maximum simultaneous SQLite connections per database.
+  # SQLite serializes writes; this limits reader concurrency.
+  max_connections: 5
+
+  # SQLite cache size in kilobytes (negative = KB, positive = pages).
+  # 16 MB cache reduces disk I/O for repeated queries.
+  cache_size_kb: -16384
+
+  # Enable foreign key enforcement — SQLite disables it by default.
+  foreign_keys: true
+
+  # SQLite journal mode applied on every new connection.
+  # "wal" is set here as a belt-and-suspenders complement to wal_mode above.
+  journal_mode: "wal"
+
+  # Synchronous mode. "NORMAL" is safe with WAL and avoids fsync overhead.
+  synchronous: "NORMAL"
+
+integrity:
+  # Run PRAGMA integrity_check on startup to catch corruption early.
+  check_on_startup: true
+
+  # Periodic integrity check schedule (cron syntax, UTC).
+  check_schedule_cron: "0 2 * * *"   # 02:00 UTC daily
+
+  # Maximum number of integrity errors before alerting.
+  max_errors_before_alert: 0
+
+backup:
+  enabled: true
+
+  # Backup destination relative to project root.
+  backup_dir: "data/backups"
+
+  # Incremental backup using SQLite Online Backup API (non-blocking).
+  mode: "online_backup"
+
+  # Backup schedule (cron syntax, UTC).
+  schedule_cron: "0 3 * * *"          # 03:00 UTC daily
+
+  # Number of backup generations to retain before rotation.
+  retention_days: 30
+
+  # Compress backup files (gzip).
+  compress: true
+
+  # Alert if the most recent backup is older than this many hours.
+  max_backup_age_hours: 25
+
+  # Databases included in scheduled backups.
+  include:
+    - sparkpilot
+    - memory
+    - activity
+
+migrations:
+  # Directory containing SQL migration scripts (named NNN_description.sql).
+  migrations_dir: "tools/db/migrations"
+
+  # Automatically apply pending migrations on application startup.
+  auto_migrate: true
+
+  # Lock timeout in seconds while acquiring migration lock.
+  lock_timeout_seconds: 30
+
+audit:
+  # Audit trail tables are append-only (NIST AU compliance — D6).
+  # These tables must NEVER receive UPDATE or DELETE operations.
+  append_only_tables:
+    - audit_trail
+    - compliance_evidence
+    - firmware_deploy_log
+    - ota_update_log
+    - fleet_canary_log
+    - marketplace_invoices
+    - wg_analysis_results
+    - wg_analysis_findings
+
+  # Warn if any migration contains UPDATE/DELETE targeting append-only tables.
+  enforce_append_only: true