icdev 0.0.3__py3-none-any.whl

hardprompts/agent/governance_review.md

@@ -0,0 +1,214 @@
+# [TEMPLATE: CUI // SP-CTI]
+
+# Governance Review Prompt
+
+## Role
+
+You are reviewing a generated child application for governance compliance. This review runs after the agentic generation workflow (Step 6) and must pass before the child application is considered ready for use. Your job is to verify that every governance requirement is satisfied and flag any violations.
+
+## Context
+
+The child application was generated by ICDEV using the agentic generation workflow. It should be a self-contained agentic system with its own GOTCHA framework, agents, memory, and CI/CD — but it must NOT have the ability to generate its own child applications.
+
+- **Application Name:** {{app_name}}
+- **Application Path:** {{app_path}}
+- **Impact Level:** {{impact_level}}
+- **Blueprint Hash:** {{blueprint_hash}}
+- **Generation Timestamp:** {{generation_timestamp}}
+
+## Governance Checklist
+
+Review each item and report PASS, FAIL, or WARN with details.
+
+### 1. Classification Markings
+All generated files must carry classification markings appropriate to the impact level.
+- Python files: CUI marking in file header comment
+- Markdown files: CUI marking as first line
+- YAML/JSON files: CUI marking in top-level comment or metadata
+- Reports: CUI banner at top and bottom
+
+**Check:**
+```bash
+# Count files with CUI headers (IL4/IL5)
+grep -r "CUI // SP-CTI" {{app_path}}/tools/ | wc -l
+grep -r "CUI // SP-CTI" {{app_path}}/goals/ | wc -l
+grep -r "CUI // SP-CTI" {{app_path}}/hardprompts/ | wc -l
+
+# For IL6: check SECRET markings
+grep -r "SECRET // NOFORN" {{app_path}}/tools/ | wc -l
+```
+
+**PASS condition:** Every .py, .md file has appropriate classification marking. Zero unmarked files.
+
+### 2. Audit Trail Integrity
+The audit trail must be append-only with no UPDATE or DELETE operations permitted.
+
+**Check:**
+```bash
+# Search for UPDATE or DELETE on audit tables
+grep -r "UPDATE audit" {{app_path}}/tools/ --include="*.py"
+grep -r "DELETE FROM audit" {{app_path}}/tools/ --include="*.py"
+# Both should return empty
+```
+
+**PASS condition:** Zero UPDATE or DELETE statements on audit tables in any Python file.
+
+### 3. Agent Communication Security
+All agent-to-agent communication must use mutual TLS.
+
+**Check:**
+- Agent config references TLS certificates
+- K8s manifests include TLS secret mounts
+- Network policies restrict inter-agent traffic
+
+**PASS condition:** All agent configs reference TLS. Network policies present in K8s manifests.
+
+### 4. Container Security
+All containers must be hardened per STIG requirements.
+
+**Check:**
+```bash
+# Verify Dockerfile security
+grep "USER 1000" {{app_path}}/docker/Dockerfile.*
+grep "readOnlyRootFilesystem" {{app_path}}/k8s/*.yaml
+grep 'drop.*ALL' {{app_path}}/k8s/*.yaml
+```
+
+**PASS condition:** All containers non-root (UID 1000), read-only rootfs, all capabilities dropped.
+
+### 5. CLAUDE.md Accuracy
+The child app's CLAUDE.md must not reference ICDEV generation tools and must document grandchild prevention.
+
+**Check:**
+```bash
+# Should NOT find references to generation tools
+grep -E "(agentic_fitness|app_blueprint|child_app_generator)" {{app_path}}/CLAUDE.md
+# Should return empty
+
+# MUST find grandchild prevention statement
+grep "CANNOT generate child" {{app_path}}/CLAUDE.md
+# Should match
+```
+
+**PASS condition:** Zero references to generation tools. Grandchild prevention statement present.
+
+### 6. Grandchild Prevention (3-Layer Check)
+
+**Level 1 — Config flag:**
+```bash
+grep "enabled: false" {{app_path}}/args/project_defaults.yaml
+# Must match in agentic_generation section
+```
+
+**Level 2 — Tool exclusion:**
+```bash
+ls {{app_path}}/tools/builder/ | grep -E "(agentic_fitness|app_blueprint)"
+# Must return empty — these tools should NOT exist in the child app
+```
+
+**Level 3 — CLAUDE.md documentation:**
+```bash
+grep "CANNOT generate child" {{app_path}}/CLAUDE.md
+# Must match
+```
+
+**PASS condition:** All 3 levels enforced. Any single failure is a FAIL for the entire check.
+
+### 7. Blueprint Hash Verification
+The generation summary must contain a blueprint hash that matches the blueprint used for generation.
+
+**Check:**
+```bash
+python -c "
+import json
+summary = json.load(open('{{app_path}}/data/generation_summary.json'))
+print(f'Blueprint hash: {summary.get(\"blueprint_hash\", \"MISSING\")}')
+print(f'Expected: {{blueprint_hash}}')
+print(f'Match: {summary.get(\"blueprint_hash\") == \"{{blueprint_hash}}\"}')
+"
+```
+
+**PASS condition:** Hash in generation_summary.json matches the blueprint hash from the generation workflow.
+
+### 8. CSP MCP Server Appropriateness
+MCP servers configured in the child app must be appropriate for the classification level.
+
+**Check:**
+- IL4/IL5: GovCloud MCP servers only (no commercial endpoints)
+- IL6: No external MCP servers (air-gapped)
+- MCP config does not reference ICDEV's MCP servers
+
+**PASS condition:** All configured MCP servers are classification-appropriate.
+
+### 9. Secret Hygiene
+No secrets, API keys, passwords, or tokens in any file committed to version control.
+
+**Check:**
+```bash
+# Run secret detection
+python {{app_path}}/tools/security/secret_detector.py --project-dir {{app_path}}
+```
+
+**PASS condition:** Zero secrets detected. `.env` is in `.gitignore`. Only `.env.example` with placeholder values exists.
+
+### 10. Goals Manifest Accuracy
+The goals manifest must only list goals that exist as files.
+
+**Check:**
+```bash
+# Extract goal filenames from manifest and verify each exists
+python -c "
+import os
+manifest = open('{{app_path}}/goals/manifest.md').read()
+# Parse listed goals and check file existence
+"
+```
+
+**PASS condition:** Every goal listed in `goals/manifest.md` has a corresponding file. No phantom entries.
+
+## Report Format
+
+Produce a governance review report in this format:
+
+```markdown
+# Governance Review Report
+**Application:** {{app_name}}
+**Path:** {{app_path}}
+**Impact Level:** {{impact_level}}
+**Review Date:** {{review_date}}
+**Reviewer:** governance-agent
+
+## Results
+
+| # | Check | Result | Details |
+|---|-------|--------|---------|
+| 1 | Classification Markings | PASS/FAIL/WARN | ... |
+| 2 | Audit Trail Integrity | PASS/FAIL/WARN | ... |
+| 3 | Agent Communication | PASS/FAIL/WARN | ... |
+| 4 | Container Security | PASS/FAIL/WARN | ... |
+| 5 | CLAUDE.md Accuracy | PASS/FAIL/WARN | ... |
+| 6 | Grandchild Prevention | PASS/FAIL/WARN | ... |
+| 7 | Blueprint Hash | PASS/FAIL/WARN | ... |
+| 8 | CSP MCP Servers | PASS/FAIL/WARN | ... |
+| 9 | Secret Hygiene | PASS/FAIL/WARN | ... |
+| 10 | Goals Manifest | PASS/FAIL/WARN | ... |
+
+## Overall: PASS / FAIL
+Passed: X/10
+Failed: Y/10
+Warnings: Z/10
+
+## Remediation Required
+[List any FAIL items with specific remediation steps]
+```
+
+## Blocking Conditions
+
+The governance review FAILS if any of the following are true:
+- Any classification marking missing (check 1)
+- Audit trail allows UPDATE or DELETE (check 2)
+- Grandchild prevention incomplete (check 6 — any level)
+- Secrets detected in codebase (check 9)
+- Blueprint hash mismatch (check 7)
+
+WARN items do not block but must be tracked for remediation.

hardprompts/agent/reviewer_prompt.md

@@ -0,0 +1,34 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Agent Reviewer Prompt
+
+You are a reviewing agent in a multi-agent system. Your role is to evaluate output produced by another agent.
+
+## Your Task
+Review the following output and decide whether to APPROVE or REJECT it.
+
+## Evaluation Criteria
+1. **Correctness** — Is the output technically correct?
+2. **Completeness** — Does it fully address the requirements?
+3. **Security** — Are there any security concerns?
+4. **Compliance** — Does it meet CUI/classification requirements?
+5. **Quality** — Is it well-structured and maintainable?
+
+## Output Format
+Respond with ONLY valid JSON:
+```json
+{
+  "decision": "approve" or "reject",
+  "confidence": 0.0-1.0,
+  "feedback": "Specific, actionable feedback",
+  "issues": ["list of specific issues found"],
+  "classification": "CUI"
+}
+```
+
+## Context
+Producer Agent: {{producer_agent_id}}
+Task: {{task_description}}
+Round: {{round_number}} of {{max_rounds}}
+
+## Output to Review
+{{output_content}}

hardprompts/agent/skill_design.md

@@ -0,0 +1,172 @@
+# [TEMPLATE: CUI // SP-CTI]
+
+# Agent Skill Design Prompt
+
+## Role
+
+You are designing skills for an A2A-compatible agent in the ICDEV multi-agent system. Each skill is a discrete unit of work that an agent can perform. Skills are the atomic building blocks of agent capabilities — they are registered in agent cards, invoked via JSON-RPC 2.0, and tracked in the audit trail.
+
+## Skill Structure
+
+Every skill must satisfy these requirements:
+
+1. **Unique ID** — kebab-case identifier (e.g., `code-generation`, `sast-scan`, `ssp-generation`)
+2. **Input/output schemas** — JSON Schema defining expected parameters and return values
+3. **Validation logic** — Check all required parameters before execution; fail fast with clear errors
+4. **JSON-RPC 2.0 compliance** — Return results in standard `{ "jsonrpc": "2.0", "result": {...}, "id": "..." }` format
+5. **Audit trail logging** — Log execution start, completion, and failure to the append-only audit trail
+6. **Confidence tracking** — Report execution confidence (0.0-1.0) for self-healing integration
+7. **Idempotency** — Running the same skill with the same inputs should produce the same result
+
+## Implementation Template
+
+```python
+"""
+CUI // SP-CTI
+Skill: {{skill-id}}
+Agent: {{agent-name}}
+"""
+
+import json
+import logging
+from datetime import datetime, timezone
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+
+class {{SkillName}}Skill:
+    """{{One-sentence description of what this skill does.}}"""
+
+    SKILL_ID = "{{skill-id}}"
+    VERSION = "1.0.0"
+
+    # Input schema (JSON Schema format)
+    INPUT_SCHEMA = {
+        "type": "object",
+        "properties": {
+            "project_id": {"type": "string", "description": "Project identifier"},
+            # Add skill-specific parameters here
+        },
+        "required": ["project_id"],
+    }
+
+    # Output schema
+    OUTPUT_SCHEMA = {
+        "type": "object",
+        "properties": {
+            "status": {"type": "string", "enum": ["success", "failure", "partial"]},
+            "confidence": {"type": "number", "minimum": 0.0, "maximum": 1.0},
+            "result": {"type": "object"},
+            "errors": {"type": "array", "items": {"type": "string"}},
+        },
+        "required": ["status", "confidence"],
+    }
+
+    def __init__(self, db_path: str = "data/icdev.db"):
+        self.db_path = db_path
+
+    def validate(self, params: dict) -> tuple[bool, list[str]]:
+        """Validate input parameters against INPUT_SCHEMA.
+
+        Returns:
+            (is_valid, list_of_error_messages)
+        """
+        errors = []
+        for field in self.INPUT_SCHEMA.get("required", []):
+            if field not in params:
+                errors.append(f"Missing required parameter: {field}")
+        return (len(errors) == 0, errors)
+
+    def execute(self, params: dict) -> dict:
+        """Execute the skill with validated parameters.
+
+        Returns:
+            JSON-RPC 2.0 compatible result dict with status, confidence, and result.
+        """
+        is_valid, errors = self.validate(params)
+        if not is_valid:
+            return {
+                "status": "failure",
+                "confidence": 1.0,
+                "result": {},
+                "errors": errors,
+            }
+
+        try:
+            # Skill-specific logic here
+            result = self._do_work(params)
+            return {
+                "status": "success",
+                "confidence": result.get("confidence", 0.9),
+                "result": result,
+                "errors": [],
+            }
+        except Exception as e:
+            logger.error(f"Skill {self.SKILL_ID} failed: {e}")
+            return {
+                "status": "failure",
+                "confidence": 0.0,
+                "result": {},
+                "errors": [str(e)],
+            }
+
+    def _do_work(self, params: dict) -> dict:
+        """Override this method with skill-specific implementation."""
+        raise NotImplementedError
+
+    def get_skill_card(self) -> dict:
+        """Return the skill card for agent card registration."""
+        return {
+            "id": self.SKILL_ID,
+            "version": self.VERSION,
+            "description": self.__doc__ or "",
+            "input_schema": self.INPUT_SCHEMA,
+            "output_schema": self.OUTPUT_SCHEMA,
+            "tags": [],
+        }
+```
+
+## Registration
+
+Skills are registered in agent cards via `register_skill()`:
+
+```python
+agent_card = {
+    "agent_id": "builder-agent",
+    "skills": [
+        CodeGenerationSkill().get_skill_card(),
+        TestWritingSkill().get_skill_card(),
+        LintSkill().get_skill_card(),
+    ]
+}
+```
+
+The agent card is published at `/.well-known/agent.json` and stored in `tools/agent/cards/<agent-name>.json`.
+
+## Confidence Tracking
+
+Every skill execution reports a confidence score:
+
+| Confidence | Meaning | Self-Healing Action |
+|------------|---------|---------------------|
+| >= 0.7 | High confidence | Auto-remediate if failure recurs |
+| 0.3 - 0.7 | Medium confidence | Suggest fix, require human approval |
+| < 0.3 | Low confidence | Escalate with full context |
+
+The knowledge agent tracks confidence trends. Declining confidence triggers pattern analysis.
+
+## Error Handling
+
+- **Validation errors:** Return immediately with `status: failure`, `confidence: 1.0` (we are confident the input is wrong)
+- **Execution errors:** Catch exceptions, log to audit trail, return `status: failure` with error details
+- **Partial results:** Return `status: partial` with what succeeded and what failed
+- **Timeout:** Skills must respect the agent's configured timeout (default: 300s). Long-running skills should report progress.
+
+## Testing Requirements
+
+Every skill must have:
+- Unit tests for `validate()` with valid and invalid inputs
+- Unit tests for `execute()` with mocked dependencies
+- Integration tests that verify audit trail entries are created
+- Edge case tests for empty inputs, missing optional fields, and boundary values