icdev 0.0.3__py3-none-any.whl

args/devsecops_config.yaml

@@ -0,0 +1,286 @@
+# DevSecOps Configuration — Profile Schema, Maturity Levels, Pipeline Stages
+# Used by: tools/devsecops/profile_manager.py, intake_engine.py, pipeline_security_generator.py
+# ADR D119: Per-project DevSecOps profile controls all downstream pipeline and infra generation
+
+# =============================================================================
+# Pipeline Security Stages — toggleable per project based on DevSecOps profile
+# =============================================================================
+devsecops_stages:
+  sast:
+    description: "Static Application Security Testing"
+    tools: [bandit, spotbugs, gosec, clippy, eslint-security, security-code-scan]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_critical
+
+  dast:
+    description: "Dynamic Application Security Testing"
+    tools: [zap, burp]
+    default: false
+    optional: true
+    ci_stage: security-scan
+    gate_impact: warn_on_high
+
+  sca:
+    description: "Software Composition Analysis / Dependency Scanning"
+    tools: [pip-audit, npm-audit, cargo-audit, govulncheck, owasp-dc, dotnet-list]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_critical
+
+  secret_detection:
+    description: "Secret and Credential Detection"
+    tools: [detect-secrets, gitleaks]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_any
+
+  container_scan:
+    description: "Container Image Vulnerability Scanning"
+    tools: [trivy, grype]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_critical
+
+  image_signing:
+    description: "Container Image Signing and Verification (SLSA Level 3)"
+    tools: [cosign, notation]
+    default: false
+    optional: true
+    ci_stage: devsecops-check
+    gate_impact: block_when_active
+
+  sbom_attestation:
+    description: "SBOM Attestation and Supply Chain Provenance"
+    tools: [cosign-attach, in-toto]
+    default: false
+    optional: true
+    ci_stage: devsecops-check
+    gate_impact: block_when_active
+
+  rasp:
+    description: "Runtime Application Self-Protection"
+    tools: [falco, sysdig]
+    default: false
+    optional: true
+    ci_stage: deploy-staging
+    gate_impact: warn_on_bypass
+
+  policy_as_code:
+    description: "Policy-as-Code Admission Control"
+    tools: [kyverno, opa-gatekeeper]
+    default: false
+    optional: true
+    ci_stage: devsecops-check
+    gate_impact: block_on_critical
+
+  license_compliance:
+    description: "Open Source License Compliance Scanning"
+    tools: [fossa, black-duck, scancode]
+    default: false
+    optional: true
+    ci_stage: compliance-check
+    gate_impact: warn_on_copyleft
+
+# =============================================================================
+# Maturity Levels — DevSecOps Maturity Model (5 levels)
+# =============================================================================
+maturity_levels:
+  level_1_initial:
+    description: "Ad hoc security, no automation in CI/CD pipeline"
+    min_stages: 0
+    required_stages: []
+    characteristics:
+      - "Manual security reviews only"
+      - "No automated scanning in pipeline"
+      - "Security is a separate phase, not integrated"
+
+  level_2_managed:
+    description: "Basic shift-left with SAST and dependency scanning"
+    min_stages: 2
+    required_stages: [sast, sca]
+    characteristics:
+      - "SAST integrated into CI/CD"
+      - "Dependency vulnerabilities tracked"
+      - "Security findings reviewed before merge"
+
+  level_3_defined:
+    description: "Full shift-left with container security and secret detection"
+    min_stages: 4
+    required_stages: [sast, sca, secret_detection, container_scan]
+    characteristics:
+      - "Container images scanned before deployment"
+      - "Secrets prevented from entering codebase"
+      - "Security gates block deployments on critical findings"
+      - "Minimum for ATO-bound projects"
+
+  level_4_measured:
+    description: "Policy enforcement, attestation, and supply chain integrity"
+    min_stages: 6
+    required_stages: [sast, sca, secret_detection, container_scan, policy_as_code, sbom_attestation]
+    characteristics:
+      - "Admission control enforces security policies"
+      - "SBOM attestation on all artifacts"
+      - "Supply chain provenance verified"
+      - "Compliance metrics tracked and reported"
+
+  level_5_optimized:
+    description: "Full DevSecOps with runtime protection and continuous improvement"
+    min_stages: 8
+    required_stages: [sast, sca, secret_detection, container_scan, policy_as_code, sbom_attestation, image_signing, rasp]
+    characteristics:
+      - "Runtime security monitoring and auto-response"
+      - "Image integrity verified via signatures"
+      - "Self-healing security patterns"
+      - "Continuous security posture improvement"
+
+# =============================================================================
+# Intake Detection — Keywords for DevSecOps maturity auto-detection
+# =============================================================================
+intake_detection:
+  keywords_by_stage:
+    sast:
+      - static analysis
+      - code scanning
+      - bandit
+      - sonarqube
+      - fortify
+      - checkmarx
+      - veracode
+      - semgrep
+      - codeql
+      - spotbugs
+      - gosec
+      - eslint-security
+    dast:
+      - dynamic testing
+      - penetration test
+      - OWASP ZAP
+      - burp suite
+      - DAST
+      - web app scanning
+      - runtime testing
+    sca:
+      - dependency scan
+      - software composition
+      - pip-audit
+      - snyk
+      - npm audit
+      - cargo audit
+      - govulncheck
+      - OWASP dependency
+      - software composition analysis
+    secret_detection:
+      - secret scanning
+      - credential detection
+      - gitleaks
+      - trufflehog
+      - detect-secrets
+      - secret detection
+      - credential scan
+    container_scan:
+      - container scanning
+      - image scanning
+      - trivy
+      - grype
+      - twistlock
+      - prisma cloud
+      - anchore
+      - clair
+    image_signing:
+      - image signing
+      - cosign
+      - sigstore
+      - notary
+      - docker content trust
+      - SLSA
+      - image verification
+    sbom_attestation:
+      - SBOM
+      - software bill of materials
+      - attestation
+      - SLSA
+      - in-toto
+      - supply chain attestation
+      - provenance
+    rasp:
+      - runtime protection
+      - falco
+      - sysdig
+      - RASP
+      - runtime security
+      - runtime monitoring
+      - eBPF security
+    policy_as_code:
+      - policy as code
+      - OPA
+      - gatekeeper
+      - kyverno
+      - sentinel
+      - conftest
+      - admission control
+      - policy engine
+    license_compliance:
+      - license compliance
+      - FOSSA
+      - black duck
+      - scancode
+      - license scanning
+      - open source license
+      - copyleft
+
+  # Keywords indicating NO existing DevSecOps
+  absence_signals:
+    - no security scanning
+    - manual security review
+    - no automated security
+    - security is handled separately
+    - we don't have automated
+    - greenfield
+    - starting from scratch
+
+  # Keywords indicating ZTA requirements (triggers ZTA profiling)
+  zta_keywords:
+    - zero trust
+    - micro-segmentation
+    - microsegmentation
+    - mTLS
+    - mutual TLS
+    - identity-aware proxy
+    - service mesh
+    - istio
+    - linkerd
+    - never trust always verify
+    - least privilege access
+    - continuous verification
+    - device posture
+    - NIST 800-207
+    - zero trust architecture
+
+# =============================================================================
+# Profile Defaults by Impact Level
+# =============================================================================
+il_defaults:
+  IL2:
+    minimum_maturity: level_1_initial
+    recommended_maturity: level_2_managed
+    zta_required: false
+  IL4:
+    minimum_maturity: level_3_defined
+    recommended_maturity: level_4_measured
+    zta_required: false
+    zta_recommended: true
+  IL5:
+    minimum_maturity: level_3_defined
+    recommended_maturity: level_4_measured
+    zta_required: true
+    minimum_zta_maturity: advanced
+  IL6:
+    minimum_maturity: level_4_measured
+    recommended_maturity: level_5_optimized
+    zta_required: true
+    minimum_zta_maturity: advanced

args/endpoint_security_config.yaml

@@ -0,0 +1,207 @@
+# CUI // SP-CTI
+# Endpoint Security Scanner Configuration (D-EPSEC-2)
+# Detects API routes missing security safeguards (auth, validation, IDOR).
+# Declarative YAML — add new patterns without code changes (D26).
+---
+
+# Route detection patterns (per language)
+route_patterns:
+  python:
+    - '@\w+\.(route|get|post|put|delete|patch)\s*\('
+    - '@app\.route\s*\('
+    - '@bp\.route\s*\('
+    - '@blueprint\.route\s*\('
+  java:
+    - '@(Get|Post|Put|Delete|Patch)Mapping'
+    - '@RequestMapping'
+  go:
+    - 'http\.HandleFunc\s*\('
+    - '\.(GET|POST|PUT|DELETE|PATCH)\s*\('
+    - 'router\.(Handle|HandleFunc|Get|Post|Put|Delete)\s*\('
+  typescript:
+    - 'router\.(get|post|put|delete|patch)\s*\('
+    - 'app\.(get|post|put|delete|patch)\s*\('
+  rust:
+    - '#\[actix_web::(get|post|put|delete)\('
+    - '\.route\s*\('
+  csharp:
+    - '\[Http(Get|Post|Put|Delete|Patch)\]'
+    - '\[Route\('
+
+# Auth patterns — presence in ±context_window lines means endpoint is secured
+auth_patterns:
+  python:
+    - '@require_role'
+    - '@require_auth'
+    - '@login_required'
+    - '@jwt_required'
+    - '@auth_required'
+    - 'g\.current_user'
+    - 'g\.tenant_id'
+    - 'g\.user_id'
+    - 'g\.user_role'
+    - '@token_required'
+    - 'verify_hmac'
+    - 'verify_signature'
+  java:
+    - '@PreAuthorize'
+    - '@Secured'
+    - '@RolesAllowed'
+    - 'SecurityContext'
+  go:
+    - 'authMiddleware'
+    - 'requireAuth'
+    - 'AuthRequired'
+  typescript:
+    - 'authMiddleware'
+    - 'requireAuth'
+    - 'passport\.authenticate'
+    - 'isAuthenticated'
+  rust:
+    - '#\[authorize\]'
+    - 'AuthGuard'
+  csharp:
+    - '\[Authorize\]'
+    - '\[AllowAnonymous\]'
+
+# File-level auth patterns — if found ANYWHERE in the file, all routes
+# in that file are considered authenticated.  Handles middleware-based auth
+# (Flask before_request, Express app.use, etc.) that lives outside the
+# ±context_window around individual route definitions.
+file_level_auth_patterns:
+  python:
+    - 'before_request'
+    - 'register_dashboard_auth'
+    - 'session\[.user_id.\]'
+    - 'session\.get\(.user_id.\)'
+    - 'authenticate_request'
+    - 'verify_hmac_signature'
+    - 'import hmac'
+    - '_verify_\w+_signature'
+    - '_verify_\w+_token'
+    - 'verify_challenge'
+    - 'verify_binding'
+    - 'from tools\.saas\.auth'
+  typescript:
+    - 'app\.use\(.*auth'
+    - 'app\.use\(.*passport'
+  java:
+    - 'WebSecurityConfigurerAdapter'
+    - 'SecurityFilterChain'
+  go:
+    - 'Use\(.*authMiddleware'
+  csharp:
+    - 'AddAuthentication'
+    - 'UseAuthorization'
+
+# Input validation patterns — presence means input is validated
+validation_patterns:
+  python:
+    - 'isinstance\s*\('
+    - 'validate\s*\('
+    - 'schema\.\w+\s*\('
+    - '_validate_fields\s*\('
+    - 'if\s+not\s+data'
+    - 'if\s+["\x27]\w+["\x27]\s+not\s+in\s+data'
+    - 'pydantic'
+    - 'request\.get_json'
+    - 'request\.json'
+    - 'request\.form'
+    - 'return.*40[0-9]'
+    - 'abort\(4'
+  java:
+    - '@Valid'
+    - '@NotNull'
+    - '@NotBlank'
+    - 'Validator'
+  go:
+    - 'validate\.Struct'
+    - 'binding:"required"'
+  typescript:
+    - 'Joi\.'
+    - 'zod\.'
+    - 'class-validator'
+  rust:
+    - '#\[validate\]'
+    - 'serde::Deserialize'
+  csharp:
+    - '\[Required\]'
+    - 'ModelState\.IsValid'
+
+# HTTP methods that require input validation
+write_methods:
+  - POST
+  - PUT
+  - PATCH
+
+# Directories where all routes inherit auth from a parent app
+# (e.g., Flask blueprints registered on an app with before_request auth,
+# or SaaS API gateway middleware setting g.tenant_id/g.user_id).
+# Files in these dirs skip the missing-auth check; validation checks still apply.
+auth_inherited_dirs:
+  - tools/dashboard/api
+  - tools/dashboard/templates
+  - tools/saas/portal
+  - tools/saas/rest_api
+  - tools/saas/mcp_http
+  - tools/saas/mcp_sse
+  - tools/saas/swagger_ui
+
+# Files that generate route code as strings (code generators, not servers).
+# Exclude entirely — these are not real endpoints.
+exclude_file_patterns_extra:
+  - 'child_app_generator.py'
+  - 'code_generator.py'
+  - 'scaffolder.py'
+  - 'claude_md_generator.py'
+  - 'db_init_generator.py'
+  - 'migration_code_generator.py'
+  - 'legacy_analyzer.py'
+  - 'claude_dir_validator.py'
+  - 'playground/app.py'
+
+# Endpoints exempt from auth checks (health/metrics/public)
+exempt_patterns:
+  - '/health'
+  - '/ready'
+  - '/metrics'
+  - '/ping'
+  - '/favicon'
+  - '/static'
+  - '/login'
+  - '/logout'
+  - '/register'
+  - '/api_events'
+
+# Severity assignment
+# missing_auth is critical (direct exploit path — unauthorized access)
+# missing_validation is medium (defense-in-depth, not a direct exploit)
+severity:
+  missing_auth: critical
+  missing_validation_on_write: medium
+  missing_idor_check: medium
+
+# Scan settings
+scan:
+  skip_dirs:
+    - node_modules
+    - .git
+    - __pycache__
+    - .tox
+    - .venv
+    - venv
+    - .tmp
+    - vendor
+    - build
+    - dist
+  exclude_file_patterns:
+    - 'test_*.py'
+    - '*_test.py'
+    - 'conftest.py'
+    - '*_test.go'
+    - '*Test.java'
+    - '*.spec.ts'
+    - '*.test.ts'
+  # Lines above/below route to search for auth/validation
+  context_window_lines: 20
+  max_file_size_kb: 500

args/exit_criteria.yaml

@@ -0,0 +1,102 @@
+# CUI // SP-CTI
+# Centralized Exit Criteria Registry — machine-readable acceptance conditions per workflow.
+# Evaluated by tools/harness/exit_criteria_evaluator.py.
+# GOTCHA args layer: change criteria without editing tools or goals.
+
+workflows:
+  build:
+    description: "Code build and quality gates"
+    required_gates:
+      - py_compile_pass
+      - ruff_lint_pass
+      - pytest_pass
+      - bandit_sast_pass
+    acceptance_criteria:
+      - "All source files compile without syntax errors"
+      - "No critical or high linting violations"
+      - "All unit tests pass with >= 80% coverage"
+      - "No high/critical SAST findings"
+    blocking_failures:
+      - syntax_error
+      - critical_sast_finding
+      - test_failure_on_core_module
+
+  test:
+    description: "Full test suite validation"
+    required_gates:
+      - unit_tests_pass
+      - bdd_tests_pass
+      - e2e_tests_pass
+    acceptance_criteria:
+      - "All unit tests pass"
+      - "All BDD scenarios pass"
+      - "All E2E browser tests pass with screenshots"
+    blocking_failures:
+      - unit_test_failure
+      - bdd_scenario_failure
+      - e2e_page_error
+
+  deploy:
+    description: "Deployment readiness"
+    required_gates:
+      - all_test_gates_pass
+      - security_scan_clean
+      - compliance_gate_pass
+      - sbom_generated
+    acceptance_criteria:
+      - "All test gates pass"
+      - "No critical/high security findings"
+      - "Compliance controls verified"
+      - "SBOM generated and current"
+    blocking_failures:
+      - security_gate_failure
+      - compliance_gate_failure
+      - sbom_missing
+
+  comply:
+    description: "Compliance artifact generation"
+    required_gates:
+      - ssp_generated
+      - poam_current
+      - stig_checked
+      - cui_markings_verified
+    acceptance_criteria:
+      - "SSP generated for all controls"
+      - "POAM has no overdue items"
+      - "STIG has no CAT1 findings"
+      - "All artifacts have CUI markings"
+    blocking_failures:
+      - cat1_stig_finding
+      - missing_cui_markings
+      - poam_overdue
+
+  secure:
+    description: "Security scanning gates"
+    required_gates:
+      - sast_clean
+      - dependency_audit_clean
+      - secret_detection_clean
+      - container_scan_clean
+    acceptance_criteria:
+      - "No critical/high SAST findings"
+      - "No critical dependency vulnerabilities"
+      - "No secrets detected in codebase"
+      - "No critical container vulnerabilities"
+    blocking_failures:
+      - critical_vulnerability
+      - secrets_detected
+      - high_vulnerability
+
+  review:
+    description: "Code review and merge readiness"
+    required_gates:
+      - peer_review_approved
+      - security_review_approved
+      - compliance_review_approved
+    acceptance_criteria:
+      - "Peer review approved by qualified reviewer"
+      - "Security review completed"
+      - "Compliance review completed"
+    blocking_failures:
+      - review_rejected
+      - reviewer_conflict_of_interest