icdev 0.0.3__py3-none-any.whl

tools/cloudforge/mbse_thread/ato_thread_weaver.py

@@ -0,0 +1,111 @@
+# CUI // SP-CTI
+"""ATO thread weaver — end-to-end digital thread from SysML to ATO.
+
+Weaves together: SysML Model → System Boundary → Control Mapping →
+IaC Resources → Security Scans → Evidence → ATO Package.
+"""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+
+def weave_thread(zone_id: str, project_id: str = "cloudforge") -> Dict[str, Any]:
+    """Build the complete digital thread for ATO.
+
+    Returns the full traceability chain from model to authorization.
+    """
+    from tools.cloudforge.mbse_thread.system_boundary import derive_boundary
+    from tools.cloudforge.mbse_thread.control_tracer import trace_controls
+    from tools.cloudforge.compliance.control_inheritor import get_inherited_controls
+    from tools.cloudforge.compliance.ato_accelerator import get_ato_status
+    from tools.cloudforge.landing_zone.zone_provisioner import get_zone
+
+    zone = get_zone(zone_id)
+    if not zone:
+        return {"status": "error", "message": f"Zone {zone_id} not found"}
+
+    # Layer 1: System boundary
+    boundary = derive_boundary(zone_id, project_id)
+
+    # Layer 2: Control traceability
+    traces = trace_controls(zone_id, project_id)
+
+    # Layer 3: Inherited controls
+    inherited = get_inherited_controls(zone["cloud_type"], zone["impact_level"])
+
+    # Layer 4: ATO pipeline status
+    ato_status = get_ato_status(zone_id)
+
+    # Thread summary
+    thread_links: List[Dict[str, str]] = []
+    for trace in traces.get("traces", []):
+        for control in trace.get("mapped_controls", []):
+            thread_links.append({
+                "model_element": trace["component"],
+                "element_type": trace["component_type"],
+                "nist_control": control,
+                "inherited": control in inherited,
+                "iac_resource": f"{zone['cloud_type']}_{trace['component_type']}",
+            })
+
+    coverage = {
+        "boundary_components": boundary.get("component_count", 0),
+        "traced_controls": traces.get("unique_control_count", 0),
+        "inherited_controls": len(inherited),
+        "total_thread_links": len(thread_links),
+        "ato_phases_complete": ato_status.get("completed_phases", 0),
+        "ato_total_phases": ato_status.get("total_phases", 5),
+    }
+
+    return {
+        "status": "ok",
+        "zone_id": zone_id,
+        "cloud_type": zone["cloud_type"],
+        "impact_level": zone["impact_level"],
+        "thread_links": thread_links,
+        "coverage": coverage,
+        "ato_complete": ato_status.get("ato_complete", False),
+        "classification": "CUI // SP-CTI",
+    }
+
+
+def thread_coverage_report(zone_id: str, project_id: str = "cloudforge") -> Dict[str, Any]:
+    """Generate a coverage report for the digital thread."""
+    thread = weave_thread(zone_id, project_id)
+    if thread.get("status") != "ok":
+        return thread
+
+    coverage = thread["coverage"]
+    total = coverage["traced_controls"] + coverage["inherited_controls"]
+    score = min(100.0, round(total / 325 * 100, 1)) if total else 0.0
+
+    return {
+        "status": "ok",
+        "zone_id": zone_id,
+        "coverage_score_pct": score,
+        "coverage": coverage,
+        "recommendation": (
+            "Full coverage" if score >= 80
+            else "Additional control mapping needed" if score >= 50
+            else "Significant gaps — review boundary and control mapping"
+        ),
+        "classification": "CUI // SP-CTI",
+    }
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge ATO Thread Weaver")
+    parser.add_argument("--zone-id", required=True)
+    parser.add_argument("--coverage", action="store_true")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    if args.coverage:
+        result = thread_coverage_report(args.zone_id)
+    else:
+        result = weave_thread(args.zone_id)
+    print(json.dumps(result, indent=2))

tools/cloudforge/mbse_thread/control_tracer.py

@@ -0,0 +1,68 @@
+# CUI // SP-CTI
+"""Control tracer — map MBSE model elements to NIST 800-53 controls.
+
+Creates traceability links: SysML Block → NIST Control → IaC Resource.
+This forms the digital thread from design to implementation to compliance.
+"""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+# Standard mapping: model element types → NIST control families
+_ELEMENT_CONTROL_MAP: Dict[str, List[str]] = {
+    "network": ["SC-7", "SC-8", "AC-17", "AC-4"],
+    "compute": ["CM-6", "CM-7", "SI-2", "SI-3"],
+    "identity": ["AC-2", "AC-3", "IA-2", "IA-5"],
+    "crypto": ["SC-12", "SC-13", "SC-28"],
+    "logging": ["AU-2", "AU-3", "AU-6", "AU-12"],
+    "storage": ["SC-28", "MP-2", "MP-4"],
+    "database": ["SC-28", "AC-3", "AU-3"],
+    "container": ["CM-6", "CM-7", "SI-2", "SC-7"],
+    "dmz": ["SC-7", "AC-17", "SI-4"],
+}
+
+
+def trace_controls(zone_id: str, project_id: str = "cloudforge") -> Dict[str, Any]:
+    """Build control traceability from boundary components to NIST controls."""
+    from tools.cloudforge.mbse_thread.system_boundary import derive_boundary
+
+    boundary = derive_boundary(zone_id, project_id)
+    if boundary.get("status") != "ok":
+        return boundary
+
+    traces: List[Dict[str, Any]] = []
+    all_controls: set = set()
+
+    for component in boundary.get("boundary_components", []):
+        comp_type = component.get("type", "")
+        mapped_controls = _ELEMENT_CONTROL_MAP.get(comp_type, [])
+        all_controls.update(mapped_controls)
+
+        traces.append({
+            "component": component["name"],
+            "component_type": comp_type,
+            "boundary": component.get("boundary", "internal"),
+            "mapped_controls": mapped_controls,
+        })
+
+    return {
+        "status": "ok",
+        "zone_id": zone_id,
+        "trace_count": len(traces),
+        "traces": traces,
+        "unique_controls": sorted(all_controls),
+        "unique_control_count": len(all_controls),
+        "classification": "CUI // SP-CTI",
+    }
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge Control Tracer")
+    parser.add_argument("--zone-id", required=True)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    print(json.dumps(trace_controls(args.zone_id), indent=2))

tools/cloudforge/mbse_thread/system_boundary.py

@@ -0,0 +1,83 @@
+# CUI // SP-CTI
+"""System boundary — derive ATO boundary from SysML model + landing zone IaC.
+
+Maps model elements (blocks, interfaces, data flows) to infrastructure
+components, defining the authorization boundary for RMF.
+"""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+
+def derive_boundary(zone_id: str, project_id: str = "cloudforge") -> Dict[str, Any]:
+    """Derive an ATO system boundary from the landing zone and MBSE model.
+
+    Combines:
+    - Landing zone infrastructure (VPC, subnets, K8s, IAM)
+    - MBSE model elements (if available)
+    - Data flows and ports/protocols
+    """
+    from tools.cloudforge.landing_zone.zone_provisioner import get_zone
+
+    zone = get_zone(zone_id)
+    if not zone:
+        return {"status": "error", "message": f"Zone {zone_id} not found"}
+
+    # Build boundary components from IaC
+    components: List[Dict[str, str]] = [
+        {"name": "VPC/VNet", "type": "network", "boundary": "internal"},
+        {"name": "Private Subnet", "type": "network", "boundary": "internal"},
+        {"name": "Public Subnet", "type": "network", "boundary": "dmz"},
+        {"name": "K8s Cluster", "type": "compute", "boundary": "internal"},
+        {"name": "IAM/RBAC", "type": "identity", "boundary": "internal"},
+        {"name": "KMS", "type": "crypto", "boundary": "internal"},
+        {"name": "Flow Logs", "type": "logging", "boundary": "internal"},
+    ]
+
+    # Try to enrich from MBSE digital thread
+    mbse_elements: List[Dict[str, str]] = []
+    try:
+        from tools.mbse.digital_thread import get_thread_elements
+        mbse_elements = get_thread_elements(project_id)
+    except (ImportError, Exception):
+        pass
+
+    # Data flows
+    data_flows: List[Dict[str, str]] = [
+        {"from": "Public Subnet", "to": "K8s Cluster", "protocol": "HTTPS/443", "encrypted": "true"},
+        {"from": "K8s Cluster", "to": "Private Subnet", "protocol": "TCP/5432", "encrypted": "true"},
+        {"from": "Flow Logs", "to": "SIEM", "protocol": "HTTPS/443", "encrypted": "true"},
+    ]
+
+    # Ports and protocols
+    ports_protocols: List[Dict[str, Any]] = [
+        {"port": 443, "protocol": "TCP", "direction": "inbound", "service": "HTTPS"},
+        {"port": 5432, "protocol": "TCP", "direction": "internal", "service": "PostgreSQL"},
+        {"port": 6443, "protocol": "TCP", "direction": "internal", "service": "K8s API"},
+    ]
+
+    return {
+        "status": "ok",
+        "zone_id": zone_id,
+        "cloud_type": zone["cloud_type"],
+        "impact_level": zone["impact_level"],
+        "region": zone["region"],
+        "boundary_components": components,
+        "mbse_elements": mbse_elements,
+        "data_flows": data_flows,
+        "ports_protocols": ports_protocols,
+        "component_count": len(components),
+        "classification": "CUI // SP-CTI",
+    }
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge System Boundary")
+    parser.add_argument("--zone-id", required=True)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    print(json.dumps(derive_boundary(args.zone_id), indent=2))

tools/cloudforge/metastore/__init__.py

@@ -0,0 +1,2 @@
+# CUI // SP-CTI
+"""CloudForge Application Metastore — CMDB-like registry with dependency mapping."""

tools/cloudforge/metastore/dependency_graph.py

@@ -0,0 +1,202 @@
+# CUI // SP-CTI
+"""Dependency graph — adjacency list for application dependencies.
+
+Design decision D-CF-23: Adjacency list pattern (same as D27, D-CF-13).
+Cycle detection via DFS to prevent circular dependencies.
+"""
+
+import json
+import logging
+import sqlite3
+from collections import defaultdict
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+DB_PATH = BASE_DIR / "data" / "icdev.db"
+
+
+def _get_db() -> sqlite3.Connection:
+    conn = sqlite3.connect(str(DB_PATH))
+    conn.row_factory = sqlite3.Row
+    return conn
+
+
+def add_dependency(
+    source_app_id: str,
+    target_app_id: str,
+    dependency_type: str,
+    protocol: str = "",
+    port: Optional[int] = None,
+    description: str = "",
+    tenant_id: str = "default",
+) -> Dict[str, Any]:
+    """Add a dependency edge between two applications."""
+    if source_app_id == target_app_id:
+        return {"status": "error", "errors": ["Self-dependency not allowed"]}
+
+    conn = _get_db()
+    try:
+        # Verify both apps exist
+        for app_id in (source_app_id, target_app_id):
+            row = conn.execute("SELECT id FROM cf_applications WHERE id = ?", (app_id,)).fetchone()
+            if not row:
+                return {"status": "error", "errors": [f"App not found: {app_id}"]}
+
+        # Check for cycles before inserting
+        if _would_create_cycle(conn, source_app_id, target_app_id, tenant_id):
+            return {"status": "error", "errors": ["Would create circular dependency"]}
+
+        conn.execute(
+            """INSERT INTO cf_app_dependencies
+               (source_app_id, target_app_id, dependency_type,
+                protocol, port, description, classification,
+                tenant_id, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, 'CUI // SP-CTI', ?, datetime('now'))""",
+            (source_app_id, target_app_id, dependency_type,
+             protocol, port, description, tenant_id),
+        )
+        conn.commit()
+        return {
+            "status": "ok",
+            "source": source_app_id,
+            "target": target_app_id,
+            "type": dependency_type,
+        }
+    except sqlite3.IntegrityError:
+        return {"status": "error", "errors": ["Dependency already exists"]}
+    finally:
+        conn.close()
+
+
+def get_dependencies(
+    app_id: str,
+    direction: str = "both",
+    tenant_id: str = "default",
+) -> Dict[str, Any]:
+    """Get dependencies for an app. direction: upstream, downstream, both."""
+    conn = _get_db()
+    try:
+        upstream = []
+        downstream = []
+
+        if direction in ("upstream", "both"):
+            rows = conn.execute(
+                """SELECT d.*, a.name as source_name
+                   FROM cf_app_dependencies d
+                   JOIN cf_applications a ON a.id = d.source_app_id
+                   WHERE d.target_app_id = ? AND d.tenant_id = ?""",
+                (app_id, tenant_id),
+            ).fetchall()
+            upstream = [dict(r) for r in rows]
+
+        if direction in ("downstream", "both"):
+            rows = conn.execute(
+                """SELECT d.*, a.name as target_name
+                   FROM cf_app_dependencies d
+                   JOIN cf_applications a ON a.id = d.target_app_id
+                   WHERE d.source_app_id = ? AND d.tenant_id = ?""",
+                (app_id, tenant_id),
+            ).fetchall()
+            downstream = [dict(r) for r in rows]
+
+        return {
+            "app_id": app_id,
+            "upstream": upstream,
+            "downstream": downstream,
+            "upstream_count": len(upstream),
+            "downstream_count": len(downstream),
+        }
+    finally:
+        conn.close()
+
+
+def get_full_graph(tenant_id: str = "default") -> Dict[str, Any]:
+    """Export the full dependency graph as nodes + edges for visualization."""
+    conn = _get_db()
+    try:
+        apps = conn.execute(
+            "SELECT id, name, app_type, status, criticality FROM cf_applications WHERE tenant_id = ?",
+            (tenant_id,),
+        ).fetchall()
+
+        deps = conn.execute(
+            "SELECT source_app_id, target_app_id, dependency_type, protocol FROM cf_app_dependencies WHERE tenant_id = ?",
+            (tenant_id,),
+        ).fetchall()
+
+        nodes = [
+            {
+                "id": a["id"],
+                "name": a["name"],
+                "type": a["app_type"],
+                "status": a["status"],
+                "criticality": a["criticality"],
+            }
+            for a in apps
+        ]
+        edges = [
+            {
+                "source": d["source_app_id"],
+                "target": d["target_app_id"],
+                "type": d["dependency_type"],
+                "protocol": d["protocol"],
+            }
+            for d in deps
+        ]
+
+        return {
+            "nodes": nodes,
+            "edges": edges,
+            "node_count": len(nodes),
+            "edge_count": len(edges),
+            "classification": "CUI // SP-CTI",
+        }
+    finally:
+        conn.close()
+
+
+def remove_dependency(
+    source_app_id: str,
+    target_app_id: str,
+    dependency_type: str,
+) -> Dict[str, Any]:
+    """Remove a specific dependency edge."""
+    conn = _get_db()
+    try:
+        conn.execute(
+            """DELETE FROM cf_app_dependencies
+               WHERE source_app_id = ? AND target_app_id = ? AND dependency_type = ?""",
+            (source_app_id, target_app_id, dependency_type),
+        )
+        conn.commit()
+        return {"status": "ok", "action": "removed"}
+    finally:
+        conn.close()
+
+
+def _would_create_cycle(
+    conn: sqlite3.Connection,
+    source: str,
+    target: str,
+    tenant_id: str,
+) -> bool:
+    """Check if adding source->target would create a cycle via DFS."""
+    # If there's a path from target back to source, adding source->target creates a cycle
+    visited: Set[str] = set()
+
+    def dfs(node: str) -> bool:
+        if node == source:
+            return True
+        if node in visited:
+            return False
+        visited.add(node)
+        rows = conn.execute(
+            "SELECT target_app_id FROM cf_app_dependencies WHERE source_app_id = ? AND tenant_id = ?",
+            (node, tenant_id),
+        ).fetchall()
+        return any(dfs(r["target_app_id"]) for r in rows)
+
+    return dfs(target)

tools/cloudforge/metastore/discovery.py

@@ -0,0 +1,192 @@
+# CUI // SP-CTI
+"""Auto-discovery — discover applications from existing CloudForge and DataBridge data.
+
+Design decision D-CF-24: Idempotent upsert on unique constraint.
+Pulls from: db_connections, cf_landing_zones, devices.
+"""
+
+import json
+import logging
+import sqlite3
+from pathlib import Path
+from typing import Any, Dict, List
+from tools.db.storage import get_connection
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+DB_PATH = BASE_DIR / "data" / "icdev.db"
+
+
+def discover_from_zones(tenant_id: str = "default") -> List[Dict[str, Any]]:
+    """Discover applications from cf_landing_zones."""
+    conn = get_connection()
+    discovered = []
+    try:
+        rows = conn.execute(
+            "SELECT id, name, cloud_type, impact_level, environment, status FROM cf_landing_zones WHERE status = 'active'"
+        ).fetchall()
+        for row in rows:
+            env = row["environment"] if row["environment"] else "production"
+            result = _upsert_discovered_app(
+                conn=conn,
+                name=f"zone-{row['name']}",
+                app_type="monolith",
+                description=f"Landing zone: {row['name']} ({row['cloud_type']}, {row['impact_level']})",
+                environment=env,
+                zone_ids=row["id"],
+                discovery_source="cf_landing_zones",
+                tenant_id=tenant_id,
+            )
+            discovered.append(result)
+        conn.commit()
+    except Exception as exc:
+        logger.warning("Zone discovery failed: %s", exc)
+    finally:
+        conn.close()
+    return discovered
+
+
+def discover_from_connections(tenant_id: str = "default") -> List[Dict[str, Any]]:
+    """Discover applications from db_connections (DataBridge)."""
+    conn = get_connection()
+    discovered = []
+    try:
+        rows = conn.execute(
+            "SELECT id, name, connector_type, status FROM db_connections WHERE status = 'active'"
+        ).fetchall()
+        for row in rows:
+            app_type = _infer_app_type(row["connector_type"])
+            result = _upsert_discovered_app(
+                conn=conn,
+                name=f"db-{row['name']}",
+                app_type=app_type,
+                description=f"DataBridge connection: {row['name']} ({row['connector_type']})",
+                connection_ids=row["id"],
+                discovery_source="db_connections",
+                tenant_id=tenant_id,
+            )
+            discovered.append(result)
+        conn.commit()
+    except Exception as exc:
+        logger.warning("Connection discovery failed: %s", exc)
+    finally:
+        conn.close()
+    return discovered
+
+
+def discover_from_devices(tenant_id: str = "default") -> List[Dict[str, Any]]:
+    """Discover applications from devices table (SparkPilot fleet)."""
+    conn = get_connection()
+    discovered = []
+    try:
+        # devices table is in sparkpilot.db — check if accessible
+        sp_db = BASE_DIR / "data" / "sparkpilot.db"
+        if not sp_db.exists():
+            return []
+        sp_conn = sqlite3.connect(str(sp_db))
+        sp_conn.row_factory = sqlite3.Row
+        rows = sp_conn.execute(
+            "SELECT device_id, name, board, status FROM devices WHERE status = 'online'"
+        ).fetchall()
+        sp_conn.close()
+
+        for row in rows:
+            result = _upsert_discovered_app(
+                conn=conn,
+                name=f"device-{row['name']}",
+                app_type="firmware",
+                description=f"Fleet device: {row['name']} ({row['board']})",
+                device_ids=row["device_id"],
+                discovery_source="devices",
+                tenant_id=tenant_id,
+            )
+            discovered.append(result)
+        conn.commit()
+    except Exception as exc:
+        logger.warning("Device discovery failed: %s", exc)
+    finally:
+        conn.close()
+    return discovered
+
+
+def run_full_discovery(tenant_id: str = "default") -> Dict[str, Any]:
+    """Run all three discovery sources."""
+    zones = discover_from_zones(tenant_id)
+    connections = discover_from_connections(tenant_id)
+    devices = discover_from_devices(tenant_id)
+
+    return {
+        "status": "ok",
+        "zones_discovered": len(zones),
+        "connections_discovered": len(connections),
+        "devices_discovered": len(devices),
+        "total": len(zones) + len(connections) + len(devices),
+        "classification": "CUI // SP-CTI",
+    }
+
+
+def _upsert_discovered_app(
+    conn: sqlite3.Connection,
+    name: str,
+    app_type: str,
+    description: str = "",
+    environment: str = "production",
+    zone_ids: str = "",
+    device_ids: str = "",
+    connection_ids: str = "",
+    discovery_source: str = "",
+    tenant_id: str = "default",
+) -> Dict[str, Any]:
+    """Insert or update a discovered application (idempotent on name+environment)."""
+    import uuid
+
+    existing = conn.execute(
+        "SELECT id FROM cf_applications WHERE tenant_id = ? AND name = ? AND environment = ?",
+        (tenant_id, name, environment),
+    ).fetchone()
+
+    if existing:
+        conn.execute(
+            """UPDATE cf_applications SET description = ?, zone_ids = ?,
+               device_ids = ?, connection_ids = ?, discovery_source = ?,
+               updated_at = datetime('now') WHERE id = ?""",
+            (description, zone_ids, device_ids, connection_ids, discovery_source, existing["id"]),
+        )
+        return {"id": existing["id"], "name": name, "action": "updated"}
+
+    app_id = f"app-{uuid.uuid4().hex[:8]}"
+    conn.execute(
+        """INSERT INTO cf_applications
+           (id, name, description, app_type, status, environment,
+            zone_ids, device_ids, connection_ids, discovery_source,
+            classification, tenant_id, created_by,
+            created_at, updated_at)
+           VALUES (?, ?, ?, ?, 'discovered', ?, ?, ?, ?, ?,
+                   'CUI // SP-CTI', ?, 'auto-discovery',
+                   datetime('now'), datetime('now'))""",
+        (
+            app_id, name, description, app_type, environment,
+            zone_ids, device_ids, connection_ids, discovery_source, tenant_id,
+        ),
+    )
+    return {"id": app_id, "name": name, "action": "created"}
+
+
+def _infer_app_type(connector_type: str) -> str:
+    """Infer app_type from DataBridge connector type."""
+    db_types = {"postgresql", "mysql", "sqlite", "oracle", "mssql", "dynamodb", "mongodb"}
+    queue_types = {"kafka", "rabbitmq", "sqs", "kinesis"}
+    cache_types = {"redis", "memcached", "elasticache"}
+    api_types = {"rest_api", "graphql", "grpc"}
+
+    ct = connector_type.lower()
+    if ct in db_types:
+        return "database"
+    elif ct in queue_types:
+        return "queue"
+    elif ct in cache_types:
+        return "cache"
+    elif ct in api_types:
+        return "api"
+    return "other"