icdev 0.0.3__py3-none-any.whl

args/security_gates.yaml

@@ -0,0 +1,763 @@
+# ICDEV Security Gate Configuration
+# Defines what blocks merges and deployments
+
+code_review:
+  require_peer_review: true
+  require_security_scan: true
+  require_compliance_check: true
+  require_tests_pass: true
+
+merge_gates:
+  block_on:
+    - cat1_stig_finding
+    - critical_vulnerability
+    - high_vulnerability
+    - failed_tests
+    - missing_cui_markings
+    - secrets_detected
+  warn_on:
+    - cat2_stig_finding
+    - medium_vulnerability
+    - coverage_below_threshold
+
+deployment_gates:
+  block_on:
+    - any_merge_gate_failure
+    - sbom_not_generated
+    - ssp_not_current
+    - poam_has_overdue_items
+  auto_rollback_on:
+    - health_check_failure
+    - cat1_finding_post_deploy
+    - critical_vuln_runtime
+    - error_rate_spike
+
+cssp:
+  blocking:
+    - critical_requirements_not_satisfied
+    - ir_plan_missing
+    - siem_not_configured
+    - pki_cac_not_configured
+  warning:
+    - partial_requirements_below_80_pct
+    - vuln_scan_overdue_30_days
+    - ir_plan_not_tested
+    - xacta_sync_overdue
+
+sbd:
+  blocking:
+    - critical_sbd_requirements_not_satisfied
+    - default_credentials_detected
+    - no_mfa_configured
+    - no_vulnerability_disclosure_policy
+    - stack_traces_in_production
+  warning:
+    - partial_sbd_requirements_below_80_pct
+    - memory_unsafe_language_without_tooling
+    - sbom_stale_over_30_days
+    - threat_model_missing
+    - security_headers_incomplete
+
+ivv:
+  blocking:
+    - critical_ivv_findings_open
+    - test_coverage_below_threshold
+    - rtm_gaps_in_critical_requirements
+    - no_independent_security_assessment
+  warning:
+    - partial_ivv_requirements_below_70_pct
+    - code_review_incomplete
+    - bdd_feature_coverage_low
+    - pipeline_security_stages_missing
+
+# Acceptance Criteria Validation Gate (V&V — "did we build what was asked?")
+acceptance_validation:
+  blocking:
+    - acceptance_criteria_failed
+    - ui_page_renders_with_error
+    - plan_has_no_acceptance_criteria
+  warning:
+    - acceptance_criteria_unverified
+    - page_content_empty
+
+thresholds:
+  sast:
+    max_critical: 0
+    max_high: 0
+    max_medium: 10
+  dependency:
+    max_critical: 0
+    max_high: 0
+  container:
+    max_critical: 0
+    max_high: 0
+  coverage:
+    minimum_percent: 80
+  stig:
+    max_cat1_open: 0
+    max_cat2_open: 20
+  cssp:
+    min_satisfied_pct: 80
+    max_critical_not_satisfied: 0
+    vuln_scan_max_age_days: 30
+    ir_plan_required: true
+    siem_config_required: true
+  sbd:
+    min_satisfied_pct: 80
+    max_critical_not_satisfied: 0
+    sbom_max_age_days: 30
+    mfa_required: true
+    vuln_disclosure_required: true
+    default_creds_max: 0
+  ivv:
+    min_verification_score: 70
+    min_validation_score: 70
+    max_critical_findings: 0
+    min_test_coverage_pct: 80
+    rtm_completeness_pct: 90
+  fedramp:
+    min_satisfied_pct: 80
+    max_other_than_satisfied_critical: 0
+    max_other_than_satisfied_high: 0
+    encryption_fips_required: true
+    boundary_protection_required: true
+    poam_max_overdue_days: 30
+  cmmc:
+    min_met_pct: 80
+    max_not_met_level2: 0
+    max_not_met_critical: 0
+    evidence_max_age_days: 90
+    nist_171_alignment_min_pct: 90
+  cato:
+    min_readiness_pct: 50
+    max_expired_critical: 0
+    max_stale_pct: 20
+    evidence_freshness_check_days: 7
+    reassessment_max_overdue_days: 30
+  maintenance:
+    maintenance_score_min: 50
+    max_overdue_critical_sla: 0
+    max_overdue_high_sla: 3
+    avg_staleness_max_days: 180
+    sla_compliant_min_pct: 80
+  acceptance:
+    max_failed_criteria: 0
+    max_error_pages: 0
+    require_acceptance_criteria: true
+
+fedramp:
+  blocking:
+    - high_priority_controls_not_satisfied
+    - encryption_requirements_not_met
+    - boundary_protection_missing
+    - fedramp_assessment_not_completed
+  warning:
+    - fedramp_coverage_below_80_pct
+    - fedramp_poam_overdue_items
+    - fedramp_evidence_stale
+
+cmmc:
+  blocking:
+    - cmmc_level2_practice_not_met
+    - cmmc_assessment_score_below_threshold
+    - cmmc_critical_domain_gap
+  warning:
+    - cmmc_coverage_below_80_pct
+    - cmmc_evidence_stale
+    - cmmc_800_171_alignment_gap
+
+cato:
+  blocking:
+    - evidence_expired_on_critical_controls
+    - cato_readiness_below_50_pct
+  warning:
+    - evidence_stale_above_20_pct
+    - reassessment_overdue
+    - cato_readiness_below_80_pct
+
+maintenance:
+  blocking:
+    - overdue_critical_sla
+    - maintenance_score_below_50
+  warning:
+    - maintenance_score_below_70
+    - avg_staleness_over_180_days
+    - overdue_high_sla_count_above_3
+
+ricoas:
+  blocking:
+    - red_tier_requirement_without_alternative
+    - readiness_score_below_threshold
+    - unresolved_critical_gaps
+    - ambiguous_requirements_above_threshold
+  warning:
+    - readiness_score_below_80_pct
+    - orange_tier_requirements_without_review
+    - decomposition_incomplete
+    - bdd_criteria_missing
+
+supply_chain:
+  blocking:
+    - critical_scrm_risk_unmitigated
+    - isa_expired_with_active_data_flow
+    - critical_cve_sla_overdue
+    - section_889_prohibited_vendor
+  warning:
+    - scrm_risk_above_medium
+    - isa_expiring_within_30_days
+    - high_cve_sla_approaching
+    - vendor_assessment_stale
+
+# FIPS 199/200 Security Categorization Gates (Phase 20)
+fips199:
+  blocking:
+    - no_categorization_for_ato_project
+    - nss_system_without_cnssi_overlay
+  warning:
+    - categorization_not_approved
+    - no_information_types_assigned
+    - manual_categorization_without_justification
+  thresholds:
+    require_categorization_for_ato: true
+    require_cnssi_for_nss: true
+    max_draft_age_days: 30
+
+fips200:
+  blocking:
+    - any_area_not_satisfied
+    - missing_fips199_categorization
+  warning:
+    - partial_satisfaction_below_80_pct
+    - gap_controls_exceeds_threshold
+    - assessment_stale_over_90_days
+  thresholds:
+    min_satisfied_areas: 17
+    max_not_satisfied_areas: 0
+    min_coverage_pct: 80
+    max_gap_controls_per_area: 5
+    assessment_max_age_days: 90
+
+# Marketplace Asset Registry Gates (Phase 22)
+# DevSecOps Pipeline Gates (Phase 24)
+devsecops:
+  blocking:
+    - policy_as_code_violation_critical
+    - image_attestation_missing
+    - sbom_attestation_missing
+    - critical_sast_finding_unresolved
+    - secrets_detected_in_pipeline
+  warning:
+    - policy_as_code_deviation
+    - image_attestation_stale
+    - rasp_rule_bypass_detected
+    - license_compliance_violation
+  thresholds:
+    policy_violations:
+      max_critical: 0
+      max_high: 0
+      max_medium: 5
+    attestation_age_days: 7
+    minimum_maturity_for_ato: "level_3_defined"
+
+# DoD MOSA Gates (Phase 26)
+mosa:
+  blocking:
+    - external_interface_without_icd
+    - circular_dependencies_detected
+    - modularity_score_below_minimum
+    - direct_coupling_violation
+  warning:
+    - interface_coverage_below_80_pct
+    - tsp_expired_or_missing
+    - cohesion_score_below_threshold
+    - coupling_score_above_threshold
+  thresholds:
+    min_modularity_score: 0.6
+    max_coupling_score: 0.4
+    min_cohesion_score: 0.6
+    min_interface_coverage_pct: 80
+    max_circular_dependencies: 0
+    max_direct_coupling_violations: 0
+    tsp_max_age_days: 180
+    require_icd_per_external_interface: true
+
+# Zero Trust Architecture Gates (Phase 25)
+zero_trust:
+  blocking:
+    - zta_maturity_below_minimum
+    - mtls_not_enforced
+    - network_policy_missing
+    - identity_verification_absent
+  warning:
+    - zta_pillar_below_threshold
+    - posture_evidence_stale
+    - pdp_connectivity_degraded
+    - service_mesh_sidecar_missing
+  thresholds:
+    minimum_maturity_score: 0.34
+    pillar_minimum_score: 0.2
+    evidence_max_age_days: 30
+    require_mtls_for_il4_plus: true
+    require_network_policy: true
+
+# Remote Command Gateway Gates (Phase 28)
+remote_command:
+  blocking:
+    - unbound_user_command
+    - signature_verification_failed
+    - classification_level_exceeded
+    - rate_limit_exceeded
+    - blocked_command_on_remote
+  warning:
+    - unbound_attempts_approaching_limit
+    - response_redacted
+    - challenge_expired
+  thresholds:
+    binding_required: true
+    max_unbound_attempts: 3
+    challenge_ttl_minutes: 10
+    signature_required: true
+    replay_window_seconds: 300
+    rate_limit_per_user: 30
+    rate_limit_per_channel: 100
+    blocked_commands_remote:
+      - icdev-deploy
+      - icdev-init
+    confirmation_required:
+      - icdev-test
+      - icdev-secure
+      - icdev-build
+
+# Prompt Injection Detection Gates (Phase 37 — D217)
+prompt_injection:
+  blocking:
+    - high_confidence_injection_unresolved
+    - prompt_injection_defense_inactive
+  warning:
+    - flagged_injection_count_high
+    - base64_encoded_injection_detected
+  thresholds:
+    max_unresolved_block: 0
+    max_unresolved_flag: 5
+    detection_active_required: true
+    deep_base64_scan: true
+
+# AI Security Gates (Phase 37 — MITRE ATLAS, D216)
+atlas_ai:
+  blocking:
+    - critical_atlas_technique_unmitigated
+    - prompt_injection_defense_inactive
+    - ai_telemetry_not_active
+    - agent_permissions_not_configured
+    - ai_bom_missing
+  warning:
+    - atlas_coverage_below_threshold
+    - owasp_llm_gap_detected
+    - ai_bom_stale
+  thresholds:
+    min_atlas_coverage_pct: 80
+    ai_telemetry_required: true
+    ai_bom_required: true
+    ai_bom_max_age_days: 90
+    red_team_scan_required_for_il5_plus: true
+
+# OWASP Agentic AI Security Gates (Phase 45 — D257-D264)
+owasp_agentic:
+  blocking:
+    - agent_trust_below_untrusted_threshold
+    - tool_chain_critical_violation_unresolved
+    - output_classification_leak_detected
+    - behavioral_drift_critical_unresolved
+    - mcp_authorization_not_configured
+  warning:
+    - agent_trust_below_degraded_threshold
+    - tool_chain_high_violations_above_threshold
+    - output_violations_above_threshold
+    - behavioral_red_team_not_run
+    - threat_model_not_current
+  thresholds:
+    min_agent_trust_score: 0.30
+    max_unresolved_critical_chain_violations: 0
+    max_unresolved_critical_output_violations: 0
+    behavioral_drift_detection_required: true
+    mcp_authorization_required: true
+
+# CI/CD Self-Recovery Guard Rails (Phase 4 — D134)
+recovery:
+  max_attempts: 3
+  non_recoverable_failures:
+    - secrets_detected
+    - cat1_stig_finding
+    - critical_vulnerability
+    - missing_cui_markings
+    - classification_violation
+    - high_vulnerability_sast
+  auto_recoverable_failures:
+    - test_assertion_failure
+    - syntax_error
+    - lint_violation
+    - import_error
+    - type_error
+    - bdd_scenario_failure
+    - compile_error
+  require_human_review_for:
+    - security_gate_failure
+    - compliance_gate_failure
+    - high_vulnerability
+    - bandit_high_severity
+
+# Cross-Language Translation Gates (Phase 43)
+translation:
+  blocking:
+    - translation_syntax_errors_in_output
+    - translation_api_surface_below_threshold
+    - translation_compliance_coverage_below_threshold
+    - secrets_detected_in_translation
+    - cui_markings_missing_in_translation
+  warning:
+    - translation_round_trip_similarity_low
+    - translation_type_coverage_low
+    - translation_complexity_increase_high
+    - translation_unmapped_dependencies
+    - translation_stub_functions_present
+    - translation_lint_issues
+  thresholds:
+    min_api_surface_match: 0.90
+    min_type_coverage: 0.85
+    min_round_trip_similarity: 0.80
+    max_complexity_increase_pct: 30
+    min_compliance_coverage_pct: 95.0
+    max_mocked_unit_pct: 20
+
+# .claude Directory Governance Gates (Auto-Validation)
+claude_config_alignment:
+  blocking:
+    - append_only_table_unprotected
+    - hook_syntax_error
+    - hook_reference_missing
+  warning:
+    - dashboard_route_undocumented
+    - e2e_coverage_gap
+    - settings_deny_rule_missing
+  thresholds:
+    max_unprotected_append_only: 0
+    require_hook_syntax_valid: true
+    require_hook_refs_valid: true
+
+# Code Pattern Detection Gates (Phase 44 — D278)
+code_patterns:
+  blocking:
+    - critical_code_pattern_detected
+    - high_code_pattern_detected
+  warning:
+    - medium_code_pattern_detected
+  thresholds:
+    max_critical: 0
+    max_high: 0
+    max_medium: 10
+
+# Endpoint Security Gates (D-EPSEC-2)
+endpoint_security:
+  blocking:
+    - api_route_without_auth_decorator
+    - write_route_without_input_validation
+  thresholds:
+    max_critical: 0
+    max_high: 0
+
+# Production Readiness Audit Gates (D293)
+production_readiness:
+  blocking:
+    - sast_critical_findings
+    - secrets_detected
+    - critical_dependency_vulnerabilities
+    - mcp_server_import_failure
+    - db_schema_mismatch
+    - python_version_incompatible
+    - test_collection_failure
+    - governance_check_failure
+  warning:
+    - cui_markings_incomplete
+    - sbom_generation_skipped
+    - documentation_drift
+    - backup_config_missing
+    - dockerfile_issues
+    - cross_import_errors
+    - dashboard_page_errors
+  thresholds:
+    max_sast_critical: 0
+    max_sast_high: 0
+    max_dep_critical: 0
+    max_dep_high: 5
+    min_cui_coverage_pct: 90
+    min_python_version: "3.9"
+
+observability_xai:
+  blocking:
+    - tracing_not_active
+    - provenance_graph_empty
+    - xai_assessment_not_completed
+    - content_tracing_active_in_cui_without_approval
+  warning:
+    - shap_analysis_stale
+    - provenance_gaps_detected
+    - mlflow_connectivity_degraded
+    - xai_coverage_below_threshold
+  thresholds:
+    tracing_required: true
+    provenance_required: true
+    shap_max_age_days: 30
+    min_xai_coverage_pct: 80
+
+marketplace_publish:
+  blocking:
+    - sast_critical_or_high_findings
+    - secrets_detected
+    - critical_dependency_vulnerabilities
+    - cui_markings_missing
+    - prompt_injection_in_asset
+    - behavioral_sandbox_critical_violation
+    - sbom_generation_failed
+    - digital_signature_failed
+  warning:
+    - unpinned_dependencies
+    - medium_sast_findings
+    - sbom_generation_skipped
+
+marketplace_cross_tenant:
+  blocking:
+    - any_publish_gate_failure
+    - human_review_not_completed
+    - code_review_not_confirmed
+    - compliance_review_not_confirmed
+    - publisher_is_reviewer
+  warning:
+    - review_age_exceeds_threshold
+    - conditional_approval_conditions_unmet
+
+marketplace_install:
+  blocking:
+    - il_compatibility_violation
+    - asset_not_published
+    - required_dependency_missing
+  warning:
+    - optional_dependency_missing
+    - version_constraint_not_satisfied
+    - asset_deprecated
+
+# Phase 48: AI Transparency & Accountability (D307-D315)
+ai_transparency:
+  blocking:
+    - high_impact_ai_not_classified
+    - model_cards_missing_for_deployed_models
+    - ai_inventory_incomplete
+    - gao_evidence_gaps_on_critical_practices
+    - confabulation_detection_not_active
+  warning:
+    - system_card_stale
+    - fairness_assessment_not_conducted
+    - bias_mitigation_not_documented
+    - annual_report_data_missing
+  thresholds:
+    ai_inventory_required: true
+    model_card_required_per_model: true
+    system_card_max_age_days: 90
+    confabulation_detection_required: true
+    min_gao_evidence_coverage_pct: 80
+    fairness_assessment_max_age_days: 180
+
+ai_accountability:
+  blocking:
+    - caio_not_designated_for_high_impact
+    - oversight_plan_missing_for_high_impact
+    - critical_incident_unresolved
+    - reassessment_overdue_over_90_days
+  warning:
+    - appeal_process_not_defined
+    - ethics_review_not_conducted
+    - impact_assessment_missing
+    - fairness_gate_not_passing
+  thresholds:
+    caio_required_for_high_impact: true
+    oversight_plan_required: true
+    max_unresolved_critical_incidents: 0
+    reassessment_max_overdue_days: 90
+    ethics_review_max_age_days: 365
+
+ai_governance:
+  blocking:
+    - caio_not_designated_for_rights_impacting_ai
+    - oversight_plan_missing_for_high_impact_ai
+    - impact_assessment_not_completed
+  warning:
+    - model_card_missing
+    - fairness_assessment_stale
+    - reassessment_overdue
+    - ai_inventory_incomplete
+  thresholds:
+    caio_required_for_rights_impacting: true
+    oversight_plan_required: true
+    impact_assessment_required: true
+
+owasp_asi:
+  blocking:
+    - critical_asi_risk_unmitigated
+    - prompt_injection_defense_inactive_for_asi01
+    - tool_chain_validation_missing_for_asi02
+    - supply_chain_ai_bom_missing_for_asi04
+  warning:
+    - memory_integrity_not_verified_asi06
+    - inter_agent_comms_not_secured_asi07
+    - resilience_config_missing_asi08
+    - human_oversight_gaps_asi09
+    - rogue_agent_detection_not_active_asi10
+  thresholds:
+    min_asi_coverage_pct: 60
+    critical_risks_must_pass: true
+    supply_chain_verification_required: true
+
+eu_ai_act:
+  blocking:
+    - high_risk_ai_system_not_classified
+    - risk_management_system_missing
+    - data_governance_not_documented
+    - technical_documentation_missing
+    - transparency_requirements_not_met
+  warning:
+    - human_oversight_plan_incomplete
+    - record_keeping_partial
+    - conformity_assessment_missing
+    - post_market_monitoring_not_active
+    - incident_reporting_not_configured
+    - fundamental_rights_impact_not_assessed
+  thresholds:
+    risk_classification_required: true
+    min_euai_coverage_pct: 60
+    data_governance_required_for_high_risk: true
+    transparency_required: true
+    human_oversight_required_for_high_risk: true
+
+swft:
+  blocking:
+    - slsa_provenance_missing
+    - sbom_not_generated
+    - sast_scan_not_completed
+    - secret_detection_not_run
+    - dependency_audit_not_completed
+  warning:
+    - slsa_level_below_target
+    - vex_document_missing
+    - container_scan_not_completed
+    - image_attestation_missing
+    - swft_evidence_stale
+  thresholds:
+    min_slsa_level: 2
+    sbom_max_age_days: 30
+    sast_required: true
+    dependency_audit_required: true
+    secret_detection_required: true
+
+# RAG Subsystem (Phase 64, D-RAG-1 through D-RAG-14)
+rag:
+  blocking:
+    - rag_injection_without_provenance
+    - rag_cross_tenant_query_detected
+    - rag_content_tracing_in_cui_without_approval
+  warning:
+    - rag_ingestion_stale_over_7_days
+    - rag_retrieval_low_relevance_trend
+    - rag_vector_store_unavailable
+  thresholds:
+    provenance_required: true
+    tenant_isolation_required: true
+    max_ingestion_staleness_days: 7
+
+code_quality:
+  blocking:
+    - avg_cyclomatic_complexity_exceeds_critical
+  warning:
+    - maintainability_score_declining
+    - high_smell_density
+    - dead_code_exceeds_threshold
+  thresholds:
+    max_avg_complexity: 25
+    min_maintainability_score: 0.40
+    max_smell_density_per_kloc: 20
+    max_dead_code_pct: 10
+
+marketplace:
+  thresholds:
+    sast:
+      max_critical: 0
+      max_high: 0
+    secret_detection:
+      max_findings: 0
+    dependency_audit:
+      max_critical: 0
+      max_high: 0
+    review:
+      max_age_days: 30
+      escalation_after_days: 7
+
+# Fine-Tuning Security Gate (D-FT-4, D-FT-16, D-FT-18)
+fine_tuning:
+  blocking:
+    - training_data_cui_boundary_violation
+    - cloud_finetune_exceeds_classification_level
+    - lora_adapter_unsigned_for_marketplace
+    - training_data_provenance_missing
+  warning:
+    - training_dataset_below_min_size
+    - eval_score_below_baseline
+    - gpu_vram_insufficient
+    - auto_retrain_disabled
+  thresholds:
+    min_dataset_examples: 20
+    min_bleu_for_promotion: 0.30
+    min_rouge_l_for_promotion: 0.40
+    min_perplexity_improvement_pct: 10
+    cloud_max_classification: CUI
+    min_gpu_vram_gb: 16
+
+# WriteGuard Writing Assistant Gate (Phase 65, D-WG-1 through D-WG-14)
+writeguard:
+  blocking:
+    - cui_marking_violations_in_production
+    - classification_vocabulary_leak
+  warning:
+    - readability_grade_above_14
+    - passive_voice_above_40_pct
+    - quality_score_below_threshold
+  thresholds:
+    max_grade_level: 14
+    max_passive_voice_pct: 40
+    min_quality_score: 50.0
+    cui_marking_required_for_il4_plus: true
+
+# Harness Engineering Gates (D-HARNESS-1 through D-HARNESS-8)
+harness:
+  blocking:
+    - loop_detection_threshold_exceeded_critical
+  warning:
+    - loop_detection_escalation_triggered
+    - exit_criteria_not_defined
+    - harness_maturity_below_managed
+  thresholds:
+    min_maturity_level: 2
+    loop_detection_critical_multiplier: 3
+    require_exit_criteria: true
+
+# Marketplace Commerce Extension Gate (D-MKT-C1 through D-MKT-C10)
+marketplace_commerce:
+  blocking:
+    - unsigned_license_token
+    - license_key_not_found
+    - append_only_table_mutation
+  warning:
+    - stripe_unavailable
+    - grace_period_approaching
+    - po_approval_pending
+  thresholds:
+    max_grace_period_days: 30
+    license_cache_ttl_seconds: 60
+    rsa_key_min_bits: 4096