icdev 0.0.3__py3-none-any.whl

args/storage_config.yaml

@@ -0,0 +1,63 @@
+# CUI // SP-CTI
+# Storage Configuration — ICDEV Database Backend (D-DB-20)
+#
+# Controls which database backend ICDEV uses for operational data.
+# Environment variables override these values (highest priority).
+#
+# Backend options:
+#   sqlite      — Zero-config, file-based (default for dev/portable)
+#   postgresql  — Full ACID, concurrent writes, schema evolution (recommended for production)
+#
+# Migration path: Start with sqlite, switch to postgresql when ready.
+# All tools use the same API via tools/db/storage.py — no code changes needed.
+
+# Active backend (override: ICDEV_STORAGE_BACKEND env var)
+backend: postgresql
+
+# ---------------------------------------------------------------------------
+# SQLite configuration
+# ---------------------------------------------------------------------------
+sqlite:
+  # Path relative to project root (override: ICDEV_DB_PATH env var)
+  path: data/icdev.db
+
+# ---------------------------------------------------------------------------
+# PostgreSQL configuration
+# ---------------------------------------------------------------------------
+postgresql:
+  # Connection parameters (override: ICDEV_PG_* env vars)
+  host: localhost
+  port: 5432
+  database: icdev
+  username: icdev
+
+  # Password resolution (pick one):
+  #   1. ICDEV_PG_PASSWORD env var (direct)
+  #   2. secret_ref with env: prefix (indirection)
+  #   3. password field below (least secure, dev only)
+  #   4. ICDEV_PG_CONNECTION_STRING env var (full DSN, overrides all)
+  secret_ref: "env:ICDEV_PG_PASSWORD"
+  password: "icdev"  # Local dev only — production uses secret_ref
+
+  # Connection string (overrides host/port/database/username/password)
+  # connection_string: "host=localhost port=5432 dbname=icdev user=icdev password=secret"
+
+  # Connection pool
+  pool_size: 5
+
+# ---------------------------------------------------------------------------
+# Database mapping (future: per-database backend selection)
+# ---------------------------------------------------------------------------
+# When PostgreSQL is active, all databases (icdev, sparkpilot, memory) map
+# to schemas within the same PostgreSQL database. Schema separation:
+#   - public    → icdev tables
+#   - sparkpilot → sparkpilot tables
+#   - memory    → memory tables
+#
+# databases:
+#   icdev:
+#     schema: public
+#   sparkpilot:
+#     schema: sparkpilot
+#   memory:
+#     schema: memory

args/writeguard_config.yaml

@@ -0,0 +1,131 @@
+# WriteGuard Configuration (Phase 65, D-WG-1 through D-WG-14)
+
+writeguard:
+  enabled: true
+  version: "1.0.0"
+
+  # Analysis modes
+  modes:
+    inline:
+      max_text_length: 50000  # characters
+      timeout_seconds: 30
+    batch:
+      max_documents: 50
+      max_document_length: 200000
+      timeout_seconds: 300
+
+  # Grammar checker (D-WG-2 — deterministic)
+  grammar:
+    enabled: true
+    rules_file: "context/writing/grammar_rules/common_errors.json"
+    govcon_vocabulary_file: "context/writing/grammar_rules/govcon_vocabulary.json"
+    max_findings_per_category: 50
+
+  # Readability scorer (D-WG-2 — deterministic)
+  readability:
+    enabled: true
+    target_grade_level: 12.0  # Default; overridable by style guide
+    formulas:
+      - flesch_kincaid
+      - gunning_fog
+      - smog
+      - coleman_liau
+      - ari
+
+  # Tone profiler (D-WG-12 — scanner tier)
+  tone:
+    enabled: true
+    profiles:
+      - formal
+      - technical
+      - persuasive
+      - authoritative
+      - compliant
+      - plain_language
+    gov_profiles:
+      - authoritative_government
+      - persuasive_technical
+      - plain_writing_act
+
+  # Style enforcer (D-WG-3 — cascade)
+  style:
+    enabled: true
+    cascade_order:
+      - platform
+      - tenant
+      - program
+      - project
+      - user
+    default_guide: "government"
+
+  # Coherence analyzer (D-WG-12 — worker tier)
+  coherence:
+    enabled: true
+    min_paragraphs: 2
+
+  # Plagiarism detector (D-WG-5 — RAG similarity)
+  plagiarism:
+    enabled: true
+    similarity_threshold: 0.85
+    min_text_length: 50
+    source_types:
+      - proposal_knowledge_base
+      - proposal_section_drafts
+      - wg_snippets
+
+  # AI content detector (D-WG-6 — deterministic)
+  ai_detection:
+    enabled: true
+    advisory_only: true  # D110 — advisory, not blocking
+    thresholds:
+      likely_ai: 0.75
+      possibly_ai: 0.50
+      likely_human: 0.25
+
+  # Rewriter (D-WG-12 — worker tier)
+  rewriter:
+    enabled: true
+    max_text_length: 5000
+
+  # Snippet manager (D-WG-7)
+  snippets:
+    enabled: true
+    max_content_length: 10000
+    categories:
+      - boilerplate
+      - transition
+      - introduction
+      - conclusion
+      - methodology
+      - compliance
+      - evidence
+      - custom
+
+  # CUI-aware rules (D-WG-13)
+  cui:
+    enabled: true
+    il4_marking_mandatory: true
+    il6_no_spillage_vocabulary: true
+
+  # Quality score weights
+  quality_weights:
+    grammar: 0.20
+    readability: 0.20
+    style_compliance: 0.15
+    coherence: 0.15
+    tone_alignment: 0.10
+    passive_voice: 0.10
+    sentence_variety: 0.10
+
+  # Innovation signal registration (D-WG-14, D360)
+  innovation:
+    enabled: true
+    min_finding_frequency: 5  # Register signal after N identical findings
+    source_type: "writing_analysis"
+
+  # GovProposal integration (D-WG-8)
+  govcon:
+    enabled: true
+    bridge_read_only: true  # Never writes to proposal tables
+    shall_coverage_threshold: 0.90
+    win_theme_threshold: 0.80

args/zta_config.yaml

@@ -0,0 +1,247 @@
+# Zero Trust Architecture Configuration — 7-Pillar Maturity Model, Service Mesh, Policy Engine
+# Used by: tools/devsecops/zta_maturity_scorer.py, service_mesh_generator.py, pdp_config_generator.py
+# ADR D120: ZTA maturity model uses DoD 7-pillar scoring (Traditional > Advanced > Optimal)
+# ADR D121: Service mesh and policy engine are profile-selectable (Istio/Linkerd, Kyverno/OPA)
+# ADR D124: PDP modeled as external reference; ICDEV generates PEP configs, not PDP itself
+
+# =============================================================================
+# ZTA 7-Pillar Maturity Model (DoD Zero Trust Strategy + NIST SP 800-207)
+# =============================================================================
+pillars:
+  user_identity:
+    weight: 0.20
+    description: "Identity verification, MFA, ICAM, continuous authentication"
+    nist_800_53_controls: [AC-2, IA-2, IA-5, IA-8, IA-12]
+    evidence_types:
+      - mfa_enabled
+      - sso_configured
+      - cac_piv_required
+      - continuous_auth_active
+      - identity_provider_integrated
+    scoring_criteria:
+      traditional: "Password-based auth, no MFA"
+      advanced: "MFA enabled, SSO integrated, role-based access"
+      optimal: "Continuous authentication, risk-based access, CAC/PIV, phishing-resistant MFA"
+
+  device:
+    weight: 0.15
+    description: "Device posture, health attestation, MDM integration"
+    nist_800_53_controls: [CM-8, IA-3, SC-17, SI-7]
+    evidence_types:
+      - mdm_enrolled
+      - device_health_check
+      - endpoint_detection
+      - patch_compliance
+      - disk_encryption
+    scoring_criteria:
+      traditional: "No device posture checking"
+      advanced: "MDM enrollment required, basic health checks"
+      optimal: "Continuous device attestation, EDR integrated, compliance-gated access"
+
+  network:
+    weight: 0.15
+    description: "Micro-segmentation, encrypted channels, software-defined perimeter"
+    nist_800_53_controls: [AC-3, AC-4, SC-7, SC-8, SC-13]
+    evidence_types:
+      - network_policies_present
+      - default_deny_egress
+      - mtls_enforced
+      - encrypted_transit
+      - microsegmentation_active
+    scoring_criteria:
+      traditional: "Flat network, perimeter firewall only"
+      advanced: "Network policies per namespace, mTLS between services"
+      optimal: "Per-pod micro-segmentation, encrypted all channels, SDP/ZTNA"
+
+  application_workload:
+    weight: 0.15
+    description: "Application security, container hardening, workload identity"
+    nist_800_53_controls: [SA-8, SA-11, SA-15, SI-7, CM-7]
+    evidence_types:
+      - non_root_containers
+      - read_only_rootfs
+      - capabilities_dropped
+      - service_accounts_restricted
+      - workload_identity_verified
+    scoring_criteria:
+      traditional: "No container hardening, default security context"
+      advanced: "Non-root, read-only rootfs, capabilities dropped, resource limits"
+      optimal: "Workload identity per service, admission control, signed images, minimal base images"
+
+  data:
+    weight: 0.15
+    description: "Data classification, encryption at rest and transit, DLP"
+    nist_800_53_controls: [AC-16, MP-4, SC-12, SC-28, SI-12]
+    evidence_types:
+      - data_classified
+      - encryption_at_rest
+      - encryption_in_transit
+      - key_management
+      - dlp_active
+    scoring_criteria:
+      traditional: "No data classification, partial encryption"
+      advanced: "Data classified, FIPS 140-2 encryption, key rotation"
+      optimal: "Automated DLP, customer-managed keys, classification-driven access, tokenization"
+
+  visibility_analytics:
+    weight: 0.10
+    description: "SIEM integration, continuous monitoring, anomaly detection"
+    nist_800_53_controls: [AU-2, AU-6, AU-12, SI-4, IR-4]
+    evidence_types:
+      - centralized_logging
+      - siem_integrated
+      - anomaly_detection
+      - audit_trail_complete
+      - real_time_alerts
+    scoring_criteria:
+      traditional: "Basic logging, no SIEM"
+      advanced: "Centralized logging, SIEM with alerts, audit trail"
+      optimal: "ML-based anomaly detection, SOAR integration, real-time threat intelligence"
+
+  automation_orchestration:
+    weight: 0.10
+    description: "SOAR, automated response, self-healing, policy automation"
+    nist_800_53_controls: [IR-4, SI-4, CP-2, CA-7]
+    evidence_types:
+      - auto_remediation
+      - incident_playbooks
+      - self_healing_active
+      - policy_automation
+      - compliance_automation
+    scoring_criteria:
+      traditional: "Manual incident response"
+      advanced: "Automated playbooks, basic auto-remediation"
+      optimal: "Full SOAR, self-healing infrastructure, policy-driven automation"
+
+# =============================================================================
+# Maturity Levels
+# =============================================================================
+maturity_levels:
+  traditional:
+    score_range: [0.0, 0.33]
+    description: "Perimeter-based security, limited Zero Trust adoption"
+    allowed_for_il: [IL2]
+    blocked_for_il: [IL5, IL6]
+
+  advanced:
+    score_range: [0.34, 0.66]
+    description: "Partial Zero Trust adoption, key pillars implemented"
+    allowed_for_il: [IL2, IL4, IL5]
+    minimum_for_il: [IL4, IL5]
+
+  optimal:
+    score_range: [0.67, 1.0]
+    description: "Full Zero Trust across all pillars"
+    allowed_for_il: [IL2, IL4, IL5, IL6]
+    minimum_for_il: [IL6]
+
+# =============================================================================
+# Service Mesh Options (D121: both supported, customer selects)
+# =============================================================================
+service_mesh_options:
+  istio:
+    description: "Istio service mesh — most mature, widest DoD/Gov adoption"
+    features:
+      mtls: true
+      authz_policy: true         # AuthorizationPolicy CRD
+      peer_auth: true             # PeerAuthentication CRD
+      virtual_service: true       # VirtualService for traffic routing
+      destination_rule: true      # DestinationRule for circuit breaking
+      sidecar: true               # Sidecar CRD for egress control
+      telemetry: true             # Built-in Prometheus/Jaeger
+    api_versions:
+      security: "security.istio.io/v1beta1"
+      networking: "networking.istio.io/v1beta1"
+    mtls_mode: "STRICT"
+    injection_label: "istio-injection: enabled"
+
+  linkerd:
+    description: "Linkerd service mesh — lightweight, simpler operations"
+    features:
+      mtls: true
+      authz_policy: true          # ServerAuthorization CRD
+      server_auth: true           # Server CRD
+      service_profile: true       # ServiceProfile for retries/timeouts
+      http_route: true            # HTTPRoute for traffic routing
+      telemetry: true             # Built-in Prometheus/Grafana
+    api_versions:
+      policy: "policy.linkerd.io/v1beta2"
+      server: "policy.linkerd.io/v1beta1"
+    mtls_mode: "enforced"
+    injection_annotation: "linkerd.io/inject: enabled"
+
+# =============================================================================
+# Policy Engine Options (D121: both supported, customer selects)
+# =============================================================================
+policy_engine_options:
+  kyverno:
+    description: "K8s-native policy engine — YAML policies, no Rego learning curve"
+    features:
+      validation: true
+      mutation: true
+      generation: true
+      image_verification: true
+      audit_mode: true
+    api_version: "kyverno.io/v1"
+    policy_types: [ClusterPolicy, Policy]
+
+  opa_gatekeeper:
+    description: "OPA/Gatekeeper — powerful Rego language, broader ecosystem"
+    features:
+      constraint_templates: true
+      constraints: true
+      audit: true
+      external_data: true
+    api_version: "constraints.gatekeeper.sh/v1beta1"
+    policy_types: [ConstraintTemplate, Constraint]
+
+# =============================================================================
+# Policy Decision Point (PDP) References (D124: external, not implemented by ICDEV)
+# =============================================================================
+pdp_references:
+  - id: disa_icam
+    name: "DISA ICAM/IDAM"
+    type: identity
+    description: "DoD Identity, Credential, and Access Management"
+    integration: "SAML/OIDC federation to Istio/Linkerd"
+
+  - id: zscaler
+    name: "Zscaler Private Access"
+    type: network
+    description: "Zero Trust Network Access (ZTNA)"
+    integration: "Connector deployment in K8s, policy push via API"
+
+  - id: palo_alto_prisma
+    name: "Palo Alto Prisma Access"
+    type: network
+    description: "Cloud-delivered security platform"
+    integration: "GlobalProtect agent, Prisma Cloud Defender"
+
+  - id: crowdstrike
+    name: "CrowdStrike Falcon"
+    type: device
+    description: "Endpoint detection and response (EDR)"
+    integration: "Falcon sensor DaemonSet, device posture API"
+
+  - id: microsoft_entra
+    name: "Microsoft Entra ID (Azure AD)"
+    type: identity
+    description: "Cloud identity and access management"
+    integration: "OIDC/SAML federation, conditional access policies"
+
+  - id: custom
+    name: "Customer-provided PDP"
+    type: custom
+    description: "Customer's existing policy decision point"
+    integration: "Customer provides integration spec"
+
+# =============================================================================
+# Posture Scoring — Integration with cATO (D123)
+# =============================================================================
+posture_scoring:
+  cato_integration: true
+  evidence_refresh_days: 30
+  minimum_score_for_deploy: 0.5
+  minimum_pillar_score: 0.2      # No pillar can be zero for IL4+
+  scoring_method: weighted_average  # Uses pillar weights above
+  trend_window_days: 90           # Track maturity trend over 90 days

context/__init__.py

@@ -0,0 +1,6 @@
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: ICDEV System Administrator
+# Package marker for PyPI distribution

context/agent/__init__.py

@@ -0,0 +1,6 @@
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: ICDEV System Administrator
+# Package marker for PyPI distribution

context/agent/response_schemas/__init__.py

@@ -0,0 +1,6 @@
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: ICDEV System Administrator
+# Package marker for PyPI distribution

context/agent/response_schemas/debate_position.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "DebatePosition",
+  "description": "Schema for agent debate pattern output. Defines a structured position in a multi-agent debate including arguments, counterarguments, and a recommendation.",
+  "type": "object",
+  "required": ["position", "confidence", "arguments"],
+  "additionalProperties": false,
+  "properties": {
+    "position": {
+      "type": "string",
+      "enum": ["support", "oppose", "neutral"],
+      "description": "The agent's stance on the debate topic"
+    },
+    "confidence": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 1,
+      "description": "Confidence in the stated position (0.0 to 1.0)"
+    },
+    "arguments": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "minItems": 1,
+      "description": "Key arguments supporting the agent's position"
+    },
+    "counterarguments": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Responses to arguments from other agents' positions",
+      "default": []
+    },
+    "recommendation": {
+      "type": "string",
+      "description": "Specific actionable recommendation based on the position"
+    },
+    "classification": {
+      "type": "string",
+      "default": "CUI",
+      "description": "Classification marking for this debate position"
+    }
+  }
+}

context/agent/response_schemas/fitness_scorecard.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "FitnessScorecard",
+  "description": "Schema for agentic fitness assessment output. Evaluates whether a component should use agent, hybrid, or traditional architecture.",
+  "type": "object",
+  "required": ["component", "scores", "overall_score", "recommendations"],
+  "additionalProperties": false,
+  "properties": {
+    "component": {
+      "type": "string",
+      "description": "Name of the component being assessed",
+      "minLength": 2,
+      "maxLength": 60
+    },
+    "scores": {
+      "type": "object",
+      "required": ["data_complexity", "decision_complexity", "user_interaction", "integration_density", "compliance_sensitivity", "scale_variability"],
+      "additionalProperties": false,
+      "properties": {
+        "data_complexity": {"type": "integer", "minimum": 0, "maximum": 10},
+        "decision_complexity": {"type": "integer", "minimum": 0, "maximum": 10},
+        "user_interaction": {"type": "integer", "minimum": 0, "maximum": 10},
+        "integration_density": {"type": "integer", "minimum": 0, "maximum": 10},
+        "compliance_sensitivity": {"type": "integer", "minimum": 0, "maximum": 10},
+        "scale_variability": {"type": "integer", "minimum": 0, "maximum": 10}
+      }
+    },
+    "overall_score": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 10,
+      "description": "Weighted average of dimension scores"
+    },
+    "recommendations": {
+      "type": "object",
+      "required": ["architecture"],
+      "additionalProperties": false,
+      "properties": {
+        "architecture": {
+          "type": "string",
+          "enum": ["agent", "hybrid", "traditional"],
+          "description": "Primary architecture recommendation"
+        },
+        "agent_components": {
+          "type": "array",
+          "items": {"type": "string"},
+          "default": [],
+          "description": "Components that should use agent architecture"
+        },
+        "nlq_interfaces": {
+          "type": "array",
+          "items": {"type": "string"},
+          "default": [],
+          "description": "Interfaces that should support NLQ"
+        },
+        "traditional_components": {
+          "type": "array",
+          "items": {"type": "string"},
+          "default": [],
+          "description": "Components that should use traditional patterns"
+        }
+      }
+    },
+    "rationale": {
+      "type": ["string", "null"],
+      "description": "Brief explanation of the assessment"
+    },
+    "classification": {
+      "type": "string",
+      "default": "CUI",
+      "description": "Classification marking"
+    }
+  }
+}

context/agent/response_schemas/review_decision.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "ReviewDecision",
+  "description": "Schema for agent reviewer pattern output. Defines the structure of a review decision including approval/rejection, confidence, feedback, and specific issues found.",
+  "type": "object",
+  "required": ["decision", "confidence", "feedback"],
+  "additionalProperties": false,
+  "properties": {
+    "decision": {
+      "type": "string",
+      "enum": ["approve", "reject"],
+      "description": "Whether the reviewed output is approved or rejected"
+    },
+    "confidence": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 1,
+      "description": "Reviewer's confidence in the decision (0.0 to 1.0)"
+    },
+    "feedback": {
+      "type": "string",
+      "description": "Specific, actionable feedback explaining the decision",
+      "minLength": 1
+    },
+    "issues": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "List of specific issues found in the output",
+      "default": []
+    },
+    "classification": {
+      "type": "string",
+      "default": "CUI",
+      "description": "Classification marking for this review decision"
+    }
+  }
+}