icdev 0.0.3__py3-none-any.whl

context/agentic/csp_mcp_registry.yaml

@@ -0,0 +1,280 @@
+# [TEMPLATE: CUI // SP-CTI]
+# CSP MCP Server Registry - maps cloud providers to their MCP servers
+# Used by: tools/builder/app_blueprint.py (resolve_csp_mcp_servers function)
+# Purpose: When generating cloud-native child apps, select relevant CSP MCP servers
+#          based on the app's capabilities and target cloud provider.
+# Phase: ICDEV Phase 19
+
+providers:
+  aws:
+    display_name: "Amazon Web Services"
+    govcloud_region: "us-gov-west-1"
+    default_region: "us-east-1"
+    mcp_servers:
+      core:
+        - name: "@aws/core-mcp-server"
+          description: "Core AWS service operations"
+          transport: "stdio"
+        - name: "@aws/aws-api-mcp-server"
+          description: "AWS API operations"
+          transport: "stdio"
+      iac:
+        - name: "@aws/cdk-mcp-server"
+          description: "AWS CDK infrastructure as code"
+          transport: "stdio"
+        - name: "@aws/terraform-mcp-server"
+          description: "Terraform for AWS"
+          transport: "stdio"
+        - name: "@aws/cloudformation-mcp-server"
+          description: "CloudFormation stack management"
+          transport: "stdio"
+      ai_ml:
+        - name: "@aws/bedrock-knowledge-bases-retrieval-mcp-server"
+          description: "Amazon Bedrock Knowledge Bases retrieval"
+          transport: "stdio"
+        - name: "@aws/sagemaker-mcp-server"
+          description: "SageMaker ML operations"
+          transport: "stdio"
+      data:
+        - name: "@aws/dynamodb-mcp-server"
+          description: "DynamoDB table operations"
+          transport: "stdio"
+        - name: "@aws/aurora-postgresql-mcp-server"
+          description: "Aurora PostgreSQL database"
+          transport: "stdio"
+        - name: "@aws/s3-tables-mcp-server"
+          description: "S3 object and table storage"
+          transport: "stdio"
+      containers:
+        - name: "@aws/eks-mcp-server"
+          description: "EKS Kubernetes management"
+          transport: "stdio"
+        - name: "@aws/ecs-mcp-server"
+          description: "ECS container service"
+          transport: "stdio"
+      security:
+        - name: "@aws/iam-mcp-server"
+          description: "IAM policy and role management"
+          transport: "stdio"
+        - name: "@aws/well-architected-security-mcp-server"
+          description: "Well-Architected security review"
+          transport: "stdio"
+      monitoring:
+        - name: "@aws/cloudwatch-mcp-server"
+          description: "CloudWatch metrics and logs"
+          transport: "stdio"
+        - name: "@aws/cloudtrail-mcp-server"
+          description: "CloudTrail audit logging"
+          transport: "stdio"
+        - name: "@aws/cost-explorer-mcp-server"
+          description: "Cost analysis and optimization"
+          transport: "stdio"
+      serverless:
+        - name: "@aws/serverless-mcp-server"
+          description: "Serverless application management"
+          transport: "stdio"
+        - name: "@aws/lambda-tool-mcp-server"
+          description: "Lambda function operations"
+          transport: "stdio"
+      docs:
+        - name: "@aws/aws-documentation-mcp-server"
+          description: "AWS documentation search"
+          transport: "stdio"
+        - name: "@aws/aws-knowledge-mcp-server"
+          description: "AWS knowledge base queries"
+          transport: "stdio"
+      messaging:
+        - name: "@aws/sns-sqs-mcp-server"
+          description: "SNS/SQS messaging"
+          transport: "stdio"
+        - name: "@aws/step-functions-mcp-server"
+          description: "Step Functions workflow orchestration"
+          transport: "stdio"
+      diagrams:
+        - name: "@aws/diagram-mcp-server"
+          description: "AWS architecture diagrams"
+          transport: "stdio"
+
+  gcp:
+    display_name: "Google Cloud Platform"
+    default_region: "us-central1"
+    managed_endpoint_pattern: "https://{service}.googleapis.com/mcp"
+    mcp_servers:
+      core:
+        - name: "@google-cloud/bigquery-mcp"
+          description: "BigQuery analytics"
+          transport: "stdio"
+        - name: "@google-cloud/gce-mcp"
+          description: "Compute Engine VM management"
+          transport: "stdio"
+        - name: "@google-cloud/gke-mcp"
+          description: "GKE Kubernetes management"
+          transport: "stdio"
+      data:
+        - name: "@google-cloud/cloud-storage-mcp"
+          description: "Cloud Storage object management"
+          transport: "stdio"
+        - name: "@google-cloud/alloydb-mcp"
+          description: "AlloyDB PostgreSQL"
+          transport: "stdio"
+      ai_ml:
+        - name: "@google-cloud/vertex-ai-mcp"
+          description: "Vertex AI ML operations"
+          transport: "stdio"
+      monitoring:
+        - name: "@google-cloud/cloud-monitoring-mcp"
+          description: "Cloud Monitoring metrics"
+          transport: "stdio"
+      docs:
+        - name: "@google-cloud/data-commons-mcp"
+          description: "Data Commons knowledge"
+          transport: "stdio"
+
+  azure:
+    display_name: "Microsoft Azure"
+    default_region: "eastus"
+    gov_region: "usgovvirginia"
+    mcp_servers:
+      core:
+        - name: "@microsoft/azure-mcp-server"
+          description: "Core Azure operations"
+          transport: "stdio"
+      devops:
+        - name: "@microsoft/azure-devops-mcp-server"
+          description: "Azure DevOps CI/CD"
+          transport: "stdio"
+      ai_ml:
+        - name: "@microsoft/foundry-mcp-server"
+          description: "Azure AI Foundry"
+          transport: "stdio"
+      security:
+        - name: "@microsoft/sentinel-mcp-server"
+          description: "Microsoft Sentinel SIEM"
+          transport: "stdio"
+      developer:
+        - name: "@microsoft/dev-box-mcp-server"
+          description: "Dev Box environments"
+          transport: "stdio"
+
+  oracle:
+    display_name: "Oracle Cloud Infrastructure"
+    default_region: "us-ashburn-1"
+    gov_region: "us-gov-ashburn-1"
+    mcp_servers:
+      core:
+        - name: "@oracle/oci-api-mcp-server"
+          description: "OCI API operations"
+          transport: "stdio"
+      data:
+        - name: "@oracle/database-mcp-server"
+          description: "Oracle Database operations"
+          transport: "stdio"
+      ai_ml:
+        - name: "@oracle/oci-data-science-mcp-server"
+          description: "OCI Data Science"
+          transport: "stdio"
+
+  ibm:
+    display_name: "IBM Cloud for Government (IC4G)"
+    default_region: "us-south"
+    gov_region: "us-south"
+    mcp_servers:
+      core:
+        - name: "@ibm/cloud-core-mcp-server"
+          description: "IBM Cloud core operations (VPC, IAM, Resource Controller)"
+          transport: "stdio"
+      data:
+        - name: "@ibm/cloud-object-storage-mcp-server"
+          description: "IBM Cloud Object Storage (S3-compatible)"
+          transport: "stdio"
+        - name: "@ibm/db2-mcp-server"
+          description: "IBM Db2 database operations"
+          transport: "stdio"
+      ai_ml:
+        - name: "@ibm/watsonx-ai-mcp-server"
+          description: "IBM watsonx.ai (Granite, Llama)"
+          transport: "stdio"
+      security:
+        - name: "@ibm/key-protect-mcp-server"
+          description: "IBM Key Protect (FIPS 140-2 Level 3)"
+          transport: "stdio"
+        - name: "@ibm/security-compliance-mcp-server"
+          description: "IBM Security and Compliance Center"
+          transport: "stdio"
+      containers:
+        - name: "@ibm/iks-mcp-server"
+          description: "IBM Kubernetes Service / Red Hat OpenShift on IBM Cloud"
+          transport: "stdio"
+      monitoring:
+        - name: "@ibm/cloud-monitoring-mcp-server"
+          description: "IBM Cloud Monitoring with Sysdig"
+          transport: "stdio"
+        - name: "@ibm/log-analysis-mcp-server"
+          description: "IBM Log Analysis"
+          transport: "stdio"
+
+# Capability-to-CSP-category mapping
+# Maps child app capabilities to which CSP MCP server categories to include.
+# The blueprint engine iterates the app's declared capabilities and unions the
+# corresponding server categories for the target CSP.
+capability_mapping:
+  core:
+    aws: ["core", "docs"]
+    gcp: ["core"]
+    azure: ["core"]
+    oracle: ["core"]
+    ibm: ["core"]
+  compliance:
+    aws: ["security", "monitoring"]
+    gcp: []
+    azure: ["security"]
+    oracle: []
+    ibm: ["security"]
+  data:
+    aws: ["data"]
+    gcp: ["data"]
+    azure: []
+    oracle: ["data"]
+    ibm: ["data"]
+  cicd:
+    aws: []
+    gcp: []
+    azure: ["devops"]
+    oracle: []
+    ibm: []
+  monitoring:
+    aws: ["monitoring"]
+    gcp: ["monitoring"]
+    azure: []
+    oracle: []
+    ibm: ["monitoring"]
+  containers:
+    aws: ["containers"]
+    gcp: ["core"]  # GKE is in GCP core category
+    azure: []
+    oracle: []
+    ibm: ["containers"]
+  infrastructure:
+    aws: ["iac"]
+    gcp: []
+    azure: []
+    oracle: []
+    ibm: []
+  ai_ml:
+    aws: ["ai_ml"]
+    gcp: ["ai_ml"]
+    azure: ["ai_ml"]
+    oracle: ["ai_ml"]
+    ibm: ["ai_ml"]
+  serverless:
+    aws: ["serverless"]
+    gcp: []
+    azure: []
+    oracle: []
+    ibm: []
+  messaging:
+    aws: ["messaging"]
+    gcp: []
+    azure: []
+    oracle: []
+    ibm: []

context/agentic/fitness_rubric.md

@@ -0,0 +1,56 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Agentic Fitness Scoring Rubric
+
+## Purpose
+This rubric guides the Architect agent when evaluating whether a component should use agent architecture, NLQ interfaces, traditional REST/CRUD, or a hybrid approach.
+
+## 6 Scoring Dimensions (each 0-10)
+
+### 1. Data Complexity (Weight: 10%)
+- **1-3:** Simple flat data, key-value, single table CRUD
+- **4-6:** Relational data with joins, versioning, search indices
+- **7-10:** Graph relationships, event-sourcing, CQRS, unstructured data, multi-tenant sharding
+
+### 2. Decision Complexity (Weight: 25%)
+- **1-3:** Simple CRUD, static lookups, deterministic validation
+- **4-6:** Workflow with branching, state machines, rule-based scoring
+- **7-10:** Classification, intent routing, NLP, prediction, anomaly detection, adaptive behavior
+
+### 3. User Interaction (Weight: 20%)
+- **1-3:** API-only, headless, batch processing, CLI
+- **4-6:** Dashboard, forms, wizards, filtered search, reports
+- **7-10:** Natural language queries, conversational, voice, exploratory search, chatbot
+
+### 4. Integration Density (Weight: 15%)
+- **1-3:** Standalone, self-contained, no external dependencies
+- **4-6:** API integrations, webhooks, SSO, database connections
+- **7-10:** Multi-agent orchestration, event-driven mesh, federated, cross-system sync
+
+### 5. Compliance Sensitivity (Weight: 15%)
+- **1-3:** Public data, no compliance requirements, prototype
+- **4-6:** Standard compliance (GDPR, HIPAA), RBAC, logging
+- **7-10:** CUI/SECRET, FedRAMP, CMMC, NIST 800-53, FIPS encryption, audit non-repudiation
+
+### 6. Scale Variability (Weight: 15%)
+- **1-3:** Fixed users, low traffic, single instance
+- **4-6:** Moderate scale, predictable growth, load balanced
+- **7-10:** Burst patterns, auto-scaling, real-time streaming, millions concurrent
+
+## Recommendation Mapping
+
+| Overall Score | Architecture |
+|---------------|-------------|
+| >= 6.0 | Full agent architecture |
+| 4.0 - 5.9 | Hybrid (agent + traditional) |
+| < 4.0 | Traditional REST/CRUD |
+
+**NLQ Interface:** Added when user_interaction dimension >= 5.0 (regardless of overall score).
+
+## Always-On Capabilities
+These are included in EVERY generated app regardless of fitness score:
+- Self-healing with pattern detection
+- A2A interoperability (agent card)
+- AIOps (predictive scaling, anomaly detection)
+- GOTCHA framework (goals, tools, args, context, hardprompts)
+- AI governance (token budgets, prompt injection defense)
+- User feedback collection (RLHF-lite)

context/agentic/governance_baseline.md

@@ -0,0 +1,205 @@
+# [TEMPLATE: CUI // SP-CTI]
+
+# Governance Baseline for Generated Applications
+
+## Purpose
+
+This document defines the mandatory governance requirements that every ICDEV-generated child application must satisfy. These requirements are non-negotiable and are enforced during generation (Step 5) and verified during post-generation checks (Step 6) of the agentic generation workflow.
+
+---
+
+## Classification
+
+All generated applications inherit classification from the parent ICDEV instance. The impact level determines markings, encryption, and network constraints.
+
+| Impact Level | Classification Marking | Network | Encryption | Cloud Region |
+|-------------|----------------------|---------|------------|--------------|
+| IL2 | Public — no markings required | Internet OK | TLS 1.2+ | Any commercial |
+| IL4 | CUI // SP-CTI | GovCloud only | FIPS 140-2 | us-gov-west-1 |
+| IL5 | CUI // SP-CTI | Dedicated GovCloud | FIPS 140-2 | us-gov-west-1 (dedicated) |
+| IL6 | SECRET // NOFORN | SIPR only | NSA Type 1 | Air-gapped SIPR |
+
+**Enforcement:** The `classification_manager.py` tool generates all markings. Do NOT hard-code CUI banners. The child app's classification is set at generation time via the blueprint and cannot be escalated without regeneration.
+
+**File marking rules:**
+- All Python files: CUI marking in file header comment
+- All Markdown files: CUI marking as first line
+- All YAML/JSON config files: CUI marking in top-level comment or metadata field
+- All generated reports: CUI banner at top and bottom, page-level portion markings
+
+---
+
+## Compliance Inheritance
+
+Child applications with the compliance capability enabled inherit support for all 9 compliance frameworks:
+
+| # | Framework | Catalog Source | Assessor Tool |
+|---|-----------|---------------|---------------|
+| 1 | NIST 800-53 Rev 5 | `nist_800_53.json` | `control_mapper.py` |
+| 2 | FedRAMP Moderate | `fedramp_moderate_baseline.json` | `fedramp_assessor.py` |
+| 3 | FedRAMP High | `fedramp_high_baseline.json` | `fedramp_assessor.py` |
+| 4 | NIST 800-171 | `nist_800_171_controls.json` | via crosswalk |
+| 5 | CMMC Level 2/3 | `cmmc_practices.json` | `cmmc_assessor.py` |
+| 6 | DoD CSSP (DI 8530.01) | `dod_cssp_8530.json` | `cssp_assessor.py` |
+| 7 | CISA Secure by Design | `cisa_sbd_requirements.json` | `sbd_assessor.py` |
+| 8 | IEEE 1012 IV&V | `ivv_requirements.json` | `ivv_assessor.py` |
+| 9 | DoDI 5000.87 DES | `des_requirements.json` | `des_assessor.py` |
+
+**Crosswalk inheritance:** When the child app implements a NIST 800-53 control (e.g., AC-2), the crosswalk engine automatically maps it to the corresponding controls in FedRAMP, CMMC, and NIST 800-171. This is inherited behavior from ICDEV's `crosswalk_engine.py`.
+
+**Compliance catalogs:** JSON catalog files are copied into the child app's `context/compliance/` directory during generation. The child app uses its own local copies, not references back to ICDEV.
+
+---
+
+## Security Requirements
+
+### Container Security
+- All containers run as non-root (UID 1000)
+- Read-only root filesystem enforced (`readOnlyRootFilesystem: true`)
+- All Linux capabilities dropped (`drop: ["ALL"]`)
+- No privilege escalation allowed (`allowPrivilegeEscalation: false`)
+- Resource limits enforced (CPU and memory)
+- STIG-hardened base image (`docker/Dockerfile.agent-base`)
+
+### Network Security
+- Default-deny network policies in Kubernetes namespace
+- Agent-to-agent traffic restricted to cluster-internal only
+- Mutual TLS (mTLS) for all A2A communication
+- X.509 certificates issued by cluster CA
+- Ingress restricted to authenticated endpoints only
+
+### Secret Management
+- No secrets in code, config files, or environment variables checked into version control
+- AWS Secrets Manager (GovCloud) or K8s secrets for runtime secrets
+- `.env.example` provided with placeholder values; `.env` is in `.gitignore`
+- Secret detection runs as part of every CI/CD pipeline stage
+
+### Encryption
+- TLS 1.2+ for all data in transit
+- AES-256 for all data at rest
+- FIPS 140-2 validated modules required for IL4+ impact levels
+- NSA Type 1 encryption required for IL6 (SECRET)
+
+---
+
+## Audit Requirements
+
+### Append-Only Audit Trail
+The audit trail is immutable. No UPDATE or DELETE operations are permitted on audit tables. This satisfies NIST 800-53 AU-family controls:
+
+| Control | Requirement | Implementation |
+|---------|-------------|----------------|
+| AU-2 | Event logging | All agent actions, A2A messages, tool executions logged |
+| AU-3 | Content of audit records | Timestamp, actor, action, project_id, result, classification |
+| AU-6 | Audit review | Query tools for filtering and analysis |
+| AU-9 | Protection of audit info | Append-only schema, no delete permissions |
+| AU-11 | Audit retention | Configurable retention (default: 7 years) |
+
+### What Gets Logged
+- Every A2A task lifecycle event (created, assigned, in_progress, completed, failed)
+- Every tool execution with input parameters and output summary
+- Every compliance assessment and gate check result
+- Every security scan finding
+- All user decisions and approvals
+- Generation events (when the child app was created, by which ICDEV instance)
+
+### Audit Schema
+```sql
+CREATE TABLE audit_trail (
+    id TEXT PRIMARY KEY,
+    timestamp TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    actor TEXT NOT NULL,
+    action TEXT NOT NULL,
+    project_id TEXT,
+    details TEXT,
+    classification TEXT DEFAULT 'CUI // SP-CTI',
+    created_at TEXT NOT NULL
+);
+-- NO UPDATE OR DELETE triggers/permissions
+```
+
+---
+
+## Grandchild Prevention
+
+Generated applications MUST NOT generate their own child applications. This is enforced at three independent levels to prevent bypass:
+
+### Level 1: Configuration Flag
+The child app's `args/project_defaults.yaml` contains:
+```yaml
+agentic_generation:
+  enabled: false
+  reason: "Child applications cannot generate grandchild applications"
+```
+The scaffolder checks this flag at startup and refuses to run with `--agentic` if `enabled: false`.
+
+### Level 2: Tool Exclusion
+The following ICDEV tools are excluded from the child app's file manifest and are never copied:
+- `tools/builder/agentic_fitness.py`
+- `tools/builder/app_blueprint.py`
+- Any templates in `context/agentic/` related to generation (fitness rubric, architecture patterns, governance baseline are retained as reference)
+
+### Level 3: CLAUDE.md Documentation
+The child app's CLAUDE.md contains the following statement in a prominent section:
+```
+## Limitations
+This application CANNOT generate child applications. Agentic generation
+is only available in the parent ICDEV system. This restriction is enforced
+by configuration, tool exclusion, and this documentation.
+```
+
+### Verification
+During governance review (Step 6), all three levels are checked:
+```bash
+# Level 1: Config flag
+grep "enabled: false" args/project_defaults.yaml
+
+# Level 2: Tool exclusion
+ls tools/builder/ | grep -E "(agentic_fitness|app_blueprint)"
+# Should return empty
+
+# Level 3: CLAUDE.md
+grep "CANNOT generate child" CLAUDE.md
+# Should match
+```
+
+---
+
+## Memory System Requirements
+
+Every child application includes a memory system with dual storage:
+
+| Storage | Format | Purpose |
+|---------|--------|---------|
+| `memory/MEMORY.md` | Markdown | Human-readable curated facts and preferences |
+| `data/memory.db` | SQLite | Searchable database with embeddings support |
+| `memory/logs/YYYY-MM-DD.md` | Markdown | Daily session logs |
+
+**Session protocol:** The child app's AI orchestrator must read `MEMORY.md` and the current day's log at the start of every session, exactly as ICDEV does.
+
+---
+
+## CI/CD Requirements
+
+Every child application includes a CI/CD pipeline with these mandatory stages:
+
+| Stage | Gate | Blocking Condition |
+|-------|------|--------------------|
+| Build | Compilation | Syntax errors, missing dependencies |
+| Lint | Code quality | Linting violations above threshold |
+| Test | Coverage | Coverage < 80%, any test failures |
+| Security | SAST + deps | CAT1 findings, critical vulnerabilities, secrets detected |
+| Compliance | CUI markings | Missing markings on any file at IL4+ |
+| Deploy | All gates | Any blocking condition from prior stages |
+
+---
+
+## Related Files
+
+- **Goal:** `goals/agentic_generation.md` — Workflow that enforces this baseline
+- **Context:** `context/agentic/architecture_patterns.md` — Architecture patterns for child apps
+- **Context:** `context/agentic/fitness_rubric.md` — Fitness scoring rubric
+- **Tools:** `tools/compliance/classification_manager.py` — Classification marking generation
+- **Tools:** `tools/compliance/crosswalk_engine.py` — Multi-framework control crosswalk
+- **Args:** `args/security_gates.yaml` — Gate thresholds and blocking conditions

context/ci/__init__.py

@@ -0,0 +1,6 @@
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: ICDEV System Administrator
+# Package marker for PyPI distribution

context/ci/worktree_templates.json

@@ -0,0 +1,44 @@
+{
+    "worktree_naming": {
+        "pattern": "icdev-{task_id}",
+        "branch_pattern": "icdev-{task_id}",
+        "description": "Consistent naming for worktrees and their branches"
+    },
+    "sparse_checkout_profiles": {
+        "full": {
+            "directories": ["."],
+            "description": "Full repository checkout"
+        },
+        "tools_only": {
+            "directories": ["tools/", "args/", "context/", "hardprompts/"],
+            "description": "ICDEV framework files only"
+        },
+        "app_only": {
+            "directories": ["src/", "tests/", "features/"],
+            "description": "Application source code only"
+        },
+        "compliance": {
+            "directories": ["tools/compliance/", "context/compliance/", "args/"],
+            "description": "Compliance tools and configuration"
+        },
+        "infra": {
+            "directories": ["tools/infra/", "k8s/", "docker/", "args/"],
+            "description": "Infrastructure and deployment files"
+        }
+    },
+    "classification_markers": {
+        "CUI": "CUI // SP-CTI",
+        "SECRET": "SECRET // NOFORN",
+        "UNCLASSIFIED": "UNCLASSIFIED"
+    },
+    "tag_workflow_map": {
+        "intake": {"workflow": "icdev_intake", "profile": "full", "description": "RICOAS requirements intake"},
+        "build": {"workflow": "icdev_build", "profile": "app_only", "description": "TDD build cycle"},
+        "sdlc": {"workflow": "icdev_sdlc", "profile": "full", "description": "Full SDLC pipeline"},
+        "comply": {"workflow": "icdev_comply", "profile": "compliance", "description": "Compliance artifact generation"},
+        "secure": {"workflow": "icdev_secure", "profile": "app_only", "description": "Security scanning"},
+        "modernize": {"workflow": "icdev_modernize", "profile": "full", "description": "Legacy modernization"},
+        "deploy": {"workflow": "icdev_deploy", "profile": "infra", "description": "IaC and deployment"},
+        "maintain": {"workflow": "icdev_maintain", "profile": "tools_only", "description": "Maintenance audit"}
+    }
+}

context/cloud/__init__.py

@@ -0,0 +1,6 @@
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: ICDEV System Administrator
+# Package marker for PyPI distribution