icdev 0.0.3__py3-none-any.whl

tools/compliance/swft_evidence_bundler.py

@@ -0,0 +1,326 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+"""DoD SWFT (Software Factory Trust) Evidence Bundler.
+
+Packages ICDEV compliance artifacts into a SWFT-compliant evidence bundle
+for DoD software factory authorization. Bundles SLSA provenance, SBOM,
+VEX, attestations, and compliance artifacts into a single package.
+
+Architecture Decisions:
+  D341: Extends existing attestation_manager.py patterns.
+  D342: CycloneDX spec version parameterized for forward compatibility.
+
+Usage:
+  python tools/compliance/swft_evidence_bundler.py --project-id proj-test --bundle --json
+  python tools/compliance/swft_evidence_bundler.py --project-id proj-test --validate --json
+  python tools/compliance/swft_evidence_bundler.py --project-id proj-test --bundle --output-dir /tmp/swft --json
+"""
+
+import argparse
+import hashlib
+import json
+import sqlite3
+import sys
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from tools.db.storage import get_connection
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+
+# SWFT artifact categories per DoD Software Factory requirements
+SWFT_ARTIFACT_CATEGORIES = {
+    "provenance": {
+        "description": "SLSA provenance attestation",
+        "required": True,
+        "sources": ["slsa_attestation_generator"],
+    },
+    "sbom": {
+        "description": "Software Bill of Materials (CycloneDX)",
+        "required": True,
+        "sources": ["sbom_generator"],
+    },
+    "vex": {
+        "description": "Vulnerability Exploitability eXchange",
+        "required": True,
+        "sources": ["slsa_attestation_generator"],
+    },
+    "sast_results": {
+        "description": "Static Application Security Testing results",
+        "required": True,
+        "sources": ["sast_runner"],
+    },
+    "dependency_audit": {
+        "description": "Dependency vulnerability audit",
+        "required": True,
+        "sources": ["dependency_auditor"],
+    },
+    "container_scan": {
+        "description": "Container image security scan",
+        "required": False,
+        "sources": ["container_scanner"],
+    },
+    "secret_detection": {
+        "description": "Secret detection scan results",
+        "required": True,
+        "sources": ["secret_detector"],
+    },
+    "image_attestation": {
+        "description": "Signed container image attestation",
+        "required": False,
+        "sources": ["attestation_manager"],
+    },
+    "compliance_assessment": {
+        "description": "Multi-framework compliance assessment",
+        "required": True,
+        "sources": ["multi_regime_assessor"],
+    },
+    "production_audit": {
+        "description": "Production readiness audit results",
+        "required": False,
+        "sources": ["production_audit"],
+    },
+}
+
+
+def _collect_artifact_evidence(project_id: str, category: str, conn) -> dict:
+    """Collect evidence for a specific SWFT artifact category."""
+    evidence = {"available": False, "records": [], "latest_date": None}
+
+    if not conn:
+        return evidence
+
+    # Table mapping for each category
+    table_queries = {
+        "provenance": ("devsecops_pipeline_audit", "project_id"),
+        "sbom": ("sbom_records", "project_id"),
+        "sast_results": ("audit_trail", "project_id"),
+        "dependency_audit": ("audit_trail", "project_id"),
+        "secret_detection": ("audit_trail", "project_id"),
+        "compliance_assessment": ("production_audits", "project_id"),
+        "production_audit": ("production_audits", "project_id"),
+        "container_scan": ("devsecops_pipeline_audit", "project_id"),
+        "image_attestation": ("devsecops_pipeline_audit", "project_id"),
+    }
+
+    query_info = table_queries.get(category)
+    if not query_info:
+        return evidence
+
+    table, id_col = query_info
+    try:
+        row = conn.execute(
+            f"SELECT COUNT(*) as cnt FROM {table} WHERE {id_col} = ?",
+            (project_id,),
+        ).fetchone()
+        if row and row["cnt"] > 0:
+            evidence["available"] = True
+            evidence["record_count"] = row["cnt"]
+
+        # Get latest date
+        date_row = conn.execute(
+            f"SELECT MAX(created_at) as latest FROM {table} WHERE {id_col} = ?",
+            (project_id,),
+        ).fetchone()
+        if date_row and date_row["latest"]:
+            evidence["latest_date"] = date_row["latest"]
+    except sqlite3.OperationalError:
+        pass
+
+    return evidence
+
+
+def bundle_swft_evidence(
+    project_id: str,
+    output_dir: str = None,
+    db_path: Path = None,
+) -> dict:
+    """Bundle SWFT evidence package for DoD software factory authorization.
+
+    Args:
+        project_id: Project identifier.
+        output_dir: Optional output directory for evidence files.
+        db_path: Optional database path override.
+
+    Returns:
+        dict with bundle manifest, artifact status, and readiness assessment.
+    """
+    conn = get_connection(db_path=db_path)
+    now = datetime.now(timezone.utc)
+    bundle_id = str(uuid.uuid4())[:12]
+
+    try:
+        artifacts = {}
+        required_met = 0
+        required_total = 0
+        optional_met = 0
+        optional_total = 0
+
+        for category, config in SWFT_ARTIFACT_CATEGORIES.items():
+            evidence = _collect_artifact_evidence(project_id, category, conn)
+            artifact = {
+                "category": category,
+                "description": config["description"],
+                "required": config["required"],
+                "available": evidence["available"],
+                "latest_date": evidence.get("latest_date"),
+                "record_count": evidence.get("record_count", 0),
+            }
+            artifacts[category] = artifact
+
+            if config["required"]:
+                required_total += 1
+                if evidence["available"]:
+                    required_met += 1
+            else:
+                optional_total += 1
+                if evidence["available"]:
+                    optional_met += 1
+
+        total_met = required_met + optional_met
+        total_artifacts = required_total + optional_total
+        readiness_pct = (total_met / total_artifacts * 100) if total_artifacts > 0 else 0
+
+        bundle = {
+            "bundle_id": bundle_id,
+            "project_id": project_id,
+            "bundle_type": "swft_evidence",
+            "specification": "DoD Software Factory Trust Framework",
+            "generated_at": now.isoformat(),
+            "artifacts": artifacts,
+            "summary": {
+                "total_categories": total_artifacts,
+                "available": total_met,
+                "missing": total_artifacts - total_met,
+                "required_met": required_met,
+                "required_total": required_total,
+                "optional_met": optional_met,
+                "optional_total": optional_total,
+                "readiness_pct": round(readiness_pct, 1),
+                "all_required_met": required_met == required_total,
+            },
+            "integrity": {
+                "digest_algorithm": "sha256",
+                "bundle_hash": hashlib.sha256(
+                    json.dumps(artifacts, sort_keys=True, default=str).encode()
+                ).hexdigest(),
+            },
+        }
+
+        # Write to output directory if specified
+        if output_dir:
+            out_path = Path(output_dir)
+            out_path.mkdir(parents=True, exist_ok=True)
+            manifest_file = out_path / f"swft-bundle-{bundle_id}.json"
+            manifest_file.write_text(json.dumps(bundle, indent=2, default=str))
+            bundle["output_file"] = str(manifest_file)
+
+        return bundle
+
+    finally:
+        if conn:
+            conn.close()
+
+
+def validate_swft_bundle(
+    project_id: str,
+    db_path: Path = None,
+) -> dict:
+    """Validate SWFT evidence completeness and freshness.
+
+    Args:
+        project_id: Project identifier.
+        db_path: Optional database path override.
+
+    Returns:
+        dict with validation results, gaps, and recommendations.
+    """
+    bundle = bundle_swft_evidence(project_id, db_path=db_path)
+    gaps = []
+    recommendations = []
+
+    for category, artifact in bundle["artifacts"].items():
+        if artifact["required"] and not artifact["available"]:
+            gaps.append({
+                "category": category,
+                "description": artifact["description"],
+                "severity": "blocking",
+            })
+            rec_map = {
+                "provenance": "Run: python tools/compliance/slsa_attestation_generator.py --project-id {pid} --generate",
+                "sbom": "Run: python tools/compliance/sbom_generator.py --project-id {pid}",
+                "vex": "Run: python tools/compliance/slsa_attestation_generator.py --project-id {pid} --vex",
+                "sast_results": "Run: python tools/security/sast_runner.py --project-dir <path>",
+                "dependency_audit": "Run: python tools/security/dependency_auditor.py --project-dir <path>",
+                "secret_detection": "Run: python tools/security/secret_detector.py --project-dir <path>",
+                "compliance_assessment": "Run: python tools/testing/production_audit.py --json",
+            }
+            recommendations.append(
+                rec_map.get(category, f"Generate {category} evidence").format(pid=project_id)
+            )
+        elif not artifact["required"] and not artifact["available"]:
+            gaps.append({
+                "category": category,
+                "description": artifact["description"],
+                "severity": "warning",
+            })
+
+    return {
+        "project_id": project_id,
+        "valid": len([g for g in gaps if g["severity"] == "blocking"]) == 0,
+        "bundle_summary": bundle["summary"],
+        "gaps": gaps,
+        "gap_count": len(gaps),
+        "blocking_gaps": len([g for g in gaps if g["severity"] == "blocking"]),
+        "warning_gaps": len([g for g in gaps if g["severity"] == "warning"]),
+        "recommendations": recommendations,
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="DoD SWFT Evidence Bundler"
+    )
+    parser.add_argument("--project-id", required=True, help="Project ID", dest="project_id")
+    parser.add_argument("--bundle", action="store_true", help="Bundle SWFT evidence")
+    parser.add_argument("--validate", action="store_true", help="Validate SWFT evidence completeness")
+    parser.add_argument("--output-dir", help="Output directory for evidence files", dest="output_dir")
+    parser.add_argument("--db", help="Database path")
+    parser.add_argument("--json", action="store_true", dest="json_output", help="JSON output")
+    parser.add_argument("--human", action="store_true", help="Human-readable output")
+    args = parser.parse_args()
+
+    db = Path(args.db) if args.db else None
+
+    if not any([args.bundle, args.validate]):
+        args.bundle = True  # Default action
+
+    if args.bundle:
+        result = bundle_swft_evidence(args.project_id, args.output_dir, db_path=db)
+    else:
+        result = validate_swft_bundle(args.project_id, db_path=db)
+
+    if args.json_output:
+        print(json.dumps(result, indent=2, default=str))
+    else:
+        if args.bundle:
+            s = result["summary"]
+            print(f"\n=== SWFT Evidence Bundle ===")
+            print(f"  Bundle ID: {result['bundle_id']}")
+            print(f"  Readiness: {s['readiness_pct']}%")
+            print(f"  Required: {s['required_met']}/{s['required_total']}")
+            print(f"  Optional: {s['optional_met']}/{s['optional_total']}")
+            print(f"  All Required Met: {s['all_required_met']}")
+        else:
+            print(f"\n=== SWFT Validation ===")
+            print(f"  Valid: {result['valid']}")
+            print(f"  Blocking Gaps: {result['blocking_gaps']}")
+            print(f"  Warning Gaps: {result['warning_gaps']}")
+            if result["recommendations"]:
+                print(f"  Recommendations:")
+                for rec in result["recommendations"]:
+                    print(f"    - {rec}")
+
+
+if __name__ == "__main__":
+    main()

tools/compliance/system_card_generator.py

@@ -0,0 +1,303 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: ICDEV System Administrator
+"""System Card Generator — AI system-level documentation.
+
+Generates system cards per OMB M-26-04. System cards are broader than
+model cards — they cover the entire AI system including all models,
+tools, agents, data flows, human oversight, and compliance status.
+
+ADR D309: System cards are ICDEV-specific (covers full agentic system).
+
+Usage:
+    python tools/compliance/system_card_generator.py --project-id proj-123 --json
+    python tools/compliance/system_card_generator.py --project-id proj-123 --list --json
+"""
+
+import argparse
+import hashlib
+import json
+import sqlite3
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Dict, List, Optional
+from tools.db.storage import get_connection
+DB_PATH = None  # Storage layer handles path resolution (D-DB-20)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+
+
+def _ensure_table(conn: sqlite3.Connection) -> None:
+    conn.executescript("""
+        CREATE TABLE IF NOT EXISTS system_cards (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            project_id TEXT NOT NULL,
+            card_data TEXT NOT NULL,
+            card_hash TEXT,
+            version INTEGER DEFAULT 1,
+            created_at TEXT DEFAULT (datetime('now')),
+            UNIQUE(project_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_system_cards_project
+            ON system_cards(project_id);
+    """)
+    conn.commit()
+
+
+def _get_project_info(conn: sqlite3.Connection, project_id: str) -> Dict:
+    try:
+        row = conn.execute("SELECT * FROM projects WHERE id = ?", (project_id,)).fetchone()
+        return dict(row) if row else {"id": project_id, "name": project_id}
+    except Exception:
+        return {"id": project_id, "name": project_id}
+
+
+def _get_model_cards(conn: sqlite3.Connection, project_id: str) -> List[Dict]:
+    try:
+        rows = conn.execute(
+            "SELECT model_name, version, card_hash, created_at FROM model_cards WHERE project_id = ?",
+            (project_id,),
+        ).fetchall()
+        return [dict(r) for r in rows]
+    except Exception:
+        return []
+
+
+def _get_agent_info(conn: sqlite3.Connection) -> List[Dict]:
+    try:
+        rows = conn.execute(
+            "SELECT agent_id, agent_type, status FROM agents LIMIT 20"
+        ).fetchall()
+        return [dict(r) for r in rows]
+    except Exception:
+        return []
+
+
+def _get_compliance_status(conn: sqlite3.Connection, project_id: str) -> List[Dict]:
+    try:
+        rows = conn.execute(
+            """SELECT framework_id, coverage_pct, gate_status, last_assessed
+               FROM project_framework_status WHERE project_id = ?""",
+            (project_id,),
+        ).fetchall()
+        return [dict(r) for r in rows]
+    except Exception:
+        return []
+
+
+def generate_system_card(
+    project_id: str,
+    system_purpose: str = "",
+    db_path: Path = DB_PATH,
+) -> Dict:
+    """Generate a system card and store in DB."""
+    conn = get_connection(db_path=db_path)
+    try:
+        _ensure_table(conn)
+        now = datetime.now(timezone.utc).isoformat()
+
+        project = _get_project_info(conn, project_id)
+        model_cards = _get_model_cards(conn, project_id)
+        agents = _get_agent_info(conn)
+        compliance = _get_compliance_status(conn, project_id)
+
+        card = {
+            "system_card_version": "1.0",
+            "generated_at": now,
+            "classification": "CUI // SP-CTI",
+            "system_overview": {
+                "name": project.get("name", project_id),
+                "project_id": project_id,
+                "purpose": system_purpose or "ICDEV-generated application with AI-assisted development, compliance automation, and continuous monitoring.",
+                "system_type": "Agentic AI Development Platform",
+                "deployment_status": project.get("status", "active"),
+            },
+            "ai_components": {
+                "models": [
+                    {
+                        "name": mc["model_name"],
+                        "model_card_version": mc["version"],
+                        "model_card_hash": mc.get("card_hash", ""),
+                    }
+                    for mc in model_cards
+                ],
+                "model_count": len(model_cards),
+                "agents": [
+                    {
+                        "agent_id": a.get("agent_id", ""),
+                        "type": a.get("agent_type", ""),
+                        "status": a.get("status", ""),
+                    }
+                    for a in agents[:10]
+                ],
+                "agent_count": len(agents),
+                "tools": "See tools/manifest.md for complete tool inventory",
+            },
+            "data_flows": {
+                "input_sources": [
+                    "User prompts via CLI or dashboard",
+                    "Requirements documents (SOW, CDD, CONOPS)",
+                    "Source code repositories",
+                    "Compliance catalogs and frameworks",
+                ],
+                "processing": [
+                    "LLM inference via cloud providers (Bedrock, Azure, GCP, OCI, IBM)",
+                    "Deterministic tool execution (GOTCHA framework)",
+                    "Compliance assessment via crosswalk engine",
+                ],
+                "outputs": [
+                    "Generated code with CUI markings",
+                    "Compliance artifacts (SSP, POAM, STIG, SBOM)",
+                    "Model cards and system cards",
+                    "Audit trail entries",
+                ],
+                "data_classification": "CUI // SP-CTI (configurable per impact level)",
+            },
+            "risk_profile": {
+                "impact_classification": "See ai_use_case_inventory for per-component classification",
+                "key_risks": [
+                    "Confabulation in generated code or compliance artifacts",
+                    "Prompt injection via untrusted inputs",
+                    "Model drift affecting output quality",
+                    "Supply chain risk from third-party AI providers",
+                ],
+                "mitigations": [
+                    "Multi-layer security: prompt injection detection, behavioral drift monitoring, agent trust scoring",
+                    "Compliance framework: 28+ frameworks, dual-hub crosswalk, continuous assessment",
+                    "Human oversight: agent authority matrix, veto system, appeal process",
+                    "Audit: append-only trail, W3C PROV provenance, AgentSHAP attribution",
+                ],
+            },
+            "human_oversight": {
+                "oversight_roles": [
+                    "Chief AI Officer (CAIO) — overall AI governance",
+                    "ISSO — security and compliance oversight",
+                    "Program Manager — operational oversight",
+                    "Developer — day-to-day AI interaction",
+                ],
+                "override_capability": "Agent authority matrix with hard/soft vetoes (args/agent_authority.yaml)",
+                "appeal_process": "Human review of AI-assisted decisions, independent appeal via governance chain",
+            },
+            "monitoring": {
+                "continuous_monitoring": [
+                    "AI telemetry logging (SHA-256 hashed)",
+                    "Behavioral drift detection (z-score baseline)",
+                    "Performance metrics tracking",
+                    "Confabulation detection checks",
+                ],
+                "alerting": "Configurable thresholds with automated escalation",
+                "incident_response": "Integrated with cyber IR plan, AI-specific procedures",
+            },
+            "compliance_status": {
+                "frameworks_assessed": len(compliance),
+                "framework_results": compliance,
+                "transparency_controls": [
+                    "Model cards per OMB M-26-04",
+                    "AI use case inventory per OMB M-25-21",
+                    "XAI assessments per NIST AI RMF",
+                    "GAO evidence packages per GAO-21-519SP",
+                ],
+            },
+        }
+
+        # Store
+        card_json = json.dumps(card, indent=2)
+        card_hash = hashlib.sha256(card_json.encode()).hexdigest()[:16]
+
+        existing = conn.execute(
+            "SELECT version FROM system_cards WHERE project_id = ?",
+            (project_id,),
+        ).fetchone()
+        version = (existing["version"] + 1) if existing else 1
+
+        conn.execute(
+            """INSERT OR REPLACE INTO system_cards
+               (project_id, card_data, card_hash, version, created_at)
+               VALUES (?, ?, ?, ?, ?)""",
+            (project_id, card_json, card_hash, version, now),
+        )
+        conn.commit()
+
+        # Audit
+        try:
+            conn.execute(
+                """INSERT INTO audit_trail
+                   (project_id, event_type, actor, action, details, classification)
+                   VALUES (?, ?, ?, ?, ?, ?)""",
+                (
+                    project_id, "system_card_generated",
+                    "icdev-compliance-engine",
+                    "Generated system card",
+                    json.dumps({"version": version, "hash": card_hash}),
+                    "CUI",
+                ),
+            )
+            conn.commit()
+        except Exception:
+            pass
+
+        return {
+            "status": "success",
+            "project_id": project_id,
+            "version": version,
+            "card_hash": card_hash,
+            "card": card,
+        }
+    finally:
+        conn.close()
+
+
+def list_system_cards(project_id: str, db_path: Path = DB_PATH) -> Dict:
+    conn = get_connection(db_path=db_path)
+    try:
+        _ensure_table(conn)
+        rows = conn.execute(
+            "SELECT version, card_hash, created_at FROM system_cards WHERE project_id = ?",
+            (project_id,),
+        ).fetchall()
+        return {
+            "project_id": project_id,
+            "system_cards": [dict(r) for r in rows],
+            "count": len(rows),
+        }
+    finally:
+        conn.close()
+
+
+def main():
+    parser = argparse.ArgumentParser(description="System Card Generator (OMB M-26-04)")
+    parser.add_argument("--project-id", required=True)
+    parser.add_argument("--system-purpose", default="", help="System purpose description")
+    parser.add_argument("--list", action="store_true")
+    parser.add_argument("--json", action="store_true")
+    parser.add_argument("--db-path", type=Path, default=None)
+    args = parser.parse_args()
+
+    db = args.db_path or DB_PATH
+    try:
+        if args.list:
+            result = list_system_cards(args.project_id, db)
+        else:
+            result = generate_system_card(args.project_id, args.system_purpose, db)
+
+        if args.json:
+            print(json.dumps(result, indent=2))
+        else:
+            if args.list:
+                print(f"System Cards for {args.project_id}: {result['count']}")
+                for sc in result["system_cards"]:
+                    print(f"  - v{sc['version']} ({sc['created_at']})")
+            else:
+                print(f"System card generated: v{result['version']}")
+                print(f"  Hash: {result['card_hash']}")
+    except Exception as e:
+        print(f"ERROR: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()