icdev 0.0.3__py3-none-any.whl

tools/compliance/xacta/xacta_sync.py

@@ -0,0 +1,322 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+"""Xacta 360 sync orchestrator — coordinates data flow between ICDEV and Xacta.
+
+Supports three modes:
+    - api: Push data directly via Xacta 360 REST API
+    - export: Generate OSCAL/CSV files for batch import
+    - hybrid: Try API first, fall back to export on failure
+
+Usage:
+    python tools/compliance/xacta/xacta_sync.py --project-id proj-123 --mode hybrid
+    python tools/compliance/xacta/xacta_sync.py --project-id proj-123 --mode export
+"""
+
+import argparse
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from tools.db.storage import get_connection
+DB_PATH = None  # Storage layer handles path resolution (D-DB-20)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+
+sys.path.insert(0, str(BASE_DIR))
+
+
+def _log_audit(conn, project_id, action, details=None):
+    """Log sync event to audit trail."""
+    conn.execute(
+        """INSERT INTO audit_trail
+           (project_id, event_type, actor, action, details, classification, created_at)
+           VALUES (?, 'xacta_sync_completed', 'icdev-xacta-sync', ?, ?, 'CUI', datetime('now'))""",
+        (project_id, action, json.dumps(details) if details else None),
+    )
+    conn.commit()
+
+
+def _load_project_data(conn, project_id):
+    """Load all project compliance data for sync."""
+    data = {}
+
+    # Project info
+    row = conn.execute("SELECT * FROM projects WHERE id = ?", (project_id,)).fetchone()
+    if not row:
+        raise ValueError(f"Project '{project_id}' not found.")
+    data["project"] = dict(row)
+
+    # Control implementations
+    rows = conn.execute(
+        "SELECT * FROM project_controls WHERE project_id = ? ORDER BY control_id",
+        (project_id,),
+    ).fetchall()
+    data["controls"] = [dict(r) for r in rows]
+
+    # CSSP assessments
+    rows = conn.execute(
+        "SELECT * FROM cssp_assessments WHERE project_id = ? ORDER BY requirement_id",
+        (project_id,),
+    ).fetchall()
+    data["cssp_assessments"] = [dict(r) for r in rows]
+
+    # STIG findings
+    rows = conn.execute(
+        "SELECT * FROM stig_findings WHERE project_id = ? ORDER BY severity, finding_id",
+        (project_id,),
+    ).fetchall()
+    data["stig_findings"] = [dict(r) for r in rows]
+
+    # POA&M items
+    rows = conn.execute(
+        "SELECT * FROM poam_items WHERE project_id = ? ORDER BY severity",
+        (project_id,),
+    ).fetchall()
+    data["poam_items"] = [dict(r) for r in rows]
+
+    # Certification status
+    row = conn.execute(
+        "SELECT * FROM cssp_certifications WHERE project_id = ?",
+        (project_id,),
+    ).fetchone()
+    data["certification"] = dict(row) if row else None
+
+    # Vulnerability management
+    rows = conn.execute(
+        "SELECT * FROM cssp_vuln_management WHERE project_id = ? ORDER BY scan_date DESC LIMIT 10",
+        (project_id,),
+    ).fetchall()
+    data["vuln_scans"] = [dict(r) for r in rows]
+
+    return data
+
+
+def _sync_via_api(project_id, data, db_path=None):
+    """Sync data to Xacta via REST API.
+
+    Returns:
+        Dict with sync results per data type.
+    """
+    try:
+        from tools.compliance.xacta.xacta_client import XactaClient
+    except ImportError:
+        return {"status": "error", "error": "XactaClient import failed", "fallback": True}
+
+    client = XactaClient(db_path=db_path)
+    results = {"mode": "api", "steps": {}}
+
+    try:
+        # Step 1: Push/update system
+        result = client.push_system(data["project"])
+        results["steps"]["push_system"] = result
+        if result and result.get("status") == "error":
+            results["status"] = "partial"
+
+        # Step 2: Push control implementations
+        if data["controls"]:
+            result = client.push_controls(project_id, data["controls"])
+            results["steps"]["push_controls"] = {
+                "count": len(data["controls"]),
+                "result": result,
+            }
+
+        # Step 3: Push CSSP assessment results
+        if data["cssp_assessments"]:
+            result = client.push_assessment(project_id, data["cssp_assessments"])
+            results["steps"]["push_assessment"] = {
+                "count": len(data["cssp_assessments"]),
+                "result": result,
+            }
+
+        # Step 4: Push STIG findings
+        if data["stig_findings"]:
+            result = client.push_findings(project_id, data["stig_findings"])
+            results["steps"]["push_findings"] = {
+                "count": len(data["stig_findings"]),
+                "result": result,
+            }
+
+        # Step 5: Push POA&M items
+        if data["poam_items"]:
+            result = client.push_poam(project_id, data["poam_items"])
+            results["steps"]["push_poam"] = {
+                "count": len(data["poam_items"]),
+                "result": result,
+            }
+
+        # Step 6: Pull back certification status
+        cert_status = client.get_certification_status(project_id)
+        if cert_status and cert_status.get("status") != "error":
+            results["steps"]["pull_certification"] = cert_status
+            # Update local certification record
+            conn = get_connection(db_path=db_path)
+            try:
+                conn.execute(
+                    """INSERT OR REPLACE INTO cssp_certifications
+                       (project_id, status, xacta_system_id, last_xacta_sync, updated_at)
+                       VALUES (?, ?, ?, datetime('now'), datetime('now'))""",
+                    (
+                        project_id,
+                        cert_status.get("certification_status", "in_progress"),
+                        cert_status.get("xacta_system_id", ""),
+                    ),
+                )
+                conn.commit()
+            finally:
+                conn.close()
+
+        results["status"] = "success"
+
+    except Exception as e:
+        results["status"] = "error"
+        results["error"] = str(e)
+        results["fallback"] = True
+
+    finally:
+        client.close()
+
+    return results
+
+
+def _sync_via_export(project_id, output_dir=None, db_path=None):
+    """Sync data to Xacta via file export.
+
+    Returns:
+        Dict with export results.
+    """
+    try:
+        from tools.compliance.xacta.xacta_export import export_all
+    except ImportError:
+        return {"status": "error", "error": "xacta_export import failed"}
+
+    result = export_all(project_id, export_format="all", output_dir=output_dir, db_path=db_path)
+    result["mode"] = "export"
+    result["status"] = "success"
+    return result
+
+
+def sync_to_xacta(project_id, mode="hybrid", output_dir=None, db_path=None):
+    """Orchestrate full sync between ICDEV and Xacta 360.
+
+    Args:
+        project_id: ICDEV project ID
+        mode: Sync mode — "api", "export", or "hybrid"
+        output_dir: Output directory for export mode
+        db_path: Database path
+
+    Returns:
+        Dict with comprehensive sync results.
+    """
+    conn = get_connection(db_path=db_path)
+    sync_start = datetime.now(timezone.utc).isoformat()
+
+    try:
+        # Load all project data
+        data = _load_project_data(conn, project_id)
+
+        summary = {
+            "project_id": project_id,
+            "mode": mode,
+            "sync_start": sync_start,
+            "data_counts": {
+                "controls": len(data["controls"]),
+                "cssp_assessments": len(data["cssp_assessments"]),
+                "stig_findings": len(data["stig_findings"]),
+                "poam_items": len(data["poam_items"]),
+                "vuln_scans": len(data["vuln_scans"]),
+            },
+            "results": {},
+        }
+
+        if mode == "api":
+            summary["results"] = _sync_via_api(project_id, data, db_path)
+
+        elif mode == "export":
+            summary["results"] = _sync_via_export(project_id, output_dir, db_path)
+
+        elif mode == "hybrid":
+            # Try API first
+            api_result = _sync_via_api(project_id, data, db_path)
+            summary["results"]["api"] = api_result
+
+            # Fall back to export if API failed
+            if api_result.get("fallback") or api_result.get("status") == "error":
+                print("API sync failed, falling back to export mode...")
+                export_result = _sync_via_export(project_id, output_dir, db_path)
+                summary["results"]["export"] = export_result
+                summary["mode_used"] = "export (fallback)"
+            else:
+                summary["mode_used"] = "api"
+
+        summary["sync_end"] = datetime.now(timezone.utc).isoformat()
+        summary["status"] = "completed"
+
+        # Update last sync timestamp
+        conn.execute(
+            """INSERT OR REPLACE INTO cssp_certifications
+               (project_id, last_xacta_sync, updated_at)
+               VALUES (
+                   ?,
+                   datetime('now'),
+                   datetime('now')
+               )
+               ON CONFLICT(project_id) DO UPDATE SET
+                   last_xacta_sync = datetime('now'),
+                   updated_at = datetime('now')""",
+            (project_id,),
+        )
+        conn.commit()
+
+        # Log sync completion
+        _log_audit(conn, project_id, f"sync_completed_{mode}", {
+            "mode": mode,
+            "data_counts": summary["data_counts"],
+            "status": summary["status"],
+        })
+
+        return summary
+
+    except Exception as e:
+        error_result = {
+            "project_id": project_id,
+            "mode": mode,
+            "status": "error",
+            "error": str(e),
+            "sync_start": sync_start,
+            "sync_end": datetime.now(timezone.utc).isoformat(),
+        }
+        try:
+            _log_audit(conn, project_id, f"sync_failed_{mode}", {"error": str(e)})
+        except Exception:
+            pass
+        return error_result
+
+    finally:
+        conn.close()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Sync ICDEV compliance data to Xacta 360"
+    )
+    parser.add_argument("--project-id", required=True, help="ICDEV project ID")
+    parser.add_argument(
+        "--mode", default="hybrid", choices=["api", "export", "hybrid"],
+        help="Sync mode (default: hybrid — try API, fall back to export)"
+    )
+    parser.add_argument("--output-dir", type=Path, help="Output directory for exports")
+    parser.add_argument("--db-path", type=Path, default=DB_PATH, help="Database path")
+    parser.add_argument("--json", action="store_true", dest="json_output", help="JSON output")
+    args = parser.parse_args()
+
+    result = sync_to_xacta(args.project_id, args.mode, args.output_dir, args.db_path)
+    print(json.dumps(result, indent=2, default=str))
+
+    if result.get("status") == "error":
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
+
+# [TEMPLATE: CUI // SP-CTI]

tools/compliance/xai_assessor.py

@@ -0,0 +1,231 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+"""XAI Compliance Assessor — Explainable AI assessment (D289).
+
+Evaluates project observability and explainability posture against
+NIST AI RMF, DoD RAI "Traceable" principle, and ISO 42001 requirements.
+
+10 automated checks:
+  XAI-001: Tracing active (OTel or SQLite tracer configured)
+  XAI-002: MCP instrumentation enabled (tool call spans exist)
+  XAI-003: A2A distributed tracing active (cross-agent spans linked)
+  XAI-004: Provenance graph populated (prov_entities > 0)
+  XAI-005: Content tracing policy documented
+  XAI-006: SHAP analysis run within 30 days
+  XAI-007: Decision rationale recorded (decision_recorder entries exist)
+  XAI-008: Trace retention configured and enforced
+  XAI-009: AI telemetry active (recent entries)
+  XAI-010: Agent trust scoring active (trust scores computed)
+
+CLI:
+    python tools/compliance/xai_assessor.py --project-id proj-123 --json
+    python tools/compliance/xai_assessor.py --project-id proj-123 --gate
+"""
+
+import json
+import logging
+import sqlite3
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Dict, Optional
+
+from tools.compliance.base_assessor import BaseAssessor
+
+logger = logging.getLogger("icdev.compliance.xai_assessor")
+
+
+class XAIAssessor(BaseAssessor):
+    """Explainable AI compliance assessor (D289).
+
+    Implements BaseAssessor pattern (D116) with 10 automated checks
+    covering observability, traceability, and explainability.
+    Crosswalks through NIST 800-53 US hub to FedRAMP/CMMC cascade.
+    """
+
+    FRAMEWORK_ID = "xai"
+    FRAMEWORK_NAME = "Observability & Explainable AI (Phase 46)"
+    TABLE_NAME = "xai_assessments"
+    CATALOG_FILENAME = "xai_requirements.json"
+
+    def get_automated_checks(
+        self,
+        project: Dict,
+        project_dir: Optional[str] = None,
+    ) -> Dict[str, str]:
+        """Run 10 automated XAI checks against project.
+
+        Returns:
+            Dict mapping check_id -> status.
+        """
+        project_id = project.get("id", "")
+        results = {}
+
+        # XAI-001: Tracing active
+        results["XAI-001"] = self._check_tracing_active(project_id)
+
+        # XAI-002: MCP instrumentation enabled
+        results["XAI-002"] = self._check_mcp_instrumentation(project_id)
+
+        # XAI-003: A2A distributed tracing active
+        results["XAI-003"] = self._check_a2a_tracing(project_id)
+
+        # XAI-004: Provenance graph populated
+        results["XAI-004"] = self._check_provenance_populated(project_id)
+
+        # XAI-005: Content tracing policy documented
+        results["XAI-005"] = self._check_content_policy()
+
+        # XAI-006: SHAP analysis recent
+        results["XAI-006"] = self._check_shap_recent(project_id)
+
+        # XAI-007: Decision rationale recorded
+        results["XAI-007"] = self._check_decision_rationale(project_id)
+
+        # XAI-008: Trace retention configured
+        results["XAI-008"] = self._check_retention_configured()
+
+        # XAI-009: AI telemetry active
+        results["XAI-009"] = self._check_ai_telemetry(project_id)
+
+        # XAI-010: Agent trust scoring active
+        results["XAI-010"] = self._check_trust_scoring(project_id)
+
+        return results
+
+    def _check_tracing_active(self, project_id: str) -> str:
+        """XAI-001: Check if tracing is active (any spans exist)."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            count = conn.execute(
+                "SELECT COUNT(*) FROM otel_spans WHERE project_id = ?",
+                (project_id,),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_mcp_instrumentation(self, project_id: str) -> str:
+        """XAI-002: Check for MCP tool call spans."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            count = conn.execute(
+                "SELECT COUNT(*) FROM otel_spans WHERE project_id = ? AND name = 'mcp.tool_call'",
+                (project_id,),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_a2a_tracing(self, project_id: str) -> str:
+        """XAI-003: Check for cross-agent span linking."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            # Look for spans with parent_span_id (indicates linked hierarchy)
+            count = conn.execute(
+                """SELECT COUNT(*) FROM otel_spans
+                   WHERE project_id = ? AND parent_span_id IS NOT NULL""",
+                (project_id,),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "partially_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_provenance_populated(self, project_id: str) -> str:
+        """XAI-004: Check provenance graph has entities."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            count = conn.execute(
+                "SELECT COUNT(*) FROM prov_entities WHERE project_id = ?",
+                (project_id,),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_content_policy(self) -> str:
+        """XAI-005: Check content tracing policy config exists."""
+        config_path = Path(__file__).resolve().parent.parent.parent / "args" / "observability_tracing_config.yaml"
+        if config_path.exists():
+            return "satisfied"
+        return "not_satisfied"
+
+    def _check_shap_recent(self, project_id: str) -> str:
+        """XAI-006: Check SHAP analysis run within 30 days."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            cutoff = (datetime.now(timezone.utc) - timedelta(days=30)).isoformat()
+            count = conn.execute(
+                """SELECT COUNT(*) FROM shap_attributions
+                   WHERE project_id = ? AND analyzed_at > ?""",
+                (project_id, cutoff),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_decision_rationale(self, project_id: str) -> str:
+        """XAI-007: Check decision_records exist for project."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            count = conn.execute(
+                "SELECT COUNT(*) FROM decision_records WHERE project_id = ?",
+                (project_id,),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_retention_configured(self) -> str:
+        """XAI-008: Check retention config exists in YAML."""
+        try:
+            import yaml
+            config_path = Path(__file__).resolve().parent.parent.parent / "args" / "observability_tracing_config.yaml"
+            if not config_path.exists():
+                return "not_satisfied"
+            with open(config_path) as f:
+                config = yaml.safe_load(f)
+            retention = config.get("retention", {})
+            if retention.get("sqlite_retention_days"):
+                return "satisfied"
+            return "not_satisfied"
+        except Exception:
+            return "not_assessed"
+
+    def _check_ai_telemetry(self, project_id: str) -> str:
+        """XAI-009: Check AI telemetry has recent entries."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            cutoff = (datetime.now(timezone.utc) - timedelta(days=7)).isoformat()
+            count = conn.execute(
+                """SELECT COUNT(*) FROM ai_telemetry
+                   WHERE project_id = ? AND logged_at > ?""",
+                (project_id, cutoff),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+    def _check_trust_scoring(self, project_id: str) -> str:
+        """XAI-010: Check agent trust scores have been computed."""
+        try:
+            conn = sqlite3.connect(str(self.db_path))
+            count = conn.execute(
+                "SELECT COUNT(*) FROM agent_trust_scores WHERE project_id = ?",
+                (project_id,),
+            ).fetchone()[0]
+            conn.close()
+            return "satisfied" if count > 0 else "not_satisfied"
+        except sqlite3.Error:
+            return "not_assessed"
+
+
+if __name__ == "__main__":
+    assessor = XAIAssessor()
+    assessor.run_cli()

tools/core/__init__.py

@@ -0,0 +1,2 @@
+# CUI // SP-CTI
+"""Core infrastructure: circuit breaker, error hierarchy, DI container, task DLQ."""