icdev 0.0.3__py3-none-any.whl

tools/mosa/mosa_code_enforcer.py

@@ -0,0 +1,348 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: SPARKPILOT System Administrator
+"""MOSA Code Enforcer -- static analysis for Modular Open Systems Approach violations.
+
+Scans code for MOSA violations: direct coupling bypassing interfaces, missing
+OpenAPI specs, module boundary violations, missing interface abstractions, and
+circular imports.  Output format matches the SAST runner pattern.
+
+Violation types:
+    MOSA-V001  Direct Coupling Violation     (HIGH)
+    MOSA-V002  Missing OpenAPI Spec          (MEDIUM)
+    MOSA-V003  Module Boundary Violation     (HIGH)
+    MOSA-V004  Missing Interface Abstraction (MEDIUM)
+    MOSA-V005  Circular Import               (HIGH)
+
+Usage:
+    python tools/mosa/mosa_code_enforcer.py --project-dir /path/to/project --json
+    python tools/mosa/mosa_code_enforcer.py --project-dir /path --fix-suggestions --human
+"""
+
+import argparse
+import ast
+import json
+import os
+import re
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+CONFIG_PATH = BASE_DIR / "args" / "mosa_config.yaml"
+
+
+def _load_config() -> Dict[str, Any]:
+    """Load code_enforcement settings from args/mosa_config.yaml."""
+    defaults: Dict[str, Any] = {
+        "enforce_interface_based_design": True, "generate_openapi_specs": True,
+        "enforce_module_boundaries": True, "max_direct_coupling_violations": 0,
+        "check_circular_dependencies": True, "supported_languages": ["python"],
+    }
+    if not CONFIG_PATH.exists():
+        return defaults
+    try:
+        content = CONFIG_PATH.read_text(encoding="utf-8")
+        in_section = False
+        cfg: Dict[str, Any] = {}
+        for line in content.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("#") or not stripped:
+                continue
+            if stripped == "code_enforcement:":
+                in_section = True
+                continue
+            if in_section:
+                indent = len(line) - len(line.lstrip())
+                if indent <= 2 and ":" in stripped and not stripped.startswith("-"):
+                    in_section = False
+                    continue
+                if ":" in stripped and not stripped.startswith("-"):
+                    key, val = stripped.split(":", 1)
+                    key, val = key.strip(), val.strip()
+                    if val.lower() in ("true", "false"):
+                        cfg[key] = val.lower() == "true"
+                    elif val.isdigit():
+                        cfg[key] = int(val)
+                    elif val:
+                        cfg[key] = val
+                elif stripped.startswith("- "):
+                    cfg.setdefault("supported_languages", []).append(
+                        stripped[2:].strip().strip('"').strip("'"))
+        return {**defaults, **cfg}
+    except Exception:
+        return defaults
+
+
+def _build_module_map(project_dir: Path) -> Dict[str, Path]:
+    """Return mapping of top-level Python package names to their directories."""
+    modules: Dict[str, Path] = {}
+    for child in sorted(project_dir.iterdir()):
+        if not child.is_dir() or child.name.startswith((".", "_", "venv", "node_modules")):
+            continue
+        if (child / "__init__.py").exists():
+            modules[child.name] = child
+    return modules
+
+
+def _python_files(directory: Path) -> List[Path]:
+    """Collect all .py files under *directory*, skipping hidden/venv dirs."""
+    results: List[Path] = []
+    skip = {".git", "__pycache__", "venv", ".venv", "node_modules", "build", "dist"}
+    for root, dirs, files in os.walk(directory):
+        dirs[:] = [d for d in dirs if d not in skip]
+        for fname in files:
+            if fname.endswith(".py"):
+                results.append(Path(root) / fname)
+    return results
+
+
+def _extract_imports(filepath: Path) -> List[Dict[str, Any]]:
+    """Parse a Python file with ast and return structured import details."""
+    try:
+        source = filepath.read_text(encoding="utf-8", errors="replace")
+        tree = ast.parse(source, filename=str(filepath))
+    except (SyntaxError, UnicodeDecodeError):
+        return []
+    imports: List[Dict[str, Any]] = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                imports.append({"module": alias.name, "line": node.lineno,
+                                "names": [alias.name.split(".")[-1]]})
+        elif isinstance(node, ast.ImportFrom):
+            imports.append({"module": node.module or "", "line": node.lineno,
+                            "names": [a.name for a in node.names]})
+    return imports
+
+
+# -- Violation detectors ----------------------------------------------------
+
+def _check_direct_coupling(fp: Path, imports: List[Dict], modules: Dict[str, Path],
+                           own: str, fix: bool) -> List[Dict]:
+    """MOSA-V001: direct import from another module's internal package."""
+    violations: List[Dict] = []
+    for imp in imports:
+        parts = imp["module"].split(".")
+        if len(parts) < 2:
+            continue
+        top = parts[0]
+        if top == own or top not in modules:
+            continue
+        if any(p.startswith("_") and p != "__init__" for p in parts[1:]):
+            v: Dict[str, Any] = {
+                "id": "MOSA-V001", "type": "direct_coupling_violation",
+                "severity": "HIGH", "file": str(fp), "line": imp["line"],
+                "message": f"Direct import from internal module '{imp['module']}'",
+            }
+            if fix:
+                v["suggestion"] = f"Import from '{top}' public API instead of '{imp['module']}'"
+            violations.append(v)
+    return violations
+
+
+def _check_missing_openapi(fp: Path, fix: bool) -> Optional[Dict]:
+    """MOSA-V002: API module without a corresponding openapi.yaml/json."""
+    try:
+        source = fp.read_text(encoding="utf-8", errors="replace")
+    except Exception:
+        return None
+    api_patterns = [
+        r"@app\.route\(", r"@blueprint\.route\(",
+        r"@router\.(get|post|put|delete|patch)\(",
+        r"app\.add_url_rule\(", r"APIRouter\(",
+    ]
+    if not any(re.search(p, source) for p in api_patterns):
+        return None
+    spec_names = ["openapi.yaml", "openapi.yml", "openapi.json",
+                  "swagger.yaml", "swagger.json"]
+    for d in (fp.parent, fp.parent.parent):
+        if any((d / s).exists() for s in spec_names):
+            return None
+    v: Dict[str, Any] = {
+        "id": "MOSA-V002", "type": "missing_openapi_spec",
+        "severity": "MEDIUM", "file": str(fp), "line": 1,
+        "message": f"API module '{fp.name}' has no corresponding OpenAPI spec",
+    }
+    if fix:
+        v["suggestion"] = f"Create '{fp.parent.name}/openapi.yaml' with OpenAPI 3.x specification"
+    return v
+
+
+def _check_boundary_violation(fp: Path, imports: List[Dict], modules: Dict[str, Path],
+                              own: str, fix: bool) -> List[Dict]:
+    """MOSA-V003: importing _private-prefixed names across module boundaries."""
+    violations: List[Dict] = []
+    for imp in imports:
+        top = imp["module"].split(".")[0] if imp["module"] else ""
+        if top == own or top not in modules:
+            continue
+        for name in imp["names"]:
+            if name.startswith("_") and name != "__init__":
+                v: Dict[str, Any] = {
+                    "id": "MOSA-V003", "type": "module_boundary_violation",
+                    "severity": "HIGH", "file": str(fp), "line": imp["line"],
+                    "message": f"Cross-module import of private name '{name}' from '{top}'",
+                }
+                if fix:
+                    v["suggestion"] = f"Use the module's public interface instead of accessing '{name}'"
+                violations.append(v)
+    return violations
+
+
+def _check_missing_interface(fp: Path, imports: List[Dict], modules: Dict[str, Path],
+                             own: str, fix: bool) -> List[Dict]:
+    """MOSA-V004: cross-module dependency without abstract interface (ABC/Protocol)."""
+    violations: List[Dict] = []
+    for imp in imports:
+        top = imp["module"].split(".")[0] if imp["module"] else ""
+        if top == own or top not in modules:
+            continue
+        target = modules[top]
+        has_iface = (target / "interfaces.py").exists() or (target / "protocols.py").exists()
+        for name in imp["names"]:
+            if name.startswith("_"):
+                continue
+            if not has_iface and not name.startswith("Abstract"):
+                v: Dict[str, Any] = {
+                    "id": "MOSA-V004", "type": "missing_interface_abstraction",
+                    "severity": "MEDIUM", "file": str(fp), "line": imp["line"],
+                    "message": f"Cross-module import of '{name}' from '{top}' without interface abstraction",
+                }
+                if fix:
+                    v["suggestion"] = f"Create an abstract interface (ABC/Protocol) in '{top}/interfaces.py'"
+                violations.append(v)
+                break  # one per import statement
+    return violations
+
+
+def _check_circular_imports(modules: Dict[str, Path], project_dir: Path,
+                            fix: bool) -> List[Dict]:
+    """MOSA-V005: circular import chains via graphlib.TopologicalSorter (D40)."""
+    try:
+        from graphlib import TopologicalSorter, CycleError
+    except ImportError:
+        return []
+    graph: Dict[str, Set[str]] = {m: set() for m in modules}
+    for mod_name, mod_path in modules.items():
+        for pyfile in _python_files(mod_path):
+            for imp in _extract_imports(pyfile):
+                top = imp["module"].split(".")[0] if imp["module"] else ""
+                if top in modules and top != mod_name:
+                    graph[mod_name].add(top)
+    sorter = TopologicalSorter(graph)
+    try:
+        list(sorter.static_order())
+        return []
+    except CycleError as exc:
+        v: Dict[str, Any] = {
+            "id": "MOSA-V005", "type": "circular_import",
+            "severity": "HIGH", "file": str(project_dir), "line": 0,
+            "message": f"Circular import detected: {exc}",
+        }
+        if fix:
+            v["suggestion"] = "Break circular dependency by extracting shared types into a common module"
+        return [v]
+
+
+# -- Scan orchestrator ------------------------------------------------------
+
+def scan_project(project_dir: str, fix_suggestions: bool = False) -> Dict[str, Any]:
+    """Run all MOSA code enforcement checks on *project_dir*."""
+    root = Path(project_dir).resolve()
+    config = _load_config()
+    modules = _build_module_map(root)
+    violations: List[Dict] = []
+
+    for pyfile in _python_files(root):
+        try:
+            rel = pyfile.relative_to(root)
+        except ValueError:
+            continue
+        own = rel.parts[0] if rel.parts else ""
+        imports = _extract_imports(pyfile)
+        fix = fix_suggestions
+        if config.get("enforce_module_boundaries", True):
+            violations.extend(_check_direct_coupling(pyfile, imports, modules, own, fix))
+            violations.extend(_check_boundary_violation(pyfile, imports, modules, own, fix))
+        if config.get("generate_openapi_specs", True):
+            v = _check_missing_openapi(pyfile, fix)
+            if v:
+                violations.append(v)
+        if config.get("enforce_interface_based_design", True):
+            violations.extend(_check_missing_interface(pyfile, imports, modules, own, fix))
+
+    if config.get("check_circular_dependencies", True):
+        violations.extend(_check_circular_imports(modules, root, fix_suggestions))
+
+    sev_counts = {"HIGH": 0, "MEDIUM": 0, "LOW": 0}
+    for v in violations:
+        sev_counts[v.get("severity", "LOW")] = sev_counts.get(v.get("severity", "LOW"), 0) + 1
+
+    max_high = config.get("max_direct_coupling_violations", 0)
+    return {
+        "tool": "mosa_code_enforcer",
+        "project_dir": str(root),
+        "scan_date": datetime.now(timezone.utc).isoformat(),
+        "total_violations": len(violations),
+        "violations_by_severity": sev_counts,
+        "violations": violations,
+        "pass": sev_counts["HIGH"] <= max_high,
+    }
+
+
+# -- Human-readable output -------------------------------------------------
+
+def _human_output(result: Dict[str, Any]) -> str:
+    """Render scan results as colored terminal output."""
+    try:
+        from tools.cli.output_formatter import C
+    except Exception:
+        class _C:
+            @staticmethod
+            def wrap(t: str, *s: str) -> str: return t
+        C = _C  # type: ignore[assignment]
+
+    lines: List[str] = []
+    status = "PASS" if result["pass"] else "FAIL"
+    lines.append(C.wrap(f"MOSA Code Enforcer  [{status}]", "green" if result["pass"] else "red", "bold"))
+    lines.append(f"  Project: {result['project_dir']}")
+    lines.append(f"  Scanned: {result['scan_date']}")
+    lines.append(f"  Total violations: {result['total_violations']}")
+    sev = result["violations_by_severity"]
+    lines.append(f"  HIGH: {C.wrap(str(sev.get('HIGH', 0)), 'red')}  "
+                 f"MEDIUM: {C.wrap(str(sev.get('MEDIUM', 0)), 'yellow')}  "
+                 f"LOW: {C.wrap(str(sev.get('LOW', 0)), 'green')}")
+    lines.append("")
+    for v in result["violations"]:
+        clr = {"HIGH": "red", "MEDIUM": "yellow", "LOW": "green"}.get(v["severity"], "dim")
+        lines.append(f"  {C.wrap('[' + v['severity'] + ']', clr)} {v['id']}  {v['file']}:{v['line']}")
+        lines.append(f"    {v['message']}")
+        if "suggestion" in v:
+            lines.append(f"    {C.wrap('Fix:', 'cyan')} {v['suggestion']}")
+    return "\n".join(lines)
+
+
+# -- CLI entry point --------------------------------------------------------
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="MOSA Code Enforcer -- scan for Modular Open Systems Approach violations")
+    parser.add_argument("--project-dir", required=True, help="Path to the project to scan")
+    parser.add_argument("--fix-suggestions", action="store_true", help="Include fix suggestions")
+    parser.add_argument("--json", dest="json_output", action="store_true", help="JSON output")
+    parser.add_argument("--human", action="store_true", help="Colored terminal output")
+    args = parser.parse_args()
+
+    result = scan_project(args.project_dir, fix_suggestions=args.fix_suggestions)
+    if args.json_output:
+        print(json.dumps(result, indent=2))
+    else:
+        print(_human_output(result))
+
+
+if __name__ == "__main__":
+    main()

tools/mosa/tsp_generator.py

@@ -0,0 +1,265 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+# Controlled by: Department of Defense
+# CUI Category: CTI
+# Distribution: D
+# POC: SPARKPILOT System Administrator
+"""TSP Generator -- Technical Standard Profile for DoD MOSA compliance.
+
+Auto-detects standards from project tech stack, generates a CUI-marked
+markdown TSP document, and stores it in the tsp_documents table.
+
+Usage:
+    python tools/mosa/tsp_generator.py --project-id proj-123 --json
+    python tools/mosa/tsp_generator.py --project-id proj-123 --output-dir /tmp
+    python tools/mosa/tsp_generator.py --project-id proj-123 --human
+"""
+import argparse
+import json
+import sqlite3
+import sys
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from tools.db.storage import get_connection
+DB_PATH = None  # Storage layer handles path resolution (D-DB-20)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+CONFIG_PATH = BASE_DIR / "args" / "mosa_config.yaml"
+
+# (indicator_files, standard_name, version, category)
+RULES = [
+    (["requirements.txt","setup.py","pyproject.toml","Pipfile"], "PEP 8", "2001", "programming_language"),
+    (["requirements.txt","setup.py","pyproject.toml","Pipfile"], "PEP 257", "2001", "programming_language"),
+    (["pom.xml","build.gradle","build.gradle.kts"], "JSR 330 Dependency Injection", "1.0", "programming_language"),
+    (["pom.xml","build.gradle","build.gradle.kts"], "JSR 370 JAX-RS 2.1", "2.1", "programming_language"),
+    (["package.json","tsconfig.json"], "ECMAScript Specification", "ES2023", "programming_language"),
+    (["go.mod"], "Effective Go Conventions", "1.21+", "programming_language"),
+    (["Cargo.toml"], "Rust Edition Guide", "2021", "programming_language"),
+    (["*.csproj"], ".NET Design Guidelines", "8.0", "programming_language"),
+    (["openapi.yaml","openapi.json","swagger.yaml","swagger.json"], "OpenAPI Specification", "3.1.0", "api_specification"),
+    (["*.proto"], "Protocol Buffers (gRPC)", "3", "api_specification"),
+    (["Dockerfile","docker-compose.yml","docker-compose.yaml"], "OCI Image Specification", "1.0", "containerization"),
+    (["Dockerfile","docker-compose.yml","docker-compose.yaml"], "OCI Runtime Specification", "1.0", "containerization"),
+    ([], "Kubernetes API", "1.28+", "containerization"),  # detected via content
+    ([], "OAuth 2.0 (RFC 6749)", "2.0", "authentication"),  # detected via content
+    ([], "OpenID Connect Core 1.0", "1.0", "authentication"),  # detected via content
+    ([], "TLS 1.3 (RFC 8446)", "1.3", "communication_protocol"),  # always for DoD
+    ([], "FIPS 140-2 Cryptographic Validation", "140-2", "security"),  # always for DoD
+    ([], "JSON Schema", "2020-12", "data_format"),  # detected if *.json present
+    (["*.xsd","*.xml"], "XML Schema (W3C)", "1.1", "data_format"),
+]
+AUTH_KW = ["oauth", "oidc", "openid", "authorization_code", "jwt"]
+K8S_KW = ["apiVersion:", "kind: Deployment", "kind: Service"]
+ALWAYS_CATS = {"communication_protocol", "security"}
+
+
+def _conn(db_path=None):
+    p = db_path or DB_PATH
+    if not Path(p).exists():
+        raise FileNotFoundError(f"DB not found: {p}. Run: python tools/db/init_icdev_db.py")
+    c = sqlite3.connect(str(p))
+    c.row_factory = sqlite3.Row
+    return c
+
+def _project(conn, pid):
+    r = conn.execute("SELECT * FROM projects WHERE id = ?", (pid,)).fetchone()
+    if not r:
+        raise ValueError(f"Project '{pid}' not found")
+    return dict(r)
+
+def _config():
+    defaults = {"max_age_days": 180, "standard_categories": [
+        "api_specification","data_format","communication_protocol",
+        "authentication","containerization","programming_language","security"]}
+    if not CONFIG_PATH.exists():
+        return defaults
+    try:
+        import yaml
+        tsp = yaml.safe_load(CONFIG_PATH.open()).get("mosa",{}).get("tsp",{})
+        return {"max_age_days": tsp.get("max_age_days", 180),
+                "standard_categories": tsp.get("standard_categories", defaults["standard_categories"])}
+    except Exception:
+        return defaults
+
+
+def detect_standards(project_dir):
+    """Auto-detect standards from project tech stack."""
+    pp = Path(project_dir)
+    if not pp.is_dir():
+        return []
+    files = {p.name for pat in ("*","*/*","*/*/*") for p in pp.glob(pat) if p.is_file()}
+    has_auth = has_k8s = False
+    for ext in ("*.py","*.java","*.ts","*.js","*.yaml","*.yml"):
+        for fp in pp.rglob(ext):
+            try:
+                txt = fp.read_text(encoding="utf-8", errors="ignore")[:8192]
+                if any(k in txt.lower() for k in AUTH_KW):
+                    has_auth = True
+                if any(k in txt for k in K8S_KW):
+                    has_k8s = True
+                if has_auth and has_k8s:
+                    break
+            except Exception:
+                continue
+        if has_auth and has_k8s:
+            break
+    detected, seen = [], set()
+    def _add(name, ver, cat):
+        if name not in seen:
+            seen.add(name)
+            detected.append({"category": cat, "standard": name, "version": ver,
+                             "conformance": "full", "deviation_rationale": None})
+    for inds, name, ver, cat in RULES:
+        if name in seen:
+            continue
+        if cat in ALWAYS_CATS:
+            _add(name, ver, cat)
+            continue
+        if cat == "authentication":
+            if has_auth:
+                _add(name, ver, cat)
+                continue
+            else:
+                continue
+        if "Kubernetes" in name:
+            if has_k8s:
+                _add(name, ver, cat)
+                continue
+            else:
+                continue
+        if "JSON Schema" in name:
+            if any(f.endswith(".json") for f in files):
+                _add(name, ver, cat)
+            continue
+        if not inds:
+            continue
+        for ind in inds:
+            if ("*" in ind and any(f.endswith(ind.lstrip("*")) for f in files)) \
+               or ind in files:
+                _add(name, ver, cat)
+                break
+    return sorted(detected, key=lambda s: (s["category"], s["standard"]))
+
+
+def _build_md(proj, tid, now, stds, devs, cfg):
+    """Build CUI-marked TSP markdown."""
+    L = ["CUI // SP-CTI\n\n# Technical Standard Profile (TSP)\n",
+         "## Document Identification\n",
+         "| Field | Value |", "|-------|-------|",
+         f"| TSP ID | {tid} |",
+         f"| Project | {proj.get('name', proj['id'])} ({proj['id']}) |",
+         "| Version | 1.0.0 |", f"| Date | {now.strftime('%Y-%m-%d')} |",
+         "| Classification | CUI // SP-CTI |",
+         "| Authority | 10 U.S.C. Section 4401, DoDI 5000.87 |",
+         "\n## Standards Inventory\n",
+         "| # | Category | Standard | Version | Conformance |",
+         "|---|----------|----------|---------|-------------|"]
+    for i, s in enumerate(stds, 1):
+        L.append(f"| {i} | {s['category']} | {s['standard']} | {s['version']} | {s['conformance']} |")
+    full = sum(1 for s in stds if s["conformance"] == "full")
+    partial = sum(1 for s in stds if s["conformance"] == "partial")
+    planned = sum(1 for s in stds if s["conformance"] == "planned")
+    cats = len(set(s["category"] for s in stds))
+    L.extend(["\n## Conformance Summary\n",
+              f"- **Total standards:** {len(stds)}", f"- **Full:** {full}",
+              f"- **Partial:** {partial}", f"- **Planned:** {planned}",
+              f"- **Categories:** {cats} of {len(cfg['standard_categories'])}"])
+    L.append("\n## Deviations\n")
+    if devs:
+        L.extend(["| Standard | Conformance | Rationale |", "|----------|-------------|-----------|"])
+        for d in devs:
+            L.append(f"| {d['standard']} | {d['conformance']} | {d.get('deviation_rationale') or 'Pending'} |")
+    else:
+        L.append("No deviations recorded.")
+    L.extend(["\n## Validation\n", "- Status: **draft**", "- Approval: **pending**",
+              f"- Max age: {cfg['max_age_days']} days",
+              f"- Next review: within {cfg['max_age_days']} days of approval",
+              "\n---\nCUI // SP-CTI"])
+    return "\n".join(L)
+
+
+def generate_tsp(project_id, output_dir=None, db_path=None):
+    """Generate a Technical Standard Profile and store in DB + filesystem."""
+    conn = _conn(db_path)
+    try:
+        proj = _project(conn, project_id)
+        cfg = _config()
+        now = datetime.now(tz=timezone.utc)
+        tid = f"tsp-{uuid.uuid4().hex[:12]}"
+        pdir = proj.get("project_dir") or proj.get("source_path")
+        stds = detect_standards(pdir) if pdir and Path(pdir).is_dir() else detect_standards(str(BASE_DIR))
+        devs = [s for s in stds if s["conformance"] != "full"]
+        content = _build_md(proj, tid, now, stds, devs, cfg)
+        out = Path(output_dir) if output_dir else BASE_DIR / ".tmp" / "mosa" / "tsp"
+        out.mkdir(parents=True, exist_ok=True)
+        fp = out / f"{tid}.md"
+        fp.write_text(content, encoding="utf-8")
+        conn.execute(
+            """INSERT INTO tsp_documents (id,project_id,version,standards,deviations,
+            content,file_path,classification,status,approval_status,created_at,updated_at)
+            VALUES (?,?,'1.0.0',?,?,?,?,'CUI // SP-CTI','draft','pending',?,?)""",
+            (tid, project_id, json.dumps(stds), json.dumps(devs), content, str(fp),
+             now.isoformat(), now.isoformat()))
+        conn.execute(
+            """INSERT INTO audit_trail (project_id,event_type,actor,action,details,classification)
+            VALUES (?,'tsp_generated','sparkpilot-mosa-engine',?,?,'CUI')""",
+            (project_id, f"TSP generated: {tid} ({len(stds)} standards)",
+             json.dumps({"tsp_id": tid, "standards_count": len(stds)})))
+        conn.commit()
+        return {"tsp_id": tid, "project_id": project_id, "version": "1.0.0",
+                "standards_count": len(stds), "standards": stds,
+                "deviations_count": len(devs), "deviations": devs,
+                "file_path": str(fp), "classification": "CUI // SP-CTI",
+                "status": "draft", "approval_status": "pending",
+                "valid_categories": cfg["standard_categories"],
+                "max_age_days": cfg["max_age_days"], "generated_at": now.isoformat()}
+    finally:
+        conn.close()
+
+
+def _print_plain(r):
+    print(f"Technical Standard Profile -- {r['project_id']}")
+    print("=" * 60)
+    for k in ("tsp_id","version","standards_count","deviations_count","status","approval_status","file_path"):
+        print(f"  {k:20s} {r[k]}")
+    print("\nStandards:\n" + "-" * 60)
+    for s in r["standards"]:
+        print(f"  [{s['conformance']:7s}] {s['category']:25s} {s['standard']}")
+    if r["deviations"]:
+        print(f"\nDeviations ({r['deviations_count']}):")
+        for d in r["deviations"]:
+            print(f"  - {d['standard']}: {d.get('deviation_rationale','N/A')}")
+
+
+def main():
+    ap = argparse.ArgumentParser(description="MOSA Technical Standard Profile (TSP) Generator")
+    ap.add_argument("--project-id", required=True, help="Project ID")
+    ap.add_argument("--output-dir", default=None, help="Output directory (default: .tmp/mosa/tsp/)")
+    ap.add_argument("--json", action="store_true", help="JSON output")
+    ap.add_argument("--human", action="store_true", help="Human-readable colored output")
+    ap.add_argument("--db-path", type=Path, default=None)
+    args = ap.parse_args()
+    try:
+        result = generate_tsp(args.project_id, output_dir=args.output_dir, db_path=args.db_path)
+        if args.json:
+            print(json.dumps(result, indent=2, default=str))
+        elif args.human:
+            try:
+                sys.path.insert(0, str(BASE_DIR / "tools"))
+                from cli_formatter import CLIOutput
+                CLIOutput(json_mode=False).print(result)
+            except ImportError:
+                _print_plain(result)
+        else:
+            _print_plain(result)
+    except (ValueError, FileNotFoundError) as e:
+        if args.json:
+            print(json.dumps({"error": str(e)}, indent=2))
+        else:
+            print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()