icdev 0.0.3__py3-none-any.whl

context/requirements/gap_patterns.json

@@ -0,0 +1,108 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "Common requirement gap patterns for DoD/Government systems",
+  "gap_patterns": [
+    {
+      "id": "GAP-SEC-001",
+      "category": "security",
+      "name": "Missing authentication requirements",
+      "description": "No requirements specify how users authenticate (CAC, MFA, SSO)",
+      "severity": "critical",
+      "nist_controls": ["IA-2", "IA-5", "IA-8"],
+      "detection_keywords_absent": ["authentication", "login", "CAC", "PIV", "MFA", "SSO", "credential"],
+      "recommendation": "Specify authentication method (CAC/PIV required for DoD), MFA requirements, and session management"
+    },
+    {
+      "id": "GAP-SEC-002",
+      "category": "security",
+      "name": "Missing authorization/access control requirements",
+      "description": "No requirements define role-based access or privilege management",
+      "severity": "critical",
+      "nist_controls": ["AC-2", "AC-3", "AC-6"],
+      "detection_keywords_absent": ["role", "permission", "access control", "authorization", "privilege", "RBAC"],
+      "recommendation": "Define user roles, permissions matrix, least privilege principle, and account management"
+    },
+    {
+      "id": "GAP-SEC-003",
+      "category": "security",
+      "name": "Missing encryption requirements",
+      "description": "No requirements specify data-at-rest or data-in-transit encryption",
+      "severity": "critical",
+      "nist_controls": ["SC-8", "SC-13", "SC-28"],
+      "detection_keywords_absent": ["encrypt", "TLS", "FIPS 140", "AES", "data at rest", "data in transit"],
+      "recommendation": "Specify FIPS 140-2/3 validated encryption for data at rest and in transit"
+    },
+    {
+      "id": "GAP-SEC-004",
+      "category": "security",
+      "name": "Missing audit/logging requirements",
+      "description": "No requirements define what events are logged or audit trail requirements",
+      "severity": "high",
+      "nist_controls": ["AU-2", "AU-3", "AU-6", "AU-12"],
+      "detection_keywords_absent": ["audit", "log", "event", "trail", "monitor"],
+      "recommendation": "Define auditable events, log retention, log protection, and audit review frequency"
+    },
+    {
+      "id": "GAP-DATA-001",
+      "category": "data",
+      "name": "Missing data retention requirements",
+      "description": "No requirements specify how long data is retained or when it is purged",
+      "severity": "high",
+      "nist_controls": ["SI-12", "MP-6"],
+      "detection_keywords_absent": ["retention", "purge", "archive", "backup", "lifecycle"],
+      "recommendation": "Define data retention periods, archival strategy, and secure deletion requirements"
+    },
+    {
+      "id": "GAP-DATA-002",
+      "category": "data",
+      "name": "Missing data classification requirements",
+      "description": "No requirements specify CUI categories or data handling procedures",
+      "severity": "critical",
+      "nist_controls": ["RA-2", "SC-16"],
+      "detection_keywords_absent": ["CUI", "classification", "marking", "handling", "sensitivity"],
+      "recommendation": "Define CUI categories, portion marking requirements, and data handling procedures per NIST 800-171"
+    },
+    {
+      "id": "GAP-PERF-001",
+      "category": "performance",
+      "name": "Missing performance/SLA requirements",
+      "description": "No quantifiable performance targets defined",
+      "severity": "medium",
+      "nist_controls": [],
+      "detection_keywords_absent": ["response time", "latency", "throughput", "SLA", "availability", "uptime"],
+      "recommendation": "Define response time targets, availability SLA (e.g., 99.9%), throughput requirements, and degradation thresholds"
+    },
+    {
+      "id": "GAP-INT-001",
+      "category": "interface",
+      "name": "Missing interface specification",
+      "description": "External system integrations mentioned but protocols/formats not specified",
+      "severity": "high",
+      "nist_controls": ["SA-9", "CA-3"],
+      "detection_keywords_present": ["integrate", "connect", "interface", "external", "third-party"],
+      "detection_keywords_absent": ["REST", "API", "protocol", "format", "schema", "ISA", "MOU"],
+      "recommendation": "Define interface protocol (REST/SOAP/MQ), data format (JSON/XML), authentication, and ISA/MOU requirements"
+    },
+    {
+      "id": "GAP-OPS-001",
+      "category": "operational",
+      "name": "Missing disaster recovery requirements",
+      "description": "No requirements for backup, failover, or disaster recovery",
+      "severity": "high",
+      "nist_controls": ["CP-2", "CP-6", "CP-7", "CP-9", "CP-10"],
+      "detection_keywords_absent": ["backup", "recovery", "failover", "disaster", "continuity", "RTO", "RPO"],
+      "recommendation": "Define RTO/RPO targets, backup frequency, failover strategy, and DR testing cadence"
+    },
+    {
+      "id": "GAP-OPS-002",
+      "category": "operational",
+      "name": "Missing incident response requirements",
+      "description": "No requirements for how security incidents are detected and handled",
+      "severity": "high",
+      "nist_controls": ["IR-1", "IR-4", "IR-5", "IR-6"],
+      "detection_keywords_absent": ["incident", "response", "alert", "notify", "escalat"],
+      "recommendation": "Define incident detection methods, response procedures, notification requirements, and escalation paths"
+    }
+  ]
+}

context/requirements/readiness_rubric.json

@@ -0,0 +1,78 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "Scoring rubric for requirements readiness assessment",
+  "dimensions": {
+    "completeness": {
+      "weight": 0.25,
+      "description": "Are all necessary requirements captured?",
+      "scoring": {
+        "1.0": "All functional, non-functional, security, interface, and data requirements captured. No critical gaps.",
+        "0.8": "Most requirements captured. 1-2 minor gaps in non-critical areas.",
+        "0.6": "Core functional requirements present. Missing some security or interface specs.",
+        "0.4": "Only high-level capabilities described. Significant gaps in detail.",
+        "0.2": "Minimal requirements. Missing entire categories (security, data, interfaces).",
+        "0.0": "No structured requirements captured."
+      },
+      "auto_check": "gap_count == 0 and all required categories have >= 1 requirement"
+    },
+    "clarity": {
+      "weight": 0.25,
+      "description": "Are requirements unambiguous and specific?",
+      "scoring": {
+        "1.0": "Zero ambiguous terms. All requirements use measurable, testable language.",
+        "0.8": "1-3 minor ambiguities. Core requirements are clear.",
+        "0.6": "4-6 ambiguities. Some requirements need clarification.",
+        "0.4": "7-10 ambiguities. Multiple requirements use vague terms.",
+        "0.2": "10+ ambiguities. Most requirements are vague or subjective.",
+        "0.0": "Requirements are entirely qualitative with no measurable criteria."
+      },
+      "auto_check": "ambiguity_count / total_requirements < 0.1"
+    },
+    "feasibility": {
+      "weight": 0.20,
+      "description": "Can these requirements be built within the stated constraints?",
+      "scoring": {
+        "1.0": "All requirements feasible within budget, timeline, and technology constraints.",
+        "0.8": "Most feasible. 1-2 may require trade-offs but are achievable.",
+        "0.6": "Several requirements push constraints. Scope negotiation needed.",
+        "0.4": "Multiple conflicting constraints. Significant scope reduction required.",
+        "0.2": "Major feasibility concerns. Technology or timeline constraints severely limit scope.",
+        "0.0": "Requirements are not feasible within any reasonable interpretation of constraints."
+      },
+      "auto_check": "no requirements flagged as infeasible by architect assessment"
+    },
+    "compliance": {
+      "weight": 0.15,
+      "description": "Do requirements address NIST 800-53 controls for the impact level?",
+      "scoring": {
+        "1.0": "All applicable control families addressed. ATO boundary impact assessed.",
+        "0.8": "Most control families addressed. Minor gaps in low-impact areas.",
+        "0.6": "Core security controls addressed. Missing several families.",
+        "0.4": "Only basic security mentioned. No systematic control coverage.",
+        "0.2": "Minimal security awareness. Critical control families missing.",
+        "0.0": "No compliance requirements captured."
+      },
+      "auto_check": "crosswalk_coverage >= 0.8 for impact_level baseline"
+    },
+    "testability": {
+      "weight": 0.15,
+      "description": "Do requirements have measurable acceptance criteria?",
+      "scoring": {
+        "1.0": "All requirements have BDD-style acceptance criteria (Given/When/Then).",
+        "0.8": "80%+ have testable criteria. Remaining have clear intent.",
+        "0.6": "60-80% have some form of acceptance criteria.",
+        "0.4": "40-60% have criteria. Many are vague or untestable.",
+        "0.2": "Under 40% have any form of acceptance criteria.",
+        "0.0": "No acceptance criteria defined for any requirement."
+      },
+      "auto_check": "requirements_with_bdd_criteria / total_requirements >= 0.8"
+    }
+  },
+  "thresholds": {
+    "proceed_to_decomposition": 0.7,
+    "proceed_to_coa": 0.8,
+    "proceed_to_implementation": 0.9,
+    "warning": 0.5
+  }
+}

context/requirements/red_alternative_patterns.json

@@ -0,0 +1,210 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "Patterns for generating alternative Courses of Action (COAs) when a requirement receives RED-tier boundary impact classification",
+  "alternative_patterns": [
+    {
+      "id": "ALT-CDS",
+      "name": "Cross-Domain Solution",
+      "description": "Use an approved Cross-Domain Solution instead of direct cross-classification connection",
+      "applicable_when": ["classification_change", "cross_network"],
+      "resulting_tier": "YELLOW",
+      "feasibility": 0.7,
+      "tradeoffs": [
+        "Added latency",
+        "CDS procurement/certification required",
+        "Data format constraints"
+      ],
+      "implementation_steps": [
+        "Identify approved CDS from NSA EPL",
+        "Submit CDS connection request to DAA",
+        "Define data filter rules",
+        "Implement data format adapters",
+        "Test cross-domain data flow"
+      ],
+      "estimated_timeline_days": 120,
+      "cost_impact": "high"
+    },
+    {
+      "id": "ALT-DOWNGRADE",
+      "name": "Data Downgrade",
+      "description": "Process data at lower classification level, aggregate results at higher level",
+      "applicable_when": ["classification_change", "data_sensitivity"],
+      "resulting_tier": "GREEN",
+      "feasibility": 0.6,
+      "tradeoffs": [
+        "Reduced data fidelity",
+        "Manual aggregation step",
+        "Dual-system maintenance"
+      ],
+      "implementation_steps": [
+        "Identify data elements requiring higher classification",
+        "Design data decomposition strategy",
+        "Implement lower-classification processing pipeline",
+        "Create secure aggregation workflow at higher level",
+        "Validate results maintain required accuracy"
+      ],
+      "estimated_timeline_days": 45,
+      "cost_impact": "medium"
+    },
+    {
+      "id": "ALT-PHASE",
+      "name": "Phased Implementation",
+      "description": "Split requirement into phases that stay within boundary",
+      "applicable_when": ["boundary_expansion", "scope_increase"],
+      "resulting_tier": "YELLOW",
+      "feasibility": 0.8,
+      "tradeoffs": [
+        "Longer timeline",
+        "Partial capability initially",
+        "Multiple ATO actions"
+      ],
+      "implementation_steps": [
+        "Decompose requirement into boundary-safe phases",
+        "Identify minimum viable phase within current boundary",
+        "Plan subsequent phases with incremental boundary changes",
+        "Submit separate ATO actions per phase",
+        "Establish phase gates with compliance checkpoints"
+      ],
+      "estimated_timeline_days": 30,
+      "cost_impact": "low"
+    },
+    {
+      "id": "ALT-PROXY",
+      "name": "Authorized Proxy",
+      "description": "Use existing authorized system as intermediary/gateway",
+      "applicable_when": ["new_interconnection", "prohibited_technology"],
+      "resulting_tier": "ORANGE",
+      "feasibility": 0.5,
+      "tradeoffs": [
+        "Single point of failure",
+        "Performance bottleneck",
+        "Proxy system ATO scope increase"
+      ],
+      "implementation_steps": [
+        "Identify existing authorized gateway/proxy systems",
+        "Assess proxy system capacity for additional load",
+        "Negotiate ISA amendment with proxy system owner",
+        "Implement API adapter layer on proxy",
+        "Test end-to-end data flow through proxy"
+      ],
+      "estimated_timeline_days": 60,
+      "cost_impact": "medium"
+    },
+    {
+      "id": "ALT-ENCLAVE",
+      "name": "Isolated Enclave",
+      "description": "Create an isolated enclave within existing boundary for sensitive processing",
+      "applicable_when": ["data_sensitivity", "boundary_expansion"],
+      "resulting_tier": "YELLOW",
+      "feasibility": 0.65,
+      "tradeoffs": [
+        "Additional infrastructure",
+        "Network segmentation complexity",
+        "Separate monitoring"
+      ],
+      "implementation_steps": [
+        "Define enclave boundary within existing ATO boundary",
+        "Implement network segmentation (VLAN, firewall rules)",
+        "Apply enhanced controls within enclave",
+        "Create SSP addendum for enclave",
+        "Validate enclave isolation with penetration testing"
+      ],
+      "estimated_timeline_days": 75,
+      "cost_impact": "high"
+    },
+    {
+      "id": "ALT-DECLASS",
+      "name": "Declassification Pipeline",
+      "description": "Implement automated declassification review to process data at lower classification",
+      "applicable_when": ["classification_change"],
+      "resulting_tier": "YELLOW",
+      "feasibility": 0.4,
+      "tradeoffs": [
+        "Declassification authority required",
+        "Review latency for each record",
+        "Not applicable to all data types",
+        "Regulatory approval needed"
+      ],
+      "implementation_steps": [
+        "Identify data elements eligible for declassification",
+        "Obtain declassification authority approval",
+        "Implement automated review pipeline with human-in-the-loop",
+        "Create audit trail for all declassification decisions",
+        "Test pipeline with representative data samples"
+      ],
+      "estimated_timeline_days": 90,
+      "cost_impact": "high"
+    },
+    {
+      "id": "ALT-VENDOR-SWAP",
+      "name": "Vendor Replacement",
+      "description": "Replace prohibited or high-risk vendor with compliant alternative",
+      "applicable_when": ["prohibited_technology", "section_889_violation"],
+      "resulting_tier": "GREEN",
+      "feasibility": 0.75,
+      "tradeoffs": [
+        "Migration effort for existing integrations",
+        "Possible feature gap with alternative vendor",
+        "Retraining required",
+        "Contract renegotiation"
+      ],
+      "implementation_steps": [
+        "Identify Section 889 compliant alternative vendors",
+        "Conduct SCRM assessment on alternatives",
+        "Perform feature gap analysis",
+        "Plan migration from prohibited to compliant vendor",
+        "Execute migration with parallel-run validation"
+      ],
+      "estimated_timeline_days": 90,
+      "cost_impact": "medium"
+    },
+    {
+      "id": "ALT-SCOPE-REDUCE",
+      "name": "Scope Reduction",
+      "description": "Reduce requirement scope to eliminate boundary-breaking elements",
+      "applicable_when": ["boundary_expansion", "scope_increase", "new_interconnection"],
+      "resulting_tier": "GREEN",
+      "feasibility": 0.85,
+      "tradeoffs": [
+        "Reduced functionality",
+        "May not fully satisfy stakeholder needs",
+        "Requires stakeholder negotiation"
+      ],
+      "implementation_steps": [
+        "Identify specific elements causing RED classification",
+        "Propose reduced scope that eliminates boundary impact",
+        "Present trade-off analysis to stakeholders",
+        "Document accepted scope reduction in requirements",
+        "Update decomposition to reflect reduced scope"
+      ],
+      "estimated_timeline_days": 14,
+      "cost_impact": "low"
+    }
+  ],
+  "selection_criteria": {
+    "primary_factors": [
+      "feasibility",
+      "resulting_tier",
+      "estimated_timeline_days",
+      "cost_impact"
+    ],
+    "scoring_weights": {
+      "feasibility": 0.35,
+      "resulting_tier_score": 0.25,
+      "timeline_score": 0.20,
+      "cost_score": 0.20
+    },
+    "tier_scores": {
+      "GREEN": 1.0,
+      "YELLOW": 0.75,
+      "ORANGE": 0.5,
+      "RED": 0.0
+    },
+    "cost_scores": {
+      "low": 1.0,
+      "medium": 0.6,
+      "high": 0.3
+    }
+  }
+}

context/requirements/safe_templates.json

@@ -0,0 +1,72 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "SAFe Agile hierarchy templates for requirements decomposition",
+  "hierarchy": {
+    "epic": {
+      "description": "Program-level capability spanning multiple PIs",
+      "template": {
+        "title": "[Epic] {capability_name}",
+        "description": "As a {persona}, I need {capability} so that {business_value}.",
+        "acceptance_criteria_template": "The epic is complete when all child capabilities are delivered and validated.",
+        "fields": ["lean_business_case", "mvp_definition", "nfrs", "kpis"]
+      },
+      "decomposition_guidance": "Decompose into 2-5 Capabilities based on functional domains or user journeys.",
+      "typical_duration": "2-4 PIs"
+    },
+    "capability": {
+      "description": "ART-level capability deliverable within 1-2 PIs",
+      "template": {
+        "title": "[Capability] {name}",
+        "description": "Provide {functionality} for {user_group} enabling {outcome}.",
+        "acceptance_criteria_template": "All child features are delivered, integrated, and pass UAT.",
+        "fields": ["benefit_hypothesis", "acceptance_criteria", "enablers_needed"]
+      },
+      "decomposition_guidance": "Decompose into 3-8 Features, each deliverable within a single PI.",
+      "typical_duration": "1-2 PIs"
+    },
+    "feature": {
+      "description": "PI-level deliverable providing user-visible value",
+      "template": {
+        "title": "[Feature] {name}",
+        "description": "Enable {user_role} to {action} with {quality_attribute}.",
+        "acceptance_criteria_template": "Given {context}, When {action}, Then {expected_result}.",
+        "fields": ["benefit_hypothesis", "acceptance_criteria", "nfrs", "wsjf_inputs"]
+      },
+      "decomposition_guidance": "Decompose into 3-10 Stories + necessary Enablers. Each story fits in one sprint.",
+      "typical_duration": "1 PI (5 sprints)"
+    },
+    "story": {
+      "description": "Sprint-level user story with clear acceptance criteria",
+      "template": {
+        "title": "As a {role}, I want to {action} so that {benefit}",
+        "description": "Detailed description with context and constraints.",
+        "acceptance_criteria_template": "Given {precondition}\nWhen {action}\nThen {postcondition}",
+        "fields": ["story_points", "acceptance_criteria", "definition_of_done"]
+      },
+      "sizing_guidance": "Must be completable in one sprint. If >13 story points, split further.",
+      "typical_duration": "1 sprint (2 weeks)"
+    },
+    "enabler": {
+      "description": "Technical work enabling features — infrastructure, architecture, compliance",
+      "template": {
+        "title": "[Enabler] {name}",
+        "description": "Technical enablement: {what} to support {which_features}.",
+        "acceptance_criteria_template": "The enabler is complete when {technical_criteria} and {integration_test_passes}.",
+        "fields": ["enabler_type", "blocks", "acceptance_criteria"]
+      },
+      "types": ["infrastructure", "architecture", "exploration", "compliance"],
+      "typical_duration": "1-2 sprints"
+    }
+  },
+  "wsjf": {
+    "description": "Weighted Shortest Job First prioritization",
+    "formula": "WSJF = (Business Value + Time Criticality + Risk Reduction) / Job Size",
+    "scales": {
+      "business_value": {"1": "Minimal", "2": "Low", "3": "Moderate", "5": "Significant", "8": "High", "13": "Critical", "20": "Maximum"},
+      "time_criticality": {"1": "No deadline", "2": "Distant", "3": "Moderate", "5": "Near-term", "8": "Urgent", "13": "Critical", "20": "Immediate"},
+      "risk_reduction": {"1": "None", "2": "Minor", "3": "Moderate", "5": "Significant", "8": "Major", "13": "Critical", "20": "Existential"},
+      "job_size": {"1": "XS", "2": "S", "3": "M", "5": "L", "8": "XL", "13": "XXL"}
+    }
+  }
+}

context/requirements/spec_quality_checklist.json

@@ -0,0 +1,122 @@
+{
+  "classification": "CUI // SP-CTI",
+  "version": "1.0.0",
+  "description": "Spec quality checklist — 'unit tests for English' (adapted from GitHub spec-kit, ADR D156)",
+  "required_sections": [
+    {
+      "name": "Feature Description",
+      "severity": "critical",
+      "min_words": 20,
+      "description": "Clear description of what the feature does and why"
+    },
+    {
+      "name": "User Story",
+      "severity": "critical",
+      "pattern": "(?i)as a .+ i want .+ so that .+",
+      "description": "Standard user story format: As a <role> I want <goal> So that <benefit>"
+    },
+    {
+      "name": "Solution Statement",
+      "severity": "critical",
+      "min_words": 30,
+      "description": "How the feature will be implemented at a high level"
+    },
+    {
+      "name": "ATO Impact Assessment",
+      "severity": "critical",
+      "description": "Boundary impact tier (GREEN/YELLOW/ORANGE/RED), NIST controls, SSP impact"
+    },
+    {
+      "name": "Acceptance Criteria",
+      "severity": "critical",
+      "min_items": 3,
+      "description": "Testable success criteria — at least 3 items"
+    },
+    {
+      "name": "Implementation Plan",
+      "severity": "high",
+      "description": "Phased implementation approach"
+    },
+    {
+      "name": "Step by Step Tasks",
+      "severity": "high",
+      "min_items": 3,
+      "description": "Ordered task list for execution"
+    },
+    {
+      "name": "Testing Strategy",
+      "severity": "high",
+      "description": "Unit, BDD, edge case, and E2E testing approach"
+    },
+    {
+      "name": "Validation Commands",
+      "severity": "medium",
+      "description": "Bash commands to verify the implementation"
+    },
+    {
+      "name": "NIST 800-53 Controls",
+      "severity": "medium",
+      "description": "Applicable NIST controls with justification"
+    }
+  ],
+  "quality_rules": [
+    {
+      "id": "SQ-AMB-001",
+      "name": "No ambiguous phrases",
+      "severity": "high",
+      "uses": "ambiguity_patterns.json",
+      "description": "Spec should not contain vague terms like 'timely', 'appropriate', 'as needed'"
+    },
+    {
+      "id": "SQ-ACC-001",
+      "name": "Acceptance criteria are testable",
+      "severity": "critical",
+      "description": "Each acceptance criterion must contain a measurable or observable assertion"
+    },
+    {
+      "id": "SQ-ACC-002",
+      "name": "Min 3 acceptance criteria",
+      "severity": "high",
+      "description": "Specifications must have at least 3 acceptance criteria"
+    },
+    {
+      "id": "SQ-ATO-001",
+      "name": "ATO boundary tier specified",
+      "severity": "critical",
+      "keywords": ["GREEN", "YELLOW", "ORANGE", "RED"],
+      "description": "ATO Impact Assessment must specify a boundary impact tier"
+    },
+    {
+      "id": "SQ-ATO-002",
+      "name": "NIST controls listed",
+      "severity": "high",
+      "pattern": "[A-Z]{2}-\\d+",
+      "description": "At least one NIST 800-53 control ID should be referenced"
+    },
+    {
+      "id": "SQ-TST-001",
+      "name": "Testing strategy present",
+      "severity": "high",
+      "description": "Testing Strategy section must exist with content"
+    },
+    {
+      "id": "SQ-TST-002",
+      "name": "Validation commands present",
+      "severity": "medium",
+      "description": "Validation Commands section should include executable commands"
+    },
+    {
+      "id": "SQ-TASK-001",
+      "name": "Tasks cover all phases",
+      "severity": "high",
+      "description": "Each Implementation Plan phase should have corresponding Step by Step Tasks"
+    },
+    {
+      "id": "SQ-CON-001",
+      "name": "Constitution compliance",
+      "severity": "critical",
+      "uses": "constitutions",
+      "description": "Spec must not violate project constitution principles"
+    }
+  ]
+}