icdev 0.0.3__py3-none-any.whl

args/cloudforge_blueprints/aws_commercial.yaml

@@ -0,0 +1,29 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — AWS Commercial IL2
+cloud_type: aws_commercial
+impact_level: IL2
+region: us-east-1
+description: "Standard AWS commercial landing zone for non-sensitive workloads"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+
+parameters:
+  vpc_cidr: "10.0.0.0/16"
+  az_count: 2
+  k8s_version: "1.29"
+  node_count: 2
+  node_size: "m5.large"
+  enable_flow_logs: true
+  log_retention_days: 90
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+  ato_target_days: 30
+  stig_required: false
+  fips_140_3: false

args/cloudforge_blueprints/aws_govcloud_il4.yaml

@@ -0,0 +1,34 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — AWS GovCloud IL4
+cloud_type: aws_govcloud
+impact_level: IL4
+region: us-gov-west-1
+description: "FedRAMP High / DoD IL4 landing zone on AWS GovCloud"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+  - guardduty
+  - waf
+
+parameters:
+  vpc_cidr: "10.0.0.0/16"
+  az_count: 2
+  k8s_version: "1.29"
+  node_count: 3
+  node_size: "m5.xlarge"
+  enable_flow_logs: true
+  log_retention_days: 365
+  enforce_mfa: true
+  kms_rotation_days: 365
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+    - "FedRAMP High"
+  ato_target_days: 18
+  stig_required: true
+  fips_140_3: true

args/cloudforge_blueprints/aws_govcloud_il5.yaml

@@ -0,0 +1,38 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — AWS GovCloud IL5
+cloud_type: aws_govcloud
+impact_level: IL5
+region: us-gov-west-1
+description: "DoD IL5 landing zone on AWS GovCloud with enhanced security controls"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+  - guardduty
+  - waf
+  - database
+
+parameters:
+  vpc_cidr: "10.0.0.0/16"
+  az_count: 3
+  k8s_version: "1.29"
+  node_count: 3
+  node_size: "m5.xlarge"
+  enable_flow_logs: true
+  log_retention_days: 365
+  enforce_mfa: true
+  kms_rotation_days: 90
+  database_engine: "postgres"
+  database_multi_az: true
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+    - "FedRAMP High"
+    - "CMMC Level 3"
+  ato_target_days: 18
+  stig_required: true
+  fips_140_3: true

args/cloudforge_blueprints/azure_commercial.yaml

@@ -0,0 +1,28 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — Azure Commercial IL2
+cloud_type: azure_commercial
+impact_level: IL2
+region: eastus
+description: "Standard Azure commercial landing zone"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+
+parameters:
+  vnet_cidr: "10.0.0.0/16"
+  k8s_version: "1.29"
+  node_count: 2
+  node_size: "Standard_D2s_v3"
+  enable_flow_logs: true
+  log_retention_days: 90
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+  ato_target_days: 30
+  stig_required: false
+  fips_140_3: false

args/cloudforge_blueprints/azure_gov_il4.yaml

@@ -0,0 +1,32 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — Azure Government IL4
+cloud_type: azure_gov
+impact_level: IL4
+region: usgovvirginia
+description: "SCCA-compliant Azure Government IL4 landing zone"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+  - waf
+
+parameters:
+  vnet_cidr: "10.0.0.0/16"
+  k8s_version: "1.29"
+  node_count: 3
+  node_size: "Standard_D4s_v3"
+  enable_flow_logs: true
+  log_retention_days: 365
+  enforce_mfa: true
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+    - "FedRAMP High"
+  ato_target_days: 18
+  stig_required: true
+  fips_140_3: true
+  scca_compliant: true

args/cloudforge_blueprints/azure_gov_il5.yaml

@@ -0,0 +1,36 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — Azure Government IL5
+cloud_type: azure_gov
+impact_level: IL5
+region: usgovvirginia
+description: "DoD IL5 Azure Government landing zone with SCCA compliance"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+  - waf
+  - database
+
+parameters:
+  vnet_cidr: "10.0.0.0/16"
+  k8s_version: "1.29"
+  node_count: 3
+  node_size: "Standard_D4s_v3"
+  enable_flow_logs: true
+  log_retention_days: 365
+  enforce_mfa: true
+  database_engine: "sqlserver"
+  database_multi_az: true
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+    - "FedRAMP High"
+    - "CMMC Level 3"
+  ato_target_days: 18
+  stig_required: true
+  fips_140_3: true
+  scca_compliant: true

args/cloudforge_blueprints/gcp_commercial.yaml

@@ -0,0 +1,28 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — GCP Commercial
+cloud_type: gcp
+impact_level: IL2
+region: us-central1
+description: "GCP commercial landing zone with Assured Workloads support"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+
+parameters:
+  subnet_cidr: "10.0.0.0/20"
+  k8s_version: "1.29"
+  node_count: 2
+  node_size: "e2-standard-4"
+  enable_flow_logs: true
+  log_retention_days: 90
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+  ato_target_days: 30
+  stig_required: false
+  fips_140_3: false

args/cloudforge_blueprints/oci_commercial.yaml

@@ -0,0 +1,28 @@
+# CUI // SP-CTI
+# CloudForge Blueprint — OCI Commercial
+cloud_type: oci
+impact_level: IL2
+region: us-ashburn-1
+description: "Oracle Cloud Infrastructure commercial landing zone"
+
+modules:
+  - vpc
+  - k8s
+  - iam_baseline
+  - logging
+  - kms
+
+parameters:
+  vcn_cidr: "10.0.0.0/16"
+  k8s_version: "1.29"
+  node_count: 2
+  node_size: "VM.Standard.E4.Flex"
+  enable_flow_logs: true
+  log_retention_days: 90
+
+compliance:
+  frameworks:
+    - "NIST 800-53 Rev 5"
+  ato_target_days: 30
+  stig_required: false
+  fips_140_3: false

args/cloudforge_config.yaml

@@ -0,0 +1,231 @@
+# CUI // SP-CTI
+# CloudForge Configuration (D-CF-1 through D-CF-18)
+# Cloud-Agnostic Landing Zone & Hybrid Cloud Platform
+
+cloudforge:
+  enabled: true
+  version: "1.0.0"
+
+  # Marketplace tier limits (D-CF-16)
+  tiers:
+    community:
+      max_landing_zones: 3
+      max_csps: 1
+      migration_enabled: false
+      hybrid_enabled: false
+      finops_enabled: false
+      siem_enabled: false
+      shift_emulator: false
+      cd_hub_spokes: 1
+      container_hardening: basic        # basic = SBOM only
+      ato_target_days: 30
+      max_runbooks: 3
+      runbook_snippets_enabled: false
+      runbook_ai_generation: false
+      metastore_auto_discovery: false
+      metastore_max_apps: 10
+    pro:
+      max_landing_zones: -1             # unlimited
+      max_csps: -1                      # all CSPs
+      migration_enabled: true
+      hybrid_enabled: true
+      finops_enabled: true
+      siem_enabled: true
+      shift_emulator: true
+      cd_hub_spokes: -1                 # unlimited
+      container_hardening: full         # full = STIG + CIS + SBOM
+      ato_target_days: 18
+      max_runbooks: -1                   # unlimited
+      runbook_snippets_enabled: true
+      runbook_ai_generation: true
+      metastore_auto_discovery: true
+      metastore_max_apps: -1             # unlimited
+
+  # Default IaC engine (D-CF-4)
+  default_iac_engine: terraform         # terraform, opentofu, pulumi
+
+  # ATO acceleration phases (D-CF-14)
+  ato_phases:
+    - name: "Boundary Definition"
+      target_days: 2
+      gates:
+        - system_boundary_defined
+        - data_flow_mapped
+        - ports_protocols_documented
+    - name: "Control Implementation"
+      target_days: 5
+      gates:
+        - inherited_controls_mapped
+        - implemented_controls_documented
+        - crosswalk_complete
+    - name: "Security Scanning"
+      target_days: 4
+      gates:
+        - sast_passed
+        - container_scan_passed
+        - stig_checked
+        - secret_scan_clean
+    - name: "Evidence Collection"
+      target_days: 3
+      gates:
+        - ssp_generated
+        - poam_generated
+        - sbom_generated
+        - test_results_attached
+    - name: "Assessment & Authorization"
+      target_days: 4
+      gates:
+        - assessor_review_complete
+        - risk_accepted
+        - ato_letter_signed
+
+  # CSP provider defaults
+  providers:
+    aws_govcloud:
+      default_region: us-gov-west-1
+      state_backend: s3
+    aws_commercial:
+      default_region: us-east-1
+      state_backend: s3
+    aws_secret:
+      default_region: us-iso-east-1
+      state_backend: s3
+    azure_gov:
+      default_region: usgovvirginia
+      state_backend: azurerm
+    azure_commercial:
+      default_region: eastus
+      state_backend: azurerm
+    azure_secret:
+      default_region: usgovvirginia
+      state_backend: azurerm
+    gcp:
+      default_region: us-central1
+      state_backend: gcs
+    oci:
+      default_region: us-ashburn-1
+      state_backend: oci_objectstorage
+
+  # Migration engine (D-CF-7, D-CF-12)
+  migration:
+    max_concurrent_workloads: 5
+    validation_timeout_seconds: 300
+    rollback_on_failure: true
+    risk_threshold_block: 0.9           # Block migration if risk > 0.9
+    strategies:
+      - phased
+      - big_bang
+      - trickle
+      - replatform
+      - hybrid
+
+  # Hybrid cloud (D-CF-13)
+  hybrid:
+    health_check_interval_seconds: 60
+    max_connections_per_topology: 20
+    supported_connection_types:
+      - vpn
+      - peering
+      - direct_connect
+      - expressroute
+      - interconnect
+      - transit_gateway
+      - relay
+
+  # FinOps engine (D-CF-11)
+  finops:
+    collection_interval_hours: 6
+    budget_alert_channels:
+      - dashboard
+      - email
+    anomaly_z_score_threshold: 2.5
+    cost_api_connectors:
+      aws: aws_cost_explorer
+      azure: azure_cost_management
+      gcp: gcp_billing
+      oci: oci_cost_analysis
+
+  # Cross-cloud SIEM (D-CF-10)
+  siem:
+    retention_days: 90
+    max_events_per_query: 10000
+    correlation_window_minutes: 15
+    log_sources:
+      aws: cloudtrail
+      azure: activity_log
+      gcp: cloud_audit_logs
+      oci: audit_events
+
+  # SHIFT emulator (D-CF-6)
+  shift:
+    container_runtime: docker           # docker, podman
+    network_isolation: true
+    max_concurrent_sessions: 3
+    emulated_services:
+      IL4:
+        - vpc
+        - iam
+        - kms
+        - cloudtrail
+        - config
+      IL5:
+        - vpc
+        - iam
+        - kms
+        - cloudtrail
+        - config
+        - guardduty
+        - securityhub
+      IL6:
+        - vpc
+        - iam
+        - kms
+        - cloudtrail
+        - config
+        - guardduty
+        - securityhub
+        - macie
+        - inspector
+
+  # Container hardening (D-CF-9)
+  container_forge:
+    base_images:
+      - registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal
+      - registry1.dso.mil/ironbank/opensource/nginx/nginx
+      - registry1.dso.mil/ironbank/opensource/postgres/postgresql
+    bigbang_version: "2.x"
+    enforce_non_root: true
+    read_only_rootfs: true
+    scan_on_build: true
+
+  # CD Hub (D-CF-8)
+  cd_hub:
+    gitops_tool: argocd                 # argocd, fluxcd
+    spoke_heartbeat_interval_seconds: 60
+    canary_default_pct: 10
+    rollback_on_slo_violation: true
+
+  # FIPS cryptography
+  fips:
+    enabled: false
+    tls_min_version: "1.2"
+
+  # Runbook engine (D-CF-19 through D-CF-22)
+  runbooks:
+    max_parallel_tasks: 10
+    task_timeout_seconds: 600
+    execution_history_retention_days: 365
+    ai_generation_enabled: true
+    template_dir: cloudforge_runbook_templates
+
+  # Application Metastore (D-CF-23 through D-CF-27)
+  metastore:
+    auto_discovery_enabled: true
+    auto_discovery_interval_hours: 24
+    rto_compliance_check: true
+    max_dependency_depth: 10
+
+  # CUI marking (D-CF-18)
+  cui:
+    default_marking: "CUI // SP-CTI"
+    iac_header: true

args/cloudforge_runbook_templates/backup_verify.yaml

@@ -0,0 +1,98 @@
+# CUI // SP-CTI
+# Backup Verification Runbook Template
+name: Backup Verification
+description: Verify backup integrity — check schedules, validate checksums, test restore, report compliance
+category: backup
+tags: backup,verification,data-protection,compliance
+estimated_duration_minutes: 20
+
+parameters:
+  zone_id: ""
+  backup_target: ""
+  restore_test_db: ""
+
+tasks:
+  - id: t1-check-schedules
+    name: Verify Backup Schedules
+    action: sql_query
+    description: Confirm all backup jobs ran on schedule with no missed windows
+    parameters:
+      query: "SELECT name, last_run, status FROM backup_schedules WHERE zone_id = '${zone_id}'"
+    timeout_seconds: 60
+    on_failure: continue
+
+  - id: t2-validate-checksums
+    name: Validate Backup Checksums
+    action: shell_cmd
+    description: Verify SHA-256 checksums of latest backup files match recorded values
+    parameters:
+      command: "backup-verify --checksums --target ${backup_target}"
+    timeout_seconds: 180
+    retries: 1
+    on_failure: stop
+
+  - id: t3-check-size
+    name: Check Backup Size Anomaly
+    action: shell_cmd
+    description: Compare backup size against 7-day average to detect anomalies
+    parameters:
+      command: "backup-verify --size-check --target ${backup_target} --threshold 20"
+    timeout_seconds: 60
+    on_failure: continue
+
+  - id: t4-restore-test
+    name: Test Restore to Sandbox
+    action: shell_cmd
+    description: Restore latest backup to sandbox environment and verify table counts
+    parameters:
+      command: "backup-restore --target ${restore_test_db} --verify"
+    timeout_seconds: 600
+    retries: 0
+    on_failure: continue
+
+  - id: t5-data-integrity
+    name: Verify Restored Data Integrity
+    action: sql_query
+    description: Run integrity checks on restored database
+    parameters:
+      query: "PRAGMA integrity_check"
+    timeout_seconds: 120
+    on_failure: continue
+    condition:
+      key: "task.t4-restore-test.status"
+      operator: eq
+      value: completed
+
+  - id: t6-compliance-log
+    name: Log Compliance Evidence
+    action: noop
+    description: Record backup verification results as compliance evidence (AU-11)
+    parameters: {}
+    timeout_seconds: 30
+    on_failure: continue
+
+  - id: t7-notify
+    name: Send Verification Report
+    action: notify
+    description: Send backup verification summary to ops and compliance teams
+    parameters:
+      channel: ops
+      message: "Backup verification completed for zone ${zone_id}"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-check-schedules
+    target: t2-validate-checksums
+  - source: t1-check-schedules
+    target: t3-check-size
+  - source: t2-validate-checksums
+    target: t4-restore-test
+  - source: t3-check-size
+    target: t6-compliance-log
+  - source: t4-restore-test
+    target: t5-data-integrity
+  - source: t5-data-integrity
+    target: t6-compliance-log
+  - source: t6-compliance-log
+    target: t7-notify

args/cloudforge_runbook_templates/dr_failover.yaml

@@ -0,0 +1,107 @@
+# CUI // SP-CTI
+# DR Failover Runbook Template
+name: DR Failover
+description: Disaster Recovery failover — verify health, freeze writes, sync data, switch DNS, validate
+category: dr_failover
+tags: dr,failover,disaster-recovery,high-availability
+estimated_duration_minutes: 30
+
+parameters:
+  primary_zone_id: ""
+  dr_zone_id: ""
+  dns_record: ""
+  databridge_connection: ""
+
+tasks:
+  - id: t1-health-check
+    name: Pre-Failover Health Check
+    action: zone_health
+    description: Verify primary and DR zone health before initiating failover
+    parameters:
+      zone_id: "${primary_zone_id}"
+    timeout_seconds: 120
+    retries: 1
+    on_failure: stop
+
+  - id: t2-freeze-writes
+    name: Freeze Write Operations
+    action: shell_cmd
+    description: Enable write guard on primary zone to prevent data loss during failover
+    parameters:
+      command: "writeguard --enable --zone ${primary_zone_id}"
+    timeout_seconds: 60
+    on_failure: stop
+
+  - id: t3-data-sync
+    name: Final DataBridge Sync
+    action: databridge_sync
+    description: Trigger final data synchronization from primary to DR via DataBridge
+    parameters:
+      connection_id: "${databridge_connection}"
+    timeout_seconds: 300
+    retries: 2
+    on_failure: stop
+
+  - id: t4-verify-sync
+    name: Verify Data Consistency
+    action: sql_query
+    description: Compare record counts between primary and DR to confirm sync completion
+    parameters:
+      query: "SELECT COUNT(*) FROM sync_verification WHERE status = 'consistent'"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t5-siem-check
+    name: SIEM Security Check
+    action: siem_check
+    description: Verify no active security incidents before switching traffic
+    parameters: {}
+    timeout_seconds: 60
+    on_failure: continue
+
+  - id: t6-dns-switch
+    name: Switch DNS to DR
+    action: shell_cmd
+    description: Update DNS records to point to DR zone
+    parameters:
+      command: "dns-update --record ${dns_record} --target dr"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t7-dr-health
+    name: Post-Failover DR Health Check
+    action: zone_health
+    description: Verify DR zone is healthy and serving traffic
+    parameters:
+      zone_id: "${dr_zone_id}"
+    timeout_seconds: 120
+    retries: 2
+    on_failure: stop
+
+  - id: t8-notify
+    name: Notify Stakeholders
+    action: notify
+    description: Send DR failover completion notification
+    parameters:
+      channel: ops
+      message: "DR failover completed — traffic now served from DR zone"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-health-check
+    target: t2-freeze-writes
+  - source: t2-freeze-writes
+    target: t3-data-sync
+  - source: t3-data-sync
+    target: t4-verify-sync
+  - source: t4-verify-sync
+    target: t5-siem-check
+  - source: t4-verify-sync
+    target: t6-dns-switch
+  - source: t5-siem-check
+    target: t6-dns-switch
+  - source: t6-dns-switch
+    target: t7-dr-health
+  - source: t7-dr-health
+    target: t8-notify