icdev 0.0.3__py3-none-any.whl

args/cloudforge_runbook_templates/health_check.yaml

@@ -0,0 +1,97 @@
+# CUI // SP-CTI
+# Multi-Zone Health Check Runbook Template
+name: Multi-Zone Health Check
+description: Comprehensive health check across all landing zones — network, services, SIEM, compliance
+category: health_check
+tags: health,monitoring,zones,compliance
+estimated_duration_minutes: 15
+
+parameters:
+  zone_ids: ""
+  alert_threshold: "critical"
+
+tasks:
+  - id: t1-enumerate-zones
+    name: Enumerate Active Zones
+    action: sql_query
+    description: Query all active landing zones from the registry
+    parameters:
+      query: "SELECT id, name, cloud_type FROM cf_landing_zones WHERE status = 'active'"
+    timeout_seconds: 30
+    on_failure: stop
+
+  - id: t2-network-check
+    name: Network Connectivity Check
+    action: http_check
+    description: Verify network connectivity to each zone's management endpoint
+    parameters:
+      url: "${zone_management_url}"
+    timeout_seconds: 120
+    retries: 1
+    on_failure: continue
+
+  - id: t3-service-check
+    name: Service Health Check
+    action: zone_health
+    description: Check core services (compute, storage, identity) in each zone
+    parameters:
+      zone_id: "${zone_ids}"
+    timeout_seconds: 180
+    retries: 1
+    on_failure: continue
+
+  - id: t4-siem-check
+    name: SIEM Alert Check
+    action: siem_check
+    description: Check for active SIEM alerts above threshold
+    parameters:
+      threshold: "${alert_threshold}"
+    timeout_seconds: 60
+    on_failure: continue
+
+  - id: t5-compliance-check
+    name: Compliance Status Check
+    action: sql_query
+    description: Verify compliance controls are current and no overdue POAMs
+    parameters:
+      query: "SELECT COUNT(*) FROM compliance_controls WHERE status = 'non_compliant'"
+    timeout_seconds: 60
+    on_failure: continue
+
+  - id: t6-aggregate
+    name: Aggregate Results
+    action: noop
+    description: Aggregate all health check results into a summary report
+    parameters: {}
+    timeout_seconds: 30
+    on_failure: continue
+
+  - id: t7-notify
+    name: Report Results
+    action: notify
+    description: Send health check summary to ops channel
+    parameters:
+      channel: ops
+      message: "Multi-zone health check completed"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-enumerate-zones
+    target: t2-network-check
+  - source: t1-enumerate-zones
+    target: t3-service-check
+  - source: t1-enumerate-zones
+    target: t4-siem-check
+  - source: t1-enumerate-zones
+    target: t5-compliance-check
+  - source: t2-network-check
+    target: t6-aggregate
+  - source: t3-service-check
+    target: t6-aggregate
+  - source: t4-siem-check
+    target: t6-aggregate
+  - source: t5-compliance-check
+    target: t6-aggregate
+  - source: t6-aggregate
+    target: t7-notify

args/cloudforge_runbook_templates/incident_response.yaml

@@ -0,0 +1,101 @@
+# CUI // SP-CTI
+# Incident Response Runbook Template
+name: Incident Response
+description: Security incident response — triage, contain, investigate, remediate, report
+category: incident
+tags: incident,security,siem,response
+estimated_duration_minutes: 60
+
+parameters:
+  incident_id: ""
+  severity: "high"
+  affected_zone: ""
+
+tasks:
+  - id: t1-triage
+    name: Triage Incident
+    action: siem_check
+    description: Pull SIEM events for initial triage and severity assessment
+    parameters: {}
+    timeout_seconds: 120
+    on_failure: continue
+
+  - id: t2-contain
+    name: Containment Actions
+    action: shell_cmd
+    description: Isolate affected systems to prevent lateral movement
+    parameters:
+      command: "network-isolate --zone ${affected_zone} --level partial"
+    timeout_seconds: 180
+    on_failure: stop
+
+  - id: t3-collect-evidence
+    name: Collect Forensic Evidence
+    action: shell_cmd
+    description: Capture logs, memory dumps, and network captures
+    parameters:
+      command: "forensics-collect --zone ${affected_zone} --incident ${incident_id}"
+    timeout_seconds: 300
+    on_failure: continue
+
+  - id: t4-investigate
+    name: Root Cause Analysis
+    action: noop
+    description: Analyze collected evidence to determine root cause
+    parameters: {}
+    timeout_seconds: 600
+    on_failure: continue
+
+  - id: t5-remediate
+    name: Remediate Vulnerability
+    action: shell_cmd
+    description: Apply fixes for the root cause
+    parameters:
+      command: "remediate --incident ${incident_id}"
+    timeout_seconds: 300
+    on_failure: continue
+
+  - id: t6-restore
+    name: Restore Services
+    action: shell_cmd
+    description: Remove containment and restore normal operations
+    parameters:
+      command: "network-isolate --zone ${affected_zone} --level none"
+    timeout_seconds: 180
+    on_failure: stop
+
+  - id: t7-verify
+    name: Post-Incident Verification
+    action: zone_health
+    description: Verify all services are restored and healthy
+    parameters:
+      zone_id: "${affected_zone}"
+    timeout_seconds: 120
+    retries: 2
+    on_failure: continue
+
+  - id: t8-report
+    name: Generate Incident Report
+    action: notify
+    description: Send incident summary to security team and stakeholders
+    parameters:
+      channel: security
+      message: "Incident ${incident_id} resolved — see report for details"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-triage
+    target: t2-contain
+  - source: t2-contain
+    target: t3-collect-evidence
+  - source: t3-collect-evidence
+    target: t4-investigate
+  - source: t4-investigate
+    target: t5-remediate
+  - source: t5-remediate
+    target: t6-restore
+  - source: t6-restore
+    target: t7-verify
+  - source: t7-verify
+    target: t8-report

args/cloudforge_runbook_templates/migration_cutover.yaml

@@ -0,0 +1,105 @@
+# CUI // SP-CTI
+# Migration Cutover Runbook Template
+name: Migration Cutover
+description: Full migration cutover — pre-checks, DataBridge sync, validation, DNS switch, rollback plan
+category: migration
+tags: migration,cutover,databridge,validation
+estimated_duration_minutes: 45
+
+parameters:
+  assessment_id: ""
+  source_zone: ""
+  target_zone: ""
+  databridge_connection: ""
+
+tasks:
+  - id: t1-pre-check
+    name: Pre-Migration Validation
+    action: zone_health
+    description: Verify source and target zones are ready for cutover
+    parameters:
+      zone_id: "${source_zone}"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t2-target-check
+    name: Target Zone Readiness
+    action: zone_health
+    description: Verify target zone infrastructure is fully provisioned
+    parameters:
+      zone_id: "${target_zone}"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t3-freeze
+    name: Freeze Source Writes
+    action: shell_cmd
+    description: Enable write guard on source zone during migration
+    parameters:
+      command: "writeguard --enable --zone ${source_zone}"
+    timeout_seconds: 60
+    on_failure: stop
+
+  - id: t4-sync
+    name: Final DataBridge Sync
+    action: databridge_sync
+    description: Execute final data synchronization via DataBridge
+    parameters:
+      connection_id: "${databridge_connection}"
+    timeout_seconds: 600
+    retries: 1
+    on_failure: stop
+
+  - id: t5-validate
+    name: Data Validation
+    action: sql_query
+    description: Compare record counts and checksums between source and target
+    parameters:
+      query: "SELECT COUNT(*) FROM migration_validation WHERE assessment_id = '${assessment_id}'"
+    timeout_seconds: 180
+    on_failure: stop
+
+  - id: t6-switch
+    name: Traffic Switch
+    action: shell_cmd
+    description: Switch traffic from source to target zone
+    parameters:
+      command: "traffic-switch --from ${source_zone} --to ${target_zone}"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t7-verify
+    name: Post-Cutover Verification
+    action: zone_health
+    description: Verify target zone is serving traffic correctly
+    parameters:
+      zone_id: "${target_zone}"
+    timeout_seconds: 180
+    retries: 3
+    on_failure: continue
+
+  - id: t8-notify
+    name: Notify Completion
+    action: notify
+    description: Send migration cutover completion notification
+    parameters:
+      channel: ops
+      message: "Migration cutover completed: ${source_zone} -> ${target_zone}"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-pre-check
+    target: t3-freeze
+  - source: t2-target-check
+    target: t3-freeze
+  - source: t3-freeze
+    target: t4-sync
+  - source: t4-sync
+    target: t5-validate
+  - source: t5-validate
+    target: t6-switch
+  - source: t6-switch
+    target: t7-verify
+  - source: t7-verify
+    target: t8-notify

args/cloudforge_runbook_templates/patch_rollout.yaml

@@ -0,0 +1,92 @@
+# CUI // SP-CTI
+# Patch Rollout Runbook Template
+name: Patch Rollout
+description: Rolling patch deployment with canary verification, STIG compliance check, and rollback capability
+category: patching
+tags: patching,security,compliance,rolling-update
+estimated_duration_minutes: 45
+
+parameters:
+  zone_id: ""
+  patch_id: ""
+  canary_pct: "10"
+
+tasks:
+  - id: t1-pre-check
+    name: Pre-Patch Health Check
+    action: zone_health
+    description: Verify zone health before applying patches
+    parameters:
+      zone_id: "${zone_id}"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t2-backup
+    name: Create Pre-Patch Snapshot
+    action: shell_cmd
+    description: Create backup snapshot before patching
+    parameters:
+      command: "snapshot --create --zone ${zone_id} --label pre-patch-${patch_id}"
+    timeout_seconds: 300
+    on_failure: stop
+
+  - id: t3-canary
+    name: Canary Deployment
+    action: shell_cmd
+    description: Apply patch to canary subset
+    parameters:
+      command: "patch-apply --zone ${zone_id} --patch ${patch_id} --canary-pct ${canary_pct}"
+    timeout_seconds: 600
+    on_failure: stop
+
+  - id: t4-canary-verify
+    name: Verify Canary Health
+    action: zone_health
+    description: Verify canary instances are healthy after patch
+    parameters:
+      zone_id: "${zone_id}"
+    timeout_seconds: 180
+    retries: 2
+    on_failure: stop
+
+  - id: t5-full-rollout
+    name: Full Rollout
+    action: shell_cmd
+    description: Apply patch to remaining instances
+    parameters:
+      command: "patch-apply --zone ${zone_id} --patch ${patch_id} --full"
+    timeout_seconds: 600
+    on_failure: stop
+
+  - id: t6-stig-check
+    name: STIG Compliance Scan
+    action: shell_cmd
+    description: Run STIG compliance scan post-patch
+    parameters:
+      command: "stig-check --zone ${zone_id}"
+    timeout_seconds: 300
+    on_failure: continue
+
+  - id: t7-notify
+    name: Notify Completion
+    action: notify
+    description: Send patch rollout completion notification
+    parameters:
+      channel: ops
+      message: "Patch ${patch_id} deployed to zone ${zone_id}"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-pre-check
+    target: t2-backup
+  - source: t2-backup
+    target: t3-canary
+  - source: t3-canary
+    target: t4-canary-verify
+  - source: t4-canary-verify
+    target: t5-full-rollout
+  - source: t5-full-rollout
+    target: t6-stig-check
+  - source: t6-stig-check
+    target: t7-notify

args/cloudforge_runbook_templates/zone_provision.yaml

@@ -0,0 +1,93 @@
+# CUI // SP-CTI
+# Zone Provisioning Runbook Template
+name: Zone Provisioning
+description: End-to-end landing zone provisioning — blueprint, IaC, deploy, compliance, monitoring
+category: provisioning
+tags: provisioning,landing-zone,iac,compliance
+estimated_duration_minutes: 30
+
+parameters:
+  zone_name: ""
+  cloud_type: "aws_govcloud"
+  impact_level: "IL4"
+  blueprint: "default"
+
+tasks:
+  - id: t1-blueprint
+    name: Load Blueprint
+    action: noop
+    description: Load and validate the landing zone blueprint
+    parameters: {}
+    timeout_seconds: 60
+    on_failure: stop
+
+  - id: t2-iac-render
+    name: Render IaC
+    action: shell_cmd
+    description: Generate Terraform/OpenTofu from blueprint
+    parameters:
+      command: "cloudforge render --blueprint ${blueprint} --cloud ${cloud_type}"
+    timeout_seconds: 120
+    on_failure: stop
+
+  - id: t3-plan
+    name: IaC Plan
+    action: shell_cmd
+    description: Run terraform/tofu plan to preview changes
+    parameters:
+      command: "terraform plan -out=tfplan"
+    timeout_seconds: 300
+    on_failure: stop
+
+  - id: t4-apply
+    name: IaC Apply
+    action: shell_cmd
+    description: Apply infrastructure changes
+    parameters:
+      command: "terraform apply tfplan"
+    timeout_seconds: 600
+    on_failure: stop
+
+  - id: t5-compliance
+    name: Compliance Scan
+    action: shell_cmd
+    description: Run STIG and CUI compliance checks on new zone
+    parameters:
+      command: "stig-check --zone ${zone_name} --level ${impact_level}"
+    timeout_seconds: 300
+    on_failure: continue
+
+  - id: t6-monitoring
+    name: Enable Monitoring
+    action: shell_cmd
+    description: Set up SIEM log ingestion and health monitoring
+    parameters:
+      command: "siem-setup --zone ${zone_name}"
+    timeout_seconds: 120
+    on_failure: continue
+
+  - id: t7-notify
+    name: Notify Completion
+    action: notify
+    description: Send zone provisioning completion notification
+    parameters:
+      channel: ops
+      message: "Zone ${zone_name} provisioned on ${cloud_type} at ${impact_level}"
+    timeout_seconds: 30
+    on_failure: continue
+
+edges:
+  - source: t1-blueprint
+    target: t2-iac-render
+  - source: t2-iac-render
+    target: t3-plan
+  - source: t3-plan
+    target: t4-apply
+  - source: t4-apply
+    target: t5-compliance
+  - source: t4-apply
+    target: t6-monitoring
+  - source: t5-compliance
+    target: t7-notify
+  - source: t6-monitoring
+    target: t7-notify

args/code_pattern_config.yaml

@@ -0,0 +1,151 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Code Pattern Scanner Configuration (Phase 44 — D278)
+# Declarative dangerous code patterns across 6 languages.
+---
+
+patterns:
+  universal:
+    - pattern: '\beval\s*\('
+      severity: critical
+      name: eval_usage
+      description: "Dynamic code evaluation — potential code injection"
+    - pattern: '\bexec\s*\('
+      severity: critical
+      name: exec_usage
+      description: "Dynamic code execution — potential code injection"
+    - pattern: 'subprocess\.(call|run|Popen|check_output)\s*\('
+      severity: high
+      name: subprocess_spawn
+      description: "Process spawning — potential command injection"
+
+  python:
+    - pattern: '\bos\.system\s*\('
+      severity: critical
+      name: os_system
+      description: "Shell command execution via os.system"
+    - pattern: '\bpickle\.(loads?|dumps?)\s*\('
+      severity: high
+      name: pickle_usage
+      description: "Pickle deserialization — potential arbitrary code execution"
+    - pattern: '\b__import__\s*\('
+      severity: high
+      name: dunder_import
+      description: "Dynamic import — potential code injection"
+    - pattern: '\bimportlib\.import_module\s*\('
+      severity: medium
+      name: importlib_usage
+      description: "Dynamic module import via importlib"
+    - pattern: '\bos\.popen\s*\('
+      severity: critical
+      name: os_popen
+      description: "Shell command via os.popen"
+    - pattern: '\bcompile\s*\('
+      severity: medium
+      name: compile_usage
+      description: "Dynamic code compilation"
+
+  java:
+    - pattern: 'Runtime\.getRuntime\(\)\.exec\s*\('
+      severity: critical
+      name: runtime_exec
+      description: "Shell execution via Runtime.exec"
+    - pattern: 'ObjectInputStream'
+      severity: high
+      name: deserialization
+      description: "Java deserialization — potential RCE"
+    - pattern: '(InitialContext|lookup)\s*\(.*["\x27]ldap'
+      severity: critical
+      name: jndi_injection
+      description: "JNDI lookup — potential Log4Shell"
+    - pattern: 'ProcessBuilder\s*\('
+      severity: high
+      name: process_builder
+      description: "Process execution via ProcessBuilder"
+
+  go:
+    - pattern: 'os/exec'
+      severity: high
+      name: os_exec_import
+      description: "Process execution package import"
+    - pattern: 'exec\.Command\s*\('
+      severity: high
+      name: exec_command
+      description: "Shell command execution via exec.Command"
+    - pattern: '\bunsafe\.'
+      severity: medium
+      name: unsafe_usage
+      description: "Unsafe pointer operations"
+
+  rust:
+    - pattern: '\bunsafe\s*\{'
+      severity: medium
+      name: unsafe_block
+      description: "Unsafe code block — bypasses borrow checker"
+    - pattern: 'std::process::Command'
+      severity: high
+      name: process_command
+      description: "Shell command execution via std::process::Command"
+    - pattern: 'std::mem::transmute'
+      severity: high
+      name: mem_transmute
+      description: "Unsafe memory transmutation"
+
+  csharp:
+    - pattern: 'Process\.Start\s*\('
+      severity: high
+      name: process_start
+      description: "Process execution via Process.Start"
+    - pattern: 'Assembly\.Load'
+      severity: high
+      name: assembly_load
+      description: "Dynamic assembly loading — potential code injection"
+    - pattern: 'SqlCommand\s*\(.*\+'
+      severity: high
+      name: sql_concat
+      description: "SQL string concatenation — potential SQL injection"
+
+  typescript:
+    - pattern: 'child_process'
+      severity: high
+      name: child_process
+      description: "Child process module — command execution"
+    - pattern: 'Deno\.run\s*\('
+      severity: high
+      name: deno_run
+      description: "Deno process execution"
+    - pattern: '\beval\s*\('
+      severity: critical
+      name: eval_usage
+      description: "Dynamic code evaluation"
+    - pattern: 'process\.exit\s*\('
+      severity: medium
+      name: process_exit
+      description: "Process termination"
+    - pattern: 'Function\s*\('
+      severity: high
+      name: function_constructor
+      description: "Dynamic function creation via Function constructor"
+
+scan:
+  skip_dirs:
+    - node_modules
+    - .git
+    - __pycache__
+    - .tox
+    - .venv
+    - venv
+    - target
+    - build
+    - dist
+    - .tmp
+    - vendor
+
+  file_extensions:
+    python: [".py"]
+    java: [".java"]
+    go: [".go"]
+    rust: [".rs"]
+    csharp: [".cs"]
+    typescript: [".ts", ".tsx", ".js", ".jsx"]
+
+  max_file_size_kb: 500

args/code_quality_config.yaml

@@ -0,0 +1,47 @@
+# Code Quality Intelligence Configuration (Phase 52 — D331-D337)
+# CUI // SP-CTI
+
+smell_thresholds:
+  max_function_loc: 50
+  max_nesting: 4
+  max_complexity: 10
+  max_params: 5
+  max_methods_per_class: 10
+
+maintainability_weights:
+  complexity: 0.30
+  smell_density: 0.20
+  test_health: 0.20
+  coupling: 0.15
+  coverage: 0.15
+
+audit_thresholds:
+  max_avg_complexity: 10
+  max_avg_complexity_critical: 25
+  max_high_cc_pct: 5.0
+  max_smell_density_per_kloc: 10.0
+  max_smell_density_critical: 20.0
+
+innovation_engine:
+  min_complexity_for_signal: 10
+  min_pass_rate_threshold: 0.8
+  signal_source_type: code_quality_introspective
+
+scan:
+  exclude_dirs:
+    - venv
+    - .venv
+    - env
+    - node_modules
+    - .git
+    - __pycache__
+    - build
+    - dist
+    - .tox
+    - .eggs
+    - vendor
+    - target
+    - bin
+    - obj
+    - .tmp
+  max_file_size_bytes: 1048576

args/compliance_config.yaml

@@ -0,0 +1,17 @@
+# CUI // SP-CTI
+# Compliance Sidecar Configuration (ADR: D-ARCH-3)
+# Controls CUI marking enforcement, audit trail logging, and classification validation.
+#
+# Classification: CUI // SP-CTI
+
+sidecar:
+  default_classification: "CUI // SP-CTI"
+  enforce_marking: true
+  audit_all_calls: true
+  classification_hierarchy:
+    - UNCLASSIFIED
+    - CUI
+    - "CUI // SP-CTI"
+    - SECRET
+    - "TOP SECRET"
+    - "TS//SCI"