icdev 1.0.0__py3-none-any.whl

icdev/__init__.py

@@ -0,0 +1,18 @@
+"""ICDEV -- Intelligent Certified Development Platform.
+
+A system that builds systems. AI-powered meta-builder for generating
+complete, autonomous, ATO-ready applications with 42 compliance framework
+mappings, 15 coordinating AI agents, and the GOTCHA framework.
+
+GOTCHA layers:
+  G - Goals     (workflow definitions)
+  O - Orchestration (AI agent layer)
+  T - Tools     (deterministic Python scripts)
+  C - Context   (reference material)
+  H - Hardprompts (reusable LLM instruction templates)
+  A - Args      (YAML/JSON behavior settings)
+"""
+
+from icdev._version import __version__
+
+__all__ = ["__version__"]

icdev/_paths.py

@@ -0,0 +1,85 @@
+"""Centralized ICDEV path resolution.
+
+Resolves the project root and data directories (args, context, goals,
+hardprompts) whether ICDEV is run from a source checkout or installed
+via pip.
+
+Resolution order:
+  1. ICDEV_PROJECT_ROOT environment variable (if set)
+  2. Walk up from this file to find pyproject.toml (source checkout)
+  3. Fall back to icdev/data/ (pip install)
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+_ICDEV_PKG_DIR = Path(__file__).resolve().parent  # icdev/
+_ICDEV_DATA_DIR = _ICDEV_PKG_DIR / "data"
+
+
+def _find_project_root() -> Path | None:
+    """Walk up from icdev/ to find pyproject.toml (source checkout)."""
+    d = _ICDEV_PKG_DIR.parent
+    for _ in range(5):  # max 5 levels up
+        if (d / "pyproject.toml").exists():
+            return d
+        parent = d.parent
+        if parent == d:
+            break
+        d = parent
+    return None
+
+
+_SOURCE_ROOT = _find_project_root()
+
+
+def get_project_root() -> Path:
+    """Return the ICDEV project root directory.
+
+    For source checkout: returns the repo root (parent of icdev/).
+    For pip install: returns the icdev package directory.
+    """
+    env = os.environ.get("ICDEV_PROJECT_ROOT")
+    if env:
+        p = Path(env)
+        if p.is_dir():
+            return p
+
+    if _SOURCE_ROOT is not None:
+        return _SOURCE_ROOT
+
+    return _ICDEV_PKG_DIR
+
+
+def get_data_path(name: str) -> Path:
+    """Resolve a GOTCHA data directory (args, context, goals, hardprompts, etc.).
+
+    Args:
+        name: Directory name — one of 'args', 'context', 'goals',
+              'hardprompts', 'features', 'docs'.
+
+    Returns:
+        Path to the resolved data directory.
+    """
+    # 1. Env override
+    env = os.environ.get("ICDEV_PROJECT_ROOT")
+    if env:
+        p = Path(env) / name
+        if p.is_dir():
+            return p
+
+    # 2. Source checkout: data dir at project root
+    if _SOURCE_ROOT is not None:
+        source = _SOURCE_ROOT / name
+        if source.is_dir():
+            return source
+
+    # 3. Packaged: icdev/data/<name>/
+    pkg = _ICDEV_DATA_DIR / name
+    if pkg.is_dir():
+        return pkg
+
+    # 4. Fallback: relative to CWD
+    return Path(name)

icdev/_version.py

@@ -0,0 +1,3 @@
+"""ICDEV version — single source of truth."""
+
+__version__ = "1.0.0"

icdev/data/__init__.py

@@ -0,0 +1 @@
+"""ICDEV data -- GOTCHA layers (Goals, Context, Hardprompts, Args)."""

icdev/data/args/__init__.py

@@ -0,0 +1 @@
+# Package marker for PyPI distribution

icdev/data/args/agent_authority.yaml

@@ -0,0 +1,61 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Agent Authority Matrix — defines veto rights per agent per topic
+# Decision D42: Configurable without code changes, auditable
+#
+# This file is loaded by tools/agent/authority.py at runtime.
+# Changes take effect immediately on next load (no restart needed).
+
+authority:
+  security-agent:
+    veto_type: hard
+    topics:
+      - code_generation
+      - dependency_addition
+      - infrastructure_change
+      - secret_management
+      - container_configuration
+    description: "Security agent can hard-veto any code, dependency, or infra change that introduces vulnerabilities"
+
+  compliance-agent:
+    veto_type: hard
+    topics:
+      - artifact_generation
+      - deployment
+      - classification_marking
+      - ato_submission
+      - data_handling
+    description: "Compliance agent can hard-veto artifacts, deployments, and classification changes"
+
+  devsecops-agent:
+    veto_type: hard
+    topics:
+      - pipeline_configuration
+      - zero_trust_policy
+      - deployment_gate
+      - secret_rotation
+      - network_segmentation
+    description: "DevSecOps agent can hard-veto insecure pipeline configurations, ZTA policy violations, deployment without attestation, secret rotation failures, and network segmentation violations"
+
+  architect-agent:
+    veto_type: soft
+    topics:
+      - system_design
+      - schema_change
+      - api_design
+      - technology_selection
+      - architecture_pattern
+    description: "Architect agent can soft-veto design decisions (orchestrator can override)"
+
+# Veto behavior:
+# hard = blocks output immediately, requires human override via approval_workflow
+# soft = warns orchestrator, orchestrator can override with justification logged
+#
+# Adding new authority:
+# 1. Add a new agent entry with veto_type and topics
+# 2. The authority.py module will pick it up automatically
+# 3. No code changes required
+#
+# Topic naming convention:
+# - Use snake_case
+# - Be specific enough to avoid false positives
+# - Group related concerns under a single topic when they share review criteria

icdev/data/args/agent_config.yaml

@@ -0,0 +1,355 @@
+# ICDEV Agent Configuration
+# Defines all 10 A2A agents and their connection settings
+
+agents:
+  orchestrator:
+    id: "orchestrator-agent"
+    name: "ICDEV Orchestrator"
+    description: "Top-level router. Decomposes tasks, dispatches to specialists, aggregates results."
+    host: "0.0.0.0"
+    port: 8443
+    tls:
+      cert: "/etc/icdev/certs/orchestrator.crt"
+      key: "/etc/icdev/certs/orchestrator.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "opus"
+      effort: "high"
+      max_tokens: 16384
+    max_concurrent: 20
+    # Phase 61: Dispatcher-Only Orchestrator Mode (D-DISP-1)
+    # When enabled, restricts orchestrator to delegation-only � enforces GOTCHA
+    # principle that the Orchestration layer delegates, not executes.
+    dispatcher_mode:
+      enabled: false
+      dispatch_only_tools:
+        - task_dispatch
+        - agent_status
+        - agent_mailbox
+        - workflow_status
+        - prompt_chain_execute
+      blocked_when_dispatching:
+        - scaffold
+        - generate_code
+        - write_tests
+        - run_tests
+        - lint
+        - format
+        - ssp_generate
+        - poam_generate
+        - stig_check
+        - sbom_generate
+        - terraform_plan
+        - terraform_apply
+        - ansible_run
+        - k8s_deploy
+
+  architect:
+    id: "architect-agent"
+    name: "ICDEV Architect"
+    description: "System design, schema design, technology selection. Runs ATLAS A/T phases."
+    host: "0.0.0.0"
+    port: 8444
+    tls:
+      cert: "/etc/icdev/certs/architect.crt"
+      key: "/etc/icdev/certs/architect.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "opus"
+      effort: "max"
+      max_tokens: 32768
+    max_concurrent: 5
+
+  builder:
+    id: "builder-agent"
+    name: "ICDEV Builder"
+    description: "Code generation with TDD. Tests first (Cucumber/Gherkin), then implementation."
+    host: "0.0.0.0"
+    port: 8445
+    tls:
+      cert: "/etc/icdev/certs/builder.crt"
+      key: "/etc/icdev/certs/builder.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "opus"
+      effort: "max"
+      max_tokens: 32768
+    max_concurrent: 10
+
+  compliance:
+    id: "compliance-agent"
+    name: "ICDEV Compliance"
+    description: "ATO artifact generation: SSP, POAM, STIG, SBOM, CUI markings, NIST mapping."
+    host: "0.0.0.0"
+    port: 8446
+    tls:
+      cert: "/etc/icdev/certs/compliance.crt"
+      key: "/etc/icdev/certs/compliance.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "high"
+      max_tokens: 16384
+    max_concurrent: 5
+
+  security:
+    id: "security-agent"
+    name: "ICDEV Security"
+    description: "Vulnerability scanning, SAST/DAST, dependency auditing, secret detection."
+    host: "0.0.0.0"
+    port: 8447
+    tls:
+      cert: "/etc/icdev/certs/security.crt"
+      key: "/etc/icdev/certs/security.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "high"
+      max_tokens: 16384
+    max_concurrent: 5
+
+  infra:
+    id: "infra-agent"
+    name: "ICDEV Infrastructure"
+    description: "Terraform/Ansible generation, K8s manifests, Dockerfiles, pipeline config."
+    host: "0.0.0.0"
+    port: 8448
+    tls:
+      cert: "/etc/icdev/certs/infra.crt"
+      key: "/etc/icdev/certs/infra.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "medium"
+      max_tokens: 16384
+    max_concurrent: 5
+
+  knowledge:
+    id: "knowledge-agent"
+    name: "ICDEV Knowledge"
+    description: "Learning knowledge base. Pattern detection, recommendations, self-healing."
+    host: "0.0.0.0"
+    port: 8449
+    tls:
+      cert: "/etc/icdev/certs/knowledge.crt"
+      key: "/etc/icdev/certs/knowledge.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "medium"
+      max_tokens: 8192
+    max_concurrent: 10
+
+  monitor:
+    id: "monitor-agent"
+    name: "ICDEV Monitor"
+    description: "Production monitoring, log analysis, alert correlation, rollback decisions."
+    host: "0.0.0.0"
+    port: 8450
+    tls:
+      cert: "/etc/icdev/certs/monitor.crt"
+      key: "/etc/icdev/certs/monitor.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-3-5"
+      effort: "low"
+      max_tokens: 4096
+    max_concurrent: 10
+
+  mbse:
+    id: "mbse-agent"
+    name: "ICDEV MBSE"
+    description: "Model-Based Systems Engineering — SysML parsing, DOORS NG integration, digital thread, model-code sync, DES compliance."
+    host: "0.0.0.0"
+    port: 8451
+    tls:
+      cert: "/etc/icdev/certs/mbse.crt"
+      key: "/etc/icdev/certs/mbse.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "medium"
+      max_tokens: 16384
+    max_concurrent: 5
+    capabilities:
+      - xmi_parsing
+      - reqif_parsing
+      - digital_thread
+      - model_code_generation
+      - bidirectional_sync
+      - des_assessment
+
+  modernization:
+    id: "modernization-agent"
+    name: "ICDEV Modernization"
+    description: "Application modernization — legacy analysis, 7R assessment, migration planning, code generation, compliance bridge."
+    host: "0.0.0.0"
+    port: 8452
+    tls:
+      cert: "/etc/icdev/certs/modernization.crt"
+      key: "/etc/icdev/certs/modernization.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "opus"
+      effort: "high"
+      max_tokens: 32768
+    max_concurrent: 5
+    capabilities:
+      - legacy_analysis
+      - seven_r_assessment
+      - migration_planning
+      - code_generation
+      - compliance_bridge
+      - version_migration
+
+  requirements_analyst:
+    id: "requirements-analyst-agent"
+    name: "ICDEV Requirements Analyst"
+    description: "AI-driven conversational requirements intake, gap detection, SAFe decomposition, readiness scoring, document extraction, COA generation, boundary analysis."
+    host: "0.0.0.0"
+    port: 8453
+    tls:
+      cert: "/etc/icdev/certs/requirements-analyst.crt"
+      key: "/etc/icdev/certs/requirements-analyst.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "opus"
+      effort: "high"
+      max_tokens: 16384
+    max_concurrent: 10
+    capabilities:
+      - conversational_intake
+      - gap_detection
+      - safe_decomposition
+      - readiness_scoring
+      - document_extraction
+      - coa_generation
+      - boundary_analysis
+
+  supply_chain:
+    id: "supply-chain-agent"
+    name: "ICDEV Supply Chain"
+    description: "Supply chain intelligence — upstream/downstream impact propagation, SBOM aggregation, ISA lifecycle, CVE triage, NIST 800-161 SCRM."
+    host: "0.0.0.0"
+    port: 8454
+    tls:
+      cert: "/etc/icdev/certs/supply-chain.crt"
+      key: "/etc/icdev/certs/supply-chain.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "medium"
+      max_tokens: 8192
+    max_concurrent: 5
+    capabilities:
+      - dependency_graph
+      - sbom_aggregation
+      - isa_lifecycle
+      - cve_triage
+      - scrm_assessment
+      - impact_propagation
+
+  simulation:
+    id: "simulation-agent"
+    name: "ICDEV Simulation"
+    description: "Digital Program Twin — 6-dimension what-if simulation (architecture, compliance, supply chain, schedule, cost, risk), scenario management, Monte Carlo."
+    host: "0.0.0.0"
+    port: 8455
+    tls:
+      cert: "/etc/icdev/certs/simulation.crt"
+      key: "/etc/icdev/certs/simulation.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "medium"
+      max_tokens: 16384
+    max_concurrent: 5
+    capabilities:
+      - what_if_simulation
+      - monte_carlo_schedule
+      - compound_risk_analysis
+      - cost_modeling
+      - scenario_management
+      - inline_visualization
+
+  # ── Phase 28: Remote Command Gateway Agent ──
+
+  gateway:
+    id: "gateway-agent"
+    name: "ICDEV Remote Command Gateway"
+    description: "Receives commands from messaging channels (Telegram, Slack, Teams, Mattermost, internal chat), validates through 8-gate security chain, executes via ICDEV tools, returns classification-filtered responses."
+    host: "0.0.0.0"
+    port: 8458
+    tls:
+      cert: "/etc/icdev/certs/gateway.crt"
+      key: "/etc/icdev/certs/gateway.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "low"
+      max_tokens: 4096
+    max_concurrent: 20
+    capabilities:
+      - remote_command_reception
+      - security_chain_validation
+      - classification_filtering
+      - user_binding
+      - multi_channel_routing
+
+  # ── Phase 25: DevSecOps & Zero Trust Architecture Agent ──
+
+  devsecops:
+    id: "devsecops-agent"
+    name: "ICDEV DevSecOps & Zero Trust"
+    description: "DevSecOps pipeline security, Zero Trust Architecture (NIST SP 800-207), policy-as-code, secrets lifecycle, ZTA maturity scoring, service mesh configuration."
+    host: "0.0.0.0"
+    port: 8457
+    tls:
+      cert: "/etc/icdev/certs/devsecops.crt"
+      key: "/etc/icdev/certs/devsecops.key"
+      ca: "/etc/icdev/certs/ca.crt"
+    bedrock:
+      model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+      region: "us-gov-west-1"
+      model_preference: "sonnet-4-5"
+      effort: "high"
+      max_tokens: 16384
+    max_concurrent: 8
+    capabilities:
+      - devsecops_profile_management
+      - zta_maturity_assessment
+      - pipeline_security_generation
+      - policy_as_code_generation
+      - service_mesh_configuration
+      - attestation_management
+      - network_segmentation
+      - zta_posture_monitoring
+      - nist_800_207_assessment

icdev/data/args/agentic_fitness.yaml

@@ -0,0 +1,31 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Agentic Fitness Assessment Configuration
+# Decision D22: Weighted rule-based scoring with configurable thresholds
+
+scoring:
+  weights:
+    data_complexity: 0.10
+    decision_complexity: 0.25
+    user_interaction: 0.20
+    integration_density: 0.15
+    compliance_sensitivity: 0.15
+    scale_variability: 0.15
+
+thresholds:
+  agent_minimum: 6.0          # Overall score >= 6.0 -> recommend full agent architecture
+  nlq_minimum: 5.0            # user_interaction >= 5.0 -> recommend NLQ interface
+  traditional_maximum: 4.0    # Overall score < 4.0 -> recommend traditional REST/CRUD
+
+always_on:
+  self_healing: true
+  a2a_interop: true
+  aiops: true
+  gotcha_framework: true
+  ai_governance: true
+  user_feedback: true
+
+# LLM override settings (used when --llm-override flag is set)
+llm_override:
+  model_preference: sonnet-4-5
+  effort: medium
+  max_tokens: 4096

icdev/data/args/ai_governance_config.yaml

@@ -0,0 +1,137 @@
+# CUI // SP-CTI
+# AI Governance Configuration — Phase 50
+# Intake detection + chat integration for AI Transparency & Accountability tools
+#
+# Follows D26 (declarative YAML), D322 (keyword detection), D328 (single config)
+
+ai_governance:
+  # Auto-trigger conditions (D322)
+  auto_trigger:
+    ai_ml_mention: true           # Trigger on any AI/ML keyword
+    federal_agency: true          # All federal agencies per OMB M-25-21
+    impact_level_minimum: "IL2"   # All impact levels (OMB applies broadly)
+
+  # Intake detection keywords by governance pillar (D322)
+  intake_detection:
+    keywords_by_pillar:
+      ai_inventory:
+        - "ai system"
+        - "machine learning"
+        - "ml model"
+        - "deep learning"
+        - "neural network"
+        - "natural language processing"
+        - "nlp"
+        - "computer vision"
+        - "recommendation engine"
+        - "predictive model"
+        - "automated decision"
+        - "algorithmic"
+        - "chatbot"
+        - "virtual assistant"
+        - "generative ai"
+        - "large language model"
+        - "llm"
+        - "foundation model"
+      model_documentation:
+        - "model card"
+        - "model documentation"
+        - "training data"
+        - "model performance"
+        - "model accuracy"
+        - "model bias"
+        - "model validation"
+        - "model versioning"
+      human_oversight:
+        - "human oversight"
+        - "human in the loop"
+        - "human on the loop"
+        - "manual review"
+        - "human approval"
+        - "override capability"
+        - "escalation"
+        - "appeal process"
+      impact_assessment:
+        - "impact assessment"
+        - "rights impacting"
+        - "safety critical"
+        - "high risk ai"
+        - "algorithmic impact"
+        - "disparate impact"
+        - "bias assessment"
+        - "fairness"
+      transparency:
+        - "transparency"
+        - "explainability"
+        - "interpretability"
+        - "notice"
+        - "disclosure"
+        - "ai disclosure"
+      accountability:
+        - "accountability"
+        - "responsible ai"
+        - "caio"
+        - "chief ai officer"
+        - "ai governance"
+        - "ethics review"
+        - "incident response"
+
+    # Absence signals — indicate no AI governance exists
+    absence_signals:
+      - "no ai governance"
+      - "no model documentation"
+      - "no oversight process"
+      - "we don't track ai"
+
+  # Chat governance thresholds (D327)
+  chat_governance:
+    advisory_cooldown_turns: 5    # Don't repeat same advisory within N turns
+    check_frequency: "every_assistant_response"
+    ai_keywords:
+      - "ai system"
+      - "machine learning"
+      - "ml model"
+      - "deep learning"
+      - "neural network"
+      - "nlp"
+      - "computer vision"
+      - "recommendation"
+      - "predictive model"
+      - "automated decision"
+      - "algorithmic"
+      - "chatbot"
+      - "generative ai"
+      - "llm"
+      - "foundation model"
+      - "model training"
+      - "model card"
+      - "model performance"
+      - "ai governance"
+      - "responsible ai"
+    advisory_priority_order:
+      - "oversight_plan_missing"
+      - "impact_assessment_missing"
+      - "model_card_missing"
+      - "caio_not_designated"
+      - "fairness_not_assessed"
+      - "reassessment_overdue"
+
+  # Readiness dimension config (D323)
+  readiness:
+    weight: 0.10
+    scoring:
+      inventory_registered: 0.20
+      model_cards_present: 0.15
+      oversight_plan_exists: 0.20
+      impact_assessment_done: 0.20
+      caio_designated: 0.10
+      transparency_frameworks_selected: 0.15
+
+  # Probe questions for missing pillars
+  probe_questions:
+    ai_inventory: "Does this system use AI/ML models? If so, what types (classification, NLP, recommendation, generation)?"
+    model_documentation: "Are there existing model cards or documentation for the AI models used?"
+    human_oversight: "What human oversight is in place for AI decisions? Is there an appeal process?"
+    impact_assessment: "Has an algorithmic impact assessment been conducted? Does the AI make rights-impacting decisions?"
+    transparency: "Are users notified when AI is making or supporting decisions?"
+    accountability: "Is there a designated Chief AI Officer (CAIO) or responsible official?"