icdev 1.0.0__py3-none-any.whl

icdev/data/goals/maintenance_audit.md

@@ -0,0 +1,196 @@
+# Goal: Maintenance Audit Workflow
+
+## Description
+Continuously assess and remediate project dependencies to maintain security, compliance, and governance posture. This workflow detects outdated dependencies, checks for known vulnerabilities, enforces remediation SLAs, and auto-implements fixes.
+
+**Standards:**
+- NIST 800-53 SI-2 (Flaw Remediation)
+- NIST 800-53 SA-22 (Unsupported System Components)
+- NIST 800-53 CM-3 (Configuration Change Control)
+- CISA SbD Commitment 4 (Security Patches)
+
+**Why this matters:** Outdated dependencies are the #1 attack vector. This workflow ensures continuous compliance and reduces exposure window through automated detection and remediation with SLA enforcement.
+
+---
+
+## Prerequisites
+- [ ] Project initialized (`goals/init_project.md` completed)
+- [ ] Project has dependency files (requirements.txt, package.json, pom.xml, go.mod, Cargo.toml, *.csproj)
+- [ ] SBOM generated (`goals/compliance_workflow.md`)
+- [ ] Security scans completed (`goals/security_scan.md`)
+
+---
+
+## Process
+
+### Step 1: Scan Dependencies
+**Tool:** `python tools/maintenance/dependency_scanner.py --project-id <id>`
+
+Inventories all dependencies across detected languages. Checks package registries for latest versions. Calculates staleness (days behind latest).
+
+**Outputs:**
+- Dependency inventory stored in `project_dependencies` table
+- Per-language summary (total deps, outdated count, avg staleness)
+- Staleness flags: current (0d), minor (1-30d), moderate (31-90d), major (91-180d), critical (>180d)
+
+**Air-gapped mode:** Use `--offline` flag. Dependencies inventoried from manifest files but latest versions unknown. Staleness set to -1 (unknown).
+
+### Step 2: Check Vulnerabilities
+**Tool:** `python tools/maintenance/vulnerability_checker.py --project-id <id>`
+
+Runs language-native audit tools (pip-audit, npm audit, cargo-audit, etc.). Maps findings to SLA deadlines. Stores in `dependency_vulnerabilities` table.
+
+**SLA Mapping:**
+| Severity | Deadline | Auto-remediate |
+|----------|----------|---------------|
+| Critical | 48 hours | No (manual approval) |
+| High | 7 days | No (manual approval) |
+| Medium | 30 days | Yes |
+| Low | 90 days | Yes |
+
+**Outputs:**
+- Vulnerability records with CVE IDs, CVSS scores, affected versions
+- SLA deadline assignments based on severity
+- Fix availability status (fix_available, no_fix, workaround)
+
+### Step 3: Run Maintenance Audit
+**Tool:** `python tools/maintenance/maintenance_auditor.py --project-id <id>`
+
+Orchestrates full audit: scoring, SLA compliance, trend analysis, CUI-marked report generation.
+
+**Scoring Formula:**
+```
+Start at 100 points
+- Each overdue critical SLA: -20 points
+- Each overdue high SLA: -10 points
+- Each overdue medium SLA: -5 points
+- Each overdue low SLA: -2 points
+- Each critical staleness dep (>180d): -3 points
+- Each major staleness dep (91-180d): -1 point
+Floor at 0, cap at 100
+```
+
+**Gate Evaluation:**
+- Score >= 80: PASS (healthy)
+- Score 50-79: WARN (at_risk, non-blocking)
+- Score < 50: FAIL (critical, blocks deployment)
+
+**Outputs:**
+- Maintenance score (0-100)
+- SLA compliance percentage
+- Trend analysis (vs. previous audit)
+- CUI-marked markdown report at `reports/<project>/maintenance_audit_YYYY-MM-DD.md`
+
+### Step 4: Remediate
+**Tool:** `python tools/maintenance/remediation_engine.py --project-id <id> --auto`
+
+Auto-updates dependency files, creates remediation branches, runs tests, tracks actions.
+
+**Auto-remediation rules:**
+- Medium and low severity: auto-fixed (bump to patched version)
+- Critical and high severity: generate fix plan, require manual approval
+- Dry-run mode: preview all changes without applying
+
+**Process:**
+1. Identify eligible vulnerabilities (medium/low with fix_available)
+2. Generate updated dependency file (requirements.txt, package.json, etc.)
+3. Create git branch `remediate/<project-id>/<date>`
+4. Run test suite to verify no breakage
+5. If tests pass: commit changes, record action
+6. If tests fail: rollback, flag for manual review
+
+**Outputs:**
+- Remediation action records (what changed, test results, branch name)
+- Updated dependency files (if not dry-run)
+- Rollback log for any failed remediations
+
+### Step 5: Verify
+Re-run security scan and test suite to confirm fixes don't break anything.
+
+**Tool:** `python tools/security/dependency_auditor.py --project-dir <path>`
+
+Verify:
+- [ ] No new vulnerabilities introduced
+- [ ] All tests still pass
+- [ ] SBOM updated to reflect new versions
+
+### Step 6: Log to Audit Trail
+**Tool:** `python tools/audit/audit_logger.py --event-type "maintenance.audit" --actor "maintenance-agent" --action "Maintenance audit complete" --project-id <id>`
+
+Record:
+- Audit timestamp and score
+- Vulnerabilities found and remediated
+- SLA compliance status
+- Gate evaluation result
+
+---
+
+## Success Criteria
+- [ ] All dependencies inventoried across all detected languages
+- [ ] Vulnerability check completed against advisory databases
+- [ ] Maintenance score computed (target: >= 70)
+- [ ] SLA deadlines set for all open vulnerabilities
+- [ ] No overdue critical or high SLAs
+- [ ] Remediation actions tracked for all fixes
+- [ ] CUI-marked audit report generated
+- [ ] Audit trail entries logged
+
+---
+
+## Schedule
+- **On every build:** Quick dependency scan (cached versions)
+- **Weekly:** Full maintenance audit with registry checks
+- **On new CVE disclosure:** Immediate vulnerability check
+- **Before deployment:** Gate evaluation (blocking if score < 50)
+
+---
+
+## SLA Thresholds
+| Severity | Deadline | Auto-remediate | Escalation |
+|----------|----------|---------------|------------|
+| Critical | 48 hours | No (manual) | Immediate notification to security team |
+| High | 7 days | No (manual) | Daily reminder after day 3 |
+| Medium | 30 days | Yes | Weekly summary |
+| Low | 90 days | Yes | Monthly summary |
+
+---
+
+## Edge Cases & Notes
+1. **Air-gapped environments:** Use --offline flag. Dependencies inventoried but latest versions unknown. Staleness set to -1. Vulnerability checks use local advisory database snapshot.
+2. **Transitive dependencies:** SBOM includes transitives but scanner focuses on direct deps. Transitive vuln fixes require updating the direct dep that pulls them in.
+3. **Version pinning:** Some projects intentionally pin old versions. Use `risk_accept` status in `dependency_vulnerabilities` to document accepted risk with justification.
+4. **Multi-language projects:** Scanner detects all languages automatically. Each gets its own audit tool chain (pip-audit for Python, npm audit for Node.js, cargo-audit for Rust, etc.).
+5. **Feeds SbD:** Maintenance audit results feed SbD-05 (patch cadence) and SbD-22 (vulnerability scanning) assessments.
+6. **Remediation conflicts:** If two vulnerabilities require conflicting version bumps, flag for manual resolution and document in POAM.
+7. **EOL dependencies:** Dependencies with no maintainer activity >1 year flagged as unsupported per NIST SA-22. Recommend replacement.
+
+---
+
+## GOTCHA Layer Mapping
+| Step | GOTCHA Layer | Component |
+|------|-------------|-----------|
+| Dependency scan | Tools | dependency_scanner.py |
+| Vulnerability check | Tools | vulnerability_checker.py |
+| Maintenance audit | Tools | maintenance_auditor.py |
+| Remediation | Tools | remediation_engine.py |
+| Sequence decisions | Orchestration | AI (you) |
+| SLA thresholds | Args | maintenance_config.yaml |
+| Gate thresholds | Args | security_gates.yaml |
+| Assessment template | Hard Prompts | maintenance_assessment.md |
+| NIST standards | Context | NIST 800-53 SI-2, SA-22, CM-3 |
+
+---
+
+## Related Files
+- **Tools:** `tools/maintenance/dependency_scanner.py`, `tools/maintenance/vulnerability_checker.py`, `tools/maintenance/maintenance_auditor.py`, `tools/maintenance/remediation_engine.py`
+- **MCP Server:** `tools/mcp/maintenance_server.py`
+- **Skill:** `.claude/skills/icdev-maintain/SKILL.md`
+- **Hard Prompt:** `hardprompts/maintenance/maintenance_assessment.md`
+- **Args:** `args/maintenance_config.yaml`, `args/security_gates.yaml`
+- **Feeds from:** `goals/security_scan.md` (SAST/dep findings), `goals/compliance_workflow.md` (SBOM)
+- **Feeds into:** `goals/sbd_ivv_workflow.md` (SbD-05, SbD-22), `goals/deploy_workflow.md` (deployment gate)
+
+---
+
+## Changelog
+- 2026-02-15: Initial creation (Phase 16H)

icdev/data/goals/manifest.md

@@ -0,0 +1,56 @@
+# Goals Manifest
+
+> Index of all goal workflows. Check here before starting any task.
+
+| Goal | File | Description |
+|------|------|-------------|
+| ATLAS Workflow | goals/build_app.md | 5-step process for building full-stack apps: Architect, Trace, Link, Assemble, Stress-test |
+| Project Init | goals/init_project.md | Initialize new ICDEV project with full compliance scaffolding |
+| TDD Workflow | goals/tdd_workflow.md | True TDD: Gherkin feature first, step definitions, then implementation |
+| Compliance Workflow | goals/compliance_workflow.md | Generate all ATO + CSSP artifacts (SSP, POAM, STIG, SBOM, CUI, CSSP assessment, IR plan, SIEM, evidence, Xacta sync) |
+| Security Scanning | goals/security_scan.md | Run comprehensive security scanning pipeline |
+| Deployment Workflow | goals/deploy_workflow.md | Terraform + Ansible + K8s deployment with CI/CD and rollback |
+| Code Review | goals/code_review.md | Enforced review gates with security and compliance checks |
+| Self-Healing | goals/self_healing.md | Pattern detection, auto-correction, knowledge recording |
+| Monitoring | goals/monitoring.md | Production observability, alerting, and log analysis |
+| Dashboard | goals/dashboard.md | Web dashboard for business users |
+| Agent Management | goals/agent_management.md | A2A agent lifecycle, task routing, and discovery |
+| Integration Testing | goals/integration_testing.md | Multi-layer testing: unit, BDD, E2E (Playwright), security/compliance gates |
+| CI/CD Integration | goals/cicd_integration.md | GitHub + GitLab dual-platform webhooks, polling, and workflow automation |
+| SbD & IV&V Workflow | goals/sbd_ivv_workflow.md | Secure by Design assessment + IV&V certification (CISA, IEEE 1012, DoDI 5000.87) |
+| Maintenance Audit | goals/maintenance_audit.md | Dependency scanning, vulnerability checking, SLA enforcement, auto-remediation |
+| ATO Acceleration | goals/ato_acceleration.md | Multi-framework ATO pursuit: FedRAMP + CMMC + OSCAL + eMASS + cATO monitoring |
+| MBSE Integration | goals/mbse_integration.md | Model-Based Systems Engineering: SysML import, DOORS NG, digital thread, model-code sync, DES compliance, M-ATLAS workflow |
+| App Modernization | goals/modernization_workflow.md | Legacy app modernization: 7Rs assessment, version/framework migration, monolith decomposition, strangler fig, ATO compliance bridge |
+| Requirements Intake | goals/requirements_intake.md | AI-driven conversational requirements intake, gap detection, SAFe decomposition, readiness scoring, document extraction (RICOAS Phase 1) |
+| Boundary & Supply Chain | goals/boundary_supply_chain.md | ATO boundary impact (4-tier), supply chain dependency graph, ISA lifecycle, SCRM, CVE triage (RICOAS Phase 2) |
+| Simulation Engine | goals/simulation_engine.md | Digital Program Twin — 6-dimension what-if simulation, Monte Carlo, COA generation & comparison (RICOAS Phase 3) |
+| External Integration | goals/external_integration.md | Bidirectional Jira/ServiceNow/GitLab sync, DOORS NG ReqIF export, approval workflows, RTM traceability (RICOAS Phase 4) |
+| Observability | goals/observability.md | Hook-based agent monitoring: tool usage tracking, HMAC-signed events, agent execution framework, SIEM forwarding (Phase 39) |
+| NLQ Compliance | goals/nlq_compliance.md | Natural language compliance queries via Bedrock, read-only SQL enforcement, SSE dashboard events (Phase 40) |
+| Parallel CI/CD | goals/parallel_cicd.md | Git worktree task isolation, GitLab {{icdev: workflow}} tag routing, parallel workflow execution (Phase 41) |
+| Framework Planning | goals/framework_planning.md | Language-specific build commands (Python/Java/Go/Rust/C#/TypeScript), 12 Leverage Points framework (Phase 42) |
+| Multi-Agent Orchestration | goals/multi_agent_orchestration.md | Opus 4.6 multi-agent: DAG workflow, parallel execution, collaboration patterns, domain authority vetoes, agent memory |
+| Security Categorization | goals/security_categorization.md | FIPS 199/200 categorization with SP 800-60 types, high watermark, CNSSI 1253, dynamic baseline |
+| Agentic Generation | `goals/agentic_generation.md` | Generate mini-ICDEV clone apps with GOTCHA/ATLAS |
+| SaaS Multi-Tenancy | goals/saas_multi_tenancy.md | Multi-tenant SaaS: API gateway (REST+MCP SSE), per-tenant DB, 3 auth methods, subscription tiers, artifact delivery, tenant portal, Helm on-prem **(parent-only)** |
+| Marketplace | goals/marketplace.md | Federated GOTCHA asset marketplace: publish, install, search, review, sync skills/goals/hardprompts/context/args/compliance across tenant orgs with 7-gate security pipeline (Phase 22) **(parent-only)** |
+| Universal Compliance | goals/universal_compliance.md | Universal Compliance Platform: 10 data categories, dual-hub crosswalk (NIST+ISO), 6 Wave 1 frameworks, auto-detection, multi-regime assessment (Phase 23) |
+| DevSecOps Workflow | goals/devsecops_workflow.md | DevSecOps profile management, maturity assessment, pipeline security generation, policy-as-code (Kyverno/OPA), image signing & attestation (Phase 24) |
+| Zero Trust Architecture | goals/zero_trust_architecture.md | ZTA 7-pillar maturity scoring, NIST SP 800-207 compliance, service mesh generation (Istio/Linkerd), network segmentation, PDP/PEP config, cATO posture monitoring (Phase 25) |
+| MOSA Workflow | goals/mosa_workflow.md | DoD MOSA (10 U.S.C. §4401): MOSA assessment, modularity analysis, ICD/TSP generation, code enforcement, intake auto-detection, cATO evidence (Phase 26) |
+| CLI Capabilities | goals/cli_capabilities.md | Optional Claude CLI features: CI/CD automation, parallel agents, container execution, scripted intake — 4 independent toggles with tenant ceiling and cost controls (Phase 27) |
+| Remote Command Gateway | goals/remote_command_gateway.md | Remote Command Gateway: messaging channel integration, 8-gate security chain, IL-aware response filtering, user binding, air-gapped/connected mode (Phase 28) **(parent-only)** |
+| Cross-Language Translation | goals/cross_language_translation.md | LLM-assisted cross-language code translation: 5-phase hybrid pipeline (Extract→Type-Check→Translate→Assemble→Validate+Repair), 30 directional pairs, pass@k candidates, mock-and-continue, compliance bridge, Dashboard+Portal visibility (Phase 43, D242-D256) **(parent-only)** |
+| OWASP Agentic Security | goals/owasp_agentic_security.md | OWASP Agentic AI security: 8-gap implementation — behavioral drift detection, tool chain validation, output content safety, formal threat model, dynamic trust scoring, MCP per-tool RBAC, behavioral red teaming, compliance assessor (Phase 45, D257-D264) |
+| Agentic Threat Model | goals/agentic_threat_model.md | Formal STRIDE + OWASP T1-T17 agentic threat model with trust boundaries, MCP server threat surface, residual risk analysis (Phase 45, D263) |
+| Observability & XAI | goals/observability_traceability_xai.md | Distributed tracing (OTel+SQLite), W3C PROV-AGENT provenance, AgentSHAP tool attribution, XAI compliance assessor (10 checks), dashboard pages (/traces, /provenance, /xai), MCP server (Phase 46, D280-D290) |
+| AI Transparency | goals/ai_transparency.md | AI Transparency: OMB M-25-21/M-26-04, NIST AI 600-1, GAO-21-519SP — model cards, system cards, AI inventory, confabulation detection, fairness assessment, cross-framework audit (Phase 48, D307-D315) |
+| AI Accountability | goals/ai_accountability.md | AI Accountability: oversight plans, CAIO designation, appeals, incident response, ethics reviews, reassessment scheduling, cross-framework audit, assessor fixes (Phase 49, D316-D321) |
+| AI Governance Intake | goals/ai_governance_intake.md | AI governance integration: RICOAS intake detection (6 pillars), 7th readiness dimension, chat extension advisory, governance sidebar, auto-trigger for federal agencies (Phase 50, D322-D330) |
+| Code Intelligence | goals/code_intelligence.md | Code quality self-analysis: AST metrics (cyclomatic/cognitive complexity, nesting, params), 5 smell detectors, maintainability scoring, runtime feedback (test-to-source), production audit (5 CODE checks), Innovation Engine integration, pattern-based TDD learning (Phase 52, D331-D337) |
+| Creative Engine | goals/creative_engine.md | Customer-centric feature opportunity discovery: auto-discover competitors, scan review sites/forums/GitHub, extract pain points, 3-dimension scoring, trend detection, template-based spec generation, Innovation Engine bridge (Phase 58, D351-D360) **(parent-only)** |
+| GovCon Intelligence | goals/govcon_intelligence.md | GovCon capture-to-delivery flywheel: SAM.gov scanning, requirement mining, ICDEV capability mapping, gap analysis, two-tier LLM response drafting, compliance auto-population, competitive intelligence, proposal lifecycle integration (Phase 59, D361-D374) **(parent-only)** |
+| GovCon Product Descriptions | goals/govcon_product_descriptions.md | Product-level proposal content: ICDEV platform and Contract Management Portal (CPMP) as whole products in proposals, product detection logic, knowledge base seeding, Management Volume guidance **(parent-only)** |
+| CPMP Workflow | goals/cpmp_workflow.md | Contract Performance Management Portal: post-award lifecycle management — EVM (ANSI/EIA-748), CPARS prediction (NDAA), subcontractor FAR 52.219-9, CDRL auto-generation, COR portal, SAM.gov awards, portfolio health scoring (Phase 60, D-CPMP-1 through D-CPMP-10) **(parent-only)** |
+| Orchestration Improvements | goals/multi_agent_orchestration.md | Phase 61: Dispatcher-only orchestrator mode (D-DISP-1), declarative prompt chains (D-PC-1/2/3), ATLAS adversarial critique phase, session purpose declaration (D-ORCH-5), async result injection (D-ORCH-7), tiered file access (D-ORCH-8), real-time orchestration dashboard |