icdev 1.0.0__py3-none-any.whl

icdev/data/args/atlas_critique_config.yaml

@@ -0,0 +1,66 @@
+# CUI // SP-CTI
+# ATLAS Critique Phase Configuration (Phase 61 — Feature 3)
+#
+# Adversarial plan critique between Assemble and Stress-test.
+# Multiple domain agents independently review the plan, then
+# the architect revises.  Creates adversarial review pressure
+# to catch issues before stress-testing.
+
+atlas_critique:
+  enabled: true
+  max_rounds: 3
+
+  critics:
+    - agent: security-agent
+      role: security_reviewer
+      focus:
+        - security_vulnerability
+        - data_handling_issue
+        - deployment_risk
+      prompt_context: |
+        You are reviewing an implementation plan as a security expert.
+        Focus on: attack surface, input validation, authentication/authorization,
+        encryption, secrets handling, OWASP Top 10, and STIG compliance.
+
+    - agent: compliance-agent
+      role: compliance_reviewer
+      focus:
+        - compliance_gap
+        - data_handling_issue
+      prompt_context: |
+        You are reviewing an implementation plan as a compliance expert.
+        Focus on: NIST 800-53 control coverage, FedRAMP requirements,
+        CUI marking requirements, audit trail completeness, and ATO impact.
+
+    - agent: knowledge-agent
+      role: patterns_reviewer
+      focus:
+        - architecture_flaw
+        - performance_risk
+        - maintainability_concern
+        - testing_gap
+      prompt_context: |
+        You are reviewing an implementation plan as a patterns/quality expert.
+        Focus on: design patterns, code maintainability, test coverage,
+        performance bottlenecks, and lessons from past failures.
+
+  consensus_rules:
+    go:
+      max_critical: 0
+      max_high: 0
+    conditional:
+      max_critical: 0
+      # any number of high allowed — must be addressed in revision
+    nogo:
+      # any critical finding triggers nogo
+
+  revision_prompt: |
+    The following findings were identified during adversarial critique.
+    Revise the plan to address ALL critical and high findings.
+    For each finding, explain how the revision addresses it.
+
+    Findings:
+    {findings}
+
+    Original plan:
+    {original_plan}

icdev/data/args/bedrock_models.yaml

@@ -0,0 +1,63 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Bedrock Model Configuration for ICDEV Agent Orchestration
+# Defines model IDs, capabilities, pricing, and fallback chain
+
+models:
+  opus:
+    model_id: "anthropic.claude-opus-4-6-20260205-v1:0"
+    display_name: "Claude Opus 4.6"
+    max_tokens: 128000
+    context_window: 200000
+    supports_thinking: true
+    supports_effort: true
+    supports_tool_use: true
+    supports_structured_output: true
+    supports_streaming: true
+    cost_per_1k_input: 0.005
+    cost_per_1k_output: 0.025
+
+  sonnet-4-5:
+    model_id: "anthropic.claude-sonnet-4-5-20250929-v1:0"
+    display_name: "Claude Sonnet 4.5"
+    max_tokens: 64000
+    context_window: 200000
+    supports_thinking: true
+    supports_effort: true
+    supports_tool_use: true
+    supports_structured_output: true
+    supports_streaming: true
+    cost_per_1k_input: 0.003
+    cost_per_1k_output: 0.015
+
+  sonnet-3-5:
+    model_id: "anthropic.claude-3-5-sonnet-20241022-v2:0"
+    display_name: "Claude Sonnet 3.5"
+    max_tokens: 8192
+    context_window: 200000
+    supports_thinking: false
+    supports_effort: false
+    supports_tool_use: true
+    supports_structured_output: false
+    supports_streaming: true
+    cost_per_1k_input: 0.003
+    cost_per_1k_output: 0.015
+
+fallback_chain: ["opus", "sonnet-4-5", "sonnet-3-5"]
+probe_interval_seconds: 1800
+region: "us-gov-west-1"
+
+# Effort mapping per agent role (used when no explicit effort specified)
+agent_effort_defaults:
+  orchestrator-agent: "high"
+  architect-agent: "max"
+  builder-agent: "max"
+  compliance-agent: "high"
+  security-agent: "high"
+  infra-agent: "medium"
+  knowledge-agent: "medium"
+  monitor-agent: "low"
+  mbse-agent: "medium"
+  modernization-agent: "high"
+  requirements-analyst-agent: "high"
+  supply-chain-agent: "medium"
+  simulation-agent: "medium"

icdev/data/args/cicd_config.yaml

@@ -0,0 +1,82 @@
+# [TEMPLATE: CUI // SP-CTI]
+# ICDEV CI/CD Configuration — channels, routing, recovery, conversation
+# Architecture Decisions: D132 (envelope), D133 (lane-aware), D136 (connectors), D137 (threads)
+
+cicd:
+  # ── Air-Gap Detection ─────────────────────────────────────────────────
+  connectivity:
+    force_polling: false          # Set true for known air-gapped environments (D44)
+    probe_timeout_seconds: 3
+    probe_targets:
+      github: "github.com:443"
+      gitlab_default: "gitlab.com:443"
+
+  # ── Event Routing ─────────────────────────────────────────────────────
+  routing:
+    default_workflow: "icdev_plan"   # When no command detected in new issue
+    session_timeout_minutes: 120     # Lane timeout before session is released
+    max_queued_events_per_session: 20
+
+  # ── Channel Configuration (enable/disable toggles) ───────────────────
+  channels:
+    github:
+      enabled: true
+      webhook_path: "/gh-webhook"
+
+    gitlab:
+      enabled: true
+      webhook_path: "/gl-webhook"
+
+    slack:
+      enabled: false                # Toggle on when Slack bot is configured
+      webhook_path: "/slack/events"
+      bot_token_ref: "aws:secretsmanager:icdev/slack-bot-token"
+      signing_secret_ref: "aws:secretsmanager:icdev/slack-signing-secret"
+      default_channel: ""           # Channel ID for notifications
+      thread_mode: "always"         # D137: always use threads
+
+    mattermost:
+      enabled: false                # Toggle on when Mattermost bot is configured
+      webhook_path: "/mattermost/events"
+      bot_token_ref: "aws:secretsmanager:icdev/mattermost-bot-token"
+      webhook_secret_ref: "aws:secretsmanager:icdev/mattermost-webhook-secret"
+      server_url: ""                # https://mattermost.example.mil
+      default_channel: ""
+      thread_mode: "always"         # D137: always use threads
+
+  # ── Agent Executor ────────────────────────────────────────────────────
+  executor:
+    default_timeout_seconds: 300
+    max_timeout_seconds: 1200
+    timeout_overrides:
+      /icdev-build: 600
+      /implement: 900
+      /icdev-review: 600
+      /feature: 600
+      /bug: 600
+
+  # ── Self-Recovery (Phase 4) ───────────────────────────────────────────
+  recovery:
+    enabled: true
+    max_attempts: 3
+    audit_every_attempt: true
+    retest_scope: "failed_only"     # "failed_only" or "full_suite"
+    fix_model: "opus"               # Use strongest model for fix generation
+
+  # ── Conversation (Phase 3) ────────────────────────────────────────────
+  conversation:
+    enabled: true
+    max_turns_per_session: 50
+    idle_timeout_minutes: 60
+    auto_approve_after_tests_pass: false
+    signal_keywords:
+      fix_this: "fix_code"
+      fix this: "fix_code"
+      change_approach: "revise_plan"
+      change approach: "revise_plan"
+      retry: "retry_last"
+      approve: "approve"
+      reject: "reject"
+      lgtm: "approve"
+      explain: "explain"
+      skip: "skip_phase"

icdev/data/args/classification_config.yaml

@@ -0,0 +1,232 @@
+# Universal Data Classification Configuration
+# Extends CUI/SECRET markings to support multi-regime data categories
+# ADR D109: Composable, additive markings — a single artifact can carry multiple categories
+
+# ----------------------------------------------------------------
+# Data categories and their marking templates
+# ----------------------------------------------------------------
+data_categories:
+  CUI:
+    full_name: "Controlled Unclassified Information"
+    governing_framework: "NIST 800-171"
+    marking_prefix: "CUI"
+    banner_template: "CUI // SP-{subcategory}"
+    portion_marking: "(CUI)"
+    distribution: "Distribution D -- Authorized DoD Personnel Only"
+    controlled_by: "Department of Defense"
+    decontrol: "10 years from creation date"
+    color: "#FFD700"  # Gold for UI display
+
+  SECRET:
+    full_name: "Classified National Security Information"
+    governing_framework: "CNSSI 1253"
+    marking_prefix: "SECRET"
+    banner_template: "SECRET // {dissemination}"
+    portion_marking: "(S)"
+    distribution: "Authorized SECRET-cleared personnel only"
+    controlled_by: "Department of Defense"
+    color: "#FF0000"  # Red
+
+  TOP_SECRET:
+    full_name: "Top Secret / Sensitive Compartmented Information"
+    governing_framework: "CNSSI 1253"
+    marking_prefix: "TOP SECRET"
+    banner_template: "TOP SECRET // {dissemination}"
+    portion_marking: "(TS)"
+    distribution: "Authorized TS/SCI-cleared personnel only"
+    controlled_by: "Department of Defense"
+    color: "#8B0000"  # Dark red
+
+  PHI:
+    full_name: "Protected Health Information"
+    governing_framework: "HIPAA"
+    marking_prefix: "PHI"
+    banner_template: "PHI // HIPAA Security Rule"
+    portion_marking: "(PHI)"
+    distribution: "Authorized healthcare personnel and covered entities only"
+    controlled_by: "HIPAA Covered Entity / Business Associate"
+    decontrol: "Per HIPAA retention policy (minimum 6 years)"
+    color: "#2196F3"  # Blue
+    handling_requirements:
+      - "Encrypt at rest and in transit (HIPAA §164.312)"
+      - "Minimum necessary standard applies (§164.502(b))"
+      - "Business Associate Agreement required for third parties"
+      - "Breach notification within 60 days (§164.404)"
+
+  PCI:
+    full_name: "Payment Card Industry Data"
+    governing_framework: "PCI DSS v4.0"
+    marking_prefix: "PCI"
+    banner_template: "PCI // DSS v4.0"
+    portion_marking: "(PCI)"
+    distribution: "Authorized personnel with need-to-know for cardholder data"
+    controlled_by: "PCI SSC / Acquiring Bank"
+    decontrol: "Per data retention policy; purge when no longer needed"
+    color: "#4CAF50"  # Green
+    handling_requirements:
+      - "Never store full track data, CVV2, or PIN (Req 3.3/3.4)"
+      - "Encrypt cardholder data at rest with strong cryptography (Req 3.5)"
+      - "Encrypt in transit over open/public networks (Req 4.1)"
+      - "Mask PAN when displayed (show max first 6 / last 4) (Req 3.4)"
+      - "Restrict access on need-to-know basis (Req 7.1)"
+
+  CJIS:
+    full_name: "Criminal Justice Information"
+    governing_framework: "FBI CJIS Security Policy v5.9.4"
+    marking_prefix: "CJIS"
+    banner_template: "CJIS // FBI CJIS Security Policy"
+    portion_marking: "(CJIS)"
+    distribution: "Authorized criminal justice personnel and contractors with CJIS clearance"
+    controlled_by: "FBI CJIS Division / State CSO"
+    decontrol: "Per agency records retention schedule"
+    color: "#9C27B0"  # Purple
+    handling_requirements:
+      - "Advanced authentication required (§5.6.2.2)"
+      - "FIPS 140-2 certified encryption at rest and in transit (§5.10.1.2)"
+      - "Personnel must pass fingerprint-based background check (§5.12)"
+      - "Media must be physically protected and sanitized per policy (§5.8)"
+
+  PII:
+    full_name: "Personally Identifiable Information"
+    governing_framework: "NIST 800-122"
+    marking_prefix: "PII"
+    banner_template: "PII // NIST SP 800-122"
+    portion_marking: "(PII)"
+    distribution: "Authorized personnel with legitimate need-to-know"
+    controlled_by: "Data Owner / Privacy Officer"
+    decontrol: "Per organizational records retention policy"
+    color: "#FF9800"  # Orange
+    handling_requirements:
+      - "Apply confidentiality impact level per FIPS 199 (§4.2)"
+      - "Encrypt at rest and in transit"
+      - "Minimize collection and retention (§4.1)"
+      - "Breach notification per applicable law"
+
+  FTI:
+    full_name: "Federal Tax Information"
+    governing_framework: "IRS Publication 1075"
+    marking_prefix: "FTI"
+    banner_template: "FTI // IRS Pub 1075"
+    portion_marking: "(FTI)"
+    distribution: "Authorized personnel with IRS-approved access"
+    controlled_by: "Internal Revenue Service"
+    decontrol: "Per IRS retention schedule"
+    color: "#795548"  # Brown
+    handling_requirements:
+      - "FIPS 140-2 validated encryption required"
+      - "IRS background investigation required for all personnel"
+      - "45-day breach notification to IRS (§10.2)"
+      - "Secure disposal per NIST 800-88 (§9.3)"
+      - "Onsite safeguards inspection by IRS required"
+
+  ITAR:
+    full_name: "International Traffic in Arms Regulations Data"
+    governing_framework: "ITAR (22 CFR 120-130)"
+    marking_prefix: "ITAR"
+    banner_template: "ITAR // 22 CFR 120-130"
+    portion_marking: "(ITAR)"
+    distribution: "US Persons only -- no foreign national access without DDTC license"
+    controlled_by: "Directorate of Defense Trade Controls (DDTC)"
+    decontrol: "Per USML category and DDTC license"
+    color: "#E91E63"  # Pink
+    handling_requirements:
+      - "Access restricted to US Persons per 22 CFR 120.62"
+      - "Foreign person access requires DDTC license or exemption"
+      - "Must comply with NIST 800-171 for unclassified ITAR"
+      - "Cloud hosting must be in CONUS with US Person access only"
+
+  ZTA:
+    full_name: "Zero Trust Architecture"
+    governing_framework: "NIST SP 800-207"
+    marking_prefix: "ZTA"
+    banner_template: "ZTA // NIST SP 800-207"
+    portion_marking: "(ZTA)"
+    distribution: "Authorized personnel involved in ZTA implementation"
+    controlled_by: "ISSM / ISSO"
+    decontrol: "Per organizational security architecture lifecycle"
+    color: "#00BCD4"  # Cyan
+    sensitivity_level: 3
+    handling_requirements:
+      - "All traffic verified — no implicit trust zones"
+      - "Micro-segmentation enforced between service boundaries"
+      - "mTLS required for all east-west traffic"
+      - "Identity verification at every access decision point"
+      - "Continuous posture assessment feeds cATO evidence"
+
+  PUBLIC:
+    full_name: "Public Release"
+    governing_framework: "N/A"
+    marking_prefix: "PUBLIC"
+    banner_template: "PUBLIC RELEASE -- No restrictions on distribution"
+    portion_marking: ""
+    distribution: "No restrictions"
+    controlled_by: "N/A"
+    color: "#607D8B"  # Grey
+
+# ----------------------------------------------------------------
+# Composite marking rules
+# ADR D109: Markings are composable — highest-sensitivity category
+# determines the overall handling, but all categories are listed
+# ----------------------------------------------------------------
+composite_rules:
+  # Sensitivity ordering (highest to lowest)
+  sensitivity_order:
+    - "TOP_SECRET"
+    - "SECRET"
+    - "CUI"
+    - "ITAR"
+    - "FTI"
+    - "CJIS"
+    - "PHI"
+    - "PCI"
+    - "PII"
+    - "ZTA"
+    - "PUBLIC"
+
+  # Separator for composite banners
+  separator: " | "
+
+  # Example composite: "CUI // SP-CTI | PHI // HIPAA | PCI // DSS v4.0"
+  # Handling: Union of all handling requirements from all categories
+
+# ----------------------------------------------------------------
+# Banner format templates
+# ----------------------------------------------------------------
+banner_format:
+  document_header: |
+    ////////////////////////////////////////////////////////////////////
+    {banner_line}
+    Distribution: {distribution}
+    Controlled by: {controlled_by}
+    ////////////////////////////////////////////////////////////////////
+
+  document_footer: |
+    ////////////////////////////////////////////////////////////////////
+    {banner_line} | {controlled_by}
+    ////////////////////////////////////////////////////////////////////
+
+  code_header:
+    hash: "# {line}"
+    c_style: "// {line}"
+    xml_style_open: "<!--"
+    xml_style_line: "  {line}"
+    xml_style_close: "-->"
+
+# ----------------------------------------------------------------
+# Language comment style mapping
+# ----------------------------------------------------------------
+language_comment_styles:
+  python: "hash"
+  ruby: "hash"
+  java: "c_style"
+  go: "c_style"
+  rust: "c_style"
+  csharp: "c_style"
+  typescript: "c_style"
+  javascript: "c_style"
+  xml: "xml_style"
+  html: "xml_style"
+  yaml: "hash"
+  terraform: "hash"
+  dockerfile: "hash"
+  sql: "-- {line}"

icdev/data/args/cli_config.yaml

@@ -0,0 +1,154 @@
+# CLI Capabilities Configuration — Optional Claude CLI Features
+# Used by: tools/ci/workflows/*, tools/agent/agent_executor.py, intake_engine.py
+# ADR D132: CLI capabilities are optional per-project toggles; tenant sets ceiling, project opts in
+#
+# These 4 capabilities require Claude Code CLI (terminal-based) and may not be available
+# in all environments. The VSCode extension provides identical core functionality —
+# these are add-ons for environments that support headless/terminal execution.
+#
+# Decision guide: goals/cli_capabilities.md
+
+# =============================================================================
+# Tenant-Level Ceiling (set by tenant admin in SaaS platform settings)
+# Projects CANNOT enable capabilities beyond what their tenant allows.
+# For standalone (non-SaaS) deployments, tenant_ceiling is ignored — all
+# capabilities default to project-level settings.
+# =============================================================================
+tenant_ceiling:
+  cicd_automation: true       # Tenant allows projects to use CLI in CI/CD pipelines
+  parallel_agents: true       # Tenant allows parallel CLI agent execution
+  container_execution: true   # Tenant allows CLI inside K8s/Docker containers
+  scripted_intake: true       # Tenant allows batch/scripted requirements intake
+
+# =============================================================================
+# Project-Level Toggles (set per project, must be within tenant ceiling)
+# =============================================================================
+project:
+  # -------------------------------------------------------------------------
+  # 1. CI/CD Pipeline Automation
+  # Run Claude CLI headless in GitLab/GitHub runners for automated SDLC phases.
+  # Example: GitLab runner calls `claude -p "/icdev-build"` in pipeline stage
+  #
+  # Prerequisites:
+  #   - Claude CLI installed on runner (npm install -g @anthropic-ai/claude-code)
+  #   - ANTHROPIC_API_KEY or AWS Bedrock credentials available to runner
+  #   - Runner has network access to LLM endpoint (Bedrock in GovCloud, or Anthropic API)
+  #
+  # When disabled: CI/CD workflows call Python tools directly (no LLM reasoning step)
+  # When enabled:  CI/CD workflows can invoke Claude CLI for AI-assisted build/test/review
+  # -------------------------------------------------------------------------
+  cicd_automation:
+    enabled: false
+    runner_type: gitlab          # gitlab | github | jenkins | generic
+    cli_binary: "claude"         # Path to claude CLI binary on runner
+    cli_flags: "--no-interactive --output-format json"
+    max_tokens_per_run: 100000   # Cost control: max tokens per pipeline invocation
+    timeout_seconds: 600         # 10-minute timeout per CLI invocation
+    allowed_commands:             # Whitelist of /icdev-* commands allowed in CI
+      - "/icdev-build"
+      - "/icdev-test"
+      - "/icdev-review"
+      - "/icdev-secure"
+      - "/icdev-comply"
+    audit_all_invocations: true  # Log every CLI call to audit trail (NIST AU)
+
+  # -------------------------------------------------------------------------
+  # 2. Parallel Agent Execution
+  # Run multiple Claude CLI instances concurrently for independent SDLC phases.
+  # Example: Plan in one terminal, build in another, compliance scan in a third
+  #
+  # Prerequisites:
+  #   - Sufficient API rate limits for concurrent requests
+  #   - Enough compute resources (each CLI instance uses ~200MB RAM)
+  #   - Git worktree support for parallel file isolation (see args/worktree_config.yaml)
+  #
+  # When disabled: Phases run sequentially (plan → build → test → review)
+  # When enabled:  Independent phases can run in parallel (e.g., security + compliance)
+  # -------------------------------------------------------------------------
+  parallel_agents:
+    enabled: false
+    max_concurrent: 3            # Max simultaneous CLI instances per project
+    isolation_method: worktree   # worktree | directory | container
+    coordination: file_lock      # file_lock | database | none
+    shared_context_path: ".tmp/parallel_context/"  # Shared state between instances
+    phase_parallelism:           # Which phase combinations can run in parallel
+      - ["security_scan", "compliance_check"]     # Independent — safe to parallelize
+      - ["unit_test", "bdd_test"]                  # Independent test suites
+      - ["terraform_plan", "ansible_lint"]         # Independent IaC validation
+    serial_phases:               # Phases that MUST run sequentially
+      - "plan"                   # Must complete before build
+      - "build"                  # Must complete before test
+      - "deploy"                 # Must complete after all gates pass
+
+  # -------------------------------------------------------------------------
+  # 3. Container-Based Execution
+  # Run Claude CLI inside STIG-hardened Docker/K8s containers for agent execution.
+  # Example: K8s pod runs Claude CLI as builder-agent in STIG-hardened container
+  #
+  # Prerequisites:
+  #   - Container runtime (Docker, containerd, CRI-O)
+  #   - STIG-hardened base image (docker/Dockerfile.agent-base)
+  #   - Secrets mounted via K8s secrets or AWS Secrets Manager (never baked into image)
+  #   - Network policy allowing egress to LLM endpoint
+  #
+  # When disabled: Agents run as Python processes (existing A2A pattern)
+  # When enabled:  Agents can run as containerized Claude CLI instances
+  # -------------------------------------------------------------------------
+  container_execution:
+    enabled: false
+    base_image: "icdev/agent-base:latest"   # STIG-hardened base
+    registry: ""                             # Container registry URL (empty = local)
+    resource_limits:
+      cpu: "1000m"                           # 1 CPU core
+      memory: "512Mi"                        # 512MB RAM
+    security_context:
+      run_as_non_root: true
+      read_only_root_fs: true
+      drop_all_capabilities: true
+    mount_secrets_from: "k8s-secrets"        # k8s-secrets | aws-secrets-manager | env-file
+    network_policy: "default-deny-egress"    # Only allow LLM endpoint + internal A2A
+
+  # -------------------------------------------------------------------------
+  # 4. Scripted / Batch Intake
+  # Pipe requirements documents or batch commands into Claude CLI for automated
+  # processing without interactive Q&A.
+  #
+  # Example: claude -p "/icdev-intake" < requirements.txt
+  # Example: cat sow.pdf | claude -p "extract requirements and score readiness"
+  #
+  # Prerequisites:
+  #   - Input documents in supported format (txt, md, pdf, docx)
+  #   - Pre-configured intake session (project-id, customer info, impact level)
+  #
+  # When disabled: Intake is interactive only (conversational Q&A via extension or dashboard)
+  # When enabled:  Intake can accept piped input for batch processing
+  # -------------------------------------------------------------------------
+  scripted_intake:
+    enabled: false
+    input_formats: [txt, md, pdf, csv, json, yaml]  # Accepted batch input formats
+    auto_gap_detection: true     # Run gap detection after batch import
+    auto_readiness_score: true   # Compute readiness score after batch import
+    auto_decompose: false        # Auto-decompose to SAFe (requires readiness >= 0.7)
+    output_format: json          # json | markdown | both
+    max_documents_per_batch: 20  # Limit batch size for cost control
+    require_session_id: true     # Must pre-create session before batch intake
+
+# =============================================================================
+# Environment Detection — Auto-detect CLI availability
+# =============================================================================
+detection:
+  # Auto-check if Claude CLI is installed and accessible
+  auto_detect: true
+  cli_check_command: "claude --version"
+  fallback_on_missing: "extension"   # extension | error | warn
+  log_detection_result: true          # Record CLI availability in audit trail
+
+# =============================================================================
+# Cost Controls — Prevent runaway CLI usage
+# =============================================================================
+cost_controls:
+  max_tokens_per_day: 1000000        # Daily token budget across all CLI invocations
+  max_invocations_per_hour: 50       # Rate limit on CLI calls
+  alert_at_percent: 80               # Alert when 80% of daily budget consumed
+  hard_stop_at_percent: 100          # Stop CLI invocations at 100% of budget
+  track_in_db: true                  # Store usage in agent_token_usage table

icdev/data/args/cloud_config.yaml

@@ -0,0 +1,63 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Cloud Service Provider Configuration (Phase 38 — D223-D231)
+#
+# Configures which CSP to use for each service category.
+# Supports: aws, azure, gcp, oci, ibm, local
+# Per-service overrides via ICDEV_* env vars take precedence (D225).
+
+cloud:
+  # Global CSP setting — used when no per-service override is set
+  provider: local          # commercial | government | on_prem | air_gapped — controls endpoint selection (D232)
+  region: us-gov-west-1    # Default region (CSP-specific)
+  impact_level: IL5        # IL2 | IL4 | IL5 | IL6
+  air_gapped: false        # true = disable all internet-dependent services
+  cloud_mode: government     # commercial | government | on_prem | air_gapped (D232)
+
+  # AWS-specific configuration
+  aws:
+    account_type: govcloud   # govcloud | commercial
+    fips_endpoints: true     # Use FIPS 140-2 validated endpoints
+    kms_key_id: ${AWS_KMS_KEY_ID:-alias/icdev-master}
+
+  # Azure-specific configuration
+  azure:
+    cloud: AzureUSGovernment    # AzureUSGovernment | AzureCloud | AzureChinaCloud
+    vault_url: ${AZURE_VAULT_URL:-}
+    storage_account_url: ${AZURE_STORAGE_ACCOUNT_URL:-}
+    openai_endpoint: ${AZURE_OPENAI_ENDPOINT:-}
+
+  # GCP-specific configuration
+  gcp:
+    project_id: ${GCP_PROJECT_ID:-}
+    region: us-east4               # FedRAMP authorized region
+    assured_workloads: true        # Assured Workloads for government data
+
+  # OCI-specific configuration
+  oci:
+    tenancy_ocid: ${OCI_TENANCY_OCID:-}
+    compartment_ocid: ${OCI_COMPARTMENT_OCID:-}
+    vault_ocid: ${OCI_VAULT_OCID:-}
+    namespace: ${OCI_NAMESPACE:-}
+    region: us-langley-1           # OCI Government region
+
+  # IBM Cloud-specific configuration (D237)
+  ibm:
+    api_key: ${IBM_CLOUD_API_KEY:-}
+    region: us-south                     # us-south (Dallas), us-east (DC), eu-de (Frankfurt)
+    resource_group: ${IBM_RESOURCE_GROUP:-default}
+    cos_instance_id: ${IBM_COS_INSTANCE_ID:-}
+    watsonx_project_id: ${IBM_WATSONX_PROJECT_ID:-}
+    account_type: commercial             # commercial | government (IC4G)
+
+  # Per-service CSP overrides (D225)
+  # Set these env vars to override the global provider for specific services:
+  #   ICDEV_SECRETS_PROVIDER=azure  -> Use Azure Key Vault for secrets even if global is aws
+  #   ICDEV_STORAGE_PROVIDER=gcp    -> Use GCS for storage even if global is aws
+  #   ICDEV_KMS_PROVIDER=local      -> Use local Fernet for encryption
+  services:
+    secrets: ${ICDEV_SECRETS_PROVIDER:-}
+    storage: ${ICDEV_STORAGE_PROVIDER:-}
+    kms: ${ICDEV_KMS_PROVIDER:-}
+    monitoring: ${ICDEV_MONITORING_PROVIDER:-}
+    iam: ${ICDEV_IAM_PROVIDER:-}
+    registry: ${ICDEV_REGISTRY_PROVIDER:-}