icdev 1.0.0__py3-none-any.whl

icdev/data/args/csp_monitor_config.yaml

@@ -0,0 +1,268 @@
+# [TEMPLATE: CUI // SP-CTI]
+# CSP Service Monitoring Configuration — Phase 38 + Phase 35 Integration
+# Tracks cloud service provider service additions, deprecations, and compliance changes.
+# Integrates with Innovation Engine pipeline for signal scoring and triage (D239).
+#
+# ADRs: D239 (CSP monitoring as Innovation Engine source), D240 (declarative registry)
+
+# =========================================================================
+# CSP Service Catalog Sources
+# =========================================================================
+# Each CSP publishes service updates via APIs, RSS feeds, or changelog pages.
+# The monitor fetches these, diffs against the local registry, and generates
+# innovation signals for new/changed/deprecated services.
+
+sources:
+  aws:
+    enabled: true
+    scan_interval_hours: 12
+    endpoints:
+      - name: whats_new
+        url: https://aws.amazon.com/about-aws/whats-new
+        type: rss
+        filter_keywords: [govcloud, fedramp, fips, compliance, security, new service, launch]
+      - name: govcloud_updates
+        url: https://aws.amazon.com/about-aws/whats-new/?whats-new-content-all.sort-by=item.additionalFields.postDateTime&whats-new-content-all.sort-order=desc&awsf.whats-new-categories=general-products%23security-identity-compliance
+        type: rss
+        filter_keywords: [govcloud]
+      - name: service_health
+        url: https://health.aws.amazon.com/health/status
+        type: api
+      - name: compliance_programs
+        url: https://aws.amazon.com/compliance/services-in-scope
+        type: html
+        description: "Services in scope for each compliance program (FedRAMP, HIPAA, PCI, etc.)"
+    regions:
+      government: [us-gov-west-1, us-gov-east-1]
+      commercial: [us-east-1, us-west-2, eu-west-1, ap-southeast-1]
+
+  azure:
+    enabled: true
+    scan_interval_hours: 12
+    endpoints:
+      - name: updates_feed
+        url: https://azure.microsoft.com/en-us/updates/
+        type: rss
+        filter_keywords: [government, compliance, fedramp, dod, security, new service]
+      - name: gov_updates
+        url: https://azure.microsoft.com/en-us/updates/?query=government
+        type: rss
+      - name: compliance_offerings
+        url: https://learn.microsoft.com/en-us/azure/compliance/offerings/
+        type: html
+        description: "Azure compliance offerings by service and framework"
+      - name: service_health
+        url: https://status.azure.com/en-us/status
+        type: api
+    regions:
+      government: [usgovvirginia, usgovarizona, usgovtexas, usdodcentral, usdodeast]
+      commercial: [eastus, westus2, northeurope, southeastasia]
+
+  gcp:
+    enabled: true
+    scan_interval_hours: 12
+    endpoints:
+      - name: release_notes
+        url: https://cloud.google.com/release-notes
+        type: rss
+        filter_keywords: [fedramp, compliance, assured workloads, government, security]
+      - name: compliance_offerings
+        url: https://cloud.google.com/security/compliance/offerings
+        type: html
+        description: "GCP compliance offerings by service and framework"
+      - name: service_health
+        url: https://status.cloud.google.com/
+        type: api
+    regions:
+      government: [us-east4, us-central1]
+      commercial: [us-east1, us-west1, europe-west1, asia-southeast1]
+
+  oci:
+    enabled: true
+    scan_interval_hours: 24
+    endpoints:
+      - name: release_notes
+        url: https://docs.oracle.com/en-us/iaas/releasenotes/
+        type: rss
+        filter_keywords: [government, fedramp, dod, compliance, security, new service]
+      - name: compliance_listings
+        url: https://www.oracle.com/cloud/compliance/
+        type: html
+        description: "OCI compliance certifications and attestations"
+      - name: service_health
+        url: https://ocistatus.oraclecloud.com/
+        type: api
+    regions:
+      government: [us-langley-1, us-luke-1, us-gov-ashburn-1, us-gov-chicago-1, us-gov-phoenix-1]
+      commercial: [us-ashburn-1, us-phoenix-1, eu-frankfurt-1, ap-tokyo-1]
+
+  ibm:
+    enabled: true
+    scan_interval_hours: 24
+    endpoints:
+      - name: announcements
+        url: https://cloud.ibm.com/status/announcement
+        type: api
+        filter_keywords: [government, fedramp, compliance, security, new service, ic4g]
+      - name: release_notes
+        url: https://cloud.ibm.com/docs/overview?topic=overview-whatsnew
+        type: html
+      - name: compliance_programs
+        url: https://cloud.ibm.com/docs/overview?topic=overview-compliance
+        type: html
+        description: "IBM Cloud compliance programs and certifications"
+      - name: service_health
+        url: https://cloud.ibm.com/status
+        type: api
+    regions:
+      government: [us-south, us-east]  # IC4G regions
+      commercial: [us-south, us-east, eu-de, eu-gb, jp-tok, au-syd]
+
+# =========================================================================
+# Service Registry
+# =========================================================================
+# The local registry (context/cloud/csp_service_registry.json) is the
+# baseline. The monitor diffs CSP announcements against this registry
+# to detect new services, deprecations, and compliance scope changes.
+
+registry:
+  path: context/cloud/csp_service_registry.json
+  auto_update: false                      # true = auto-update registry on detection
+  require_review: true                    # Require human review before registry update
+  backup_before_update: true              # Create timestamped backup before updates
+
+# =========================================================================
+# Signal Generation
+# =========================================================================
+# Detected changes are stored as innovation_signals (reuses Phase 35 DB schema).
+# source: 'csp_monitor', source_type per change type.
+
+signals:
+  source_name: csp_monitor                # Source identifier in innovation_signals table
+
+  # Map change types to signal categories (reuses Phase 35 categories)
+  category_mapping:
+    new_service: infrastructure            # New CSP service launched
+    service_deprecation: modernization     # Service deprecated or end-of-life
+    compliance_scope_change: compliance_gap # Service added/removed from compliance program
+    region_expansion: infrastructure        # New region available
+    api_breaking_change: modernization      # Breaking API change
+    security_update: security_vulnerability # Security-related service update
+    pricing_change: developer_experience    # Pricing change affecting cost models
+    certification_change: compliance_gap    # CSP gains/loses compliance certification
+
+  # Community score mapping (normalized 0-1)
+  community_score_mapping:
+    new_service: 0.6
+    service_deprecation: 0.8              # High — may require migration
+    compliance_scope_change: 0.9          # Critical — affects ATO posture
+    region_expansion: 0.4
+    api_breaking_change: 0.9              # Critical — may break integrations
+    security_update: 0.7
+    pricing_change: 0.3
+    certification_change: 0.9            # Critical — affects deployment eligibility
+
+  # Priority boost for government-specific changes
+  government_boost: 1.3                   # Multiply score for gov cloud changes
+  compliance_boost: 1.5                   # Multiply score for compliance program changes
+
+# =========================================================================
+# Diff Engine
+# =========================================================================
+# How the monitor detects changes between scans.
+
+diff:
+  # Service matching strategy
+  match_by: [service_name, csp]           # Unique key for service identity
+  track_fields:                            # Fields to monitor for changes
+    - compliance_programs                   # Which compliance programs cover this service
+    - regions                               # Which regions offer this service
+    - status                                # active, deprecated, preview, end_of_life
+    - api_version                           # Latest API version
+    - fips_validated                        # FIPS 140-2 validation status
+    - fedramp_authorized                    # FedRAMP authorization status
+    - govcloud_available                    # Available in government cloud
+
+  # Change detection thresholds
+  min_confidence: 0.7                      # Minimum confidence to generate a signal
+  dedup_window_days: 30                    # Suppress duplicate signals within window
+  content_hash_fields: [csp, service_name, change_type, description]
+
+# =========================================================================
+# Notification & Escalation
+# =========================================================================
+notifications:
+  # Which change types trigger immediate notification (vs batch)
+  immediate:
+    - service_deprecation
+    - api_breaking_change
+    - compliance_scope_change
+    - certification_change
+
+  # Batch notification for less critical changes
+  batch:
+    interval_hours: 24
+    change_types:
+      - new_service
+      - region_expansion
+      - pricing_change
+      - security_update
+
+  # Notification sinks (reuses Phase 29 heartbeat pattern D163)
+  sinks:
+    audit_trail: true                      # Always log to audit trail
+    dashboard_sse: true                    # Push to dashboard via SSE
+    gateway_channels: false                # Push to remote gateway (if configured)
+
+# =========================================================================
+# Changelog Generation
+# =========================================================================
+# Generates human-readable changelogs for CSP service updates.
+
+changelog:
+  output_dir: .tmp/csp_changelogs
+  format: markdown                         # markdown | json | both
+  group_by: csp                            # csp | change_type | date
+  include_recommendations: true            # Include action recommendations
+  max_entries: 100                          # Max entries per changelog
+
+# =========================================================================
+# Integration with Innovation Engine (Phase 35)
+# =========================================================================
+innovation_integration:
+  enabled: true
+  # CSP signals feed into the standard Innovation Engine pipeline:
+  #   DISCOVER (csp_monitor) → SCORE (signal_ranker) → TRIAGE → GENERATE → BUILD → PUBLISH
+  feed_to_pipeline: true
+  auto_score: true                         # Auto-score CSP signals via signal_ranker
+  auto_triage: true                        # Auto-triage compliance_scope_change and certification_change
+
+  # Solution generation triggers
+  auto_generate_solutions:
+    service_deprecation: true              # Generate migration guide
+    api_breaking_change: true              # Generate compatibility adapter
+    compliance_scope_change: false         # Requires human review
+    certification_change: false            # Requires human review
+
+# =========================================================================
+# Scheduling
+# =========================================================================
+scheduling:
+  daemon_mode: false                       # true = continuous background scanning
+  default_scan_interval_hours: 12          # Fallback if per-source not set
+  quiet_hours: "02:00-06:00"              # UTC — no scanning during this window
+  max_concurrent_scans: 2                  # Max parallel CSP scans
+  scan_timeout_seconds: 120                # Per-source timeout
+  retry_on_failure: true
+  max_retries: 3
+  retry_delay_seconds: 60
+
+# =========================================================================
+# Audit
+# =========================================================================
+audit:
+  log_scans: true
+  log_signals: true
+  log_registry_updates: true
+  log_changelogs: true
+  retention_days: 365

icdev/data/args/cui_markings.yaml

@@ -0,0 +1,35 @@
+# CUI Classification Marking Configuration
+# Applied to all ICDEV-generated artifacts per DoD CUI Program
+
+enabled: false
+
+banner_top: "CUI // SP-CTI"
+banner_bottom: "CUI // SP-CTI"
+
+designation_indicator:
+  controlled_by: "Department of Defense"
+  categories: "CTI"
+  distribution: "Distribution D"
+  poc: "ICDEV System Administrator"
+
+portion_marking: "(CUI)"
+decontrol_instructions: "Decontrol on: 10 years from creation date"
+
+# File-type specific templates
+code_header: |
+  CUI // SP-CTI
+  Controlled by: Department of Defense
+  CUI Category: CTI
+  Distribution: D
+  POC: ICDEV System Administrator
+
+document_header: |
+  //////////////////////////////////////////////////////////////////
+  CONTROLLED UNCLASSIFIED INFORMATION (CUI) // SP-CTI
+  Distribution: Distribution D — Authorized DoD Personnel Only
+  //////////////////////////////////////////////////////////////////
+
+document_footer: |
+  //////////////////////////////////////////////////////////////////
+  CUI // SP-CTI | Department of Defense
+  //////////////////////////////////////////////////////////////////

icdev/data/args/db_config.yaml

@@ -0,0 +1,40 @@
+# [TEMPLATE: CUI // SP-CTI]
+# ICDEV Database Configuration — Migrations & Backup
+# ADRs: D150 (migrations), D151 (baseline), D152 (backup)
+---
+
+migrations:
+  enabled: true
+  migrations_dir: "tools/db/migrations"
+  auto_migrate: false            # If true, run pending migrations on app startup
+  checksum_validation: true      # Verify file checksums against applied records
+  lock_timeout_seconds: 30       # Max wait for migration lock
+
+backup:
+  enabled: true
+  backup_dir: "data/backups"
+  retention_days: 30             # Auto-prune backups older than this
+  max_backups: 50                # Maximum number of backups to keep
+  compression: false             # gzip compression (future)
+  encryption:
+    enabled: false               # Requires 'cryptography' package
+    algorithm: "AES-256-CBC"
+    pbkdf2_iterations: 600000
+
+  databases:
+    icdev:
+      path: "data/icdev.db"
+      schedule: "daily"
+    platform:
+      path: "data/platform.db"
+      schedule: "daily"
+    memory:
+      path: "data/memory.db"
+      schedule: "weekly"
+    activity:
+      path: "data/activity.db"
+      schedule: "weekly"
+
+  tenants:
+    backup_on_provision: true    # Backup tenant DB during provisioning
+    backup_on_migrate: true      # Backup before running migrations

icdev/data/args/deployment_profiles.yaml

@@ -0,0 +1,248 @@
+# Deployment Profiles for ICDEV Modular Installation
+# Each profile pre-selects modules, compliance frameworks, and platform defaults
+# Profiles are starting points — all can be customized post-install via --add-module
+
+profiles:
+  # ── ISV Profiles ──────────────────────────────────────────────────
+
+  isv_startup:
+    name: "ISV Startup"
+    description: "Independent Software Vendor, small team building SaaS products"
+    team_size: "2-10"
+    modules: [core, llm, builder, security, testing, compliance_base, dashboard]
+    default_compliance: []
+    default_platform: docker
+    cui_enabled: false
+    recommended_addons: [cicd]
+    notes: "Minimal setup for rapid development. Add compliance frameworks as needed for FedRAMP/SOC 2."
+
+  isv_enterprise:
+    name: "ISV Enterprise"
+    description: "ISV with FedRAMP requirements and larger engineering team"
+    team_size: "10-50"
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, infrastructure, dashboard, agent_orchestration, monitoring]
+    default_compliance: [fedramp_moderate]
+    default_platform: k8s
+    cui_enabled: false
+    recommended_addons: [saas, marketplace, ricoas]
+    notes: "Production-ready setup with CI/CD and monitoring. FedRAMP Moderate pre-selected."
+
+  # ── System Integrator Profiles ────────────────────────────────────
+
+  si_consulting:
+    name: "System Integrator (Consulting)"
+    description: "SI team doing compliance consulting, assessments, and ATO packages"
+    team_size: "3-20"
+    modules: [core, llm, compliance_base, dashboard, ricoas]
+    default_compliance: [fedramp_moderate, cmmc]
+    default_platform: docker
+    cui_enabled: true
+    recommended_addons: [modernization, mbse]
+    notes: "Assessment-focused setup. RICOAS for intake, compliance frameworks for ATO artifact generation."
+
+  si_enterprise:
+    name: "System Integrator (Enterprise)"
+    description: "Large SI with multiple programs and full lifecycle management"
+    team_size: "20-200"
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, infrastructure, dashboard, agent_orchestration, ricoas, monitoring, modernization, mbse]
+    default_compliance: [fedramp_high, cmmc, cjis]
+    default_platform: k8s
+    cui_enabled: true
+    recommended_addons: [saas, marketplace, gateway, devsecops_zta, mosa]
+    notes: "Full lifecycle platform for large programs. Multi-agent orchestration with parallel CI/CD."
+
+  # ── Defense & Government Profiles ─────────────────────────────────
+
+  dod_team:
+    name: "DoD Project Team"
+    description: "Department of Defense contractor team building mission systems"
+    team_size: "5-50"
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, infrastructure, dashboard, agent_orchestration, devsecops_zta, mosa, ricoas, monitoring]
+    default_compliance: [fedramp_high, cmmc, fips_199_200, oscal, cato, sbd_ivv]
+    default_platform: k8s
+    cui_enabled: true
+    impact_level: IL5
+    recommended_addons: [mbse, gateway, agentic_generation]
+    notes: "DoD-optimized with MOSA, DevSecOps/ZTA, FIPS 199/200, and cATO monitoring pre-configured."
+
+  # ── Sector-Specific Profiles ──────────────────────────────────────
+
+  healthcare:
+    name: "Healthcare / Life Sciences"
+    description: "Organizations handling PHI data requiring HIPAA compliance"
+    team_size: "5-50"
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, dashboard, monitoring]
+    default_compliance: [hipaa, hitrust, soc2]
+    default_platform: k8s
+    cui_enabled: false
+    recommended_addons: [ricoas, infrastructure]
+    notes: "HIPAA + HITRUST + SOC 2 for healthcare data protection. No CUI markings needed."
+
+  financial:
+    name: "Financial Services"
+    description: "Organizations handling payment card data and financial records"
+    team_size: "5-50"
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, dashboard, monitoring]
+    default_compliance: [pci_dss, soc2, iso27001]
+    default_platform: k8s
+    cui_enabled: false
+    recommended_addons: [ricoas, infrastructure, devsecops_zta]
+    notes: "PCI DSS + SOC 2 + ISO 27001 for financial compliance. ZTA recommended for zero-trust architecture."
+
+  law_enforcement:
+    name: "Law Enforcement / Criminal Justice"
+    description: "Organizations handling criminal justice information"
+    team_size: "3-30"
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, dashboard, monitoring]
+    default_compliance: [cjis, fips_199_200]
+    default_platform: k8s
+    cui_enabled: true
+    recommended_addons: [devsecops_zta, ricoas]
+    notes: "CJIS Security Policy compliance with FIPS 199/200 categorization."
+
+  # ── Full Platform Profiles ────────────────────────────────────────
+
+  govcloud_full:
+    name: "GovCloud Full Platform"
+    description: "Complete ICDEV platform for AWS GovCloud deployment"
+    team_size: "10-100+"
+    modules: ALL
+    default_compliance: ALL
+    default_platform: k8s
+    cui_enabled: true
+    impact_level: IL5
+    recommended_addons: []
+    notes: "Everything installed. Use for reference installations or comprehensive GovCloud deployments."
+
+  custom:
+    name: "Custom Configuration"
+    description: "Pick individual modules and compliance frameworks"
+    modules: [core, llm, compliance_base]
+    default_compliance: []
+    default_platform: docker
+    cui_enabled: false
+    recommended_addons: []
+    notes: "Start with minimum core and add modules individually via --add-module."
+
+  # ── Customer Delivery Profiles (D374) ───────────────────────────────
+  # Free on-prem ICDEV for winning GovProposal customers.
+  # Excludes internal business tools: GovProposal/RFX, GovCon Intel,
+  # Creative Engine, Innovation Engine, Marketplace SaaS, agentic gen.
+
+  customer_core:
+    name: "Customer Delivery — Core Platform"
+    description: "SDLC + compliance essentials for winning government customers"
+    delivery_tier: core
+    modules: [core, llm, builder, security, testing, compliance_base, dashboard, cicd]
+    default_compliance: []
+    default_platform: k8s
+    cui_enabled: true
+    recommended_addons: [infrastructure, monitoring]
+    excluded_reason:
+      govcon: "Internal capture tool — not for customer delivery"
+      creative: "Internal competitive intelligence"
+      innovation: "Internal R&D self-improvement"
+      govproposal: "Internal proposal writing engine"
+      saas: "We run the SaaS, customer is on-prem"
+      marketplace: "Customer consumes from marketplace, not runs it"
+      agentic_generation: "Advanced — available in Enterprise tier"
+    notes: "Minimum viable platform. Builder + Security + Testing + Compliance + Dashboard + CI/CD. Customer adds frameworks post-install."
+
+  customer_standard:
+    name: "Customer Delivery — Standard Platform"
+    description: "Full DevSecOps + requirements intake for winning government customers"
+    delivery_tier: standard
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, infrastructure, dashboard, monitoring, devsecops_zta, ricoas]
+    default_compliance: []
+    default_platform: k8s
+    cui_enabled: true
+    impact_level: IL5
+    recommended_addons: [mosa, agent_orchestration]
+    excluded_reason:
+      govcon: "Internal capture tool"
+      creative: "Internal competitive intelligence"
+      innovation: "Internal R&D"
+      govproposal: "Internal proposal engine"
+      saas: "Customer is on-prem"
+      marketplace: "Customer consumes, not runs"
+    notes: "Most common delivery tier. Adds DevSecOps/ZTA, requirements intake (RICOAS), infrastructure generation, and monitoring."
+
+  customer_enterprise:
+    name: "Customer Delivery — Enterprise Platform"
+    description: "Full engineering suite for winning government customers (excludes internal business tools)"
+    delivery_tier: enterprise
+    modules: [core, llm, builder, security, testing, compliance_base, cicd, infrastructure, dashboard, agent_orchestration, monitoring, devsecops_zta, mosa, ricoas, mbse, modernization, gateway, mcp_servers]
+    default_compliance: []
+    default_platform: k8s
+    cui_enabled: true
+    impact_level: IL5
+    recommended_addons: []
+    excluded_reason:
+      govcon: "Internal capture tool"
+      creative: "Internal competitive intelligence"
+      innovation: "Internal R&D"
+      govproposal: "Internal proposal engine"
+      saas: "Customer is on-prem"
+      marketplace: "Customer consumes, not runs"
+      agentic_generation: "Grandchild prevention (D52)"
+    notes: "Everything except internal business tools. MBSE, modernization, gateway, multi-agent orchestration included."
+
+# ── Platform Definitions ────────────────────────────────────────────
+
+platforms:
+  docker:
+    name: "Docker Compose"
+    description: "Local development with Docker containers"
+    generates: [docker-compose.yml, .env.template]
+    requirements: [docker, docker-compose]
+
+  k8s:
+    name: "Kubernetes"
+    description: "Production Kubernetes cluster deployment"
+    generates: [k8s/namespace.yaml, k8s/deployments/, k8s/services/, k8s/rbac.yaml, k8s/network-policies/, k8s/hpa.yaml, k8s/pdb.yaml]
+    requirements: [kubectl, helm]
+
+  helm:
+    name: "Helm Chart"
+    description: "Helm-based deployment to any Kubernetes cluster"
+    generates: [deploy/helm/values-custom.yaml]
+    requirements: [helm]
+
+  aws_govcloud:
+    name: "AWS GovCloud"
+    description: "AWS GovCloud (us-gov-west-1) with EKS, RDS, and Bedrock"
+    generates: [terraform/, k8s/, .env.template]
+    requirements: [aws-cli, terraform, kubectl, helm]
+
+  azure_gov:
+    name: "Azure Government"
+    description: "Azure Government with AKS"
+    generates: [terraform/, k8s/, .env.template]
+    requirements: [az-cli, terraform, kubectl, helm]
+
+  on_prem:
+    name: "On-Premises (Air-Gapped)"
+    description: "Air-gapped deployment with no internet access"
+    generates: [deploy/offline/, docker-compose.yml, .env.template]
+    requirements: [docker]
+    air_gapped: true
+    notes: "Requires pre-downloaded container images and Ollama local models"
+
+# ── Team Size Recommendations ───────────────────────────────────────
+
+team_sizes:
+  "1-5":
+    recommended_profiles: [isv_startup, custom]
+    notes: "Small teams benefit from minimal setup and fast iteration"
+  "5-15":
+    recommended_profiles: [isv_startup, si_consulting, healthcare, financial, law_enforcement]
+    notes: "Medium teams can handle compliance overhead with dashboard support"
+  "15-50":
+    recommended_profiles: [isv_enterprise, si_enterprise, dod_team]
+    notes: "Larger teams benefit from CI/CD, multi-agent orchestration, and monitoring"
+  "50-200":
+    recommended_profiles: [si_enterprise, govcloud_full]
+    notes: "Enterprise teams need full platform with SaaS, marketplace, and gateway"
+  "200+":
+    recommended_profiles: [govcloud_full]
+    notes: "Large organizations should deploy the full platform"