icdev 1.0.0__py3-none-any.whl

icdev/data/args/dev_profile_config.yaml

@@ -0,0 +1,144 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Dev Profile Configuration (Phase 34, D183-D188)
+# Used by: tools/builder/dev_profile_manager.py, intake_engine.py, scaffolder.py, code_generator.py
+
+dimensions:
+  language:
+    description: "Primary and allowed programming languages"
+    lockable_by: [architect, admin]
+    enforcement: enforced
+    cascade_behavior: override
+    fields: [primary, allowed, forbidden, versions, package_managers, virtual_env_tool, banned_packages, approved_registries]
+
+  style:
+    description: "Code style and formatting conventions"
+    lockable_by: [architect]
+    enforcement: enforced
+    cascade_behavior: merge
+    fields: [naming_convention, indent_style, indent_size, max_line_length, docstring_format, import_order, formatter, linter, trailing_commas, quote_style]
+
+  testing:
+    description: "Testing standards and coverage requirements"
+    lockable_by: [pm, architect]
+    enforcement: enforced
+    cascade_behavior: override_if_stricter
+    fields: [methodology, min_coverage, require_bdd, require_unit, require_e2e, bdd_framework, test_naming_pattern, flaky_test_policy]
+
+  architecture:
+    description: "Architecture patterns and constraints"
+    lockable_by: [architect, admin]
+    enforcement: enforced
+    cascade_behavior: override
+    fields: [web_framework, database, orm, auth_pattern, api_style, container_base, error_handling, logging_format, project_structure]
+
+  security:
+    description: "Security standards and requirements"
+    lockable_by: [isso, admin]
+    enforcement: enforced
+    cascade_behavior: strictest_wins
+    fields: [encryption_standard, secret_management, sast_tools, dependency_audit, container_hardening, vulnerability_sla, secret_rotation_days, image_signing]
+
+  compliance:
+    description: "Compliance framework requirements"
+    lockable_by: [isso, admin]
+    enforcement: enforced
+    cascade_behavior: union
+    fields: [frameworks, cui_required, audit_trail_required, classification_level, sbom_format, ato_approach]
+
+  operations:
+    description: "Operational standards"
+    lockable_by: [pm, architect]
+    enforcement: advisory
+    cascade_behavior: merge
+    fields: [deployment_target, container_runtime, ci_cd_platform, monitoring_stack, region, service_mesh, network_policy, backup_strategy]
+
+  documentation:
+    description: "Documentation standards"
+    lockable_by: [pm]
+    enforcement: advisory
+    cascade_behavior: merge
+    fields: [readme_required, api_docs_required, adr_required, changelog_required, diagram_tool, spec_format, runbook_required]
+
+  git:
+    description: "Git workflow conventions"
+    lockable_by: [architect, pm]
+    enforcement: advisory
+    cascade_behavior: override
+    fields: [branching_strategy, merge_strategy, commit_format, branch_naming, min_approvals, gpg_signing, pr_size_limit, delete_branch_on_merge]
+
+  ai:
+    description: "AI/LLM usage conventions"
+    lockable_by: [admin]
+    enforcement: advisory
+    cascade_behavior: merge
+    fields: [preferred_provider, code_gen_model, compliance_model, token_budget_monthly, attribution, byok_enabled, prompt_governance]
+
+cascade_rules:
+  order: [platform, tenant, program, project, user]
+  strictest_wins_dimensions: [security, compliance]
+  merge_dimensions: [style, operations, documentation, git, ai]
+  override_dimensions: [language, architecture, testing]
+
+# Task type -> relevant dimensions for LLM injection (D187)
+task_dimension_map:
+  code_generation: [language, style, testing, architecture]
+  code_review: [language, style, testing, security, compliance]
+  planning: [architecture, compliance, operations, documentation]
+  testing: [testing, security]
+  deployment: [operations, security, compliance]
+  compliance_review: [compliance, security, documentation]
+
+detection:
+  file_indicators:
+    python: ["*.py", "pyproject.toml", "requirements.txt", "setup.py", "setup.cfg", "Pipfile", "uv.lock"]
+    java: ["*.java", "pom.xml", "build.gradle", "build.gradle.kts"]
+    go: ["*.go", "go.mod", "go.sum"]
+    rust: ["*.rs", "Cargo.toml", "Cargo.lock"]
+    csharp: ["*.cs", "*.csproj", "*.sln"]
+    typescript: ["*.ts", "*.tsx", "tsconfig.json"]
+    javascript: ["*.js", "*.jsx", "package.json"]
+
+  config_files:
+    editorconfig: ".editorconfig"
+    prettier: [".prettierrc", ".prettierrc.json", ".prettierrc.yaml", "prettier.config.js"]
+    eslint: [".eslintrc", ".eslintrc.json", ".eslintrc.yaml", ".eslintrc.js", "eslint.config.js"]
+    ruff: ["ruff.toml", "pyproject.toml"]
+    black: ["pyproject.toml"]
+
+  git_signals:
+    conventional_commits: "^(feat|fix|chore|docs|style|refactor|perf|test|build|ci|revert)(\\(.+\\))?[!]?:"
+    trunk_based: ["main", "trunk"]
+    gitflow: ["develop", "feature/", "release/", "hotfix/"]
+
+  ci_signals:
+    github_actions: ".github/workflows"
+    gitlab_ci: ".gitlab-ci.yml"
+    jenkins: "Jenkinsfile"
+    azure_devops: "azure-pipelines.yml"
+
+intake_detection:
+  keywords:
+    - "coding standards"
+    - "development standards"
+    - "code style"
+    - "naming convention"
+    - "snake_case"
+    - "camelCase"
+    - "test coverage"
+    - "development profile"
+    - "engineering standards"
+    - "code quality"
+    - "linting rules"
+    - "formatting rules"
+    - "package manager"
+    - "virtual environment"
+    - "base image"
+    - "alpine"
+    - "distroless"
+  language_keywords:
+    python: ["python", "flask", "django", "fastapi", "pytest", "pydantic", "uv", "poetry", "pip"]
+    java: ["java", "spring boot", "maven", "gradle", "junit", "cucumber"]
+    go: ["go", "golang", "gin", "net/http", "godog"]
+    rust: ["rust", "actix", "cargo", "clippy", "memory-safe"]
+    typescript: ["typescript", "express", "nestjs", "jest", "prettier"]
+    csharp: ["c#", "csharp", "dotnet", ".net", "asp.net", "specflow"]

icdev/data/args/devsecops_config.yaml

@@ -0,0 +1,286 @@
+# DevSecOps Configuration — Profile Schema, Maturity Levels, Pipeline Stages
+# Used by: tools/devsecops/profile_manager.py, intake_engine.py, pipeline_security_generator.py
+# ADR D119: Per-project DevSecOps profile controls all downstream pipeline and infra generation
+
+# =============================================================================
+# Pipeline Security Stages — toggleable per project based on DevSecOps profile
+# =============================================================================
+devsecops_stages:
+  sast:
+    description: "Static Application Security Testing"
+    tools: [bandit, spotbugs, gosec, clippy, eslint-security, security-code-scan]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_critical
+
+  dast:
+    description: "Dynamic Application Security Testing"
+    tools: [zap, burp]
+    default: false
+    optional: true
+    ci_stage: security-scan
+    gate_impact: warn_on_high
+
+  sca:
+    description: "Software Composition Analysis / Dependency Scanning"
+    tools: [pip-audit, npm-audit, cargo-audit, govulncheck, owasp-dc, dotnet-list]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_critical
+
+  secret_detection:
+    description: "Secret and Credential Detection"
+    tools: [detect-secrets, gitleaks]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_any
+
+  container_scan:
+    description: "Container Image Vulnerability Scanning"
+    tools: [trivy, grype]
+    default: true
+    optional: false
+    ci_stage: security-scan
+    gate_impact: block_on_critical
+
+  image_signing:
+    description: "Container Image Signing and Verification (SLSA Level 3)"
+    tools: [cosign, notation]
+    default: false
+    optional: true
+    ci_stage: devsecops-check
+    gate_impact: block_when_active
+
+  sbom_attestation:
+    description: "SBOM Attestation and Supply Chain Provenance"
+    tools: [cosign-attach, in-toto]
+    default: false
+    optional: true
+    ci_stage: devsecops-check
+    gate_impact: block_when_active
+
+  rasp:
+    description: "Runtime Application Self-Protection"
+    tools: [falco, sysdig]
+    default: false
+    optional: true
+    ci_stage: deploy-staging
+    gate_impact: warn_on_bypass
+
+  policy_as_code:
+    description: "Policy-as-Code Admission Control"
+    tools: [kyverno, opa-gatekeeper]
+    default: false
+    optional: true
+    ci_stage: devsecops-check
+    gate_impact: block_on_critical
+
+  license_compliance:
+    description: "Open Source License Compliance Scanning"
+    tools: [fossa, black-duck, scancode]
+    default: false
+    optional: true
+    ci_stage: compliance-check
+    gate_impact: warn_on_copyleft
+
+# =============================================================================
+# Maturity Levels — DevSecOps Maturity Model (5 levels)
+# =============================================================================
+maturity_levels:
+  level_1_initial:
+    description: "Ad hoc security, no automation in CI/CD pipeline"
+    min_stages: 0
+    required_stages: []
+    characteristics:
+      - "Manual security reviews only"
+      - "No automated scanning in pipeline"
+      - "Security is a separate phase, not integrated"
+
+  level_2_managed:
+    description: "Basic shift-left with SAST and dependency scanning"
+    min_stages: 2
+    required_stages: [sast, sca]
+    characteristics:
+      - "SAST integrated into CI/CD"
+      - "Dependency vulnerabilities tracked"
+      - "Security findings reviewed before merge"
+
+  level_3_defined:
+    description: "Full shift-left with container security and secret detection"
+    min_stages: 4
+    required_stages: [sast, sca, secret_detection, container_scan]
+    characteristics:
+      - "Container images scanned before deployment"
+      - "Secrets prevented from entering codebase"
+      - "Security gates block deployments on critical findings"
+      - "Minimum for ATO-bound projects"
+
+  level_4_measured:
+    description: "Policy enforcement, attestation, and supply chain integrity"
+    min_stages: 6
+    required_stages: [sast, sca, secret_detection, container_scan, policy_as_code, sbom_attestation]
+    characteristics:
+      - "Admission control enforces security policies"
+      - "SBOM attestation on all artifacts"
+      - "Supply chain provenance verified"
+      - "Compliance metrics tracked and reported"
+
+  level_5_optimized:
+    description: "Full DevSecOps with runtime protection and continuous improvement"
+    min_stages: 8
+    required_stages: [sast, sca, secret_detection, container_scan, policy_as_code, sbom_attestation, image_signing, rasp]
+    characteristics:
+      - "Runtime security monitoring and auto-response"
+      - "Image integrity verified via signatures"
+      - "Self-healing security patterns"
+      - "Continuous security posture improvement"
+
+# =============================================================================
+# Intake Detection — Keywords for DevSecOps maturity auto-detection
+# =============================================================================
+intake_detection:
+  keywords_by_stage:
+    sast:
+      - static analysis
+      - code scanning
+      - bandit
+      - sonarqube
+      - fortify
+      - checkmarx
+      - veracode
+      - semgrep
+      - codeql
+      - spotbugs
+      - gosec
+      - eslint-security
+    dast:
+      - dynamic testing
+      - penetration test
+      - OWASP ZAP
+      - burp suite
+      - DAST
+      - web app scanning
+      - runtime testing
+    sca:
+      - dependency scan
+      - software composition
+      - pip-audit
+      - snyk
+      - npm audit
+      - cargo audit
+      - govulncheck
+      - OWASP dependency
+      - software composition analysis
+    secret_detection:
+      - secret scanning
+      - credential detection
+      - gitleaks
+      - trufflehog
+      - detect-secrets
+      - secret detection
+      - credential scan
+    container_scan:
+      - container scanning
+      - image scanning
+      - trivy
+      - grype
+      - twistlock
+      - prisma cloud
+      - anchore
+      - clair
+    image_signing:
+      - image signing
+      - cosign
+      - sigstore
+      - notary
+      - docker content trust
+      - SLSA
+      - image verification
+    sbom_attestation:
+      - SBOM
+      - software bill of materials
+      - attestation
+      - SLSA
+      - in-toto
+      - supply chain attestation
+      - provenance
+    rasp:
+      - runtime protection
+      - falco
+      - sysdig
+      - RASP
+      - runtime security
+      - runtime monitoring
+      - eBPF security
+    policy_as_code:
+      - policy as code
+      - OPA
+      - gatekeeper
+      - kyverno
+      - sentinel
+      - conftest
+      - admission control
+      - policy engine
+    license_compliance:
+      - license compliance
+      - FOSSA
+      - black duck
+      - scancode
+      - license scanning
+      - open source license
+      - copyleft
+
+  # Keywords indicating NO existing DevSecOps
+  absence_signals:
+    - no security scanning
+    - manual security review
+    - no automated security
+    - security is handled separately
+    - we don't have automated
+    - greenfield
+    - starting from scratch
+
+  # Keywords indicating ZTA requirements (triggers ZTA profiling)
+  zta_keywords:
+    - zero trust
+    - micro-segmentation
+    - microsegmentation
+    - mTLS
+    - mutual TLS
+    - identity-aware proxy
+    - service mesh
+    - istio
+    - linkerd
+    - never trust always verify
+    - least privilege access
+    - continuous verification
+    - device posture
+    - NIST 800-207
+    - zero trust architecture
+
+# =============================================================================
+# Profile Defaults by Impact Level
+# =============================================================================
+il_defaults:
+  IL2:
+    minimum_maturity: level_1_initial
+    recommended_maturity: level_2_managed
+    zta_required: false
+  IL4:
+    minimum_maturity: level_3_defined
+    recommended_maturity: level_4_measured
+    zta_required: false
+    zta_recommended: true
+  IL5:
+    minimum_maturity: level_3_defined
+    recommended_maturity: level_4_measured
+    zta_required: true
+    minimum_zta_maturity: advanced
+  IL6:
+    minimum_maturity: level_4_measured
+    recommended_maturity: level_5_optimized
+    zta_required: true
+    minimum_zta_maturity: advanced

icdev/data/args/endpoint_security_config.yaml

@@ -0,0 +1,137 @@
+# CUI // SP-CTI
+# Endpoint Security Scanner Configuration (D-EPSEC-2)
+# Detects API routes missing security safeguards (auth, validation, IDOR).
+# Declarative YAML — add new patterns without code changes (D26).
+---
+
+# Route detection patterns (per language)
+route_patterns:
+  python:
+    - '@\w+\.(route|get|post|put|delete|patch)\s*\('
+    - '@app\.route\s*\('
+    - '@bp\.route\s*\('
+    - '@blueprint\.route\s*\('
+  java:
+    - '@(Get|Post|Put|Delete|Patch)Mapping'
+    - '@RequestMapping'
+  go:
+    - 'http\.HandleFunc\s*\('
+    - '\.(GET|POST|PUT|DELETE|PATCH)\s*\('
+    - 'router\.(Handle|HandleFunc|Get|Post|Put|Delete)\s*\('
+  typescript:
+    - 'router\.(get|post|put|delete|patch)\s*\('
+    - 'app\.(get|post|put|delete|patch)\s*\('
+  rust:
+    - '#\[actix_web::(get|post|put|delete)\('
+    - '\.route\s*\('
+  csharp:
+    - '\[Http(Get|Post|Put|Delete|Patch)\]'
+    - '\[Route\('
+
+# Auth patterns — presence means endpoint is secured
+auth_patterns:
+  python:
+    - '@require_role'
+    - '@require_auth'
+    - '@login_required'
+    - '@jwt_required'
+    - '@auth_required'
+    - 'g\.current_user'
+    - '@token_required'
+  java:
+    - '@PreAuthorize'
+    - '@Secured'
+    - '@RolesAllowed'
+    - 'SecurityContext'
+  go:
+    - 'authMiddleware'
+    - 'requireAuth'
+    - 'AuthRequired'
+  typescript:
+    - 'authMiddleware'
+    - 'requireAuth'
+    - 'passport\.authenticate'
+    - 'isAuthenticated'
+  rust:
+    - '#\[authorize\]'
+    - 'AuthGuard'
+  csharp:
+    - '\[Authorize\]'
+    - '\[AllowAnonymous\]'
+
+# Input validation patterns — presence means input is validated
+validation_patterns:
+  python:
+    - 'isinstance\s*\('
+    - 'validate\s*\('
+    - 'schema\.\w+\s*\('
+    - '_validate_fields\s*\('
+    - 'if\s+not\s+data'
+    - 'if\s+["\x27]\w+["\x27]\s+not\s+in\s+data'
+    - 'pydantic'
+  java:
+    - '@Valid'
+    - '@NotNull'
+    - '@NotBlank'
+    - 'Validator'
+  go:
+    - 'validate\.Struct'
+    - 'binding:"required"'
+  typescript:
+    - 'Joi\.'
+    - 'zod\.'
+    - 'class-validator'
+  rust:
+    - '#\[validate\]'
+    - 'serde::Deserialize'
+  csharp:
+    - '\[Required\]'
+    - 'ModelState\.IsValid'
+
+# HTTP methods that require input validation
+write_methods:
+  - POST
+  - PUT
+  - PATCH
+
+# Endpoints exempt from auth checks (health/metrics)
+exempt_patterns:
+  - '/health'
+  - '/ready'
+  - '/metrics'
+  - '/ping'
+  - '/favicon'
+  - '/static'
+  - '/login'
+  - '/api_events'
+
+# Severity assignment
+severity:
+  missing_auth: critical
+  missing_validation_on_write: high
+  missing_idor_check: medium
+
+# Scan settings
+scan:
+  skip_dirs:
+    - node_modules
+    - .git
+    - __pycache__
+    - .tox
+    - .venv
+    - venv
+    - .tmp
+    - vendor
+    - build
+    - dist
+  exclude_file_patterns:
+    - 'test_*.py'
+    - '*_test.py'
+    - 'conftest.py'
+    - '*_test.go'
+    - '*Test.java'
+    - '*.spec.ts'
+    - '*.test.ts'
+  # Lines above/below route to search for auth/validation
+  context_window_lines: 20
+  max_file_size_kb: 500

icdev/data/args/extension_config.yaml

@@ -0,0 +1,79 @@
+# [TEMPLATE: CUI // SP-CTI]
+# Active Extension Hook Configuration (Phase 44 — D261-D264)
+# Adapted from Agent Zero's extension point architecture
+---
+
+extensions:
+  enabled: true
+
+  # Directories scanned for extension files
+  scan_directories:
+    - extensions/                    # Project root extensions
+    - tools/extensions/builtins/     # Built-in extensions
+
+  # Per-hook-point configuration
+  hook_points:
+    tool_execute_before:
+      enabled: true
+      allow_modification: true       # Pre-hooks can modify tool input
+      max_handlers: 20
+      timeout_ms: 5000
+    tool_execute_after:
+      enabled: true
+      allow_modification: false      # Post-hooks observe only by default
+      max_handlers: 20
+      timeout_ms: 5000
+    chat_message_before:
+      enabled: true
+      allow_modification: true
+      max_handlers: 20
+      timeout_ms: 5000
+    chat_message_after:
+      enabled: true
+      allow_modification: true       # Can add CUI markings to responses
+      max_handlers: 20
+      timeout_ms: 5000
+    agent_start:
+      enabled: true
+      allow_modification: false
+      max_handlers: 10
+      timeout_ms: 3000
+    agent_end:
+      enabled: true
+      allow_modification: false
+      max_handlers: 10
+      timeout_ms: 3000
+    memory_save_before:
+      enabled: true
+      allow_modification: true       # Can filter/transform before save
+      max_handlers: 10
+      timeout_ms: 3000
+    memory_save_after:
+      enabled: true
+      allow_modification: false
+      max_handlers: 10
+      timeout_ms: 3000
+    compliance_check_before:
+      enabled: true
+      allow_modification: false
+      max_handlers: 10
+      timeout_ms: 3000
+    compliance_check_after:
+      enabled: true
+      allow_modification: false
+      max_handlers: 10
+      timeout_ms: 3000
+
+  # Layered override resolution (D184 cascade pattern)
+  layered_override:
+    resolution_order:
+      - default     # Built-in extensions
+      - tenant      # Tenant-level overrides
+      - project     # Project-level overrides
+
+  # Safety limits
+  safety:
+    max_total_handler_time_ms: 30000   # All handlers for one dispatch
+    catch_handler_exceptions: true     # Never let extension crash core
+    log_handler_errors: true           # Log errors to stderr
+    max_handlers_per_point: 20         # Prevent runaway registration