icdev 1.2.6__tar.gz → 1.2.8__tar.gz

{icdev-1.2.6 → icdev-1.2.8}/CHANGELOG.md

@@ -6,6 +6,22 @@ All notable changes to ICDEV™ are documented in this file.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.2.8] - 2026-03-31
+
+### Added
+- **Network Design Canvas** — ACAS/Nessus vulnerability scan overlay with host-to-node matching and severity heat maps
+- **Network Design Canvas** — Natural language topology queries powered by deterministic graph algorithms (NetworkX) with local LLM fallback
+- **Network Design Canvas** — Cloud architecture diagram generation for all 6 CSPs
+- **Network Design Canvas** — Compliance audit page with per-device STIG tracking and exportable checklists
+- **Network Design Canvas** — 1,000+ device types, protocols, and interface constants
+- **Network Design Canvas** — Enhanced inventory export (CSV, JSON, YAML) with advanced filtering
+- **IBM Cloud IaC** — New Terraform generator for IBM Cloud (VPC, IKS, KMS, COS, LogDNA, SysDig)
+- **Azure IaC** — Major expansion: AKS, Key Vault, Front Door, Application Gateway, NSG rules
+- **GCP IaC** — Major expansion: GKE, Cloud KMS, Cloud Armor, VPC Service Controls
+- **OCI IaC** — Major expansion: OKE, Vault, WAF, Network Security Groups, Bastion
+- **SRE Operations** — Dashboard, runbook library, incident tracking, toil budgets, SLO monitoring
+- **Pipeline Canvas** — Visual CI/CD pipeline designer with drag-and-drop stages and YAML export
+
 ## [Unreleased]
 
 ### Added

{icdev-1.2.6 → icdev-1.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: icdev
-Version: 1.2.6
+Version: 1.2.8
 Summary: ICDEV™ — Intelligent Certified Development Platform. AI-powered SDLC with NIST 800-53 RMF compliance, multi-agent orchestration, FORGE framework, and ANVIL build workflow.
 Author: Sovanna Chuon
 License-Expression: Apache-2.0
@@ -90,6 +90,8 @@ Requires-Dist: diffusers>=0.27; extra == "image-gen"
 Requires-Dist: transformers>=4.36; extra == "image-gen"
 Requires-Dist: accelerate>=0.25; extra == "image-gen"
 Provides-Extra: network
+Requires-Dist: defusedxml>=0.7; extra == "network"
+Requires-Dist: networkx>=3.2; extra == "network"
 Provides-Extra: full
 Requires-Dist: icdev[llm-all,network,search,security,testing]; extra == "full"
 Provides-Extra: full-airgap
@@ -102,7 +104,7 @@ Dynamic: license-file
   <img src="https://img.shields.io/badge/license-Apache--2.0-blue" alt="License">
   <img src="https://img.shields.io/badge/python-3.9%2B-brightgreen" alt="Python 3.9+">
   <img src="https://img.shields.io/badge/compliance%20frameworks-42-orange" alt="Compliance Frameworks">
-  <img src="https://img.shields.io/badge/tools-500%2B-blueviolet" alt="Tools">
+  <img src="https://img.shields.io/badge/tools-530%2B-blueviolet" alt="Tools">
   <img src="https://img.shields.io/badge/agents-15-red" alt="Agents">
   <img src="https://img.shields.io/badge/languages-6-green" alt="Languages">
 </p>
@@ -664,7 +666,7 @@ The bottom line: **you don't need the original developers**. You don't need a te
 | **IBM** | Cloud for Government | watsonx.ai (Granite, Llama) |
 | **Local** | Air-Gapped | Ollama (Llama, Mistral, CodeGemma) |
 
-Generated applications connect to 100+ cloud-provider MCP servers automatically based on target CSP.
+All 6 providers have full **Infrastructure-as-Code generators** — Terraform modules with VPC/VNet/VCN networking, IAM, KMS encryption, container orchestration (EKS/AKS/GKE/OKE/IKS), and compliance-hardened defaults per cloud. Generated applications connect to 100+ cloud-provider MCP servers automatically based on target CSP.
 
 ---
 
@@ -748,6 +750,11 @@ python tools/dashboard/app.py
 | `/govcon` | GovCon Intelligence: SAM.gov scanning, pipeline status, domain distribution |
 | `/govcon/requirements` | Requirement pattern analysis: frequency, domain heatmap, trend detection |
 | `/govcon/capabilities` | ICDEV™ capability coverage: L/M/N grading, gaps, enhancement recommendations |
+| `/network/canvas` | Network Design Canvas: topology builder, drag-and-drop, cloud architecture diagrams |
+| `/network/compliance` | Network compliance audit: STIG findings, ACAS/Nessus vulnerability overlay, heat maps |
+| `/network/facilities` | Facilities management: rack layouts, power/cooling, cable tracking |
+| `/sre` | SRE Operations: runbook library, incident tracking, toil budgets, SLO monitoring |
+| `/pipeline` | Pipeline Canvas: visual CI/CD pipeline design with drag-and-drop stages |
 
 Auth: per-user API keys (SHA-256 hashed), 6 RBAC roles (admin, pm, developer, isso, co, cor). Optional BYOK (bring-your-own LLM keys) with AES-256 encryption.
 
@@ -852,6 +859,10 @@ icdev/
 │   ├── innovation/       # Autonomous self-improvement engine
 │   ├── creative/         # Customer-centric feature discovery
 │   ├── govcon/           # GovCon Intelligence — SAM.gov capture pipeline
+│   ├── network/          # Network Design Canvas — topology, ACAS/Nessus overlay, NL queries, cloud arch
+│   ├── infra/            # IaC generators — Terraform for AWS, Azure, GCP, OCI, IBM Cloud
+│   ├── sre/              # SRE Operations — runbooks, incident tracking, toil budgets, SLO monitoring
+│   ├── pipeline/         # Pipeline Canvas — visual CI/CD pipeline design
 │   └── ...               # 30+ more specialized categories
 ├── args/                 # 30+ YAML/JSON configuration files
 ├── context/              # 42 compliance catalogs, language profiles
@@ -866,6 +877,46 @@ icdev/
 
 ---
 
+## Network Design Canvas
+
+Interactive topology builder for designing, documenting, and auditing network architectures — from rack-level facilities to cloud-scale deployments.
+
+| Capability | Description |
+|------------|-------------|
+| **Topology Builder** | Drag-and-drop canvas with 200+ device types (routers, switches, firewalls, servers, IoT, OT/ICS) and automatic link routing |
+| **Cloud Architecture** | Generate cloud diagrams for all 6 CSPs — VPC/VNet/VCN, subnets, security groups, load balancers, managed services |
+| **ACAS/Nessus Overlay** | Import `.nessus` scan files, auto-match hosts to topology nodes, render vulnerability heat maps with severity badges |
+| **Natural Language Queries** | Ask plain-English questions about any topology ("What happens if Core-Switch goes down?", "Show all paths between A and B") — powered by deterministic graph algorithms with local LLM fallback |
+| **STIG Compliance Audit** | Per-device STIG finding tracking, CAT I/II/III severity, audit history, exportable checklists |
+| **Inventory Export** | Export device inventory to CSV, JSON, or YAML with filtering by type, location, STIG status |
+| **Facilities Management** | Rack elevation diagrams, power/cooling tracking, cable management |
+
+Air-gap safe — all JavaScript vendored locally (JointJS, D3, Backbone), zero CDN dependencies.
+
+---
+
+## SRE Operations
+
+Site Reliability Engineering dashboard for managing operational excellence:
+
+- **Runbook Library** — searchable runbook catalog with step-by-step procedures, linked to services and alerts
+- **Incident Tracking** — incident lifecycle from detection to postmortem, with timeline and impact analysis
+- **Toil Budgets** — track and reduce toil with per-team budgets and automation ROI tracking
+- **SLO Monitoring** — service level objective tracking with error budget burn-rate alerts
+
+---
+
+## Pipeline Canvas
+
+Visual CI/CD pipeline design tool with drag-and-drop stage composition:
+
+- Design pipelines visually with connected stages (build, test, scan, deploy, gate)
+- Export to GitLab CI and GitHub Actions YAML
+- Compliance gate integration — security scan and approval stages auto-inserted based on impact level
+- Template library for common patterns (TDD, DevSecOps, cATO continuous monitoring)
+
+---
+
 ## Testing
 
 ```bash

{icdev-1.2.6 → icdev-1.2.8}/README.md

@@ -2,7 +2,7 @@
   <img src="https://img.shields.io/badge/license-Apache--2.0-blue" alt="License">
   <img src="https://img.shields.io/badge/python-3.9%2B-brightgreen" alt="Python 3.9+">
   <img src="https://img.shields.io/badge/compliance%20frameworks-42-orange" alt="Compliance Frameworks">
-  <img src="https://img.shields.io/badge/tools-500%2B-blueviolet" alt="Tools">
+  <img src="https://img.shields.io/badge/tools-530%2B-blueviolet" alt="Tools">
   <img src="https://img.shields.io/badge/agents-15-red" alt="Agents">
   <img src="https://img.shields.io/badge/languages-6-green" alt="Languages">
 </p>
@@ -564,7 +564,7 @@ The bottom line: **you don't need the original developers**. You don't need a te
 | **IBM** | Cloud for Government | watsonx.ai (Granite, Llama) |
 | **Local** | Air-Gapped | Ollama (Llama, Mistral, CodeGemma) |
 
-Generated applications connect to 100+ cloud-provider MCP servers automatically based on target CSP.
+All 6 providers have full **Infrastructure-as-Code generators** — Terraform modules with VPC/VNet/VCN networking, IAM, KMS encryption, container orchestration (EKS/AKS/GKE/OKE/IKS), and compliance-hardened defaults per cloud. Generated applications connect to 100+ cloud-provider MCP servers automatically based on target CSP.
 
 ---
 
@@ -648,6 +648,11 @@ python tools/dashboard/app.py
 | `/govcon` | GovCon Intelligence: SAM.gov scanning, pipeline status, domain distribution |
 | `/govcon/requirements` | Requirement pattern analysis: frequency, domain heatmap, trend detection |
 | `/govcon/capabilities` | ICDEV™ capability coverage: L/M/N grading, gaps, enhancement recommendations |
+| `/network/canvas` | Network Design Canvas: topology builder, drag-and-drop, cloud architecture diagrams |
+| `/network/compliance` | Network compliance audit: STIG findings, ACAS/Nessus vulnerability overlay, heat maps |
+| `/network/facilities` | Facilities management: rack layouts, power/cooling, cable tracking |
+| `/sre` | SRE Operations: runbook library, incident tracking, toil budgets, SLO monitoring |
+| `/pipeline` | Pipeline Canvas: visual CI/CD pipeline design with drag-and-drop stages |
 
 Auth: per-user API keys (SHA-256 hashed), 6 RBAC roles (admin, pm, developer, isso, co, cor). Optional BYOK (bring-your-own LLM keys) with AES-256 encryption.
 
@@ -752,6 +757,10 @@ icdev/
 │   ├── innovation/       # Autonomous self-improvement engine
 │   ├── creative/         # Customer-centric feature discovery
 │   ├── govcon/           # GovCon Intelligence — SAM.gov capture pipeline
+│   ├── network/          # Network Design Canvas — topology, ACAS/Nessus overlay, NL queries, cloud arch
+│   ├── infra/            # IaC generators — Terraform for AWS, Azure, GCP, OCI, IBM Cloud
+│   ├── sre/              # SRE Operations — runbooks, incident tracking, toil budgets, SLO monitoring
+│   ├── pipeline/         # Pipeline Canvas — visual CI/CD pipeline design
 │   └── ...               # 30+ more specialized categories
 ├── args/                 # 30+ YAML/JSON configuration files
 ├── context/              # 42 compliance catalogs, language profiles
@@ -766,6 +775,46 @@ icdev/
 
 ---
 
+## Network Design Canvas
+
+Interactive topology builder for designing, documenting, and auditing network architectures — from rack-level facilities to cloud-scale deployments.
+
+| Capability | Description |
+|------------|-------------|
+| **Topology Builder** | Drag-and-drop canvas with 200+ device types (routers, switches, firewalls, servers, IoT, OT/ICS) and automatic link routing |
+| **Cloud Architecture** | Generate cloud diagrams for all 6 CSPs — VPC/VNet/VCN, subnets, security groups, load balancers, managed services |
+| **ACAS/Nessus Overlay** | Import `.nessus` scan files, auto-match hosts to topology nodes, render vulnerability heat maps with severity badges |
+| **Natural Language Queries** | Ask plain-English questions about any topology ("What happens if Core-Switch goes down?", "Show all paths between A and B") — powered by deterministic graph algorithms with local LLM fallback |
+| **STIG Compliance Audit** | Per-device STIG finding tracking, CAT I/II/III severity, audit history, exportable checklists |
+| **Inventory Export** | Export device inventory to CSV, JSON, or YAML with filtering by type, location, STIG status |
+| **Facilities Management** | Rack elevation diagrams, power/cooling tracking, cable management |
+
+Air-gap safe — all JavaScript vendored locally (JointJS, D3, Backbone), zero CDN dependencies.
+
+---
+
+## SRE Operations
+
+Site Reliability Engineering dashboard for managing operational excellence:
+
+- **Runbook Library** — searchable runbook catalog with step-by-step procedures, linked to services and alerts
+- **Incident Tracking** — incident lifecycle from detection to postmortem, with timeline and impact analysis
+- **Toil Budgets** — track and reduce toil with per-team budgets and automation ROI tracking
+- **SLO Monitoring** — service level objective tracking with error budget burn-rate alerts
+
+---
+
+## Pipeline Canvas
+
+Visual CI/CD pipeline design tool with drag-and-drop stage composition:
+
+- Design pipelines visually with connected stages (build, test, scan, deploy, gate)
+- Export to GitLab CI and GitHub Actions YAML
+- Compliance gate integration — security scan and approval stages auto-inserted based on impact level
+- Template library for common patterns (TDD, DevSecOps, cATO continuous monitoring)
+
+---
+
 ## Testing
 
 ```bash

icdev-1.2.8/icdev/agents/53f10a9f/icdev_state.json

@@ -0,0 +1,6 @@
+{
+  "run_id": "53f10a9f",
+  "issue_number": "42",
+  "platform": "github",
+  "project_id": ""
+}

icdev-1.2.8/icdev/agents/6e20acf1/icdev_state.json

@@ -0,0 +1,6 @@
+{
+  "run_id": "6e20acf1",
+  "issue_number": "42",
+  "platform": "github",
+  "project_id": ""
+}

icdev-1.2.8/icdev/agents/72cb131a/icdev_state.json

@@ -0,0 +1,6 @@
+{
+  "run_id": "72cb131a",
+  "issue_number": "42",
+  "platform": "github",
+  "project_id": ""
+}

icdev-1.2.8/icdev/agents/b9326710/icdev_state.json

@@ -0,0 +1,6 @@
+{
+  "run_id": "b9326710",
+  "issue_number": "42",
+  "platform": "github",
+  "project_id": ""
+}

{icdev-1.2.6 → icdev-1.2.8}/icdev.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: icdev
-Version: 1.2.6
+Version: 1.2.8
 Summary: ICDEV™ — Intelligent Certified Development Platform. AI-powered SDLC with NIST 800-53 RMF compliance, multi-agent orchestration, FORGE framework, and ANVIL build workflow.
 Author: Sovanna Chuon
 License-Expression: Apache-2.0
@@ -90,6 +90,8 @@ Requires-Dist: diffusers>=0.27; extra == "image-gen"
 Requires-Dist: transformers>=4.36; extra == "image-gen"
 Requires-Dist: accelerate>=0.25; extra == "image-gen"
 Provides-Extra: network
+Requires-Dist: defusedxml>=0.7; extra == "network"
+Requires-Dist: networkx>=3.2; extra == "network"
 Provides-Extra: full
 Requires-Dist: icdev[llm-all,network,search,security,testing]; extra == "full"
 Provides-Extra: full-airgap
@@ -102,7 +104,7 @@ Dynamic: license-file
   <img src="https://img.shields.io/badge/license-Apache--2.0-blue" alt="License">
   <img src="https://img.shields.io/badge/python-3.9%2B-brightgreen" alt="Python 3.9+">
   <img src="https://img.shields.io/badge/compliance%20frameworks-42-orange" alt="Compliance Frameworks">
-  <img src="https://img.shields.io/badge/tools-500%2B-blueviolet" alt="Tools">
+  <img src="https://img.shields.io/badge/tools-530%2B-blueviolet" alt="Tools">
   <img src="https://img.shields.io/badge/agents-15-red" alt="Agents">
   <img src="https://img.shields.io/badge/languages-6-green" alt="Languages">
 </p>
@@ -664,7 +666,7 @@ The bottom line: **you don't need the original developers**. You don't need a te
 | **IBM** | Cloud for Government | watsonx.ai (Granite, Llama) |
 | **Local** | Air-Gapped | Ollama (Llama, Mistral, CodeGemma) |
 
-Generated applications connect to 100+ cloud-provider MCP servers automatically based on target CSP.
+All 6 providers have full **Infrastructure-as-Code generators** — Terraform modules with VPC/VNet/VCN networking, IAM, KMS encryption, container orchestration (EKS/AKS/GKE/OKE/IKS), and compliance-hardened defaults per cloud. Generated applications connect to 100+ cloud-provider MCP servers automatically based on target CSP.
 
 ---
 
@@ -748,6 +750,11 @@ python tools/dashboard/app.py
 | `/govcon` | GovCon Intelligence: SAM.gov scanning, pipeline status, domain distribution |
 | `/govcon/requirements` | Requirement pattern analysis: frequency, domain heatmap, trend detection |
 | `/govcon/capabilities` | ICDEV™ capability coverage: L/M/N grading, gaps, enhancement recommendations |
+| `/network/canvas` | Network Design Canvas: topology builder, drag-and-drop, cloud architecture diagrams |
+| `/network/compliance` | Network compliance audit: STIG findings, ACAS/Nessus vulnerability overlay, heat maps |
+| `/network/facilities` | Facilities management: rack layouts, power/cooling, cable tracking |
+| `/sre` | SRE Operations: runbook library, incident tracking, toil budgets, SLO monitoring |
+| `/pipeline` | Pipeline Canvas: visual CI/CD pipeline design with drag-and-drop stages |
 
 Auth: per-user API keys (SHA-256 hashed), 6 RBAC roles (admin, pm, developer, isso, co, cor). Optional BYOK (bring-your-own LLM keys) with AES-256 encryption.
 
@@ -852,6 +859,10 @@ icdev/
 │   ├── innovation/       # Autonomous self-improvement engine
 │   ├── creative/         # Customer-centric feature discovery
 │   ├── govcon/           # GovCon Intelligence — SAM.gov capture pipeline
+│   ├── network/          # Network Design Canvas — topology, ACAS/Nessus overlay, NL queries, cloud arch
+│   ├── infra/            # IaC generators — Terraform for AWS, Azure, GCP, OCI, IBM Cloud
+│   ├── sre/              # SRE Operations — runbooks, incident tracking, toil budgets, SLO monitoring
+│   ├── pipeline/         # Pipeline Canvas — visual CI/CD pipeline design
 │   └── ...               # 30+ more specialized categories
 ├── args/                 # 30+ YAML/JSON configuration files
 ├── context/              # 42 compliance catalogs, language profiles
@@ -866,6 +877,46 @@ icdev/
 
 ---
 
+## Network Design Canvas
+
+Interactive topology builder for designing, documenting, and auditing network architectures — from rack-level facilities to cloud-scale deployments.
+
+| Capability | Description |
+|------------|-------------|
+| **Topology Builder** | Drag-and-drop canvas with 200+ device types (routers, switches, firewalls, servers, IoT, OT/ICS) and automatic link routing |
+| **Cloud Architecture** | Generate cloud diagrams for all 6 CSPs — VPC/VNet/VCN, subnets, security groups, load balancers, managed services |
+| **ACAS/Nessus Overlay** | Import `.nessus` scan files, auto-match hosts to topology nodes, render vulnerability heat maps with severity badges |
+| **Natural Language Queries** | Ask plain-English questions about any topology ("What happens if Core-Switch goes down?", "Show all paths between A and B") — powered by deterministic graph algorithms with local LLM fallback |
+| **STIG Compliance Audit** | Per-device STIG finding tracking, CAT I/II/III severity, audit history, exportable checklists |
+| **Inventory Export** | Export device inventory to CSV, JSON, or YAML with filtering by type, location, STIG status |
+| **Facilities Management** | Rack elevation diagrams, power/cooling tracking, cable management |
+
+Air-gap safe — all JavaScript vendored locally (JointJS, D3, Backbone), zero CDN dependencies.
+
+---
+
+## SRE Operations
+
+Site Reliability Engineering dashboard for managing operational excellence:
+
+- **Runbook Library** — searchable runbook catalog with step-by-step procedures, linked to services and alerts
+- **Incident Tracking** — incident lifecycle from detection to postmortem, with timeline and impact analysis
+- **Toil Budgets** — track and reduce toil with per-team budgets and automation ROI tracking
+- **SLO Monitoring** — service level objective tracking with error budget burn-rate alerts
+
+---
+
+## Pipeline Canvas
+
+Visual CI/CD pipeline design tool with drag-and-drop stage composition:
+
+- Design pipelines visually with connected stages (build, test, scan, deploy, gate)
+- Export to GitLab CI and GitHub Actions YAML
+- Compliance gate integration — security scan and approval stages auto-inserted based on impact level
+- Template library for common patterns (TDD, DevSecOps, cATO continuous monitoring)
+
+---
+
 ## Testing
 
 ```bash

{icdev-1.2.6 → icdev-1.2.8}/icdev.egg-info/SOURCES.txt

@@ -84,6 +84,7 @@ icdev/agents/4bd08f26/icdev_state.json
 icdev/agents/502c2620/icdev_state.json
 icdev/agents/52b0c549/icdev_state.json
 icdev/agents/53af1c7c/icdev_state.json
+icdev/agents/53f10a9f/icdev_state.json
 icdev/agents/5591feb3/icdev_state.json
 icdev/agents/57cb40e0/icdev_state.json
 icdev/agents/592e21db/icdev_state.json
@@ -100,7 +101,9 @@ icdev/agents/6a8821ed/icdev_state.json
 icdev/agents/6b0b3b5e/icdev_state.json
 icdev/agents/6d3d8571/icdev_state.json
 icdev/agents/6d55504c/icdev_state.json
+icdev/agents/6e20acf1/icdev_state.json
 icdev/agents/70a40119/icdev_state.json
+icdev/agents/72cb131a/icdev_state.json
 icdev/agents/73e49da2/icdev_state.json
 icdev/agents/74ac7193/icdev_state.json
 icdev/agents/7592a3b5/icdev_state.json
@@ -158,6 +161,7 @@ icdev/agents/b2abf015/icdev_state.json
 icdev/agents/b36e5371/icdev_state.json
 icdev/agents/b635b4ec/icdev_state.json
 icdev/agents/b66298ee/icdev_state.json
+icdev/agents/b9326710/icdev_state.json
 icdev/agents/ba5a3813/icdev_state.json
 icdev/agents/bafcf1eb/icdev_state.json
 icdev/agents/bc9e4dc3/icdev_state.json
@@ -1496,6 +1500,7 @@ tests/test_source_extractor.py
 tests/test_spec_organizer.py
 tests/test_spec_quality_checker.py
 tests/test_sqlite_tracer.py
+tests/test_sre_modules.py
 tests/test_state_tracker.py
 tests/test_statement_extractor.py
 tests/test_swagger_ui.py

{icdev-1.2.6 → icdev-1.2.8}/icdev.egg-info/requires.txt

@@ -59,6 +59,8 @@ google-cloud-aiplatform>=1.40
 icdev[llm-local,search]
 
 [network]
+defusedxml>=0.7
+networkx>=3.2
 
 [saas]
 psycopg2-binary>=2.9

{icdev-1.2.6 → icdev-1.2.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "icdev"
-version = "1.2.6"
+version = "1.2.8"
 description = "ICDEV™ — Intelligent Certified Development Platform. AI-powered SDLC with NIST 800-53 RMF compliance, multi-agent orchestration, FORGE framework, and ANVIL build workflow."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -140,7 +140,10 @@ image-gen = [
 ]
 # Network Design Canvas — topology design, circuit tracking, compliance audit
 # Air-gap safe (all JS vendored locally, no CDN). Zero extra Python deps.
-network = []  # No extra deps — Flask/Jinja2/SQLite already in core
+network = [
+    "defusedxml>=0.7",   # Safe XML parsing for STIG import
+    "networkx>=3.2",     # Graph analysis for NL topology queries
+]
 # Everything (includes Google — NOT air-gap safe)
 full = [
     "icdev[llm-all,search,testing,security,network]",

{icdev-1.2.6 → icdev-1.2.8}/requirements.txt

@@ -25,6 +25,10 @@ python-dotenv>=1.0       # .env file loading
 numpy>=1.26              # Embedding math
 rank_bm25>=0.2           # BM25 keyword search
 
+# === Network Design Canvas ===
+defusedxml>=0.7          # Safe XML parsing for STIG import (XXE protection)
+networkx>=3.2            # Graph analysis for topology NL query engine
+
 # === Security Scanning ===
 # bandit>=1.7             # Python SAST (install per project)
 # pip-audit>=2.6          # Dependency auditing (install per project)