platformforge 0.1.0__py3-none-any.whl

platformforge/data/evals/cases/fleet-inv-history-window-deterministic/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-history-window-deterministic
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: history-window-deterministic

platformforge/data/evals/cases/fleet-inv-low-util-not-deletable/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-low-util-not-deletable
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: low-util-not-deletable

platformforge/data/evals/cases/fleet-inv-member-key-deterministic/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-member-key-deterministic
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: member-key-deterministic

platformforge/data/evals/cases/fleet-inv-missing-denominator/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-missing-denominator
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: missing-denominator

platformforge/data/evals/cases/fleet-inv-partial-coverage-visible/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-partial-coverage-visible
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: partial-coverage-visible

platformforge/data/evals/cases/fleet-inv-plan-changeintent-only/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-plan-changeintent-only
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: plan-changeintent-only

platformforge/data/evals/cases/fleet-inv-report-all-cited/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-report-all-cited
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: fleet-report-all-cited

platformforge/data/evals/cases/fleet-inv-small-sample-confidence/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-small-sample-confidence
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: small-sample-confidence

platformforge/data/evals/cases/fleet-inv-uncertain-optimization-suppressed/case.yaml

@@ -0,0 +1,7 @@
+id: fleet-inv-uncertain-optimization-suppressed
+type: live
+variant: boundary
+domain: fleet
+expect:
+  check: fleet-invariant
+  probe: uncertain-optimization-suppressed

platformforge/data/evals/cases/gha-dangerous/case.yaml

@@ -0,0 +1,12 @@
+id: gha-dangerous
+type: golden
+variant: positive
+domain: gha
+fixture: fixture
+expect:
+  rules_fired:
+    - PF-CICD-001   # third-party action not SHA-pinned
+    - PF-CICD-002   # pull_request_target privileged trigger
+    - PF-CICD-003   # untrusted context in run
+    - PF-CICD-004   # write-all permissions
+    - PF-CICD-005   # self-hosted + dangerous trigger

platformforge/data/evals/cases/gha-dangerous/fixture/.github/workflows/ci.yaml

@@ -0,0 +1,11 @@
+name: ci
+on:
+  pull_request_target:
+jobs:
+  build:
+    runs-on: self-hosted
+    permissions: write-all
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/build-push-action@master
+      - run: echo "${{ github.event.pull_request.title }}"

platformforge/data/evals/cases/gitops-v2/case.yaml

@@ -0,0 +1,11 @@
+id: gitops-v2
+type: golden
+variant: positive
+domain: gitops
+fixture: fixture
+expect:
+  rules_fired:
+    - PF-GITOPS-010   # flux suspended
+    - PF-GITOPS-020   # app unscoped to project
+    - PF-GITOPS-021   # AppProject no source restrictions
+    - PF-GITOPS-022   # ApplicationSet no generators

platformforge/data/evals/cases/gitops-v2/fixture/argo.yaml

@@ -0,0 +1,41 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: unscoped
+  namespace: argocd
+spec:
+  source:
+    repoURL: https://git.example.com/app.git
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: prod
+---
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: open
+  namespace: argocd
+spec:
+  description: no restrictions
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: empty
+  namespace: argocd
+spec:
+  generators: []
+  template:
+    spec: {}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: suspended
+  namespace: flux-system
+spec:
+  suspend: true
+  interval: 5m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

platformforge/data/evals/cases/graph-k8s-blast/case.yaml

@@ -0,0 +1,7 @@
+id: graph-k8s-blast
+type: graph_correctness
+domain: k8s
+fixture: fixture
+expect:
+  node: workload/prod/api
+  dependents_of: []

platformforge/data/evals/cases/graph-k8s-blast/fixture/deploy.yaml

@@ -0,0 +1,15 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata: {name: api, namespace: prod}
+spec:
+  replicas: 3
+  selector: {matchLabels: {app: api}}
+  template:
+    metadata: {labels: {app: api}}
+    spec:
+      containers:
+      - name: api
+        image: api:2.0
+        resources:
+          requests: {cpu: 100m}
+          limits: {cpu: 500m}

platformforge/data/evals/cases/iac-module-nopin/case.yaml

@@ -0,0 +1,8 @@
+id: iac-module-nopin
+type: golden
+variant: positive
+case_of: PF-IAC-020
+domain: iac
+fixture: fixture
+expect:
+  rules_fired: [PF-IAC-020]

platformforge/data/evals/cases/iac-module-nopin/fixture/main.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+}

platformforge/data/evals/cases/iac-plan-replace/case.yaml

@@ -0,0 +1,8 @@
+id: iac-plan-replace
+type: golden
+variant: positive
+case_of: PF-IAC-011
+domain: plan
+fixture: fixture
+expect:
+  rules_fired: [PF-IAC-011]

platformforge/data/evals/cases/iac-plan-replace/fixture/plan.json

@@ -0,0 +1,12 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.7.0",
+  "resource_changes": [
+    {"address": "aws_db_instance.main", "type": "aws_db_instance",
+     "name": "main",
+     "change": {"actions": ["delete", "create"]}},
+    {"address": "aws_s3_bucket.logs", "type": "aws_s3_bucket",
+     "name": "logs",
+     "change": {"actions": ["update"]}}
+  ]
+}

platformforge/data/evals/cases/iac-sg-open/case.yaml

@@ -0,0 +1,8 @@
+id: iac-sg-open
+type: golden
+variant: positive
+case_of: PF-IAC-002
+domain: iac
+fixture: fixture
+expect:
+  rules_fired: [PF-IAC-002]

platformforge/data/evals/cases/iac-sg-open/fixture/main.tf

@@ -0,0 +1,9 @@
+resource "aws_security_group" "wide" {
+  name = "wide"
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}

platformforge/data/evals/cases/iam-oidc/case.yaml

@@ -0,0 +1,8 @@
+id: iam-oidc
+type: golden
+variant: positive
+case_of: PF-SEC-043
+domain: iam
+fixture: fixture
+expect:
+  rules_fired: [PF-SEC-043]

platformforge/data/evals/cases/iam-oidc/fixture/policy.json

@@ -0,0 +1,11 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"},
+      "Action": "sts:AssumeRoleWithWebIdentity",
+      "Condition": {"StringEquals": {"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"}}
+    }
+  ]
+}

platformforge/data/evals/cases/iam-wildcard-positive/case.yaml

@@ -0,0 +1,8 @@
+id: iam-wildcard-positive
+type: golden
+variant: positive
+case_of: PF-SEC-001
+domain: iam
+fixture: fixture
+expect:
+  rules_fired: [PF-SEC-001]

platformforge/data/evals/cases/iam-wildcard-positive/fixture/policy.json

@@ -0,0 +1,3 @@
+{"Version": "2012-10-17",
+ "Statement": [{"Effect": "Allow", "Principal": {"AWS": "*"},
+                "Action": "*", "Resource": "*"}]}

platformforge/data/evals/cases/k8s-bad-actor/case.yaml

@@ -0,0 +1,19 @@
+id: k8s-bad-actor
+type: golden
+variant: positive
+domain: k8s
+fixture: fixture
+expect:
+  rules_fired:
+    - PF-K8S-005   # root possible (no runAsNonRoot)
+    - PF-K8S-006   # hostNetwork
+    - PF-K8S-007   # automounted SA token
+    - PF-K8S-009   # hardcoded env secret
+    - PF-K8S-010   # ingress no TLS
+    - PF-K8S-013   # secret keys in manifest
+    - PF-K8S-021   # wildcard RBAC
+    - PF-K8S-022   # cluster-admin binding
+    - PF-K8S-023   # gateway plain HTTP
+    - PF-K8S-024   # canary without analysis
+    - PF-K8S-025   # 2 replicas, no spread
+    - PF-K8S-026   # PVC no storage class

platformforge/data/evals/cases/k8s-bad-actor/fixture/app.yaml

@@ -0,0 +1,97 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bad
+  namespace: prod
+spec:
+  replicas: 2
+  template:
+    spec:
+      hostNetwork: true
+      automountServiceAccountToken: true
+      containers:
+        - name: app
+          image: registry/app:1.0.0
+          env:
+            - name: DB_PASSWORD
+              value: "supersecretvalue123"
+          resources:
+            requests: {cpu: 100m}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bad
+  namespace: prod
+spec:
+  rules:
+    - host: bad.example.com
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: creds
+  namespace: prod
+data:
+  password: aHVudGVyMg==
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-bind
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: sa
+    namespace: prod
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: wild
+rules:
+  - verbs: ["*"]
+    resources: ["*"]
+    apiGroups: ["*"]
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gw
+  namespace: prod
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+  name: canary-noanalysis
+  namespace: prod
+spec:
+  replicas: 3
+  strategy:
+    canary:
+      steps:
+        - setWeight: 50
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry/app:1.0.0
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+  namespace: prod
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 10Gi

platformforge/data/evals/cases/k8s-beta-api/case.yaml

@@ -0,0 +1,8 @@
+id: k8s-beta-api
+type: golden
+variant: positive
+case_of: PF-K8S-032
+domain: k8s
+fixture: fixture
+expect:
+  rules_fired: [PF-K8S-032]

platformforge/data/evals/cases/k8s-beta-api/fixture/cr.yaml

@@ -0,0 +1,7 @@
+apiVersion: app.example.io/v1beta1
+kind: Widget
+metadata:
+  name: sample
+  namespace: prod
+spec:
+  size: 2

platformforge/data/evals/cases/k8s-dep-api-boundary/case.yaml

@@ -0,0 +1,15 @@
+id: k8s-dep-api-boundary
+type: version
+variant: boundary
+case_of: PF-K8S-030
+domain: k8s
+fixture: fixture
+# kubernetes exactly at the PF-K8S-030 floor (>=1.22): satisfied → the
+# rule evaluates and violates (extensions/v1beta1 removed in 1.16).
+# PF-K8S-031 requires >=1.24 → version-mismatch skip at 1.22.
+versions: {kubernetes: "1.22"}
+expect:
+  rules_fired: [PF-K8S-030]
+  rules_skipped:
+    - PF-K8S-031: version-mismatch
+  rules_not_fired: [PF-K8S-031]

platformforge/data/evals/cases/k8s-dep-api-boundary/fixture/app.yaml

@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry/app:1.4.2
+          resources:
+            requests: {cpu: 100m}
+            limits: {cpu: 500m}
+---
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app: legacy-app}

platformforge/data/evals/cases/k8s-dep-api-clean/case.yaml

@@ -0,0 +1,12 @@
+id: k8s-dep-api-clean
+type: version
+variant: version
+case_of: PF-K8S-030
+domain: k8s
+fixture: fixture
+# known-compatible NEGATIVE: version declared and satisfying, but the
+# fixture uses only served APIs → both rules evaluate to `passed`,
+# not violated and not unresolved.
+versions: {kubernetes: "1.29"}
+expect:
+  passed: [PF-K8S-030, PF-K8S-031]

platformforge/data/evals/cases/k8s-dep-api-clean/fixture/app.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: modern-app
+  namespace: prod
+spec:
+  replicas: 2
+  selector:
+    matchLabels: {app: modern}
+  template:
+    metadata:
+      labels: {app: modern}
+    spec:
+      containers:
+        - name: app
+          image: registry/app:2.0.0
+          resources:
+            requests: {cpu: 100m, memory: 128Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: modern-app
+  namespace: prod
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app: modern}

platformforge/data/evals/cases/k8s-dep-api-unknown/case.yaml

@@ -0,0 +1,11 @@
+id: k8s-dep-api-unknown
+type: version
+variant: unresolved
+case_of: PF-K8S-030
+domain: k8s
+fixture: fixture
+# no versions declared → gated rules produce status=unresolved findings
+# carrying refusal metadata, never passed/violated (cycle 2.1 §13–22)
+expect:
+  unresolved: [PF-K8S-030, PF-K8S-031]
+  rules_not_fired: [PF-K8S-030, PF-K8S-031]

platformforge/data/evals/cases/k8s-dep-api-unknown/fixture/app.yaml

@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry/app:1.4.2
+          resources:
+            requests: {cpu: 100m}
+            limits: {cpu: 500m}
+---
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app: legacy-app}

platformforge/data/evals/cases/k8s-dep-api-v120/case.yaml

@@ -0,0 +1,12 @@
+id: k8s-dep-api-v120
+type: version
+variant: version
+case_of: PF-K8S-030
+domain: k8s
+fixture: fixture
+versions: {kubernetes: "1.20"}
+expect:
+  rules_skipped:
+    - PF-K8S-030: version-mismatch
+    - PF-K8S-031: version-mismatch
+  rules_not_fired: [PF-K8S-030, PF-K8S-031]

platformforge/data/evals/cases/k8s-dep-api-v120/fixture/app.yaml

@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry/app:1.4.2
+          resources:
+            requests: {cpu: 100m}
+            limits: {cpu: 500m}
+---
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app: legacy-app}

platformforge/data/evals/cases/k8s-dep-api-v129/case.yaml

@@ -0,0 +1,9 @@
+id: k8s-dep-api-v129
+type: version
+variant: version
+case_of: PF-K8S-031
+domain: k8s
+fixture: fixture
+versions: {kubernetes: "1.29"}
+expect:
+  rules_fired: [PF-K8S-030, PF-K8S-031]

platformforge/data/evals/cases/k8s-dep-api-v129/fixture/app.yaml

@@ -0,0 +1,25 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry/app:1.4.2
+          resources:
+            requests: {cpu: 100m}
+            limits: {cpu: 500m}
+---
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: legacy-app
+  namespace: prod
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app: legacy-app}

platformforge/data/evals/cases/k8s-hpa-noreq/case.yaml

@@ -0,0 +1,8 @@
+id: k8s-hpa-noreq
+type: golden
+variant: positive
+case_of: PF-K8S-020
+domain: k8s
+fixture: fixture
+expect:
+  rules_fired: [PF-K8S-020]   # HPA target lacks requests

platformforge/data/evals/cases/k8s-hpa-noreq/fixture/app.yaml

@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: noreq
+  namespace: prod
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: app
+          image: registry/app:1.0.0
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: noreq
+  namespace: prod
+spec:
+  minReplicas: 2
+  maxReplicas: 10
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: noreq
+  metrics:
+    - type: Resource
+      resource: {name: cpu}

platformforge/data/evals/cases/k8s-limits-boundary/case.yaml

@@ -0,0 +1,10 @@
+id: k8s-limits-boundary
+type: golden
+variant: boundary
+case_of: PF-K8S-002
+domain: k8s
+fixture: fixture
+# boundary: limits set (002 silent) but single-replica (011 fires)
+expect:
+  rules_fired: [PF-K8S-011]
+  rules_not_fired: [PF-K8S-002]