platformforge 0.1.0__py3-none-any.whl

platformforge/data/evals/qpt-bench/iam-investigate/case.yaml

@@ -0,0 +1,5 @@
+id: iam-investigate
+task: "iam investigation — wildcard, privilege escalation, public principal"
+domain: iam
+fixture: fixture/policy.json
+budget: 50000

platformforge/data/evals/qpt-bench/iam-investigate/fixture/policy.json

@@ -0,0 +1,6 @@
+{"PolicyName": "deployer", "Version": "2012-10-17",
+ "Statement": [
+   {"Effect": "Allow", "Action": "*", "Resource": "*"},
+   {"Effect": "Allow", "Principal": {"AWS": "*"},
+    "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::123:role/x"}
+ ]}

platformforge/data/evals/qpt-bench/incident-analysis/case.yaml

@@ -0,0 +1,5 @@
+id: incident-analysis
+task: "incident evidence analysis — burn rate + availability series"
+domain: prometheus
+fixture: fixture
+budget: 50000

platformforge/data/evals/qpt-bench/incident-analysis/fixture/query.json

@@ -0,0 +1,5 @@
+{"status":"success","data":{"result":[
+ {"metric":{"__name__":"http_requests_total","job":"api","code":"500"},
+  "value":[1700000000,"4201"]},
+ {"metric":{"__name__":"up","job":"api"},"value":[1700000000,"0"]}
+]}}

platformforge/data/evals/qpt-bench/incident-analysis/fixture/rules.yaml

@@ -0,0 +1,6 @@
+groups:
+  - name: availability
+    rules:
+      - alert: ApiDown
+        expr: up{job="api"} == 0
+        for: 5m

platformforge/data/evals/qpt-bench/k8s-review/case.yaml

@@ -0,0 +1,6 @@
+id: k8s-review
+task: "kubernetes workload review — limits, probes, pdb, security context"
+domain: k8s
+fixture: fixture
+versions: {kubernetes: "1.29"}
+budget: 50000

platformforge/data/evals/qpt-bench/k8s-review/fixture/deploy.yaml

@@ -0,0 +1,15 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+  namespace: prod
+spec:
+  replicas: 3
+  selector: {matchLabels: {app: web}}
+  template:
+    metadata: {labels: {app: web}}
+    spec:
+      containers:
+        - name: web
+          image: registry/web:latest
+          securityContext: {privileged: true}

platformforge/data/evals/qpt-bench/tf-security/case.yaml

@@ -0,0 +1,5 @@
+id: tf-security
+task: "terraform security review — public ingress + unencrypted"
+domain: iac
+fixture: fixture
+budget: 50000

platformforge/data/evals/qpt-bench/tf-security/fixture/main.tf

@@ -0,0 +1,17 @@
+resource "aws_security_group" "web" {
+  name = "web-sg"
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+resource "aws_s3_bucket" "data" {
+  bucket = "corp-data"
+}
+resource "aws_db_instance" "db" {
+  engine         = "postgres"
+  instance_class = "db.t3.micro"
+  storage_encrypted = false
+}

platformforge/data/knowledge/aws/eks.yaml

@@ -0,0 +1,20 @@
+schema: platformforge/knowledge/v1
+id: aws-eks
+domain: aws
+applies_to:
+  versions: [eks]
+sources: [aws-eks-docs]
+claims:
+  - id: eks-support-window
+    statement: "EKS supports a Kubernetes version for ~14 months standard
+      plus ~12 months extended support (at added cost); control-plane
+      version determines which deprecated APIs are served."
+    versions: {}
+  - id: eks-oidc-irsa
+    statement: "IAM Roles for Service Accounts trust the cluster OIDC
+      provider; the role trust must pin system:serviceaccount:<ns>:<name>
+      in the sub condition."
+    versions: {}
+used_by:
+  rules: [PF-SEC-043]
+  analyzers: [cloud-aws, k8s]

platformforge/data/knowledge/aws/iam.yaml

@@ -0,0 +1,28 @@
+schema: platformforge/knowledge/v1
+id: aws-iam
+domain: aws
+applies_to: {}
+sources: [aws-iam-docs]
+claims:
+  - id: iam-wildcard-action
+    statement: "Action '*' or 'service:*' grants every current and future
+      action in scope — least-privilege requires enumerating actions."
+    versions: {}
+  - id: iam-public-principal
+    statement: "Principal '*' or a public ARN makes the resource reachable
+      by any AWS principal; resource policies need scoping plus
+      aws:PrincipalOrgID or similar condition."
+    versions: {}
+  - id: iam-wildcard-resource
+    statement: "Resource '*' is acceptable only for actions that do not
+      support resource-level permissions; everywhere else it defeats
+      least privilege."
+    versions: {}
+  - id: iam-oidc-federation
+    statement: "OIDC trust policies (token.actions.githubusercontent.com,
+      EKS oidc-provider) must constrain sub/aud via condition keys —
+      an unconstrained trust lets any repo/cluster workload assume."
+    versions: {}
+used_by:
+  rules: [PF-SEC-001, PF-SEC-002, PF-SEC-003, PF-SEC-043]
+  analyzers: [iam, cloud-aws]

platformforge/data/knowledge/aws/network-exposure.yaml

@@ -0,0 +1,19 @@
+schema: platformforge/knowledge/v1
+id: aws-network-exposure
+domain: aws
+applies_to: {}
+sources: [aws-vpc-docs, aws-s3-docs]
+claims:
+  - id: sg-world-ingress
+    statement: "Security group ingress from 0.0.0.0/0 or ::/0 exposes the
+      port to the internet; admin ports (22, 3389, 6379, 5432...) amplify
+      the blast radius."
+    versions: {}
+  - id: s3-public-acl
+    statement: "S3 public ACLs (public-read, public-read-write,
+      authenticated-read) bypass bucket policy intent; Block Public
+      Access is the account-level guardrail."
+    versions: {}
+used_by:
+  rules: [PF-IAC-001, PF-IAC-002, PF-IAC-003]
+  analyzers: [iac, cloud-aws]

platformforge/data/knowledge/aws/organizations.yaml

@@ -0,0 +1,19 @@
+schema: platformforge/knowledge/v1
+id: aws-organizations
+domain: aws
+applies_to: {}
+sources: [aws-organizations-docs]
+claims:
+  - id: org-account-isolation
+    statement: "Organization account boundaries are the strong isolation
+      primitive for workload separation; SCPs bound what member accounts
+      can do even for their root user."
+    versions: {}
+  - id: org-tag-allocation
+    statement: "Cost allocation across an organization depends on
+      consistent tags/cost categories; untagged spend lands in the
+      unallocated bucket and breaks chargeback."
+    versions: {}
+used_by:
+  rules: [PF-FIN-001]
+  analyzers: [cloud-aws]

platformforge/data/knowledge/crossplane/composition-providers.yaml

@@ -0,0 +1,20 @@
+schema: platformforge/knowledge/v1
+id: crossplane-composition-providers
+domain: crossplane
+applies_to: {}
+sources: [crossplane-docs]
+claims:
+  - id: composition-pipeline
+    statement: "A Composition in Pipeline mode runs function steps
+      (functionRef) that transform desired state; classic mode lists
+      static resource templates. The XR selects it via
+      spec.compositionRef."
+    versions: {}
+  - id: provider-revisions
+    statement: "Provider installs create ProviderRevision objects pinned
+      to an xpkg image; revisionActivationPolicy Automatic upgrades
+      in-place, Manual requires approval — relevant for change review."
+    versions: {}
+used_by:
+  rules: [PF-XR-001]
+  analyzers: [crossplane]

platformforge/data/knowledge/crossplane/managed-resources.yaml

@@ -0,0 +1,26 @@
+schema: platformforge/knowledge/v1
+id: crossplane-managed-resources
+domain: crossplane
+applies_to:
+  versions: [crossplane]
+sources: [crossplane-docs]
+claims:
+  - id: mr-shape
+    statement: "A managed resource carries spec.forProvider plus
+      providerConfigRef/managementPolicies; status.atProvider mirrors the
+      observed external state. Group suffix alone does not make an object
+      an MR — the spec shape does."
+    versions: {}
+  - id: mr-deletion-policy
+    statement: "deletionPolicy: Delete deletes the external resource when
+      the MR is deleted; Orphan keeps it. Data-bearing resources without
+      Orphan risk data loss on claim deletion."
+    versions: {}
+  - id: mr-management-policies
+    statement: "managementPolicies controls which reconcile actions
+      Crossplane performs (Observe/Create/Update/Delete/LateInitialize);
+      Observe-only is the import path for pre-existing resources."
+    versions: {crossplane: ">=1.14"}
+used_by:
+  rules: [PF-XR-001]
+  analyzers: [crossplane]

platformforge/data/knowledge/crossplane/v1-v2.yaml

@@ -0,0 +1,25 @@
+schema: platformforge/knowledge/v1
+id: crossplane-v1-vs-v2
+domain: crossplane
+applies_to:
+  versions: [crossplane]
+sources: [crossplane-docs]
+claims:
+  - id: xpv2-namespaced-xr
+    statement: "Crossplane v2 makes composite resources namespaced by
+      default (XRD spec.scope: Namespaced) and removes claims as a
+      separate object — the XR is consumed directly."
+    versions: {crossplane: ">=2.0"}
+  - id: xpv1-claims
+    statement: "In Crossplane v1 an XRD may declare claimNames — a
+      namespaced Claim that binds to a cluster-scoped XR;
+      connectionSecretKeys materialize the connection secret."
+    versions: {crossplane: "<2.0"}
+  - id: xpv2-providerconfig-groups
+    statement: "v2 moves ProviderConfig kinds out of pkg.crossplane.io
+      into provider family groups (e.g. aws.upbound.io) — group, not
+      kind, carries the provider identity."
+    versions: {crossplane: ">=2.0"}
+used_by:
+  rules: []
+  analyzers: [crossplane]

platformforge/data/knowledge/kubernetes/api-deprecations.yaml

@@ -0,0 +1,33 @@
+schema: platformforge/knowledge/v1
+id: kubernetes-api-deprecations
+domain: kubernetes
+applies_to:
+  versions: [kubernetes]
+sources: [kubernetes-docs]
+claims:
+  - id: k8s-dep-v122
+    statement: "extensions/v1beta1 and apps/v1beta1/v1beta2 Ingress,
+      networkpolicy/v1beta1 PodSecurityPolicy and policy/v1beta1
+      PodDisruptionBudget were removed in Kubernetes 1.22+; manifests must
+      use networking.k8s.io/v1, policy/v1 and stable workload APIs."
+    versions: {kubernetes: ">=1.22"}
+  - id: k8s-dep-v125
+    statement: "policy/v1beta1 PodDisruptionBudget and PodSecurityPolicy were
+      removed in 1.25; batch/v1beta1 CronJob in 1.25. Use policy/v1 and
+      batch/v1."
+    versions: {kubernetes: ">=1.25"}
+  - id: k8s-dep-v126-v129
+    statement: "FlowSchema/PriorityLevelConfiguration moved to
+      flowcontrol.apiserver.k8s.io/v1beta3 in 1.26; CSIStorageCapacity
+      storage.k8s.io/v1beta1 removed in 1.27; HorizontalPodAutoscaler
+      autoscaling/v2beta2 removed in 1.26 (use autoscaling/v2)."
+    versions: {kubernetes: ">=1.26"}
+  - id: k8s-beta-track
+    statement: "Beta APIs follow a deprecation track: introduced in beta,
+      removed ~9 months after the GA replacement ships. Serving a beta
+      apiVersion is a version-dependent risk, decidable only when the
+      cluster version is known."
+    versions: {}
+used_by:
+  rules: [PF-K8S-030, PF-K8S-031, PF-K8S-032]
+  analyzers: [k8s]

platformforge/data/knowledge/kubernetes/autoscaling-rbac.yaml

@@ -0,0 +1,27 @@
+schema: platformforge/knowledge/v1
+id: kubernetes-autoscaling-rbac
+domain: kubernetes
+applies_to:
+  versions: [kubernetes]
+sources: [kubernetes-docs, keda-docs, karpenter-docs]
+claims:
+  - id: hpa-needs-requests
+    statement: "HorizontalPodAutoscaler scales on utilization relative to
+      resource requests; a target without requests computes a meaningless
+      percentage and the HPA cannot make progress."
+    versions: {}
+  - id: hpa-v2-ga
+    statement: "autoscaling/v2 is stable since 1.23 and supports memory and
+      custom metrics; autoscaling/v2beta2 was removed in 1.26."
+    versions: {kubernetes: ">=1.26"}
+  - id: rbac-wildcards
+    statement: "RBAC '*' in verbs or resources grants all present and future
+      permissions in the group — wildcard rules survive API additions."
+    versions: {}
+  - id: cluster-admin-binding
+    statement: "Binding cluster-admin to a service account or group gives
+      unrestricted cluster control including RBAC mutation itself."
+    versions: {}
+used_by:
+  rules: [PF-K8S-020, PF-K8S-021, PF-K8S-022]
+  analyzers: [k8s]

platformforge/data/knowledge/kubernetes/gateway-api.yaml

@@ -0,0 +1,20 @@
+schema: platformforge/knowledge/v1
+id: kubernetes-gateway-api
+domain: kubernetes
+applies_to:
+  versions: [kubernetes]
+sources: [gateway-api, kubernetes-docs]
+claims:
+  - id: gw-listener-tls
+    statement: "A Gateway listener with protocol HTTPS without
+      certificateRefs terminates nothing; listeners on 443 require TLS
+      material. HTTP listeners need explicit redirect semantics."
+    versions: {}
+  - id: gw-ga-track
+    statement: "Gateway API v1.0 GA'd Gateway, GatewayClass and HTTPRoute
+      (v1); TCPRoute/UDPRoute/TLSRoute/GRPCRoute remained experimental or
+      moved to GA in v1.2+ — check channel (standard vs experimental)."
+    versions: {}
+used_by:
+  rules: [PF-K8S-023, PF-K8S-010]
+  analyzers: [k8s]

platformforge/data/knowledge/kubernetes/pod-security.yaml

@@ -0,0 +1,26 @@
+schema: platformforge/knowledge/v1
+id: kubernetes-pod-security
+domain: kubernetes
+applies_to:
+  versions: [kubernetes]
+sources: [kubernetes-docs]
+claims:
+  - id: pss-baseline
+    statement: "Pod Security Standards baseline forbids privileged
+      containers, hostNetwork/hostPID/hostIPC sharing, and
+      hostPath volumes; restricted additionally requires
+      runAsNonRoot, seccomp and dropped capabilities."
+    versions: {kubernetes: ">=1.23"}
+  - id: pss-psa-replaced-psp
+    statement: "PodSecurityPolicy was removed in 1.25; Pod Security
+      Admission (pod-security.kubernetes.io/* namespace labels) is the
+      built-in enforcement mechanism."
+    versions: {kubernetes: ">=1.25"}
+  - id: sa-token-automount
+    statement: "automountServiceAccountToken defaults to true; a pod that
+      does not need the API should set it false — the token is a
+      credential mounted at a known path."
+    versions: {}
+used_by:
+  rules: [PF-K8S-004, PF-K8S-005, PF-K8S-006, PF-K8S-007]
+  analyzers: [k8s]