platformforge 0.1.0__py3-none-any.whl

platformforge/data/rules/catalog/k8s.yaml

@@ -0,0 +1,322 @@
+# Kubernetes rules — the analyzer computes cross-resource coverage attrs
+# (pdb_count, netpol_count) so rules stay per-fact. Convention: PF-K8S-NNN.
+rules:
+  - rule_id: PF-K8S-001
+    domain: k8s
+    title: "Image pinned to :latest or untagged"
+    severity: medium
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.latest_tag, op: equals, value: true}
+    message: "mutable tags break reproducibility and rollback"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/containers/images#image-names"
+
+  - rule_id: PF-K8S-002
+    domain: k8s
+    title: "Container without resource limits"
+    severity: high
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.no_limits, op: gt, value: 0}
+    message: "unbounded containers enable noisy-neighbor OOM/CPU starvation"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/configuration/manage-resources-containers"
+
+  - rule_id: PF-K8S-003
+    domain: k8s
+    title: "Container without health probes"
+    severity: medium
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.no_probes, op: gt, value: 0}
+    message: "unprobed containers hide dead-but-running failures"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes"
+
+  - rule_id: PF-K8S-004
+    domain: k8s
+    title: "Privileged container"
+    severity: critical
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.privileged, op: equals, value: true}
+    message: "privileged containers have near-node-root capability"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/security/pod-security-standards#restricted"
+
+  - rule_id: PF-K8S-005
+    domain: k8s
+    title: "Workload may run as root"
+    severity: high
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.run_as_non_root_set, op: equals,
+           value: false}
+        - {path: attrs.pod_spec.run_as_root, op: equals, value: false}
+        - {path: attrs.kind, op: in, value: [Deployment, StatefulSet, DaemonSet]}
+    message: "no runAsNonRoot set — root execution not prevented"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/security/pod-security-standards#restricted"
+
+  - rule_id: PF-K8S-006
+    domain: k8s
+    title: "Host network/PID/IPC namespace shared"
+    severity: high
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      any:
+        - {path: attrs.pod_spec.host_network, op: equals, value: true}
+        - {path: attrs.pod_spec.host_pid, op: equals, value: true}
+        - {path: attrs.pod_spec.host_ipc, op: equals, value: true}
+    message: "host namespaces break pod isolation"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/security/pod-security-standards#baseline"
+
+  - rule_id: PF-K8S-007
+    domain: k8s
+    title: "Service-account token auto-mounted"
+    severity: medium
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.automount_token, op: equals, value: true}
+    message: "automounted tokens expand credential theft blast radius"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/tasks/configure-pod-container/configure-service-account"
+
+  - rule_id: PF-K8S-008
+    domain: k8s
+    title: "Deployment without PodDisruptionBudget"
+    severity: medium
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.kind, op: in, value: [Deployment, StatefulSet]}
+        - {path: attrs.pdb_count, op: equals, value: 0}
+        - {path: attrs.replicas, op: gt, value: 0}
+    message: "voluntary disruptions can take the workload to zero"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/tasks/run-application/configure-pdb"
+
+  - rule_id: PF-K8S-009
+    domain: k8s
+    title: "Secret-looking value hardcoded in env"
+    severity: critical
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.pod_spec.env_hardcoded_secret, op: not_empty}
+    message: "env values are plaintext in etcd, manifests and logs"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/configuration/secret#using-secrets-as-environment-variables"
+
+  - rule_id: PF-K8S-010
+    domain: k8s
+    title: "Ingress without TLS"
+    severity: high
+    applies_to: {fact_kind: k8s.ingress}
+    conditions:
+      all:
+        - {path: attrs.tls, op: equals, value: false}
+    message: "plaintext ingress terminates credentials in cleartext"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/services-networking/ingress#tls"
+
+  - rule_id: PF-K8S-011
+    domain: k8s
+    title: "Single-replica workload"
+    severity: low
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.kind, op: equals, value: Deployment}
+        - {path: attrs.replicas, op: lte, value: 1}
+    message: "one replica = no availability through node failure"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/workloads/controllers/deployment#pod-template"
+
+  - rule_id: PF-K8S-012
+    domain: k8s
+    title: "Workload without NetworkPolicy"
+    severity: medium
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.netpol_count, op: equals, value: 0}
+    message: "no pod-level network segmentation declared"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/services-networking/network-policies"
+
+  - rule_id: PF-K8S-013
+    domain: k8s
+    title: "Secret keys present in manifest"
+    severity: info
+    applies_to: {fact_kind: k8s.secret}
+    conditions:
+      all:
+        - {path: attrs.keys, op: not_empty}
+    message: "manifest-held secrets should move to ESO/Vault"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/configuration/secret#caution"
+
+  - rule_id: PF-K8S-020
+    domain: k8s
+    title: "HPA target without resource requests"
+    severity: high
+    applies_to: {fact_kind: k8s.hpa}
+    conditions:
+      all:
+        - {path: attrs.target_known, op: equals, value: true}
+        - {path: attrs.target_has_requests, op: equals, value: false}
+    message: "CPU-based autoscaling requires requests on the target workload"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/tasks/run-application/horizontal-pod-autoscale#algorithm-details"
+
+  - rule_id: PF-K8S-021
+    domain: k8s
+    title: "RBAC wildcard verbs or resources"
+    severity: high
+    applies_to: {fact_kind: k8s.rbac}
+    conditions:
+      any:
+        - {path: attrs.wildcard_verbs, op: equals, value: true}
+        - {path: attrs.wildcard_resources, op: equals, value: true}
+    message: "wildcard grants are overbroad and hard to audit"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/reference/access-authn-authz/rbac#role-examples"
+
+  - rule_id: PF-K8S-022
+    domain: k8s
+    title: "Binding to cluster-admin"
+    severity: critical
+    applies_to: {fact_kind: k8s.rbac}
+    conditions:
+      all:
+        - {path: attrs.binds_cluster_admin, op: equals, value: true}
+    message: "cluster-admin grants unrestricted control of the cluster"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/reference/access-authn-authz/rbac#default-roles-and-role-bindings"
+
+  - rule_id: PF-K8S-023
+    domain: k8s
+    title: "Gateway listener without TLS"
+    severity: medium
+    applies_to: {fact_kind: k8s.gateway}
+    conditions:
+      all:
+        - {path: attrs.has_plain_http_listener, op: equals, value: true}
+    message: "plain HTTP/TCP listeners serve unencrypted traffic"
+    sources: ['gateway-api']
+    source_refs:
+      gateway-api: "guides/tls/"
+
+  - rule_id: PF-K8S-024
+    domain: k8s
+    title: "Canary rollout without analysis"
+    severity: medium
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.rollout.canary, op: equals, value: true}
+        - {path: attrs.rollout.analysis_refs, op: empty}
+    message: "canary steps without AnalysisTemplate rely on manual judgement"
+    sources: ['argo-rollouts-docs']
+    source_refs:
+      argo-rollouts-docs: "argo-rollouts/features/analysis/"
+
+  - rule_id: PF-K8S-025
+    domain: k8s
+    title: "Multi-replica workload without spread"
+    severity: low
+    applies_to: {fact_kind: k8s.workload}
+    conditions:
+      all:
+        - {path: attrs.replicas, op: gte, value: 2}
+        - {path: attrs.pod_spec.topology_spread, op: equals, value: false}
+        - {path: attrs.pod_spec.has_pod_anti_affinity, op: equals, value: false}
+    message: "replicas may colocate on one node/zone"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/scheduling-eviction/topology-spread-constraints/"
+
+  - rule_id: PF-K8S-026
+    domain: k8s
+    title: "PVC without explicit StorageClass"
+    severity: low
+    applies_to: {fact_kind: k8s.pvc}
+    conditions:
+      all:
+        - {path: attrs.storage_class, op: empty}
+    message: "implicit default class hides provisioning semantics"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/concepts/storage/persistent-volumes#class-1"
+
+  # Version-gated deprecation rules (§version-unresolved semantics):
+  # unknown cluster version → fires with `version_notes` unresolved marker,
+  # never a silent pass; known-too-old version → skipped as inapplicable.
+  - rule_id: PF-K8S-030
+    domain: k8s
+    title: "apiVersion no longer served (removed by Kubernetes ≤1.22)"
+    severity: critical
+    versions: {kubernetes: ">=1.22"}
+    applies_to: {fact_kind_prefix: "k8s."}
+    conditions:
+      all:
+        - {path: attrs.api_removed_in, op: in,
+           value: ["1.16", "1.21", "1.22"]}
+    message: "the cluster does not serve this apiVersion — apply will fail"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/reference/using-api/deprecation-guide#v1-22"
+
+  - rule_id: PF-K8S-031
+    domain: k8s
+    title: "apiVersion no longer served (removed by Kubernetes 1.24–1.29)"
+    severity: critical
+    versions: {kubernetes: ">=1.24"}
+    applies_to: {fact_kind_prefix: "k8s."}
+    conditions:
+      all:
+        - {path: attrs.api_removed_in, op: in,
+           value: ["1.24", "1.25", "1.26", "1.29"]}
+    message: "the cluster does not serve this apiVersion — apply will fail"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/reference/using-api/deprecation-guide#v1-25"
+
+  - rule_id: PF-K8S-032
+    domain: k8s
+    title: "Beta apiVersion on removal track"
+    severity: low
+    applies_to: {fact_kind_prefix: "k8s."}
+    conditions:
+      all:
+        - {path: attrs.api_beta_track, op: equals, value: true}
+        - {path: attrs.api_removed_in, op: absent}
+    message: "beta APIs are deprecated and scheduled for removal"
+    sources: ['kubernetes-docs']
+    source_refs:
+      kubernetes-docs: "docs/reference/using-api/deprecation-guide/"

platformforge/data/rules/catalog/orchestration.yaml

@@ -0,0 +1,99 @@
+# Canonical orchestration loops — data, not buried policy (cycle5.1
+# §147–152). Each stage names a canonical agent; `fanout: domains` is
+# the only dynamic stage — the orchestrator substitutes routed
+# specialists. `if: conflicts` stages only run when a referee is needed.
+# Verification is always the last stage and is never the producer.
+schema: platformforge/orchestration/v1
+loops:
+  platform-audit:
+    description: "§150 — 'analyze my platform': full governed pipeline"
+    coordinator: platform-orchestrator
+    stages:
+      - {id: plan, agent: platform-planner}
+      - {id: spec-review, agent: platform-task-spec-reviewer,
+         after: [plan]}
+      - {id: inventory, agent: pf-inventory, after: [spec-review]}
+      - {id: extract, agent: pf-extractor, after: [inventory]}
+      - {id: specialists, fanout: domains, after: [extract]}
+      - {id: graph, agent: pf-graph-builder, after: [specialists]}
+      - {id: evidence-review, agent: platform-evidence-reviewer,
+         after: [graph]}
+      - {id: critic, agent: platform-adversarial-critic,
+         after: [evidence-review]}
+      - {id: referee, agent: platform-debate-referee, after: [critic],
+         if: conflicts}
+      - {id: synthesize, agent: pf-synthesizer,
+         after: [critic, referee]}
+      - {id: verify, agent: platform-verifier, after: [synthesize]}
+
+  incident:
+    description: "§148 — runtime evidence first; never 'last deploy = cause'"
+    coordinator: platform-incident-coordinator
+    stages:
+      - {id: inventory, agent: pf-inventory}
+      - {id: extract, agent: pf-extractor, after: [inventory]}
+      - {id: sre, agent: platform-sre-specialist, after: [extract]}
+      - {id: specialists, fanout: domains, after: [sre]}
+      - {id: graph, agent: platform-graph-specialist,
+         after: [specialists]}
+      - {id: correlate, agent: pf-reconciler, after: [graph]}
+      - {id: critic, agent: platform-adversarial-critic,
+         after: [correlate]}
+      - {id: referee, agent: platform-debate-referee, after: [critic],
+         if: conflicts}
+      - {id: synthesize, agent: pf-synthesizer,
+         after: [critic, referee]}
+      - {id: verify, agent: platform-verifier, after: [synthesize]}
+
+  change:
+    description: "§151 — finding → governed pipeline; agents never execute"
+    coordinator: platform-change-coordinator
+    stages:
+      - {id: source-of-truth, agent: pf-inventory}
+      - {id: specialists, fanout: domains, after: [source-of-truth]}
+      - {id: simulate, agent: pf-simulator, after: [specialists]}
+      - {id: safety-review,
+         agent: platform-operations-safety-reviewer, after: [simulate]}
+      - {id: policy, agent: platform-policy-specialist,
+         after: [safety-review]}
+      - {id: approval-gate, agent: human-gate, after: [policy],
+         external: true}
+      - {id: verify, agent: platform-verifier, after: [approval-gate]}
+
+  fleet:
+    description: "§149 — fleet-wide analysis with coverage evidence"
+    coordinator: platform-fleet-coordinator
+    stages:
+      - {id: fleet-scan, agent: platform-fleet-specialist}
+      - {id: specialists, fanout: domains, after: [fleet-scan]}
+      - {id: optimize, agent: platform-optimization-coordinator,
+         after: [specialists]}
+      - {id: evidence-review, agent: platform-evidence-reviewer,
+         after: [optimize]}
+      - {id: synthesize, agent: pf-synthesizer, after: [evidence-review]}
+      - {id: verify, agent: platform-verifier, after: [synthesize]}
+
+  optimization:
+    description: "§152 — recommendation only; ChangeIntent if accepted"
+    coordinator: platform-optimization-coordinator
+    stages:
+      - {id: signals, fanout: domains}
+      - {id: recommend, agent: platform-optimization-coordinator,
+         after: [signals]}
+      - {id: evidence-review, agent: platform-evidence-reviewer,
+         after: [recommend]}
+      - {id: critic, agent: platform-adversarial-critic,
+         after: [evidence-review]}
+      - {id: verify, agent: platform-verifier, after: [critic]}
+      - {id: change-intent, agent: platform-change-coordinator,
+         after: [verify], if: accepted}
+
+  single:
+    description: "§85/§284 — one domain, one specialist, still verified"
+    coordinator: null
+    stages:
+      - {id: extract, agent: pf-extractor}
+      - {id: specialist, fanout: primary-domain, after: [extract]}
+      - {id: evidence-review, agent: platform-evidence-reviewer,
+         after: [specialist]}
+      - {id: verify, agent: platform-verifier, after: [evidence-review]}

platformforge/data/rules/catalog/product.yaml

@@ -0,0 +1,42 @@
+# Platform-product rules — catalog hygiene and golden-path posture.
+rules:
+  - rule_id: PF-CAT-001
+    domain: product
+    title: "Catalog entity without owner"
+    severity: medium
+    applies_to: {fact_kind: catalog.entity}
+    conditions:
+      all:
+        - {path: attrs.owner, op: absent}
+        - {path: attrs.entity_kind, op: in, value: [Component, API, Resource]}
+    message: "unowned entities decay silently — no one is paged for them"
+    sources: ['backstage-docs']
+    source_refs:
+      backstage-docs: "docs/features/software-catalog/descriptor-format#specowner-required"
+
+  - rule_id: PF-CAT-002
+    domain: product
+    title: "Catalog entity without lifecycle"
+    severity: low
+    applies_to: {fact_kind: catalog.entity}
+    conditions:
+      all:
+        - {path: attrs.lifecycle, op: absent}
+        - {path: attrs.entity_kind, op: equals, value: Component}
+    message: "lifecycle (experimental/production/deprecated) drives routing"
+    sources: ['backstage-docs']
+    source_refs:
+      backstage-docs: "docs/features/software-catalog/descriptor-format#speclifecycle-required"
+
+  - rule_id: PF-XR-001
+    domain: product
+    title: "Managed resource with Delete policy"
+    severity: medium
+    applies_to: {fact_kind: platform.managed_resource}
+    conditions:
+      all:
+        - {path: attrs.deletion_policy, op: equals, value: Delete}
+    message: "deleting the claim destroys the resource — Orphan where data lives"
+    sources: ['crossplane-docs']
+    source_refs:
+      crossplane-docs: "latest/concepts/managed-resources#deletionpolicy"

platformforge/data/rules/catalog/routing.yaml

@@ -0,0 +1,122 @@
+# Routing table v2 — data, not judgment (§90). Every match can add
+# specialists/reviewers/a coordinator; the MODE policy (deterministic-
+# first, §88 debate triggers, §89 critical-review mandates) lives in
+# platformforge/routing/router.py. Every name here must resolve to the
+# canonical roster — the agent-routing gate fails on drift (§91).
+schema: platformforge/routing/v2
+routes:
+  - name: lint-is-deterministic
+    when: {task_type: lint}
+    reason: "lint runs on rules+facts; no model needed"
+
+  - name: incident-coordination
+    when: {task_type: incident}
+    coordinator: platform-incident-coordinator
+    reason: "incidents need correlation, timeline and blast radius"
+
+  - name: active-incident
+    when: {incident_status: active}
+    coordinator: platform-incident-coordinator
+    reason: "an active incident routes to its coordinator even when task_type is analysis"
+
+  - name: security-mandatory-review
+    when: {security_sensitive: true}
+    add_reviewers: [platform-security-reviewer]
+    reason: "security-sensitive work always gets a security reviewer"
+
+  - name: platform-architecture
+    when: {task_type: architecture, blast_radius: [platform, org]}
+    coordinator: platform-orchestrator
+    add_reviewers: [platform-architecture-reviewer]
+    reason: "cross-boundary design needs coordination + review"
+
+  - name: production-change
+    when: {task_type: change, production: true}
+    coordinator: platform-change-coordinator
+    add_reviewers: [platform-operations-safety-reviewer]
+    reason: "production changes get ops-safety review + human gate"
+
+  - name: fleet-work
+    when: {fleet_scope: true}
+    coordinator: platform-fleet-coordinator
+    reason: "fleet scope needs the fleet coordinator + coverage"
+
+  - name: optimization-coordination
+    when: {optimization: true}
+    coordinator: platform-optimization-coordinator
+    reason: "recommendations coordinate finops/capacity/reliability"
+
+  - name: cost-question
+    when: {task_type: analysis, domains: [finops]}
+    add_specialists: [platform-finops-specialist]
+    reason: "cost decomposition needs the finops graph walk"
+
+  - name: k8s-question
+    when: {task_type: analysis, domains: [k8s, kubernetes]}
+    add_specialists: [platform-kubernetes-specialist]
+    reason: "manifest/workload question"
+
+  - name: iac-question
+    when: {task_type: analysis, domains: [iac, terraform]}
+    add_specialists: [platform-iac-specialist]
+    reason: "IaC artifact question"
+
+  - name: gitops-question
+    when: {task_type: analysis, domains: [gitops, cicd]}
+    add_specialists: [platform-gitops-specialist]
+    reason: "delivery-path question"
+
+  - name: security-question
+    when: {task_type: analysis, domains: [security]}
+    add_specialists: [platform-security-specialist]
+    reason: "IAM/SBOM/supply-chain question"
+
+  - name: telemetry-question
+    when: {task_type: analysis, domains: [sre, slo, incident, otel]}
+    add_specialists: [platform-sre-specialist]
+    reason: "SLO/incident/telemetry question"
+
+  - name: graph-question
+    when: {task_type: analysis, domains: [graph]}
+    add_specialists: [platform-graph-specialist]
+    reason: "dependency/impact/blast question"
+
+  - name: policy-question
+    when: {task_type: analysis, domains: [policy, governance]}
+    add_specialists: [platform-policy-specialist]
+    reason: "policy/governance question"
+
+  - name: capacity-question
+    when: {task_type: analysis, domains: [capacity, reliability]}
+    add_specialists: [platform-capacity-specialist]
+    reason: "capacity/headroom/reliability question"
+
+  - name: product-question
+    when: {task_type: analysis, domains: [product, dx]}
+    add_specialists: [platform-product-specialist]
+    reason: "DX/adoption/golden-path question"
+
+  - name: ai-infra-question
+    when: {task_type: analysis, domains: [ai, gpu]}
+    add_specialists: [platform-ai-infra-specialist]
+    reason: "GPU/model-serving infrastructure question"
+
+  - name: federation-question
+    when: {task_type: analysis, domains: [federation]}
+    add_specialists: [platform-federation-specialist]
+    reason: "ForgeNode/export-policy question"
+
+  - name: crossplane-question
+    when: {task_type: analysis, domains: [crossplane]}
+    add_specialists: [platform-crossplane-specialist]
+    reason: "Crossplane artifact question"
+
+  - name: aws-question
+    when: {task_type: analysis, domains: [aws, cloud]}
+    add_specialists: [platform-aws-specialist]
+    reason: "cloud inventory/IAM question"
+
+  - name: fleet-analysis-question
+    when: {task_type: analysis, domains: [fleet]}
+    add_specialists: [platform-fleet-specialist]
+    reason: "fleet member/coverage question"