JjP,dZddlmZddlZddlmZmZddlmZddl m Z eje Z GddeeZGd d eeZeGd d ZeGd dZGddZGddZGddZGddZgdZy)u+Quality Gates — release validation checks. Every significant release must pass through quality gates. These gates validate that the system meets security, privacy, and architecture standards before being approved for deployment. Gates 19-21 cover Security, Privacy, and Architecture validation. ) annotationsN) dataclassfield)Enum)Anyc eZdZdZdZdZdZdZy) GateStatuszStatus of a quality gate check.passfailskipwarnN)__name__ __module__ __qualname____doc__PASSFAILSKIPWARNX/home/oem/CyberBrain26-unified/src/cyberbrain26/security_plane/quality_gates/__init__.pyr r s) D D D Drr c eZdZdZdZdZdZdZy) GateLevelz$Criticality level of a quality gate.criticalhighmediumlowN)rrrrCRITICALHIGHMEDIUMLOWrrrrrs.H D F CrrcreZdZUdZded<ded<dZded<ejZded <e e Z d ed <y ) GateCheckz%A single check within a quality gate.strnamer statusdetailrseveritydefault_factorydict[str, Any]metadataN) rrrr__annotations__r)rr!r*rdictr.rrrr$r$&s9/ I FC#**Hi*$T:Hn:rr$ceZdZUdZded<ded<ded<eeZded <d Zd ed <d Z d ed <d Z d ed<d Z d ed<ee Z ded<eddZy) GateResultz$Result of a quality gate evaluation.r% gate_namegate_idr r'r+zlist[GateCheck]checksrintpassedfailedskippedwarningsr-r.c |jdk(S)z&Whether the gate passed (no failures).r)r8selfs roverall_passedzGateResult.overall_passed?s{{arNreturnbool)rrrrr/rlistr5r7r8r9r:r0r.propertyr>rrrr2r21sk.N L #D9FO9FCOFCOGSHc$T:Hn:   rr2cbeZdZdZdZdZejZddZ d d dZ y) SecurityGateaQuality Gate #19: Security validation. Validates that the system meets security requirements: - All agents have identities - No untrusted agents in production - Permission gateway is active - Policy engine is configured - Audit logging is enabled - AI firewall is operational - No hardcoded secrets - All sensitive actions require approval or are blocked zgate-19z Security Gatecg|_yN_checksr<s r__init__zSecurityGate.__init__W (* rNc h g}|ktd|D}|jtd|rtjntj t |dtjn:|jtdtjdtj||Dcgc]}|jddk(r|} }|jtd| stjntj | rt | d nd tjn:|jtdtjdtj|;|jtd tjd tjn:|jtd tj d tj|V|jtdtjdt|dr |jndtjn:|jtdtj dtj|;|jtdtjdtjn:|jtdtj dtj|;|jtdtjdtjn:|jtdtjdtj|t|dr|jjdk(r;|jtdtjdtjn|jtdtjd|jjdtjn:|jtdtjdtj|jtdtjd tjt!d!|D} t!d"|D} t!d#|D} t!d$|D} t#|j$|j&| d%k(rtjntj || | | | d&|j(ji' Scc}w)(aEvaluate security gate checks. Args: agents: List of agent dicts with identity info. permission_gateway: PermissionGateway instance. policy_engine: PolicyEngine instance. audit_log: AuditLog instance. firewall: AIFirewall instance. Returns: GateResult with all security check results. c3hK|]*}|jdduxs|jd,yw)identityNagent_id)get).0as r z(SecurityGate.evaluate..rs4$GHj!-Bz1BB$s02all_agents_have_identityz agents checkedr&r'r)r*zNo agents provided for check trust_level untrustedno_untrusted_agentsz untrusted agents foundzNo untrusted agentspermission_gateway_activez Permission gateway is configuredz$Permission gateway is not configuredpolicy_engine_configuredzPolicy engine mode: mode configuredzPolicy engine is not configuredaudit_logging_enabledzAudit log is activezAudit logging is not enabledai_firewall_operationalzAI firewall is activezAI firewall is not configuredsafe"sensitive_actions_require_approvalz-SAFE mode: sensitive actions require approvalzMode z": verify sensitive action controlsz%Policy engine not available for checkno_hardcoded_secretsz.No hardcoded secrets detected in configurationc3\K|]$}|jtjk(s!d&ywNr'r rrQcs rrSz(SecurityGate.evaluate..F1!((joo*EQF",,c3\K|]$}|jtjk(s!d&ywrcr'r rrfs rrSz(SecurityGate.evaluate..rhric3\K|]$}|jtjk(s!d&ywrcr'r rrfs rrSz(SecurityGate.evaluate..GA188z+FaGric3\K|]$}|jtjk(s!d&ywrcr'r rrfs rrSz(SecurityGate.evaluate..HQAHH ,GqHrirlevel r3r4r'r5r7r8r9r:r.)allappendr$r rrlenrrrrPhasattrr[r rvaluesumr2 GATE_NAMEGATE_IDLEVEL)r=agentspermission_gateway policy_engine audit_logfirewallr5all_have_identityrRrWr7r8r9r:s revaluatezSecurityGate.evaluateZs6(#%   #$LR$!  MM)/*;zf+o6"++   MM)/!5"++    !55';6I MM)*.7zZ__EN#i.))@ATi"++   MM)*!5"++    ) MM)0!9"++   MM)0!="++    $ MM)/!-GM[aDbm.@.@ht-uv"++   MM)/!8"++    MM),!,"++   MM),!5"++     MM).!."   MM).!6"    $)G!!''61 i=%??J&^^  i=%??"=#5#5#;#;"<<^_&^^  MM)9!>"    i'??C''   FFFFFFGGGH&HHnnLL&,k:??ztzz//0  os0T/r@None)NNNNN) r}list[dict[str, Any]] | Noner~ Any | Nonerrrrrrr@r2 rrrrr{rzrrr|rJrrrrrErEEsz GI   E+ /3)-$( $# l +l 'l " l  l  l  l rrEcheZdZdZdZdZejZddZ d d dZ y) PrivacyGatea(Quality Gate #20: Privacy validation. Validates that the system meets privacy requirements: - Data minimization is enforced - PII handling is controlled - Telemetry is opt-in - Data residency is configured - Retention policies are set - Pseudonymous IDs are used zgate-20z Privacy Gatecg|_yrGrHr<s rrJzPrivacyGate.__init__rKrNc g}|jtd|rtjntj|rdndt j |jtd|rtjntj|rdndt j |jtd|stjntj|sd nd t j|>|jtd tjd |t jn:|jtd tjd t j|?|jtdtjd|dt jn:|jtdtjdt j|jtd|rtjntj|rdndt jtd|D}td|D} td|D} td|D} t|j|j| dk(rtjntj||| | | d|jji S)zoEvaluate privacy gate checks. Returns: GateResult with all privacy check results. data_minimizationzData minimization is enforcedzData minimization not enforcedrU pii_detectionzPII detection is activezPII detection not activetelemetry_opt_inz Telemetry is disabled by defaultu'Telemetry is enabled — verify consentdata_residency_configuredzData residency: zData residency not configuredretention_policy_setz Retention: z dayszNo retention policy configuredpseudonymous_idszPseudonymous IDs are usedzPseudonymous IDs not usedc3\K|]$}|jtjk(s!d&ywrcrerfs rrSz'PrivacyGate.evaluate..lrhric3\K|]$}|jtjk(s!d&ywrcrkrfs rrSz'PrivacyGate.evaluate..mrhric3\K|]$}|jtjk(s!d&ywrcrmrfs rrSz'PrivacyGate.evaluate..nrnric3\K|]$}|jtjk(s!d&ywrcrprfs rrSz'PrivacyGate.evaluate..orqrirrrrs)rur$r rrrrrr r!ryr2rzr{r|rx) r=telemetry_enabledrrdata_residencyretention_daysrr5r7r8r9r:s rrzPrivacyGate.evaluates@#%  i$&7:??Z__6G2Mm''     i &3:??0=,C]''     i#*;:??=N5T}^^     % MM)0!).)9:"   MM)0!6"    % MM)+!$^$4E:"))   MM)+!7"))    i#&6:??JOO2B.Hc^^   FFFFFFGGGH&HHnnLL&,k:??ztzz//0  rr)FTTNNT)rrArrArrAr str | Nonerz int | NonerrAr@r2rrrrrr s GI   E+ #("&"%)%)!%_ _  _  _ # _ # _ _  _ rrcbeZdZdZdZdZejZddZ d d dZ y) ArchitectureGateuQuality Gate #21: Architecture validation. Validates that the system meets architecture requirements: - Security boundary is enforced (Identity → Policy → Permission → Audit) - No direct coupling between planes - Extension points use interfaces - No core module imports concrete provider implementations - Agent identity is separate from user identity zgate-21zArchitecture Gatecg|_yrGrHr<s rrJzArchitectureGate.__init__rKrc g}|jtd|rtjntj|rdndt j |jtd|stjntj|sdndt j|jtd|rtjntj|rd nd t j|jtd |stjntj|sd nd t j|jtd|rtjntj|rdndt j |jtdtjdt j td|D}td|D}td|D} td|D} t|j|j|dk(rtjntj|||| | d|jji S)zyEvaluate architecture gate checks. Returns: GateResult with all architecture check results. security_boundary_enforcedu5Identity → Policy → Permission → Audit enforcedzSecurity boundary not enforcedrUno_direct_plane_couplingzPlanes are decoupledz'Direct coupling detected between planesextension_points_use_interfacesz(Extension points use abstract interfacesz-Extension points use concrete implementationsno_core_concrete_importsz-Core modules do not import concrete providersz5Core modules import concrete provider implementationsidentity_separate_from_userz-Agent identity is separate from user identityz)Agent identity is not separated from userdefault_deny_policyzDefault deny policy is activec3\K|]$}|jtjk(s!d&ywrcrerfs rrSz,ArchitectureGate.evaluate..rhric3\K|]$}|jtjk(s!d&ywrcrkrfs rrSz,ArchitectureGate.evaluate..rhric3\K|]$}|jtjk(s!d&ywrcrmrfs rrSz,ArchitectureGate.evaluate..rnric3\K|]$}|jtjk(s!d&ywrcrprfs rrSz,ArchitectureGate.evaluate..rqrirrrrs)rur$r rrrrr ryr2rzr{r|rx) r=rplanes_coupledrcore_imports_concreterr5r7r8r9r:s rrzArchitectureGate.evaluates#%  i-&@:??jooNhJoO''     i+*8:??joo1?)En^^     i2&E:??:??A`=gV^^     i+*?:??Z__J_Bf]^^     i.&A:??zFaBhS''     i&??2''   FFFFFFGGGH&HHnnLL&,k:??ztzz//0  rNr)TFTFT) rrArrArrArrArrAr@r2) rrrrr{rzrr r|rJrrrrrr~sxG#I NNE+ ,0$04&+,0 N $(N N *. N $ N &* N  N rrceZdZdZddZeddZ d d dZed dZy) QualityGateRunneraGRuns all quality gates and reports results. Usage: runner = QualityGateRunner() results = runner.run_all( agents=[...], permission_gateway=gateway, audit_log=audit, firewall=firewall, ) all_passed = all(r.overall_passed for r in results) cHtttg|_yrG)rErr_gatesr<s rrJzQualityGateRunner.__init__s N M  L  rc,t|jS)zReturn the configured gates.)rBrr<s rgateszQualityGateRunner.gatessDKK  rNc g}g|_|jD]}t|tr|j |||||}nPt|t r|j |||| | | }n(t|t r|j | | |||}nz|j|tjd|j|j|jj|j|j||_|S)zTRun all quality gates. Returns a list of GateResult, one per gate. )r}r~rrr)rrrrrr)rrrrrz/Quality gate %s (%s): %s (%d passed, %d failed)) _last_resultsr isinstancerErrrruloggerinfor3r4r'rxr7r8)r=r}r~rrrrrrrrrrrrrrresultsgateresults rrun_allzQualityGateRunner.run_alls .%'/1KK% D$ -!'9"/'% 'D+.&7&7"/#1#1%5 'D"23/I#14S*?0K ' NN6 " KKA   ##   =% N%rcTt|dsytd|jDS)z%Whether all gates passed on last run.rTc34K|]}|jywrG)r>)rQrs rrSz/QualityGateRunner.all_passed..Ds@1##@s)rwrtrr<s r all_passedzQualityGateRunner.all_passed?s(t_-@T-?-?@@@rr)r@z3list[SecurityGate | PrivacyGate | ArchitectureGate])NNNNNFTTNZTTFTFT)"r}rr~rrrrrrrrrArrArrArrrr6rrArrArrArrArrArrAr@zlist[GateResult]r?) rrrrrJrCrrrrrrrrs(  !! /3)-$( $#"'"&"%) !%+/$04&+,0#B+B'B" B  B  B B BB#BBB%)BB*.B $!B"&*#B$ %BHAArr)rr$rr2r rrrE)r __future__rlogging dataclassesrrenumrtypingr getLoggerrrr%r rr$r2rErrr__all__rrrrs#(   8 $dT ;; ;     &A A Hr r j` ` FcAcAL r