app.py

import gradio as gr
from datetime import datetime
import spaces

@spaces.GPU
def _dummy_gpu_warmup():
    return True
# ==============================================================================
# 1. DETAILED KNOWLEDGE BASE FOR CONSULTANTS (TOGAF + DAMA + ISO 27001/27701/8000)
# ==============================================================================

DETAILED_PHASES = {
    "Phase 0: Preliminary Framework & Foundation": {
        "framework_scope": "TOGAF v10 Preliminary | DAMA-DMBOK Ch. 1, 3 | ISO 27001 Cl. 4, 5 | ISO 27701 Cl. 5 | ISO 8000-61",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: ISMS boundary scope excludes 3rd-party data pipelines or if Data Ownership is assigned to IT instead of Business Units.",
        "sub_domains": {
            "Architecture & Governance Principles": [
                "Establish Architecture Board Charter, Voting Rules & Escalation Matrix",
                "Formulate 10-12 Core Enterprise Architecture Principles (TOGAF TRM aligned)",
                "Define Data Governance Operating Model (Centralized, Federated, or Hub-and-Spoke)",
                "Publish Data Stewardship Charter with assigned Data Owners per domain"
            ],
            "Security & Privacy Scope (ISO 27001 / 27701)": [
                "Document ISMS Scope Statement & Context of Organization (ISO 27001 Cl. 4.1/4.2)",
                "Define PII Processing Boundary & Joint-Controller / Processor roles (ISO 27701)",
                "Formulate Information Security & Privacy Policies signed by C-Suite (Cl. 5.2)",
                "Establish Internal Audit & Compliance Cadence for ISMS/PIMS"
            ],
            "Data Quality Framework (ISO 8000)": [
                "Adopt ISO 8000-61 Data Quality Management System (DQMS) Principles",
                "Define Enterprise Data Quality Dimensions (Completeness, Accuracy, Validity, Timeliness)",
                "Set Thresholds for Cost of Poor Data Quality (COPDQ) Tracking"
            ]
        },
        "gate_deliverables": [
            "Signed Architecture Board Charter",
            "Approved ISMS & PIMS Scope Document",
            "Data Governance Operating Model & RACI",
            "Tailored TOGAF ADM Architecture Framework"
        ]
    },
    "Phase A: Architecture Vision & Business Case": {
        "framework_scope": "TOGAF Phase A | DAMA Ch. 2, 14 | ISO 27001 Cl. 6 | ISO 27701 Cl. 6",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: Critical Data Elements (CDEs) are not identified or if the ROI calculation excludes compliance non-conformity fines.",
        "sub_domains": {
            "Vision & Value Realization": [
                "Draft Request for Architecture Work & Architecture Vision Document",
                "Define Business Scenarios & High-Level Enterprise Capability Heatmap",
                "Establish Quantified ROI & Business Case Metrics (Cost Savings, Risk Reduction)",
                "Secure Executive Sponsor Sign-off (CEO/CFO/CIO)"
            ],
            "Critical Data Elements (CDEs) & Asset Identification": [
                "Identify High-Value Critical Data Elements (CDEs) across Value Streams",
                "Conduct Initial Data Value & Impact Assessment for CDEs",
                "Define Baseline Data Flow Diagrams for Strategic Capabilities"
            ],
            "Initial Risk & Privacy Assessment": [
                "Perform High-Level Information Security Risk Assessment (ISO 27001 Cl. 6.1.2)",
                "Conduct Privacy Threshold Assessment (PTA) to identify mandatory DPIA requirements",
                "Define Initial Threat Profile & Regulatory Landscape (GDPR, Local Privacy Laws)"
            ]
        },
        "gate_deliverables": [
            "Statement of Architecture Work",
            "Approved Architecture Vision Blueprint",
            "CDE Initial Inventory",
            "High-Level Risk & Privacy Impact Heatmap"
        ]
    },
    "Phase B: Business Architecture & Governance": {
        "framework_scope": "TOGAF Phase B | DAMA Ch. 3, 8, 10 | ISO 27001 Annex A.5, A.8 | ISO 27701 Cl. 6.3-6.5",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: CRUD Matrix contains orphaned data entities (Created without Read/Delete) or PII processing lacks lawful basis.",
        "sub_domains": {
            "Capability & Business Process Mapping": [
                "Model Target Business Capabilities (L1 to L3 Breakdown)",
                "Map Business Value Streams to Business Processes (BPMN 2.0)",
                "Construct Process-to-Data CRUD Matrix (Create, Read, Update, Delete)",
                "Map Organization Units to Business Capabilities"
            ],
            "Data Domain & Information Architecture": [
                "Establish Enterprise Data Domain Boundary Map (Subject Areas)",
                "Assign Executive Data Domain Owners & Operational Data Stewards",
                "Catalog Data Assets & Assign Information Sensitivity Classification (ISO 27001 A.5.9)"
            ],
            "Privacy Processing Activity Register (ROPA)": [
                "Compile Record of Processing Activities (ROPA / ISO 27701 Annex A/B)",
                "Document Lawful Basis for Processing per PII Data Flow (Consent, Contract, Legitimate Interest)",
                "Define Data Retention & Destruction Schedules per Business Entity"
            ]
        },
        "gate_deliverables": [
            "L1-L3 Business Capability Map",
            "Enterprise Process-Data CRUD Matrix",
            "Data Domain Boundary & Governance RACI",
            "ISO 27701 Compliant ROPA Register"
        ]
    },
    "Phase C: Information Systems - Data Architecture": {
        "framework_scope": "TOGAF Phase C (Data) | DAMA Ch. 4, 5, 6, 9, 11 | ISO 8000-110 | ISO 27001 Annex A.8.10, A.8.11",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: Logical Data Model lacks PII tagging at attribute level or ISO 8000 validation rules are not machine-executable.",
        "sub_domains": {
            "Data Modeling & Master Data Architecture": [
                "Develop Conceptual Data Model (CDM) & Target Logical Data Model (LDM in 3NF/DV2.0)",
                "Design Dimensional Physical Data Models for Analytics (Star/Snowflake Schema)",
                "Define Master Data Management (MDM) Hub Patterns (Registry, Transactional, Hybrid)",
                "Establish Reference Data Governance & Hierarchy Management Rules"
            ],
            "Data Security, Privacy-by-Design & Masking": [
                "Tag PII/SPII Attributes directly inside Data Dictionary metadata",
                "Specify Static & Dynamic Data Masking Rules for Non-Production & Analytics",
                "Define Field-Level & Column-Level Encryption Requirements (AES-256)",
                "Architect Subject Rights Request (SRR / Data Erasure/Right to be Forgotten) Workflows"
            ],
            "ISO 8000 Data Quality Specifications": [
                "Publish ISO 8000-110 Portable Data Quality Rules (Syntax, Semantic, Conformity)",
                "Set Up Data Profiling Rules for Ingestion Pipelines",
                "Define Automated Quarantine & Error Remediation Workflows for Bad Data"
            ]
        },
        "gate_deliverables": [
            "Logical Data Model (LDM) & Data Dictionary",
            "MDM & Reference Data Architecture Specification",
            "Data Encryption & Masking Controls Document",
            "ISO 8000 Executable Data Quality Rules Catalog"
        ]
    },
    "Phase C: Information Systems - Application Architecture": {
        "framework_scope": "TOGAF Phase C (App) | DAMA Ch. 6 | ISO 27001 Annex A.8.25-A.8.31 | ISO 27701",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: APIs exposing PII lack OAuth2/OIDC token verification or rate-limiting/audit logging.",
        "sub_domains": {
            "Application Portfolio & Integration": [
                "Catalog Target Application Portfolio (TIME Framework: Tolerate, Innovate, Migrate, Eliminate)",
                "Map Application-to-Application Interface & API Catalog (OpenAPI/Swagger)",
                "Define System Integration Patterns (Event-Driven, Batch ETL, RESTful APIs, Mesh)",
                "Establish Legacy Decommissioning Strategy & Data Archival Plan"
            ],
            "Secure Application Development & API Governance": [
                "Define Secure Software Development Lifecycle (SSDLC) Rules (ISO 27001 A.8.25)",
                "Implement API Gateway Architecture with Rate Limiting, Mutual TLS, and OAuth2.0/OIDC",
                "Mandate OWASP Top 10 Mitigation Controls in Application Architecture Specification",
                "Architect System Audit Logging for Security Operations (SIEM Integration)"
            ]
        },
        "gate_deliverables": [
            "Target Application Communication & Interface Diagram",
            "Application Portfolio Rationalization Matrix",
            "API Security & Integration Architecture Standard",
            "System Audit & Logging Architecture Plan"
        ]
    },
    "Phase D: Technology Architecture & Infrastructure": {
        "framework_scope": "TOGAF Phase D | DAMA Ch. 4, 6 | ISO 27001 Annex A.8.20-A.8.24 | ISO 27701",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: Cloud Data Stores lack Customer-Managed Encryption Keys (CMEK) or lack automated vulnerability scanning.",
        "sub_domains": {
            "Platform & Infrastructure Design": [
                "Design Multi-Cloud / Hybrid Cloud Network Architecture (VPCs, Subnets, Transit Gateways)",
                "Architect Data Platform Tech Stack (Data Warehouse, Data Lakehouse, Feature Stores)",
                "Establish High Availability (HA), Disaster Recovery (DR), and RPO/RTO Metrics",
                "Specify Hardware, Compute, and Container Orchestration Standards (Kubernetes)"
            ],
            "Security Infrastructure & Identity Governance": [
                "Design Zero Trust Network Architecture & Micro-segmentation Controls",
                "Architect Identity & Access Management (IAM), RBAC, ABAC, and PAM Solutions",
                "Evaluate & Select Consent Management Platforms (CMP) & Data Catalog Tools",
                "Mandate Infrastructure-as-Code (IaC) Security Scanning Pipelines"
            ]
        },
        "gate_deliverables": [
            "Target Infrastructure & Cloud Topology Architecture Diagram",
            "Tech Stack Selection Scorecards & Architecture Decision Records (ADRs)",
            "Disaster Recovery & Business Continuity Plan Specification",
            "Zero Trust Network & IAM Architecture Blueprint"
        ]
    },
    "Phase E & F: Opportunities, Solutions & Migration Planning": {
        "framework_scope": "TOGAF Phase E & F | DAMA Ch. 1, 2 | ISO 27001 Cl. 6.2 | ISO 27701",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: Statement of Applicability (SoA) lacks formal justification for excluded controls or Transition Architectures create security gaps.",
        "sub_domains": {
            "Gap Analysis & Roadmap Formulation": [
                "Synthesize Baseline vs Target Gap Analysis across Business, Data, App, and Tech",
                "Group Gaps into Strategic Work Packages & Define Dependencies",
                "Construct Transition Architectures (Transition v1 [6mo], v2 [18mo], Target v3 [36mo])",
                "Develop Integrated Master Implementation Roadmap Gantt"
            ],
            "Statement of Applicability (SoA) & Cost-Benefit": [
                "Finalize ISO 27001 / 27701 Statement of Applicability (SoA) with explicit Inclusion/Exclusion Justifications",
                "Conduct Total Cost of Ownership (TCO) & Value Realization Analysis per Transition",
                "Perform Business Continuity & Data Migration Risk Assessments"
            ]
        },
        "gate_deliverables": [
            "Consolidated EA Gap Analysis Matrix",
            "Transition Architecture Specifications (v1, v2, Target)",
            "Approved Statement of Applicability (SoA)",
            "Master Implementation Roadmap & Budget Plan"
        ]
    },
    "Phase G & H: Implementation Governance & Change Management": {
        "framework_scope": "TOGAF Phase G & H | DAMA Ch. 1, 13 | ISO 27001 Cl. 8, 9, 10 | ISO 8000-61",
        "critical_warning": "⚠️ DO NOT PASS GATE IF: Non-conforming implementations are deployed without formal, time-bound Architecture Board Waivers.",
        "sub_domains": {
            "Implementation Oversight & Compliance Audits": [
                "Execute Architecture Contracts with Software Delivery & Cloud Engineering Teams",
                "Conduct Architecture Compliance Reviews prior to Production Releases",
                "Enforce Architecture Variance & Waiver Management Process",
                "Review Penetration Testing, Vulnerability Scans & ISO 27001 Internal Audits"
            ],
            "Change Management & Continuous Monitoring": [
                "Track Data Quality Scorecards (ISO 8000) against SLAs in Live Production",
                "Monitor Regulatory Changes (Privacy/AI Acts) & Re-evaluate Threat Models",
                "Measure EA Business Value Realization & Capability Maturity Trajectory",
                "Trigger ADM Cycle Iteration upon Major Business Strategy Shift or Tech Obsolescence"
            ]
        },
        "gate_deliverables": [
            "Signed Architecture Contracts",
            "Compliance Audit Reports & Waiver Logs",
            "Live Data Quality & ISMS Monitoring Dashboards",
            "Annual Architecture Maturity Re-assessment Report"
        ]
    }
}

# Helper functions
def get_all_tasks_for_phase(phase_name):
    data = DETAILED_PHASES[phase_name]
    flat_list = []
    for tasks in data["sub_domains"].values():
        flat_list.extend(tasks)
    return flat_list

def load_phase_data(phase_name):
    data = DETAILED_PHASES[phase_name]
    return (
        f"## {phase_name}",
        f"**Framework Alignment:** `{data['framework_scope']}`",
        f"### {data['critical_warning']}",
        data["gate_deliverables"]
    )

def generate_audit_report(phase_name, completed_tasks, auditor_notes, gate_status):
    data = DETAILED_PHASES[phase_name]
    total_tasks = sum(len(tasks) for tasks in data["sub_domains"].values())
    completed_count = len(completed_tasks) if completed_tasks else 0
    completion_pct = (completed_count / total_tasks) * 100 if total_tasks > 0 else 0
    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    
    report = f"""
# 📋 ARCHITECTURE GATE AUDIT REPORT
**Generated On:** `{timestamp}`  
**Phase Evaluated:** `{phase_name}`  
**Auditor Decision:** **{gate_status}**  

---

### 1. Compliance Metric
- **Verified Deliverables / Tasks:** {completed_count} / {total_tasks}
- **Completion Percentage:** `{completion_pct:.1f}%`
- **Mandatory Deliverables Required:** {", ".join(data['gate_deliverables'])}

### 2. Critical Warning Verification
> {data['critical_warning']}

### 3. Verified Task Checklist Items
"""
    if completed_tasks:
        for item in completed_tasks:
            report += f"\n- [x] {item}"
    else:
        report += "\n*No tasks explicitly marked as verified in checklist.*"

    report += f"""

### 4. Consultant Findings & Non-Conformance Log
```text
{auditor_notes if auditor_notes.strip() else "No consultant notes recorded."}
```
Sign-off Certification: This report serves as an architecture governance audit record under TOGAF v10 / ISO 27001 ISMS guidelines.
"""
    return report   # <-- FIX 1: properly indented inside the function

# ==============================================================================
# 2. GRADIO INTERFACE LAYOUT
# ==============================================================================
with gr.Blocks(title="EA Governance Consultant Helper") as demo:
    
    gr.Markdown(
        """
        # 🏛️ Enterprise Architecture & Governance Audit Tool
        ### Deep Granularity Guide for TOGAF v10 | DAMA-DMBOK2 | ISO 27001 / 27701 / 8000
        *This tool helps consultants remember every critical sub-domain control and generate formal audit reports.*
        """
    )
    
    with gr.Row():
        phase_selector = gr.Dropdown(
            choices=list(DETAILED_PHASES.keys()),
            value=list(DETAILED_PHASES.keys())[0],
            label="Select ADM Phase for Audit",
            interactive=True
        )
    
    gr.Markdown("---")

    with gr.Row():
        with gr.Column(scale=3):
            phase_title = gr.Markdown()
            framework_scope = gr.Markdown()
            critical_warning = gr.Markdown()
            
            gr.Markdown("### 🔍 Granular Verification Checklist")
            task_checkboxes = gr.CheckboxGroup(
                choices=get_all_tasks_for_phase(list(DETAILED_PHASES.keys())[0]),
                label="Check off each verified artifact/control during audit:",
                interactive=True
            )
    
        with gr.Column(scale=2):
            gr.Markdown("### 📦 Required Gate Deliverables")
            deliverables_box = gr.JSON(label="Mandatory Artifact Sign-offs")
            
            gr.Markdown("---")
            gr.Markdown("### ✍️ Consultant Gate Audit Sign-Off")
            
            gate_decision = gr.Radio(
                choices=["APPROVED (PASS GATE)", "CONDITIONAL APPROVAL (WAIVER REQUIRED)", "REJECTED (FAIL GATE)"],
                value="CONDITIONAL APPROVAL (WAIVER REQUIRED)",
                label="Phase Gate Decision"
            )
            
            consultant_notes = gr.Textbox(
                lines=6,
                placeholder="Enter non-conformances, identified architectural debt, missing ISO controls, or mandatory remediation steps...",
                label="Auditor Findings & Non-Conformance Log"
            )
            
            audit_btn = gr.Button("Generate Formal Audit Record", variant="primary")
    
    gr.Markdown("---")
    audit_output_display = gr.Markdown()
    
    # Event Handlers
    def on_phase_change(phase_name):
        title, scope, warning, deliverables = load_phase_data(phase_name)
        new_tasks = get_all_tasks_for_phase(phase_name)
        return title, scope, warning, gr.CheckboxGroup(choices=new_tasks, value=[]), deliverables, ""
    
    phase_selector.change(
        on_phase_change,
        inputs=[phase_selector],
        outputs=[phase_title, framework_scope, critical_warning, task_checkboxes, deliverables_box, audit_output_display]
    )
    audit_btn.click(
        generate_audit_report,
        inputs=[phase_selector, task_checkboxes, consultant_notes, gate_decision],
        outputs=[audit_output_display]
    )
    
    demo.load(
        on_phase_change,
        inputs=[phase_selector],
        outputs=[phase_title, framework_scope, critical_warning, task_checkboxes, deliverables_box, audit_output_display]
    )
    
    pass
    
    
if __name__ == "__main__":   # <-- FIX 2: correct dunder syntax
    demo.launch(theme=gr.themes.Soft(primary_hue="sky"))