Update from task e18074a7-2ed2-4c5a-9fbc-e9fd38431cba

.gitignore

@@ -0,0 +1,53 @@
+```
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+venv/
+env/
+ENV/
+.venv/
+.env/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Logs
+*.log
+
+# Environment variables
+.env
+.env.local
+*.env.*
+
+# Docker
+.dockerenv
+
+# Coverage
+.coverage
+htmlcov/
+.coverage.*
+.coverage.xml
+```

grc-platform/README.md

@@ -0,0 +1,171 @@
+# GRC Agentic AI Platform
+
+An autonomous AI-powered Governance, Risk, and Compliance (GRC) automation platform inspired by [CISO Assistant](https://github.com/intuitem/ciso-assistant-community).
+
+## Overview
+
+This platform automates compliance operations for:
+- **ISO 27001:2022** - Information Security Management
+- **ISR** - Information Security Regulations
+- **GDPR** - General Data Protection Regulation
+- **PCI DSS v4.0.1** - Payment Card Industry Data Security Standard
+- **Business Continuity Management (BCM)**
+
+## Key Features
+
+### 1. Framework Storage & Update Management
+- Secure database storing normalized control frameworks
+- Automated detection of framework changes via semantic diff
+- Version-controlled control library with traceability
+
+### 2. Audit Management
+- Internal/external audit gap analysis
+- Corrective action recommendations (CAPA)
+- Audit workflow engine with finding lifecycle management
+
+### 3. Interactive Dashboard
+- Real-time compliance posture visualization
+- Gap backlog tracking with status buckets
+- Audit timeline (30/60/90 days) and historical performance
+- KPIs: % controls compliant, MTTR, overdue remediation, recurring findings
+
+### 4. Environment Scanning & Gap Analysis
+- Integration with SIEM, EDR, CSPM, IAM, vulnerability scanners
+- Mapping of technical findings to ISO/NIST/ICS/PCI/GDPR controls
+- Risk-based prioritization scoring
+
+### 5. Proactive Action Recommendations
+- ML-powered prediction of potential compliance issues
+- Preventive task generation before deadlines
+- Pre-audit readiness packs
+
+### 6. User Interaction
+- Conversational AI assistant for compliance queries
+- Natural language report generation (PDF/Word/JSON)
+- Role-based access with cited evidence
+
+### 7. Compliance Timeline Management
+- Automated reminders and notifications
+- Calendar view of audits and compliance deadlines
+- Dependency graph for control testing workflows
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                    Frontend (React + TS)                     │
+│         Dashboard | Reports | Assistant | Timeline           │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────┐
+│                  API Gateway (FastAPI)                       │
+│              Auth | RBAC | Rate Limiting                     │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────┐
+│                   Agent Orchestrator                         │
+│   ┌─────────┬─────────┬─────────┬─────────┬─────────────┐   │
+│   │Collector│Normalizer│ Mapper  │Assessor │ Predictor   │   │
+│   └─────────┴─────────┴─────────┴─────────┴─────────────┘   │
+│   ┌─────────┬─────────┬─────────┬─────────────────────────┐ │
+│   │ Planner │Reporter │Assistant│ Scanner Ingestion       │ │
+│   └─────────┴─────────┴─────────┴─────────────────────────┘ │
+└─────────────────────────────────────────────────────────────┘
+                              │
+        ┌─────────────────────┼─────────────────────┐
+        ▼                     ▼                     ▼
+┌───────────────┐    ┌───────────────┐    ┌───────────────┐
+│  PostgreSQL   │    │    Neo4j      │    │  OpenSearch   │
+│  (Relational) │    │   (Graph)     │    │   (Search)    │
+└───────────────┘    └───────────────┘    └───────────────┘
+```
+
+## Tech Stack
+
+- **Frontend:** React + TypeScript + Tailwind CSS + ECharts
+- **Backend:** FastAPI (Python) + pydantic
+- **Agent Runtime:** Temporal/Celery + Redis
+- **Databases:** PostgreSQL, Neo4j, OpenSearch
+- **ML/AI:** LLM for reasoning, XGBoost for risk prediction
+- **Security:** OIDC/SAML SSO, RBAC/ABAC, KMS encryption
+
+## Quick Start
+
+### Prerequisites
+- Docker & Docker Compose
+- Python 3.11+
+- Node.js 18+
+
+### Installation
+
+```bash
+# Clone the repository
+cd grc-platform
+
+# Start all services with Docker Compose
+docker-compose up -d
+
+# Initialize the database
+docker-compose exec backend python -m app.core.init_db
+
+# Access the dashboard
+open http://localhost:3000
+```
+
+## Project Structure
+
+```
+grc-platform/
+├── backend/
+│   ├── app/
+│   │   ├── api/          # REST API endpoints
+│   │   ├── core/         # Configuration, security, DB
+│   │   ├── models/       # SQLAlchemy models
+│   │   ├── services/     # Business logic
+│   │   ├── agents/       # AI agent implementations
+│   │   ├── integrations/ # External connectors
+│   │   └── ml/           # ML models & predictors
+│   └── tests/
+├── frontend/
+│   ├── src/
+│   │   ├── components/   # React components
+│   │   ├── pages/        # Dashboard pages
+│   │   ├── hooks/        # Custom hooks
+│   │   ├── services/     # API clients
+│   │   └── utils/        # Utilities
+│   └── public/
+├── docs/                 # Documentation
+├── scripts/              # Setup & utility scripts
+└── docker/               # Docker configurations
+```
+
+## API Endpoints
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/frameworks/sync` | POST | Sync framework updates |
+| `/frameworks/{id}/versions` | GET | Get framework versions |
+| `/audits` | POST | Create new audit |
+| `/audits/{id}/run-gap-analysis` | POST | Execute gap analysis |
+| `/findings` | GET | List findings with filters |
+| `/actions/recommend` | POST | Get corrective action recommendations |
+| `/dashboard/compliance-overview` | GET | Get compliance dashboard data |
+| `/assistant/query` | POST | Query AI assistant |
+
+## Supported Integrations
+
+- **Identity:** Active Directory, Entra ID, Okta
+- **Cloud:** AWS, Azure, GCP
+- **Security Tools:** Splunk, CrowdStrike, Qualys, Nessus
+- **Ticketing:** Jira, ServiceNow
+- **Documents:** SharePoint, Confluence
+
+## License
+
+MIT License - See LICENSE file for details.
+
+## Contributing
+
+We welcome contributions! Please read our contributing guidelines before submitting PRs.

grc-platform/backend/Dockerfile

@@ -0,0 +1,27 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    gcc \
+    postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy requirements first for better caching
+COPY requirements.txt .
+
+# Install Python dependencies
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy application code
+COPY . .
+
+# Create storage directory
+RUN mkdir -p /app/storage
+
+# Expose port
+EXPOSE 8000
+
+# Run the application
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

grc-platform/backend/app/__init__.py

@@ -0,0 +1 @@
+# GRC Agentic AI Platform - Backend Application

grc-platform/backend/app/api/actions.py

@@ -0,0 +1,74 @@
+"""
+Actions API endpoints.
+
+Manages corrective and preventive action plans (CAPA).
+"""
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.orm import Session
+from typing import List, Optional
+
+from ..core.database import get_db
+from ..models.action import ActionPlan, Task, ActionType
+
+router = APIRouter()
+
+
+@router.get("/", response_model=List[dict])
+async def list_action_plans(
+    skip: int = 0,
+    limit: int = 100,
+    action_type: Optional[str] = None,
+    db: Session = Depends(get_db)
+):
+    """List all action plans."""
+    query = db.query(ActionPlan)
+
+    if action_type:
+        query = query.filter(ActionPlan.action_type == action_type)
+
+    plans = query.order_by(ActionPlan.created_at.desc()).offset(skip).limit(limit).all()
+
+    return [
+        {
+            "id": ap.id,
+            "action_plan_id": ap.action_plan_id,
+            "title": ap.title,
+            "action_type": ap.action_type.value,
+            "status": ap.status,
+            "priority": ap.priority,
+            "target_date": ap.target_date,
+            "owner": ap.owner.full_name if ap.owner else None,
+            "progress_percentage": ap.progress_percentage
+        }
+        for ap in plans
+    ]
+
+
+@router.post("/recommend", response_model=dict)
+async def get_recommendations(db: Session = Depends(get_db)):
+    """
+    Get AI-powered proactive recommendations.
+
+    Analyzes historical data to predict potential compliance issues.
+    This would be handled by the Predictor Agent.
+    """
+    # Placeholder for ML-based predictions
+    return {
+        "predictions": [
+            {
+                "risk_area": "Access Control Reviews",
+                "prediction": "High risk of missed quarterly review deadline",
+                "confidence": 0.85,
+                "recommended_action": "Initiate access review process 2 weeks early",
+                "affected_frameworks": ["ISO 27001", "PCI DSS"]
+            },
+            {
+                "risk_area": "Vulnerability Management",
+                "prediction": "Potential SLA breach for critical patches",
+                "confidence": 0.72,
+                "recommended_action": "Schedule emergency patching window",
+                "affected_frameworks": ["ISO 27001", "NIST"]
+            }
+        ],
+        "message": "Predictions generated by ML model"
+    }