feat(D22-D25): Bedrock + Vertex AI parsers, governance utils, CLI updates, v0.3.0

BACKLOG.md

@@ -71,7 +71,7 @@
 | A11 | P1 | @architect | merged | Spec persona.sections schema — structured prompt sections for IR v0.2 |
 | D20 | P1 | @dev | merged | Add persona.sections to IR model + update parsers to populate from headings |
 | D21 | P1 | @dev | merged | Update emitters (Bedrock, Vertex, diff) to use persona.sections |
-| T13 | P1 | @tester | pr-created | Write tests for persona.sections — parser detection, emitter mapping, diff |
+| T13 | P1 | @tester | merged | Write tests for persona.sections — parser detection, emitter mapping, diff |
 
 ## Week 5: Ecosystem + LangGraph + GitHub Action
 
@@ -83,3 +83,22 @@
 | D19 | P1 | @dev | merged | GitHub Action: auto-generate cloud configs when SKILL.md changes (CI/CD integration) |
 | T11 | P1 | @tester | merged | Write tests for LangGraph emitter (fixture + round-trip + integration) |
 | T12 | P1 | @tester | merged | Add LangGraph to full integration test (pregnancy-companion → langgraph) |
+
+## Week 7: Governance Framework + Cloud Parsers (v0.3)
+
+> Context: Governance system (L1/L2/L3 IR fields, audit engine, elevation) was added as untracked
+> work supporting a research paper. This week formalises it with specs, tests, reverse-direction
+> parsers for cloud platforms, and a CHANGELOG bump to v0.3.0.
+
+| ID | Priority | Owner | Status | Title |
+|----|----------|-------|--------|-------|
+| A12 | P1 | @architect | ready | Spec Governance IR schema — L1/L2/L3 layers, GPR/CFS scoring definitions, elevation rules |
+| A13 | P1 | @architect | ready | Research and document Bedrock parser format (reverse: Bedrock → IR) |
+| A14 | P1 | @architect | pr-created | Research and document Vertex AI parser format (reverse: Vertex → IR) |
+| D22 | P1 | @dev | ready | Implement Bedrock parser (bedrock-agent.json + OpenAPI + instruction.txt → IR) |
+| D23 | P1 | @dev | ready | Implement Vertex AI parser (agent.json + tool definitions → IR) |
+| D24 | P1 | @dev | ready | Add `--from bedrock` and `--from vertex` to convert/diff/audit CLI commands |
+| D25 | P1 | @dev | ready | Bump version to 0.3.0 — update CHANGELOG.md, pyproject.toml, add governance to README |
+| T14 | P1 | @tester | ready | Write tests for governance extraction (Guardrail classification, ToolPermission, L3 annotations) |
+| T15 | P1 | @tester | ready | Write tests for audit engine (GPR-L1/L2/L3 scoring, elevation tracking, CSV/JSON export) |
+| T16 | P1 | @tester | ready | Write tests for Bedrock + Vertex parsers (fixtures + round-trip with emitters) |

experiments/agents/a1-general-assistant/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: general-assistant
+description: A general-purpose assistant for everyday tasks
+version: "1.0.0"
+---
+
+## Instructions
+
+You are a helpful general assistant. Answer questions clearly and concisely.
+When you don't know something, say so honestly.
+
+## Tools
+
+Use `web-search` to find current information.
+Use `calculator` for mathematical computations.

experiments/agents/a1-general-assistant/agent_meta.json

@@ -0,0 +1,5 @@
+{
+  "id": "A1",
+  "domain": "General",
+  "complexity": "Low"
+}

experiments/agents/a1-general-assistant/tools/calculator.json

@@ -0,0 +1,7 @@
+{
+  "name": "calculator",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a1-general-assistant/tools/web-search.json

@@ -0,0 +1,7 @@
+{
+  "name": "web-search",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a10-content-moderator/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: content-moderator
+description: Content moderation agent applying community guidelines
+version: "1.0.0"
+---
+
+## Instructions
+
+You are a content moderation agent. Review user-generated content against
+community guidelines. Flag violations, escalate edge cases, and document
+all decisions.
+
+## Tools
+
+Use `content-queue` to review content items.
+Use `user-history` to check user moderation history.

experiments/agents/a10-content-moderator/agent_meta.json

@@ -0,0 +1,5 @@
+{
+  "id": "A10",
+  "domain": "Moderation",
+  "complexity": "Medium"
+}

experiments/agents/a10-content-moderator/governance/annotations.json

@@ -0,0 +1,53 @@
+{
+  "annotations": [
+    {
+      "id": "L3-A10-001",
+      "kind": "content_filter",
+      "description": "Detect hate speech (Bedrock HATE, Vertex HARASSMENT)",
+      "platform_target": "any",
+      "config": {
+        "categories": [
+          "HATE",
+          "HARASSMENT"
+        ]
+      }
+    },
+    {
+      "id": "L3-A10-002",
+      "kind": "content_filter",
+      "description": "Detect explicit content (Bedrock SEXUAL, Vertex SEXUALLY_EXPLICIT)",
+      "platform_target": "any",
+      "config": {
+        "categories": [
+          "SEXUAL",
+          "SEXUALLY_EXPLICIT"
+        ]
+      }
+    },
+    {
+      "id": "L3-A10-003",
+      "kind": "content_filter",
+      "description": "Detect violence (Bedrock VIOLENCE, Vertex DANGEROUS_CONTENT)",
+      "platform_target": "any",
+      "config": {
+        "categories": [
+          "VIOLENCE",
+          "DANGEROUS_CONTENT"
+        ]
+      }
+    },
+    {
+      "id": "L3-A10-004",
+      "kind": "pii_detection",
+      "description": "Mask user PII in moderation logs",
+      "platform_target": "any",
+      "config": {
+        "types": [
+          "NAME",
+          "EMAIL",
+          "PHONE"
+        ]
+      }
+    }
+  ]
+}

experiments/agents/a10-content-moderator/tools/content-queue.json

@@ -0,0 +1,7 @@
+{
+  "name": "content-queue",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a10-content-moderator/tools/user-history.json

@@ -0,0 +1,7 @@
+{
+  "name": "user-history",
+  "enabled": true,
+  "access": "read-only",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a11-devops-automation/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: devops-automation
+description: Infrastructure automation agent for Kubernetes and Terraform
+version: "1.0.0"
+---
+
+## Instructions
+
+You are a DevOps automation agent. Help with infrastructure management
+using kubectl and terraform. Always validate changes before applying
+and log all operations.
+
+## Tools
+
+Use `kubectl` for Kubernetes operations.
+Use `terraform-plan` to preview infrastructure changes.
+Use `monitoring-api` to check service health.
+
+```bash
+kubectl get pods --namespace dev
+terraform plan
+```

experiments/agents/a11-devops-automation/agent_meta.json

@@ -0,0 +1,5 @@
+{
+  "id": "A11",
+  "domain": "DevOps",
+  "complexity": "Medium"
+}

experiments/agents/a11-devops-automation/governance/annotations.json

@@ -0,0 +1,17 @@
+{
+  "annotations": [
+    {
+      "id": "L3-A11-001",
+      "kind": "content_filter",
+      "description": "Block credential/secret exposure in logs",
+      "platform_target": "any",
+      "config": {
+        "types": [
+          "API_KEY",
+          "PASSWORD",
+          "SECRET"
+        ]
+      }
+    }
+  ]
+}

experiments/agents/a11-devops-automation/tools/bash.json

@@ -0,0 +1,9 @@
+{
+  "name": "bash",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [
+    "rm -rf *"
+  ],
+  "allow_patterns": []
+}

experiments/agents/a11-devops-automation/tools/kubectl.json

@@ -0,0 +1,11 @@
+{
+  "name": "kubectl",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": [
+    "--namespace dev",
+    "--namespace staging"
+  ],
+  "notes": "Restricted to dev and staging namespaces only"
+}

experiments/agents/a11-devops-automation/tools/monitoring-api.json

@@ -0,0 +1,7 @@
+{
+  "name": "monitoring-api",
+  "enabled": true,
+  "access": "read-only",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a11-devops-automation/tools/terraform-apply.json

@@ -0,0 +1,8 @@
+{
+  "name": "terraform-apply",
+  "enabled": false,
+  "access": "disabled",
+  "deny_patterns": [],
+  "allow_patterns": [],
+  "notes": "Requires human trigger"
+}

experiments/agents/a11-devops-automation/tools/terraform-plan.json

@@ -0,0 +1,7 @@
+{
+  "name": "terraform-plan",
+  "enabled": true,
+  "access": "read-only",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a12-orchestrator/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: multi-agent-orchestrator
+description: Orchestrates multiple sub-agents for complex multi-step tasks
+version: "1.0.0"
+---
+
+## Instructions
+
+You are a multi-agent orchestrator. Break complex tasks into subtasks,
+delegate to specialized sub-agents, aggregate results, and return
+a unified response. Enforce timeouts and handle failures gracefully.
+
+## Tools
+
+Use `agent-registry` to find available sub-agents.
+Use `task-dispatcher` to delegate tasks.
+Use `result-aggregator` to combine sub-agent outputs.
+Use `sub-agent-control` to manage sub-agent lifecycle.

experiments/agents/a12-orchestrator/agent_meta.json

@@ -0,0 +1,5 @@
+{
+  "id": "A12",
+  "domain": "Orchestration",
+  "complexity": "High"
+}

experiments/agents/a12-orchestrator/governance/annotations.json

@@ -0,0 +1,28 @@
+{
+  "annotations": [
+    {
+      "id": "L3-A12-001",
+      "kind": "pii_detection",
+      "description": "Ensure PII doesn't leak between sub-agents",
+      "platform_target": "any",
+      "config": {
+        "scope": "inter-agent",
+        "types": [
+          "ALL"
+        ]
+      }
+    },
+    {
+      "id": "L3-A12-002",
+      "kind": "content_filter",
+      "description": "Block sub-agent outputs that violate content policies",
+      "platform_target": "any",
+      "config": {
+        "scope": "sub-agent-output",
+        "categories": [
+          "ALL"
+        ]
+      }
+    }
+  ]
+}

experiments/agents/a12-orchestrator/tools/agent-registry.json

@@ -0,0 +1,7 @@
+{
+  "name": "agent-registry",
+  "enabled": true,
+  "access": "read-only",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a12-orchestrator/tools/result-aggregator.json

@@ -0,0 +1,7 @@
+{
+  "name": "result-aggregator",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a12-orchestrator/tools/sub-agent-control.json

@@ -0,0 +1,8 @@
+{
+  "name": "sub-agent-control",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": [],
+  "notes": "start, stop, timeout"
+}

experiments/agents/a12-orchestrator/tools/task-dispatcher.json

@@ -0,0 +1,7 @@
+{
+  "name": "task-dispatcher",
+  "enabled": true,
+  "access": "full",
+  "deny_patterns": [],
+  "allow_patterns": []
+}

experiments/agents/a2-code-reviewer/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: code-reviewer
+description: Automated code review agent that analyzes code quality and security
+version: "1.0.0"
+---
+
+## Instructions
+
+You are a code review agent. Analyze code for bugs, security vulnerabilities,
+and style issues. Provide actionable feedback with severity ratings.
+
+## Tools
+
+Use `file-read` to read source code files.
+Use `git-diff` to see changes.
+Use `static-analysis` to run linting tools.

experiments/agents/a2-code-reviewer/agent_meta.json

@@ -0,0 +1,5 @@
+{
+  "id": "A2",
+  "domain": "Development",
+  "complexity": "Medium"
+}

experiments/agents/a2-code-reviewer/tools/file-read.json

@@ -0,0 +1,10 @@
+{
+  "name": "file-read",
+  "enabled": true,
+  "access": "read-only",
+  "deny_patterns": [
+    "*/secrets/*",
+    "*/credentials/*"
+  ],
+  "allow_patterns": []
+}