🕸️ Ada Research Browser

tasks.md
Home›Research Reports›tasks.md
← Back

Tasks: Compliance Assessment and Reporting Layer

Input: Design documents from /specs/003-compliance-assessment/ Prerequisites: plan.md (required), spec.md (required for user stories), research.md, data-model.md, contracts/

Tests: Tests are included as this is compliance-critical infrastructure requiring validation.

Organization: Tasks are grouped by user story to enable independent implementation and testing of each story.

Format: [ID] [P?] [Story] Description

Path Conventions

This project extends an Ansible collection with Python tooling: - Playbooks: playbooks/ - Filter plugins: plugins/filter/ - Scripts: scripts/ - Data files: data/ - Templates: templates/ - Tests: tests/

Phase 1: Setup (Shared Infrastructure)

Purpose: Directory structure, data files, and dependencies

Phase 2: Foundational (Blocking Prerequisites)

Purpose: Core utilities and filter plugin that ALL user stories depend on

CRITICAL: Assessment, scoring, and reporting all depend on SPRS filter plugin and redaction utility

Checkpoint: SPRS filter and redaction utility ready - user story implementation can begin

Phase 3: User Story 1 - Comprehensive Compliance Assessment (Priority: P1) MVP

Goal: Run assessment across all systems, produce structured JSON with control pass/fail status

Independent Test: Run ansible-playbook playbooks/assess.yml --check against test inventory, verify JSON output with correct schema

Tests for User Story 1

Implementation for User Story 1

Checkpoint: Assessment playbook functional - can run compliance assessment and produce JSON results

Phase 4: User Story 2 - SPRS Score Calculation and Reporting (Priority: P1)

Goal: Calculate SPRS score with breakdown, prioritized remediation recommendations

Independent Test: Run SPRS script with test assessment JSON, verify score matches manual calculation

Tests for User Story 2

Implementation for User Story 2

Checkpoint: SPRS scoring complete - can calculate and report scores with plain-language breakdown

Phase 5: User Story 3 - SSP Evidence Package Generation (Priority: P1)

Goal: Collect evidence artifacts, generate control narratives, package for auditors

Independent Test: Run evidence playbook, verify all evidence types collected, narratives pass glossary validation

Tests for User Story 3

Implementation for User Story 3

Checkpoint: Evidence collection complete - can generate full SSP evidence package with narratives

Phase 6: User Story 4 - POA&M Tracking and Reporting (Priority: P2)

Goal: Track remediation items, generate PM-friendly reports in Markdown and CSV

Independent Test: Create sample POA&M items, generate reports, verify PM can understand status

Tests for User Story 4

Implementation for User Story 4

Checkpoint: POA&M tracking complete - can track and report remediation items

Phase 7: User Story 5 - Compliance Dashboard (Priority: P2)

Goal: Generate HTML dashboard with audience-specific views (leadership, CISO, auditor)

Independent Test: Generate dashboard, open in browser, verify gauge renders and all views function

Tests for User Story 5

Implementation for User Story 5

Checkpoint: Dashboard complete - can generate and view compliance status for all audiences

Phase 8: User Story 6 - Auditor Package Generator (Priority: P3)

Goal: Bundle all compliance artifacts into CMMC assessment-ready package

Independent Test: Generate auditor package, verify all required artifacts present per CMMC guide

Tests for User Story 6

Implementation for User Story 6

Checkpoint: Auditor package complete - can generate full C3PAO-ready documentation bundle

Phase 9: Polish & Cross-Cutting Concerns

Purpose: Makefile integration, documentation, validation

Dependencies & Execution Order

Phase Dependencies

User Story Dependencies

Phase 2 (Foundational)
        │
        ├──────────────────────┬──────────────────────┐
        │                      │                      │
        ▼                      ▼                      ▼
    US1 (P1)               US3 (P1)               US4 (P2)
   Assessment              Evidence               POA&M
        │                      │                      │
        ├───────────┐          │                      │
        ▼           │          │                      │
    US2 (P1)        │          │                      │
     SPRS           │          │                      │
        │           │          │                      │
        ├───────────┴──────────┴──────────────────────┤
        ▼                                             │
    US5 (P2)                                          │
   Dashboard                                          │
        │                                             │
        └─────────────────────────────────────────────┤
                                                      ▼
                                                  US6 (P3)
                                               Auditor Package

Within Each User Story

Parallel Opportunities

Parallel Example: Foundational Phase

# Launch SPRS filter and redaction utility in parallel:
Task: "Create SPRS filter plugin skeleton in plugins/filter/sprs.py"
Task: "Create scripts/redact_secrets.py with REDACTION_PATTERNS list"

# After skeleton complete, implement in parallel:
Task: "Implement sprs_score() filter function"
Task: "Implement redact_file() function"
Task: "Implement sprs_breakdown() filter function"
Task: "Implement redact_directory() function"

# Tests can run in parallel:
Task: "tests/test_sprs_filter.py with known test vectors"
Task: "tests/test_redaction.py with pattern matching tests"

Implementation Strategy

MVP First (User Story 1 Only)

  1. Complete Phase 1: Setup
  2. Complete Phase 2: Foundational (SPRS filter, redaction utility)
  3. Complete Phase 3: User Story 1 (Assessment)
  4. STOP and VALIDATE: Run make assess and verify JSON output
  5. Deploy/demo assessment capability

Incremental Delivery

  1. Complete Setup + Foundational → Core utilities ready
  2. Add US1 (Assessment) → Can measure compliance state (MVP!)
  3. Add US2 (SPRS) → Can calculate and explain score
  4. Add US3 (Evidence) → Can generate auditor evidence
  5. Add US4 (POA&M) → Can track remediation
  6. Add US5 (Dashboard) → Can visualize compliance
  7. Add US6 (Auditor Package) → Can bundle for C3PAO

Parallel Team Strategy

With multiple developers:

  1. Team completes Setup + Foundational together
  2. Once Foundational is done:
  3. Developer A: US1 (Assessment) → US2 (SPRS)
  4. Developer B: US3 (Evidence)
  5. Developer C: US4 (POA&M)
  6. After US1, US2, US4 complete:
  7. Developer A: US5 (Dashboard)
  8. After all complete:
  9. Any developer: US6 (Auditor Package)

Notes