|
| 1 | +# AGENTS.md |
| 2 | + |
| 3 | +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. |
| 4 | + |
| 5 | +## Project Overview |
| 6 | + |
| 7 | +This is a web application for viewing and managing security control overlays that constitute IL6 (Information Level 6) — the DoD standard for cloud service providers working with classified secret information. It displays NIST SP 800-53 controls with security overlays including FedRAMP High, CNSSI 1253, Classified Information Overlay, and FedRAMP+. |
| 8 | + |
| 9 | +## Architecture |
| 10 | + |
| 11 | +- **Frontend**: Single-page application using vanilla JavaScript embedded in `index.html` (no build process) |
| 12 | +- **Data Pipeline**: Python scripts extract data from PDF overlays → JSON files → JavaScript web app |
| 13 | +- **Hosting**: https://il6.sl5taskforce.org/ (GitHub: https://github.com/securitylevel5/il6-control-catalog) |
| 14 | + |
| 15 | +## Common Development Commands |
| 16 | + |
| 17 | +### Python Data Extraction |
| 18 | + |
| 19 | +Python 3.13 (pinned in `.python-version`), managed with `uv`. Never use bare `pip` or conda. |
| 20 | + |
| 21 | +```bash |
| 22 | +# One-time environment setup |
| 23 | +uv venv --python 3.13 |
| 24 | +uv pip install -r requirements.txt |
| 25 | + |
| 26 | +# Extract overlay data from PDFs (requires PyMuPDF/fitz) |
| 27 | +uv run python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf |
| 28 | +uv run python classified_information/extract_classified_information.py classified_information/classified_information_overlay_2022.pdf |
| 29 | + |
| 30 | +# Debug specific pages |
| 31 | +uv run python cnssi_1253/extract_cnssi_1253.py cnssi_1253/CNSSI_1253_2022.pdf --debug-page 10 |
| 32 | + |
| 33 | +# Sort NIST controls naturally |
| 34 | +uv run python nist_catalog/nist_sorter.py input.json output.json |
| 35 | +``` |
| 36 | + |
| 37 | +**Extractor output paths:** `extract_*.py` write their JSON to the *current working directory* using hardcoded |
| 38 | +filenames, so run them from the repo root to land on the committed files. `nist_sorter.py` overwrites its input |
| 39 | +file when no output path is given. When regenerating output just to verify a change, run from a scratch |
| 40 | +directory so the committed JSON is never clobbered, then `diff` the result. |
| 41 | + |
| 42 | +### Development |
| 43 | +- No build process - edit `index.html` directly |
| 44 | +- No package manager - pure vanilla JavaScript |
| 45 | +- Deploy by pushing to GitHub |
| 46 | + |
| 47 | +## Code Structure |
| 48 | + |
| 49 | +### Frontend (`index.html`) |
| 50 | +- **Data Loading**: `loadData()` fetches all JSON files |
| 51 | +- **Rendering**: `renderControls()` displays filtered controls |
| 52 | +- **State**: Global variables store control data and overlay states |
| 53 | +- **Events**: Toggle overlays, search, filter by family, expand/collapse controls |
| 54 | + |
| 55 | +### Data Pipeline |
| 56 | +Each overlay directory contains: |
| 57 | +- PDF source document |
| 58 | +- Python extractor script (`extract_*.py`) |
| 59 | +- Generated JSON data file |
| 60 | +- Common pattern: PDF → Python extractor → JSON → Web app |
| 61 | + |
| 62 | +### Key Data Structures |
| 63 | +```javascript |
| 64 | +// Control format |
| 65 | +{ |
| 66 | + "id": "AC-1", |
| 67 | + "text": "Control description...", |
| 68 | + "family": "Access Control", |
| 69 | + "enhancements": [...], |
| 70 | + "discussion": "..." |
| 71 | +} |
| 72 | + |
| 73 | +// Overlay format varies by type |
| 74 | +// FedRAMP: {"assessment_procedures": [...]} |
| 75 | +// CNSSI: {"selections": {...}, "parameter_value": "...", "justification": "..."} |
| 76 | +// Classified: {"justification": "...", "parameter_value": "...", "guidance": "..."} |
| 77 | +``` |
| 78 | + |
| 79 | +## Important Patterns |
| 80 | + |
| 81 | +1. **Control ID Format**: `[A-Z]{2}-\d{1,2}` (base) or `[A-Z]{2}-\d{1,2}\(\d+\)` (enhancement) |
| 82 | +2. **Overlay Toggle Logic**: Each overlay can be enabled/disabled, affecting control visibility |
| 83 | +3. **Enhancement Display**: Controls with enhancements have expandable sections |
| 84 | +4. **Modal System**: Click control IDs to preview in modal |
| 85 | +5. **Natural Sorting**: Controls sorted as AC-1, AC-2, ..., AC-10 (not lexically) |
| 86 | + |
| 87 | +## Adding New Overlays |
| 88 | + |
| 89 | +1. Create directory for new overlay |
| 90 | +2. Add PDF source document |
| 91 | +3. Create Python extractor following existing patterns (see `cnssi_1253/extract_cnssi_1253.py` as template) |
| 92 | +4. Generate JSON data |
| 93 | +5. Add overlay loading in `loadData()` function |
| 94 | +6. Add toggle UI in overlay panel |
| 95 | +7. Update `getOverlayInfo()` to handle new overlay format |
| 96 | + |
| 97 | +## Testing |
| 98 | + |
| 99 | +No automated tests exist. Manual testing process: |
| 100 | +1. Run Python extractors on PDFs |
| 101 | +2. Verify JSON output structure |
| 102 | +3. Load in browser and test filtering/toggling |
| 103 | +4. Check control display and enhancements |
| 104 | +5. Test search functionality |
| 105 | + |
| 106 | +## Dependencies |
| 107 | + |
| 108 | +- **Python**: 3.13, PyMuPDF (fitz) for PDF extraction (see `requirements.txt`) |
| 109 | +- **JavaScript**: None (vanilla JS only) |
| 110 | +- **Deployment**: GitHub Pages |
0 commit comments