Upload arch_rules.py with huggingface_hub

arch_rules.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""SAP architecture best-practice rules, ported from the PAA architecture-validator
+(github.tools.sap/platform-adoption-advisory/architecture-validator, input/rules.json
++ src/rules/*.ts). Run directly on our clean semantic spec (typed components +
+connections + nested blocks) — no SPARQL/OWL/LLM-recognizer needed."""
+
+def _flat(spec):
+    """Return [(label_lower, id, [ancestor_block_labels_lower])] for all components."""
+    out = []
+    def walk(blocks, anc):
+        for b in blocks:
+            la = anc + [(b.get("label") or "").lower()]
+            for c in b.get("components", []):
+                out.append((c["label"].lower(), c["id"], la))
+            walk(b.get("blocks", []), la)
+    walk(spec.get("blocks", []), [])
+    return out
+
+def _has(comps, *kw):
+    return any(any(k in lbl for k in kw) for lbl, _, _ in comps)
+
+def _ids(comps, *kw):
+    return [cid for lbl, cid, _ in comps if any(k in lbl for k in kw)]
+
+LLM_KW   = ("gpt", "llm", "openai", "open ai", "generative ai", "claude", "gemini",
+            "anthropic", "foundation model", "large language model", "mistral", "llama")
+HUB_KW   = ("generative ai hub", "ai core")
+IDP_KW   = ("azure ad", "azure active directory", "entra", "okta", "ping identity",
+            "auth0", "3rd party identity", "third party identity", "external identity provider")
+IAS_KW   = ("cloud identity services", "identity authentication", "identity provisioning", "ias")
+BUILD_KW = ("build process automation", "build apps", "build work zone", "build workzone",
+            "business application studio", "build code")
+ONPREM_KW = ("s/4hana", "s4hana", "sap ecc", "on-premise", "on premise")
+EVENT_KW = ("event mesh", "advanced event mesh", "event hub", "cloud application event hub")
+
+def check_rules(spec):
+    """Return a list of best-practice violations (empty = compliant)."""
+    c = _flat(spec)
+    v = []
+
+    # R6: GenAI/LLM must be consumed via SAP Generative AI Hub / SAP AI Core
+    if _has(c, *LLM_KW) and not _has(c, *HUB_KW):
+        v.append("GenAI/LLM service present but not via SAP Generative AI Hub or SAP AI Core "
+                 "(add 'SAP Generative AI Hub').")
+    # R12: AI Core / Gen AI Hub require a management interface
+    if _has(c, "ai core", "generative ai hub") and not _has(c, "ai launchpad", "ai core api"):
+        v.append("SAP AI Core/Generative AI Hub present but no management interface "
+                 "(add 'SAP AI Launchpad').")
+    # R5: custom ML models must be managed via AI Core
+    if _has(c, "custom model", "ml model", "machine learning model", "trained model") and not _has(c, "ai core"):
+        v.append("Custom ML model present but not managed via SAP AI Core.")
+    # R4: external IdPs must go through SAP Cloud Identity Services (IAS)
+    if _has(c, *IDP_KW) and not _has(c, *IAS_KW):
+        v.append("External identity provider present but not integrated via SAP Cloud Identity "
+                 "Services (add 'Identity Authentication').")
+    # R2: Copilot / AI agents must integrate via Joule
+    if _has(c, "copilot", "ai agent", "ai assistant") and not _has(c, "joule"):
+        v.append("Copilot/AI agent present but not integrated via SAP Joule.")
+    # R10: Joule must be contained within an SAP system superArea
+    for lbl, cid, anc in c:
+        if "joule" in lbl and not any(any(s in a for s in ("btp", "s/4", "s4hana", "cloud solution",
+                                     "on-premise", "sap")) for a in anc):
+            v.append("SAP Joule is not contained within an SAP system block.")
+            break
+    # R3: on-premise/S4 integration needs Cloud Connector or Private Link
+    if _has(c, *ONPREM_KW) and not _has(c, "cloud connector", "private link"):
+        v.append("S/4HANA / on-premise system present but no Cloud Connector or Private Link.")
+    # R1: CAP integrating to external systems needs a Destination service
+    if _has(c, "cloud application programming", "cap application", "(cap)") and not _has(c, "destination service"):
+        v.append("CAP application present but no SAP Destination service for external integration.")
+    # R14: Cloud Connector tunnels to the SAP Connectivity service (complete the secure chain)
+    if _has(c, "cloud connector") and not _has(c, "connectivity service"):
+        v.append("Cloud Connector present but no SAP Connectivity service (incomplete on-prem tunnel).")
+    # R13: event-driven architecture must use an SAP Event service
+    event_hint = any("event" in lbl for lbl, _, _ in c) or \
+        any("event" in (e.get("label","") or "").lower() for e in spec.get("connections", []))
+    if event_hint and not _has(c, *EVENT_KW):
+        v.append("Event-driven architecture but no SAP Event Mesh / Advanced Event Mesh / Event Hub.")
+    return v
+
+if __name__ == "__main__":
+    import sys, json
+    spec = json.load(open(sys.argv[1]))
+    for x in check_rules(spec): print("VIOLATION:", x)