altour_vertex_twosprints.py

import pandas as pd
from textwrap import dedent

rows = []

def add_item(id_, sprint, epic, story, criteria, tasks, dod, owner="Engineer", deps=""):
    rows.append({
        "ID": id_,
        "Sprint": sprint,
        "Epic": epic,
        "User Story": story.strip(),
        "Acceptance Criteria (Given/When/Then)": criteria.strip(),
        "Key Tasks": tasks.strip(),
        "Definition of Done": dod.strip(),
        "Owner": owner,
        "Dependencies": deps.strip()
    })

# Sprint 1 – Platform & Access (Vertex AI)
add_item(
    "GCP-01", "Sprint 1", "GCP Org & Vertex AI Setup",
    "As a Platform Admin, I want a dedicated GCP project and billing with budgets & alerts so that spend and access are controlled from day one.",
    dedent("""\
    Given the AltourMX organization/folder,
    When the Vertex project is created and linked to billing,
    Then monthly budgets and 80/100/120% alerts are active and owners notified."""),
    dedent("""\
    • Create GCP project under correct folder
    • Link billing account; enable budget & anomaly detection
    • Enable APIs: Vertex AI, Cloud Logging, Monitoring, Secret Manager
    • Name & tag standards (labels: env, owner, cost_center)"""),
    "Project created; budgets & alerts firing in test; APIs enabled; labels validated.",
    owner="Cloud Platform"
)

add_item(
    "GCP-02", "Sprint 1", "Identity & Security",
    "As a Security Engineer, I want IAM roles, service accounts, and secrets configured according to least-privilege so that no long-lived keys or over-scoped roles are used.",
    dedent("""\
    Given CI/CD and runtime services,
    When roles are assigned,
    Then service accounts have least-privilege IAM; no user-managed keys; secrets in Secret Manager."""),
    dedent("""\
    • Define service accounts (orchestrator-sa, router-sa)
    • Assign minimal Vertex AI, Logging, Monitoring roles
    • Store provider secrets in Secret Manager (no .env keys)
    • Workload Identity Federation for GitHub/GitLab CI"""),
    "IAM policy reviewed; no key leaks; secrets rotated; WIF tested in CI.",
    owner="Security/Platform"
)

add_item(
    "GCP-03", "Sprint 1", "Private Access & Perimeters",
    "As a NetSec Engineer, I want private access to Vertex endpoints and a VPC Service Controls perimeter so that data stays in approved boundaries.",
    dedent("""\
    Given the project VPC,
    When private access is configured,
    Then calls to Vertex Online Prediction use Private Service Connect (PSC) or private routing, and the project is within a VPC SC perimeter (Vertex, Storage, BigQuery)."""),
    dedent("""\
    • Create VPC, subnets, Cloud NAT if needed
    • Configure Private Service Connect for Vertex Online Prediction (where supported)
    • Define VPC SC perimeter incl. Vertex AI, GCS, BQ
    • Test egress restrictions and perimeter audit"""),
    "LLM calls succeed over private path; perimeter audit passes; no public egress in tests.",
    owner="NetSec"
)

# Sprint 1 – App Control Plane (Routing/Guardrails)
add_item(
    "RGV-01", "Sprint 1", "Routing & Guardrails on Vertex",
    "As an Intake Orchestrator, I want pre-model PII masking and normalization so that prompts and logs do not contain raw sensitive data.",
    dedent("""\
    Given an inbound Spanish Case with PII,
    When the request is prepared,
    Then PII is masked in the prompt/logs and originals are encrypted and not sent to the model."""),
    dedent("""\
    • PII detectors (regex + NER-lite)
    • Masking policy; originals to CMEK/GCS or DB
    • Pre-normalize dates (ISO-8601), IATA, currency"""),
    "Zero PII in prompts/logs on test set; security sign-off.",
    owner="Backend"
)

add_item(
    "RGV-02", "Sprint 1", "Routing & Guardrails on Vertex",
    "As a Policy Admin, I want locked system prompts and decoding params so users cannot override core instructions.",
    dedent("""\
    Given adversarial instructions in the email,
    When normalization runs,
    Then system prompt loads from config, user overrides are stripped, and JSON schema mode is enforced (temperature=0)."""),
    dedent("""\
    • Prompt registry with version hash
    • Strip user overrides
    • JSON-constrained decoding / schema mode"""),
    "Prompt hash logged per call; unit test proves override stripping."
)

add_item(
    "RGV-03", "Sprint 1", "Routing & Guardrails on Vertex",
    "As an Intake Engineer, I want language/complexity routing so common Spanish cases go to Llama 4 Scout and edge/long cases to Qwen3 32B (if self-hosted) or remain in Llama with repair loops.",
    dedent("""\
    Given an inbound Case,
    When language=es-* and below thresholds,
    Then route to Llama 4 Scout; else use fallback path (Qwen3 on custom endpoint or two-step extract+verify)."""),
    dedent("""\
    • Implement classifier & thresholds
    • Fallback strategy (custom Vertex endpoint or two-step flow)
    • Feature flag to force single-model path"""),
    "Routing logged with reasons; flags work in staging."
)

add_item(
    "RGV-04", "Sprint 1", "Schema & Repair Loop",
    "As a Validator, I want strict JSON Schema validation against checklist_universal_gds and an automated repair loop.",
    dedent("""\
    Given a model response,
    When validated,
    Then either it passes or precise errors trigger repair prompts (max 2 retries)."""),
    dedent("""\
    • Integrate JSON Schema validator
    • Implement repair prompt strategy
    • Cap retries; status codes & metrics"""),
    "≥95% schema pass on happy-path; invalid-JSON <0.5% after repair."
)

add_item(
    "RGV-05", "Sprint 1", "Deterministic Validators",
    "As Operations, I want deterministic validators (IATA, dates, phones, emails) so outputs are normalized and trustworthy.",
    dedent("""\
    Given a validated JSON,
    When validators run,
    Then fields are normalized or flagged with reasons."""),
    dedent("""\
    • Implement validators/normalizers
    • Error taxonomy & messages"""),
    "Validators pass on Golden Set; clear remediation messages."
)

# Sprint 1 – Observability & Cost
add_item(
    "OBS-01", "Sprint 1", "Observability & Cost on GCP",
    "As an SRE, I want per-call metrics (latency, tokens, cost, schema status) exported to Cloud Monitoring so that reliability and cost are visible.",
    dedent("""\
    Given any model call,
    When it completes,
    Then metrics are recorded and visible in dashboards (p95 latency, tokens, USD/case, schema pass/fail)."""),
    dedent("""\
    • Emit metrics via OpenTelemetry to Cloud Monitoring
    • Estimate cost per call (Vertex billing export or token estimator)
    • Build initial dashboard (6 KPIs)"""),
    "Dashboard live; cost estimates validated against sample invoices."
)

add_item(
    "OBS-02", "Sprint 1", "Observability & Cost on GCP",
    "As a Compliance Officer, I want immutable audit logs with correlation IDs so I can reconstruct any case end-to-end.",
    dedent("""\
    Given a processed Case,
    When routing/guardrail/validator actions occur,
    Then append-only audit events are written with minimal PII, stored with CMEK, and retention set."""),
    dedent("""\
    • Define audit schema
    • Write to Cloud Logging + export to WORM storage (Bucket with retention lock)
    • Correlation IDs across services"""),
    "Audit trace reconstructs full path in test; retention policies enforced."
)

add_item(
    "OBS-03", "Sprint 1", "Observability & Cost on GCP",
    "As an On-Call Engineer, I want alerts for error spikes, latency SLO breaches, and cost anomalies so I can respond quickly.",
    dedent("""\
    Given production traffic,
    When error rate >0.5% (5m), p95 latency >1.2s (15m), or daily spend >2× baseline,
    Then send alert to PagerDuty/Chat/Teams with runbook link."""),
    dedent("""\
    • Alerting policies in Cloud Monitoring
    • Notification channels & runbooks
    • Synthetic load tests to validate alerts"""),
    "Alerts verified in staging; on-call ack within 5 minutes."
)

# Sprint 2 – Hardening & CI/CD
add_item(
    "GCP-04", "Sprint 2", "CMEK & Data Governance",
    "As a Security Engineer, I want CMEK for storage and logs so that we control encryption keys and access.",
    dedent("""\
    Given storage/logs with PII,
    When configured,
    Then all artifacts and logs are encrypted with CMKs; key rotation and access policies defined."""),
    dedent("""\
    • Create KMS keyring & keys; bind to buckets/logs
    • Rotation policy; key access approvals
    • Verify encryption in object metadata"""),
    "Objects/logs show CMEK; rotation tested; access reviewed."
)

add_item(
    "GCP-05", "Sprint 2", "CI/CD & Environments",
    "As a Platform Owner, I want CI/CD with GitHub Actions/Cloud Build so changes to routing/prompts and config are promoted safely across dev/stg/prod.",
    dedent("""\
    Given a change,
    When merged,
    Then pipelines run tests, eval gates, and deploy via IaC (Terraform) with approvals."""),
    dedent("""\
    • Configure Cloud Build or GitHub Actions with WIF
    • Terraform for Vertex resources & alerting
    • Environment promotion with approvals"""),
    "Green pipeline; promotion logged; IaC drift-free post-deploy."
)

add_item(
    "RGV-06", "Sprint 2", "Escalation & Human-in-the-Loop",
    "As an Intake Orchestrator, I want escalation to a human queue with context bundle after repeated failures or low confidence.",
    dedent("""\
    Given two failed repairs or low confidence,
    When evaluated,
    Then route to a Salesforce human queue with full context and reasons."""),
    dedent("""\
    • Confidence score & thresholds
    • Salesforce queue integration
    • Context bundle (inputs, attempts, validator errors)"""),
    "Escalations appear with full context; QA sign-off."
)

add_item(
    "RGV-07", "Sprint 2", "Output Safety & Policy Checks",
    "As a Security Engineer, I want post-model safety scans preventing PII leakage or policy-violating content from leaving the system.",
    dedent("""\
    Given a model output,
    When safety scan runs,
    Then unauthorized PII or policy violations block delivery and trigger remediation."""),
    dedent("""\
    • Output PII scan & policy rules
    • Block/remediate workflow
    • Tests incl. adversarial samples"""),
    "Zero known PII leaks on Golden Set; blocks logged with audit trail."
)

add_item(
    "OBS-04", "Sprint 2", "KPI Dashboards & Exec Reports",
    "As a Product Owner, I want KPI dashboards (schema fill-rate, invalid JSON, cost per 100 cases) and weekly reports for leadership.",
    dedent("""\
    Given a week of data,
    When viewing the dashboard,
    Then I see KPI trendlines by queue and an auto-generated weekly PDF summary."""),
    dedent("""\
    • Build KPI panels in Cloud Monitoring
    • Per-queue/client breakdowns
    • Scheduled report export"""),
    "Stakeholder sign-off; first weekly report delivered."
)

add_item(
    "OBS-05", "Sprint 2", "Evaluation Harness (Spanish Golden Set)",
    "As a QA Lead, I want an evaluation harness with a Spanish Golden Set so regressions are caught pre-release.",
    dedent("""\
    Given a candidate change,
    When the eval suite runs,
    Then it computes accuracy and schema fill-rate gates before rollout."""),
    dedent("""\
    • Curate & label 200–500 Spanish emails
    • Offline eval runner & gates
    • Block release on gate failure"""),
    "CI blocks failing builds; reports archived per build."
)

# Save
df = pd.DataFrame(rows)
csv_path = "/mnt/data/AltourMX_TwoSprint_Checklist_VertexAI.csv"
xlsx_path = "/mnt/data/AltourMX_TwoSprint_Checklist_VertexAI.xlsx"
df.to_csv(csv_path, index=False)
with pd.ExcelWriter(xlsx_path, engine="xlsxwriter") as writer:
    df.to_excel(writer, index=False, sheet_name="Checklist")
    # Autofit columns
    for idx, col in enumerate(df.columns):
        max_len = max(df[col].astype(str).map(len).max(), len(col)) + 2
        writer.sheets["Checklist"].set_column(idx, idx, min(max_len, 60))

import ace_tools as tools; tools.display_dataframe_to_user("AltourMX Two-Sprint Checklist (Vertex AI)", df)

(csv_path, xlsx_path)