Implementation Guide: Monitor SAM.gov / FedBizOpps for Solicitations & Maintain ITAR/EAR Export Control Compliance Checks on Outbound Technical Documents

# Autonomous SAM.gov monitoring agent running on Azure Functions timer
# trigger

# sam_autonomous_monitor.py
# Autonomous SAM.gov monitoring agent — runs on Azure Functions timer trigger

import requests, json, os, datetime
from openai import AzureOpenAI
from azure.storage.blob import BlobServiceClient

SAM_API_KEY = os.environ["SAM_GOV_API_KEY"]
AOAI_CLIENT = AzureOpenAI(
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
    api_key=os.environ["AZURE_OPENAI_KEY"],
    api_version="2024-08-01-preview"
)

# Load contractor profile from Azure Blob (update without code changes)
def load_contractor_profile() -> dict:
    blob_client = BlobServiceClient(
        account_url=f"https://{os.environ['STORAGE_ACCOUNT']}.blob.core.usgovcloudapi.net",
        credential=os.environ["STORAGE_KEY"]
    )
    container = blob_client.get_container_client("contractor-config")
    blob = container.get_blob_client("profile.json")
    return json.loads(blob.download_blob().readall())


def search_and_qualify_opportunities(profile: dict) -> list:
    """Search SAM.gov and automatically qualify opportunities against profile."""
    from sam_monitor import search_new_opportunities  # Reuse from UC-07

    raw_opportunities = search_new_opportunities(profile.get("qualification_criteria", {}))

    qualified = []
    for opp in raw_opportunities:
        # Quick autonomous qualification
        quick_score = autonomous_qualify(opp, profile)
        if quick_score["go_no_go"] in ["GO", "INVESTIGATE"]:
            qualified.append({**opp, "quick_score": quick_score})

    return qualified


def autonomous_qualify(opp: dict, profile: dict) -> dict:
    """Autonomously qualify an opportunity against contractor profile."""

    prompt = f"""You are an autonomous opportunity qualification agent for a defense contractor.
Quickly assess this opportunity against the contractor profile.

OPPORTUNITY:
{json.dumps(opp, indent=2, default=str)[:2000]}

CONTRACTOR PROFILE SUMMARY:
Capabilities: {', '.join(profile.get('capabilities', []))}
Certifications: {', '.join(profile.get('certifications', []))}
Contract vehicles: {', '.join(profile.get('contract_vehicles', []))}
Min value: ${profile.get('min_value', 0):,}
Max value: ${profile.get('max_value', 999999999):,}
Preferred NAICS: {', '.join([str(n) for n in profile.get('naics_codes', [])])}
Excluded keywords: {', '.join(profile.get('excluded_keywords', []))}

Return JSON only:
{{
  "go_no_go": "GO|INVESTIGATE|NO-GO",
  "quick_score": [1-10],
  "top_fit_reason": "single sentence",
  "top_risk": "single sentence or null",
  "recommended_action": "Full analysis|Watch|Pass|Industry Day only",
  "alert_bd_team": true/false
}}"""

    response = AOAI_CLIENT.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        messages=[{"role": "user", "content": prompt}],
        temperature=0.0, max_tokens=300,
        response_format={"type": "json_object"}
    )
    return json.loads(response.choices[0].message.content)


def generate_opportunity_briefing(opp: dict, profile: dict) -> str:
    """Generate a 1-page opportunity briefing package for the BD team."""

    briefing_prompt = f"""Generate a concise 1-page opportunity briefing for the BD team.

OPPORTUNITY:
{json.dumps(opp, indent=2, default=str)[:3000]}

CONTRACTOR PROFILE:
{json.dumps(profile.get('summary', {}), indent=2)}

Format as:
## OPPORTUNITY BRIEF — [Title]
**Agency:** | **NAICS:** | **Posted:** | **Response Due:** | **Est. Value:**
**Set-Aside:** | **SAM Link:** [URL]

### FIT ASSESSMENT (Quick Score: X/10)
- 3 bullet strengths
- 2 bullet risks or gaps

### KEY REQUIREMENTS (from description)
- 5 most important requirements

### RECOMMENDED ACTION
[GO — assign capture manager / INVESTIGATE — request more info / PASS — reason]

### NEXT STEPS (if GO/INVESTIGATE)
- [ ] Action 1 — Owner — Due date
- [ ] Action 2 — Owner — Due date

[AI-GENERATED BRIEFING — BD Director Review Required Before Gate Decision]"""

    response = AOAI_CLIENT.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        messages=[{"role": "user", "content": briefing_prompt}],
        temperature=0.2, max_tokens=1000
    )
    return response.choices[0].message.content


def deliver_daily_digest(qualified_opps: list, profile: dict):
    """Deliver daily opportunity digest via Microsoft Teams and email."""
    import requests

    if not qualified_opps:
        return  # No qualifying opportunities today

    # Compose digest
    digest = f"## SAM.gov Daily Opportunity Digest — {datetime.date.today().isoformat()}\n\n"
    digest += f"**{len(qualified_opps)} qualifying opportunities identified today**\n\n"

    go_opps = [o for o in qualified_opps if o['quick_score']['go_no_go'] == 'GO']
    investigate_opps = [o for o in qualified_opps if o['quick_score']['go_no_go'] == 'INVESTIGATE']

    if go_opps:
        digest += f"### 🟢 GO ({len(go_opps)} opportunities)\n"
        for opp in go_opps:
            digest += f"- **{opp['title']}** ({opp['agency']}) — Score: {opp['quick_score']['quick_score']}/10 — Due: {opp.get('response_date', 'TBD')}\n"
            digest += f"  _{opp['quick_score']['top_fit_reason']}_\n"
            digest += f"  [SAM.gov Link]({opp.get('sam_url', '#')})\n\n"

    if investigate_opps:
        digest += f"### 🟡 INVESTIGATE ({len(investigate_opps)} opportunities)\n"
        for opp in investigate_opps:
            digest += f"- **{opp['title']}** ({opp['agency']}) — Score: {opp['quick_score']['quick_score']}/10\n"

    # Post to Teams via webhook
    teams_webhook = os.environ.get("TEAMS_OPPORTUNITY_WEBHOOK")
    if teams_webhook:
        payload = {
            "type": "message",
            "text": digest[:2000]  # Teams message length limit
        }
        requests.post(teams_webhook, json=payload)

    # Send detailed email with full briefing packages
    # (Email delivery via Microsoft Graph API to BD team distribution list)
    print(f"Daily digest delivered: {len(go_opps)} GO, {len(investigate_opps)} INVESTIGATE")

# Automated export control screening for outbound technical documents

# itar_ear_screener.py
# Automated export control screening for outbound technical documents

from openai import AzureOpenAI
import os, json, datetime

client = AzureOpenAI(
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
    api_key=os.environ["AZURE_OPENAI_KEY"],
    api_version="2024-08-01-preview"
)

# ECCN/USML reference library (customized per contractor's product lines)
EXPORT_CONTROL_LIBRARY = {
    "ITAR_USML_CATEGORIES": {
        "Cat_I": "Firearms and Related Articles",
        "Cat_II": "Artillery Projectors",
        "Cat_III": "Ammunition and Ordnance",
        "Cat_IV": "Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets",
        "Cat_VI": "Vessels of War and Special Naval Equipment",
        "Cat_VII": "Tanks and Military Vehicles",
        "Cat_VIII": "Aircraft and Related Articles",
        "Cat_XI": "Military Electronics",
        "Cat_XII": "Fire Control, Range Finder, Optical and Guidance Equipment",
        "Cat_XIII": "Auxiliary Military Equipment",
        "Cat_XV": "Spacecraft Systems and Related Articles",
        "Cat_XVI": "Nuclear Weapons Related Articles",
        "Cat_XXI": "Articles, Technical Data, and Defense Services Not Otherwise Enumerated"
    },
    "CONTRACTOR_SPECIFIC_ECCNS": {
        # Customize per contractor product line
        "radar_systems": "EAR 7A001 / USML Cat XI",
        "encryption_software": "EAR 5E002 / CCATS required",
        "military_night_vision": "USML Cat XII",
        "propulsion_systems": "USML Cat IV / EAR 9A001",
        "structural_composites_general": "EAR99",
        "commercial_off_shelf_electronics": "EAR99"
    },
    "TRIGGER_KEYWORDS": [
        # Technical keywords that may indicate export-controlled content
        "classified", "ITAR", "export controlled", "FOUO",
        "radar", "sonar", "night vision", "infrared", "laser designator",
        "explosive", "ordnance", "propellant", "warhead",
        "encryption", "cryptographic", "key management",
        "guidance system", "inertial navigation", "GPS receiver (military)",
        "stealth", "low observable", "radar cross section",
        "EAR controlled", "ECCN", "USML", "munitions",
        "military specification", "MIL-SPEC", "MIL-STD"
    ]
}

ITAR_SCREENING_PROMPT = """You are an export control compliance specialist screening
a technical document for ITAR/EAR-controlled content prior to release.

IMPORTANT LEGAL CONTEXT:
- This screening identifies potential export control issues for ECO review
- You do NOT make final release determinations — the Export Control Officer does
- When in doubt, flag for review — false positives are acceptable, false negatives are not
- ITAR violations carry civil penalties up to $1.3M per violation

CONTRACTOR'S ECCN/USML REFERENCE:
{eccn_library}

DOCUMENT METADATA:
Filename: {filename}
Document Type: {doc_type}
Intended Recipient: {recipient}
Recipient Country: {recipient_country}
Recipient Organization: {recipient_org}

DOCUMENT CONTENT EXCERPT:
{document_text}

SCREENING ASSESSMENT:

1. EXPORT CONTROL CLASSIFICATION
   - Is this document likely ITAR-controlled (USML)? [Yes/No/Uncertain]
     If Yes: Probable USML Category: [Category]
   - Is this document EAR-controlled (CCL)? [Yes/No/Uncertain]
     If Yes: Probable ECCN: [ECCN]
   - Is this document EAR99 (no license generally required)? [Yes/No/Uncertain]
   - Is additional information needed to classify? [Yes — specify what]

2. RELEASE RISK ASSESSMENT
   - Overall risk level: [HIGH/MEDIUM/LOW/CLEARED]
   - Specific controlled content identified: [list specific sections/topics]
   - Trigger keywords found: [list]

3. RECIPIENT SCREENING FLAGS
   - Is the recipient a foreign person or foreign national? [Flag if unclear]
   - Is the recipient country subject to embargo (Cuba, Iran, North Korea, Russia, Syria)? [Flag if yes]
   - Does the transaction appear to be a deemed export (releasing to foreign national in US)? [Flag if possible]

4. RECOMMENDED ACTION
   - [HOLD — ECO Review Required: reason]
   - [CLEARED — EAR99, domestic release, no foreign persons involved]
   - [LICENSE CHECK REQUIRED — controlled content + foreign recipient]
   - [IMMEDIATE HOLD — suspected embargo violation or USML without license]

5. ECO NOTES
   Specific questions or issues the ECO should address in their review.

[AI-SCREENING RESULT — EXPORT CONTROL OFFICER REVIEW REQUIRED FOR ALL HOLDS]
[All HOLD documents must remain in SharePoint until ECO clears for release]"""

def screen_document(
    document_text: str,
    document_metadata: dict
) -> dict:
    """Screen a technical document for export control content."""

    eccn_summary = json.dumps(EXPORT_CONTROL_LIBRARY["CONTRACTOR_SPECIFIC_ECCNS"], indent=2)

    response = client.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        messages=[
            {"role": "system", "content": "You are a rigorous export control compliance specialist. Flag anything uncertain for ECO review. Never clear a document you are not confident is EAR99 and domestically released."},
            {"role": "user", "content": ITAR_SCREENING_PROMPT.format(
                eccn_library=eccn_summary,
                filename=document_metadata.get("filename", "Unknown"),
                doc_type=document_metadata.get("document_type", "Unknown"),
                recipient=document_metadata.get("recipient_name", "Unknown"),
                recipient_country=document_metadata.get("recipient_country", "Unknown"),
                recipient_org=document_metadata.get("recipient_org", "Unknown"),
                document_text=document_text[:5000]
            )}
        ],
        temperature=0.0,
        max_tokens=2000
    )

    screening_result = response.choices[0].message.content
    is_hold = "HOLD" in screening_result or "LICENSE CHECK" in screening_result

    return {
        "document_id": document_metadata.get("id", "Unknown"),
        "filename": document_metadata.get("filename", "Unknown"),
        "screening_timestamp": datetime.datetime.utcnow().isoformat(),
        "screening_result": screening_result,
        "hold_status": "HOLD" if is_hold else "PRELIMINARY-CLEAR",
        "requires_eco_review": is_hold,
        "eco_notified": False,  # Updated by Logic App
        "legal_disclaimer": "AI screening result only. Export Control Officer must review all HOLDs."
    }


def apply_sharepoint_release_hold(document_id: str, hold_status: str):
    """Apply or remove export control release hold via SharePoint sensitivity label."""
    import requests

    graph_token = get_graph_token()  # Reuse from other modules
    headers = {
        "Authorization": f"Bearer {graph_token}",
        "Content-Type": "application/json"
    }

    # Apply ITAR_HOLD label via Microsoft Purview
    # Label IDs are configured in the Purview compliance portal
    label_id = (
        os.environ["PURVIEW_ITAR_HOLD_LABEL_ID"] if hold_status == "HOLD"
        else os.environ["PURVIEW_CLEARED_LABEL_ID"]
    )

    label_resp = requests.post(
        f"https://graph.microsoft.us/v1.0/drives/{os.environ['SHAREPOINT_DRIVE_ID']}/items/{document_id}/assignLabel",
        headers=headers,
        json={"sensitivityLabelId": label_id}
    )

    return label_resp.status_code == 200

SYSTEM PROMPT:
You are an export compliance analyst performing initial recipient screening.
Review the following recipient information and flag any export control concerns.

RECIPIENT INFORMATION:
Name/Organization: {recipient}
Country: {country}
Known business activity: {activity}

SCREENING CHECKS:
1. SANCTIONED/EMBARGOED COUNTRY: Is the recipient country subject to a U.S. embargo?
   (Cuba, Iran, North Korea, Russia [for military], Syria, Belarus [for military])
   → [YES — IMMEDIATE HOLD] or [No concern identified]

2. FOREIGN PERSON CONCERN: Is the recipient a foreign person or foreign national?
   (Non-U.S. citizen not lawfully admitted for permanent residence)
   → This would constitute a "deemed export" requiring license if controlled content
   → [FLAG FOR ECO] or [No concern identified]

3. RED FLAG INDICATORS: Any unusual aspects of this recipient that warrant further scrutiny?
   (Unusual end-use, atypical business sector for requested technical data, etc.)
   → [FLAG — reason] or [No red flags identified]

RECOMMENDED ACTION:
[PROCEED TO DOCUMENT SCREENING] or [HOLD — ECO Review Before Screening] or [IMMEDIATE STOP — Legal Review Required]