Add local TSBD e-GP intelligence plugin by tendersolutionanalysis-ui · Pull Request #102 · github/copilot-plugins · GitHub
Skip to content

Add local TSBD e-GP intelligence plugin #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tendersolutionanalysis-ui wants to merge 1 commit into
base: main
Choose a base branch
from
+2,577 −0
Open

Add local TSBD e-GP intelligence plugin #102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/plugin/marketplace.json
View file
Open in desktop
791 changes: 791 additions & 0 deletions data/source_inventory.json
View file
Open in desktop

Large diffs are not rendered by default.

82 changes: 82 additions & 0 deletions docs/SELF_AUDIT_REPORT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
# Repository Self-Audit

## Baseline scope and result

Audited the selected `github/copilot-plugins` checkout at baseline commit `fbf7c536a5c7af0c94ff5f528a39004c55129e6d`. The worktree was clean before the audit artifacts were added. All 30 tracked files were inventoried and hashed in `data/source_inventory.json`; no ignored or untracked application/data files were found in the baseline. This is a frozen baseline inventory, not a count of files added later.

This repository is a Copilot plugin collection, not the e-GP Tender Solution application or its data repository. The audit found two local plugins (`spark` and `build-perf-cpp`) and marketplace references to separately hosted plugins. It found no e-GP database, award records, data collector, tender workbench, HTML report, source snapshot, calculation engine, detector engine, or test framework.

## Requested capabilities: implementation status

| Capability | Status at baseline audit | Evidence / blocker |
|---|---|---|
| Tender Passport | Not implemented | No tender model or e-GP records |
| Firm Passport | Not implemented | No canonical firm IDs, aliases, or credential records |
| Historical Timeline | Not implemented | No event ledger or historical snapshots |
| Evidence Graph | Not implemented | No tender evidence IDs, normalized records, or source snapshots |
| Mathematical Detector Stack | Not implemented | No authoritative tender calculation engine or input records |
| Automatic Self-Audit | This repository-level audit is recorded here; an e-GP self-audit is not implemented | No e-GP code/data paths to inspect |

These are explicit gaps, not zero counts or negative findings about the external e-GP system. No synthetic production records or demo intelligence were created.

## Checks performed

1. Confirmed a clean baseline and recorded the commit.
2. Enumerated tracked files and inspected on-disk files while excluding Git metadata.
3. Searched the checkout for `production_contracts`, `egp_data.db`, `TENDER_SOLUTION_BD`, `Firm Passport`, `OTM Works`, and `egp_data`; no matches were found.
4. Checked file types and project structure. No SQLite/database, CSV award data, tender HTML, application dependency manifest, test directory, or application entry point was present.
5. Inspected the marketplace configuration, local plugin manifests, hooks, operational PowerShell scripts, plugin READMEs, and relevant skill references.
6. Reviewed repository write paths. The only observed writers are the build-perf plugin's local vcperf installation and correlation-ID update beneath `%LOCALAPPDATA%\\vcperf`; neither handles primary tender data.
7. Created and verified a baseline archive before adding audit documentation. Archive SHA-256: `382AEA0B6A812303BE8840AB10521632A640E6628FB251EF392E9EC7067CD56D`.

## Audit questions

| Question | Finding |
|---|---|
| Which files are unused? | No usage graph or plugin runtime was present to prove unused files. Do not infer that documentation is unused. |
| Which data is duplicated? | No tender data exists here. Marketplace pointer/configuration and plugin descriptions overlap by design; they are not record duplication. |
| Which records lack evidence? | No tender/firm records exist in this checkout to assess. |
| Which calculations lack tests? | No e-GP calculations or tests exist here. |
| Which detectors lack evidence? | No e-GP detectors exist here. |
| Which firm IDs have collisions? | Not assessable: no firm IDs or records. |
| Which licences have unknown validity? | Not assessable: no firm credential/licence data. |
| Which records are NOT_ATTEMPTED? | Not assessable: no e-GP collection-state model or records. |
| Which data is stale? | No e-GP source timestamps or datasets exist here. |
| Which primary OTM Works records are not analyzed? | The repository contains no defined primary universe or records. |
| Which analytical results are not reproducible? | No e-GP analytical results exist here. |
| Which alerts cannot be traced to source? | No e-GP alert system exists here. |
| Which code paths can write primary records? | None found. The build-perf operational scripts write only under `%LOCALAPPDATA%\\vcperf`. |
| Which migrations are not reversible? | No database migrations exist here. |
| Which documentation is inconsistent with implementation? | No e-GP implementation exists to compare against. Plugin documentation is outside the requested tender engine scope. |

## Follow-up: local analyzer plugin

After the baseline audit, the user selected a limited local analyzer plugin
that links to their separately installed read-only query runner. The
`plugins/tsbd-egp-intelligence/` prototype implements deterministic award
summaries and the six requested module patterns without bundling private
records:

| Capability | Current prototype status | Verification boundary |
|---|---|---|
| Tender Passport | Implemented for selected `production_contracts` awards | Requires a configured local runner and actual database use to validate live fields |
| Firm Passport | Exact `firm_tenderer_id` histories; name variants remain separate | No alias resolution, participation/loss history, or credentials |
| Historical Timeline | Joins matching audit-log, revision, and recovery events | Only the inspected related tables and matching records are included |
| Evidence Graph | Links awards, firms, sources, snapshots, calculations, source-health observations, and review results | Graph is built only for a selected analysis subset |
| Detector Stack | Deterministic data-consistency and review alerts; no weighted score | Must not be interpreted as misconduct; threshold and evidence limits are documented |
| Self-Audit | Counts fields and statuses within the filtered view | Does not claim independent raw-contract completeness |

Synthetic fixtures test the pure engine only. Unit tests and mocked runner tests
do not establish that the user's local query-helper schema or production data
has been validated end-to-end. The original database, query helper, source
snapshots, and separate workbench were not modified or copied into the repo.

## Safe implementation boundary

Do not describe the local analyzer as a complete e-GP system or a validated
production data pipeline until the configured read-only helper and source
schema have been checked against the user's actual environment. The earlier
attached HTML snapshots have conflicting windows and a failed integrity
panel; they are not substitutes for a reconciled primary record store.

The original plugin files and the separate user workbench were not modified during this audit.
55 changes: 55 additions & 0 deletions docs/SOURCE_INVENTORY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# Repository Source Inventory

## Audit scope

- Repository: `github/copilot-plugins`
- Baseline commit: `fbf7c536a5c7af0c94ff5f528a39004c55129e6d`
- Baseline worktree: clean
- Scope: every tracked file in the selected checkout, plus an on-disk check excluding Git metadata.
- Machine-readable inventory: `data/source_inventory.json`

This is a frozen baseline inventory. The local analyzer plugin and audit
artifacts described below were created after the 30-file baseline was hashed
and are not represented as baseline source artifacts in the JSON inventory.

This checkout is the GitHub Copilot plugins collection. It contains 30 tracked files: 22 Markdown files, four JSON files, two PowerShell scripts, and two extensionless policy files. The local plugins are `spark` and `build-perf-cpp`; the marketplace also references plugins hosted in other repositories.

## e-GP source finding

No e-GP application, OTM award dataset, SQLite database, CSV/JSON award export, tender HTML report, collector, schema, or e-GP test suite is present in this checkout. Searches for `production_contracts`, `egp_data.db`, `TENDER_SOLUTION_BD`, `Firm Passport`, `OTM Works`, and `egp_data` returned no matches. The six HTML attachments and the separate tender workbench discussed in chat are not files in this repository and are therefore not treated as checked-in or authoritative repository sources.

Consequently, this inventory does not claim record counts, date coverage, entity coverage, or tender-data reliability for any repository file. The e-GP analytical scope and the requested passport, history, detector, and evidence features cannot be verified or implemented as a real data-backed engine from this checkout alone.

## Repository artifact groups

| Paths | Role and authority | Classification | e-GP records |
|---|---|---|---:|
| `.github\\plugin\\marketplace.json`, `.claude-plugin\\marketplace.json` | Marketplace source configuration and its Claude plugin pointer | System / operational | None |
| `plugins\\spark\\**` | Spark plugin overview, app-template skill, stack guidance, and design references | Reference / documentation | None |
| `plugins\\build-perf-cpp\\plugin.json`, `hooks\\hooks.json` | Build performance plugin and hook configuration | System / operational | None |
| `plugins\\build-perf-cpp\\scripts\\**` | Local vcperf installation and correlation-ID helper | Implementation / operational | None |
| `plugins\\build-perf-cpp\\skills\\**` | Build-performance analysis instructions and vcperf output/auth references | Reference / documentation | None |
| Root policy and contribution files | Repository governance and contributor guidance | Reference / documentation | None |

All checked-in artifacts are authoritative for the Copilot plugin repository content they define, but none is factual evidence about Bangladesh e-GP tenders, firms, PEs, awards, or credentials. File-level paths, types, sizes, SHA-256 hashes, classifications, purposes, and limitations are recorded in `data/source_inventory.json`.

## Writer and data-store review

There is no primary-record data store or tender-record write path in this repository. The build-perf plugin's `sessionStart` hook invokes `plugins\\build-perf-cpp\\scripts\\install-vcperf.ps1`, which uses NuGet to install/update vcperf under `%LOCALAPPDATA%\\vcperf\\build-perf-cpp`. Its `userPromptSubmitted` hook invokes `write-correlation-id.ps1`, which atomically replaces `%LOCALAPPDATA%\\vcperf\\correlation-id`. These operations are outside the repository and do not write tender or firm records.

## Reconciliation and overlap

- The Claude marketplace file points to the GitHub marketplace file; it is a pointer, not a second copy of e-GP data.
- Plugin READMEs, manifests, and skill documentation describe the same plugins at different levels. This is documentation/configuration overlap, not duplicated tender records.
- No source snapshots, normalized tender ledger, derived e-GP analytics, or exports exist in the checkout to reconcile.
- No database schema, migration, or reversible data migration is present.

## Post-audit local analyzer

The user selected a local-only analyzer plugin that calls an explicitly
configured read-only query helper. Its Python code, skill instructions,
formula catalog, and tests are analytical tooling, not primary e-GP records
or authoritative evidence. The plugin does not bundle the user's database,
runner, private exports, or separate HTML workbench. Refer to
`plugins/tsbd-egp-intelligence/README.md` and the updated
`docs/SELF_AUDIT_REPORT.md` for prototype capabilities and validation limits.
50 changes: 50 additions & 0 deletions plugins/tsbd-egp-intelligence/FORMULAS_AND_DETECTORS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
# Formula and Detector Catalog

All calculations are deterministic and versioned. The implementation does
not infer missing data, combine procurement scopes, or produce a weighted
risk score.

## Scope

Primary scope: records selected from the `production_contracts` view where
`procurement_method` is OTM, `contract_nature` is Works, and `noa_date` is on
or after the requested inclusive date (default `2025-09-15`). The view applies
its own collection, validation, deduplication, and exclusion rules. Reports
explicitly disclaim use of the view as a raw-source completeness denominator.

Blank currency may remain in the primary record population, but it is never
treated as BDT in value calculations. Comparisons include only peers with
usable Less% values under the same explicit currency and APP-match gates.

## Formulas

| ID | Definition | Interpretation |
|---|---|---|
| `LESS_PCT_V1` | `(contract_price - app_estimated_cost) / app_estimated_cost * 100` | Requires confirmed APP match, positive estimate, exact package number, OTM Works scope, and `contract_price_unit=BDT`; Decimal rounded HALF_UP to 0.01 percentage point. |
| `BDT_SUM_V1` | Sum positive contract prices with explicit BDT units | Reports usable count, award denominator, and excluded invalid/unknown-unit rows. |
| `CONCENTRATION_HHI_V1` | `sum((group amount / total amount) ** 2)` | Descriptive HHI over award counts or explicit BDT value; no alert threshold. Missing firm IDs are excluded and counted. |
| `DISTRIBUTION_V1` | Linear-interpolated p25, median, p75; MAD is median absolute deviation from median | Descriptive statistics only; every result carries its sample size. |
| `FIRM_HISTORY_DEVIATION_V1` | Selected Less% minus the median Less% of other awards for the same exact Tenderer ID | Percentage-point description; reports peer `n`, no threshold or score. |
| `PE_HISTORY_DEVIATION_V1` | Selected Less% minus the median of other awards with the same procuring-entity display name | Descriptive only; display name is not treated as a verified entity identifier. |
| `DISTRICT_DEVIATION_V1` | Selected Less% minus the median of other awards in the same district | Descriptive only; no threshold or score. |
| `APP_GATE_V1` | Confirmed match AND positive estimate AND exact APP package number | Eligibility/data consistency gate, not an accusation. |
| `DATE_ORDER_V1` | Expected completion date precedes contract signing date | Date consistency check only. |

## Review detectors

| ID | Rule | Status and limitation |
|---|---|---|
| `D001` | Confirmed Less% is strictly below -40% or strictly above +10% | Exclusive bounds from TSBD e-GP analysis guidance; review alert only. |
| `D015` | One exact Tenderer ID has multiple source-reported display names | Keeps variants separate and requests review; does not assert an identity collision. |
| `D016` | Duplicate `(tender_id, exact_package_no, contract_nature)` in the extracted view | Structural review alert. |
| `D018` | Expected completion date is earlier than signing date | Source-data consistency review. |
| `D019` | APP marked confirmed but its positive estimate or exact package key is unusable | Match-gate review; no Less% is calculated. |
| `D020` | Firm name, district, procuring-entity code, or price unit is missing | Missing-context notice; no inference about collection intent. |
| `D022` | Source snapshot hash or snapshot path is missing | Provenance gap; a source URL alone is not a retained snapshot. |
| `D026` | Firm Tenderer ID is missing | Identity remains unresolved; no name-based merge. |
| Upstream | Existing `audit_flags` row for an in-scope award | Reproduced as a database-sourced flag with its original reason/state; no reinterpretation. |

No ranking, participation-loss history, bidder responsiveness, credential
validity, source-staleness threshold, or composite risk score is calculated.
An absent record from this report is not evidence that the award did not
exist.
74 changes: 74 additions & 0 deletions plugins/tsbd-egp-intelligence/README.md
View file
Open in desktop
Loading