Roadmap: ingesting DISA's full SCAP/XCCDF benchmarks (beyond the sample crosswalk)

[cognis-digital]

The bundled STIG_CONTROLS table in stigsentry/core.py is a labeled 8-entry public sample. On a real system, an SCC/OpenSCAP run produces hundreds of rules per STIG, so most findings currently land in the SS-UNK-* "unknown STIG ID" bucket and lose their NIST/CCI provenance.

Two building blocks would close the gap, and I want feedback on the interface before implementing (tracked in #7 and #8):

1. XCCDF/SCAP benchmark loader — parse the *-xccdf.xml inside a DISA STIG .zip: <Rule @severity>, <title>, V- id, and the CCI-* refs under <ident>. Build the stig_id -> {title, nist, sev, cci} table from it, falling back to the built-in sample when no benchmark is supplied. Cache the parsed table through the existing air-gap datafeeds layer.
2. CCI -> 800-53 recovery — when a STIG ID is unknown but the row carries a CCI-*, look it up in DISA U_CCI_List.xml and still populate the control (keep the SS-UNK-* id so it is flagged as not-in-crosswalk).

Questions for the community:

• Should the loader accept the raw DISA .zip directly, or only the extracted XCCDF?
• Preferred call shape: scan(target, benchmark=...) vs a separate load_benchmark() that returns a crosswalk dict you pass in?
• Any interest in a --benchmark-dir that merges multiple product STIGs (RHEL + k8s + Windows) into one crosswalk for a mixed enclave?