docs: establish the control model, source register, and structural checks - #38
Merged
Merged
Conversation
…ecks Foundation for the control deliverable: the sources it maps against, the shape every control entry takes, and the checks that hold that shape. Four sources are pinned by digest: the 800-53 Rev 5.2.0 OSCAL catalogue, its High baseline profile, the DISA Web Server SRG V3R3, and the RHEL 9 STIG V2R4. Three are not, and the register records why rather than omitting them. The DISA Container Platform and Application Server SRGs are not at a predictable URL, because DISA rotates the release identifier inside the filename, so the current package has to be obtained from the published index by a person. The CIS benchmark needs an authenticated account and its terms restrict redistribution, so it can be cited by identifier but never vendored or quoted at length. Retrieving the catalogue corrected the scale recorded in ADR-0009. The High baseline selects 370 controls: 188 base and 182 enhancements. The first pass is 188, not the "roughly 370 base controls" estimated before the catalogue was in hand. The ADR now carries the measured figures. The control model fixes six origination values, a responsible role that must match the origination, and the rule that only image-owned asserts this project satisfies anything. Every other value is a hand-off that must name what the other party has to do. An image-owned control must cite a requirement from the tree, which is what stops a control claiming an obligation the product never stated. A control that is not image-owned may not carry an assessment method, because supplying one would describe an assessment this project cannot perform. The checks exist before the 188 controls do, which is the point. A rule added after the bulk authoring has to be retrofitted across every entry, and a property that is merely conventional is the first thing dropped under deadline. Verified by injecting three violations: a requirement identifier that does not exist, a host-inherited control claiming an assessment method, and a responsible role contradicting its origination. Four controls are authored to exercise the structure, one per origination that applies. The component metadata states it does not yet assert baseline coverage, and a check enforces that claim stays honest until the baseline is actually complete.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Package 5's Foundation stage. The sources the mapping runs against, the shape
every control takes, and the checks that hold it.
Sources: four pinned, three honestly not
01f37cf9…60576970…7345e31a…0434fd47…The last three are recorded with the reason, not omitted:
identifier inside the filename, so the current package has to be fetched from
the published index by a person. I stopped guessing URLs rather than
brute-force the CDN.
auth0/login. It needs an account, and its terms restrictredistribution — so it can be cited by identifier but never vendored or
quoted at length. That constrains how it can ever be used here.
The register also raises a scoping question worth answering before pinning: the
Application Server SRG may not apply at all, since this image serves and proxies
HTTP rather than hosting an application runtime.
A correction to ADR-0009
Retrieving the catalogue corrected the scale I gave you when the decision was
taken:
So the first pass is 188, not "roughly 370 base controls, well over a
thousand with enhancements". Materially smaller than I said. The ADR now
carries the measured figures.
The control model
Six origination values, and only
image-ownedasserts this project satisfiesanything. Every other value is a hand-off that must say what the other party has
to do.
Two rules that make the scope safe:
image-ownedcontrol must cite a requirement from the tree. That iswhat stops a control claiming an obligation the product never stated.
image-ownedmay not carry an assessment method.Supplying one would describe an assessment this project cannot perform.
Checks before controls
15 checks, in the lint job, verified by injecting three violations:
L1-ZZZ-999cited bycm-6au-9(host-inherited) claiming a test methodsc-8(deployment-configured) responsible role set toimage-projectThere is also a check that the document does not yet claim baseline
coverage — it fails if the remarks stop saying "Foundation" while fewer than
188 controls exist, so four controls can't be mistaken for a baseline.
Four controls are authored, one per applicable origination, to exercise the
structure rather than to begin the baseline.
Roadmap
Package 5 goes 18 → 16. Three Foundation items close; one is replaced by
resolving the outstanding sources, and one by a scheduled digest re-check so a
replaced DISA package is reported rather than silently mapped against.
🤖 Generated with Claude Code