docs: record a dated status snapshot at the handoff point - #40
Merged
Merged
Conversation
The roadmap carries outstanding work and deliberately drops an item once it is done, which makes it a poor answer to "where is this". That question is being asked now because the control work is moving to a cross-repository hardening standard, and returning to this repository later needs a starting point that does not require reading 36 merged pull requests. The snapshot records what exists, what is blocked and on what, and that the critical path here is the 188 base controls, which nothing blocks. It also records which parts of the control model are product-independent and transfer: the origination values, the pinned-source discipline, the verification-pointer rule, and the structural checks. Two DISA sources the standard will need were checked while the context was still loaded, so the search is not repeated: the GPOS SRG resolves to V3R3 and the DevSecOps Container Hardening Guide to 1.2, both pinned by digest here for reference rather than added to this repository's register. Whether the GPOS SRG becomes a cross-reference for this image is a decision that should follow the standard's model rather than precede it. It is explicitly a snapshot, not a maintained document, and says the roadmap wins where the two disagree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/STATUS.mdso work here can be picked up later without reading 36 merged pull requests, and so the control work moving to a cross-repository standard does not lose what it depends on.The roadmap deliberately drops an item once it is done, which makes it a good list of remaining work and a poor answer to "where is this". This fills that gap without competing with it — the snapshot is dated, says it is not maintained continuously, and says the roadmap wins where the two disagree.
What it records
Position. 41 open items across 9 sections, 19 of them blocked on something outside the repository (a logging platform, an exact RHEL 9 host, frozen inputs). Packages 1, 2 and 4 are complete.
Critical path. Package 5 control authoring — the 188 High-baseline base controls. Nothing blocks it: catalogue and baseline decided, representation fixed, structural checks in place and verified to fail on violation, spine and baseline pinned, requirement tree already citable. The component definition authors 4 of 188 today and its metadata says so.
What transfers to the hardening standard. The origination model, the pinned-source discipline, the verification-pointer rule, and the structural checks are product-independent and were built that way. The verification-pointer rule is the one most worth carrying: an
image-ownedcontrol must cite a requirement the product actually states, which is what stops a control asserting an obligation nobody committed to.Two sources checked while the context was loaded
So the search is not repeated in the new repository:
97026655bce18d91…9a5d5babdf567d8e…Two findings worth keeping. The GPOS SRG filename uses the token
U_GPOS_, not the expanded name, which 404s at every release. And DISA serves superseded releases alongside current ones —U_GPOS_V2R7_SRG.zipstill returns 200 — so a 200 does not mean a release is current; the adjacent-release probe is what establishes that.These are recorded, not added to the register. Whether the GPOS SRG becomes a cross-reference for this image is a decision that should follow the standard's model rather than precede it.
Checks
build-trace-matrix.py --checkreports no drift