fix: require audit results to reference declared criteria

auditlog.cue

@@ -4,6 +4,8 @@
 @status("experimental")
 package gemara
 
+import "list"
+
 @go(gemara)
 
 // AuditLog records results from an audit performed against a target resource
@@ -25,6 +27,12 @@ package gemara
 
 	if results != _|_ {
 		_uniqueResultIds: {for i, r in results {(r.id): i}}
+		let _validCriteriaIds = [for c in criteria {c."reference-id"}]
+
+		// Unify the valid ID list with a list.Contains constraint to require each result scores against declared criteria
+		for i, r in results {
+			_criteriaValidation: "\(i)": _validCriteriaIds & list.Contains(r."criteria-reference"."reference-id")
+		}
 	}
 }
 

test/schema_test.go

@@ -122,6 +122,7 @@ func TestSchemaValidation(t *testing.T) {
 		// AuditLog — negative
 		{"audit log missing summary criteria and results", "./test-data/bad-audit-log.yaml", "#AuditLog", true, ""},
 		{"audit log evidence source with invalid digest format", "./test-data/bad-audit-log-invalid-digest.yaml", "#AuditLog", true, ""},
+		{"audit result referencing undeclared criteria", "./test-data/bad-audit-log-undeclared-criteria.yaml", "#AuditLog", true, ""},
 
 		// CapabilityCatalog — negative
 		{"capability with invalid group", "./test-data/bad-capability-invalid-group.yaml", "#CapabilityCatalog", true, ""},

test/test-data/bad-audit-log-undeclared-criteria.yaml

@@ -0,0 +1,48 @@
+metadata:
+  id: audit-log-undeclared-criteria
+  type: AuditLog
+  gemara-version: "1.1.0"
+  version: "1.0.0"
+  description: "Invalid audit log: result scored against criteria the audit never declared"
+  author:
+    id: lead-auditor
+    name: "Auditor"
+    type: Human
+  mapping-references:
+    - id: security-policy
+      title: "Information Security Policy"
+      version: "2.1.0"
+    - id: OSPS
+      title: "Open Source Project Security Baseline"
+      version: "2025.1"
+      url: "https://baseline.openssf.org"
+
+target:
+  id: gemara-repo
+  name: "gemaraproj/gemara"
+  type: Software
+  uri: "https://github.com/gemaraproj/gemara"
+  environment: production
+
+owner:
+  responsible:
+    - name: "Auditor"
+      affiliation: "External Audit Firm"
+  accountable:
+    - name: "Project Lead"
+      affiliation: "OpenSSF"
+
+summary: "Criteria declaration test."
+
+criteria:
+  - reference-id: security-policy
+
+results:
+  - id: AR-AC-01
+    title: "MFA enforcement verified"
+    type: Strength
+    description: "Scored against OSPS, which is not declared in criteria."
+    criteria-reference:
+      reference-id: OSPS
+      entries:
+        - reference-id: OSPS-AC-01

test/test-data/good-audit-log.yaml

@@ -51,6 +51,9 @@ summary: "Access control and quality controls are strong. Documentation controls
 
 criteria:
   - reference-id: security-policy
+    remarks: "Organizational policy establishing the audit's scope."
+  - reference-id: OSPS
+    remarks: "Baseline whose controls each result is scored against."
 
 results:
   - id: AR-AC-01