@marinjursic/prc-linux-arm64 0.1.0

package/bin/adapters/syft-v1.51.0.yaml

@@ -0,0 +1,54 @@
+schema_version: prc.adapter-manifest/v0.4
+id: prc.adapter.syft@1.51
+title: Syft repository CycloneDX SBOM
+description: Runs the reviewed Syft 1.51.0 image against the exact sealed inventory snapshot and preserves a deterministic normalized CycloneDX 1.7 SBOM.
+publisher:
+  id: prc-project
+  name: Production Readiness Checklist
+owner: scanner-maintainers
+maintenance: active
+protocol: prc-adapter-syft-cyclonedx-json-v1
+output_schema: cyclonedx.bom/v1.7+syft-1.51.0
+observation_kinds: [sbom-generation]
+compatibility:
+  engine_apis: [prc.engine/v0.1]
+tool:
+  name: syft
+  version: 1.51.0
+  upstream: https://github.com/anchore/syft
+  formats:
+    - name: cyclonedx-json
+      versions: ["1.7"]
+limitations:
+  - Catalogs only regular files in the current sealed repository inventory; it does not describe a built release artifact or container image.
+  - Package and file discovery depends on Syft cataloger support and can contain false positives, false negatives, or incomplete metadata.
+  - Uses a scanner-owned empty Syft configuration so target configuration cannot disable or redirect cataloging.
+  - The normalized artifact removes Syft's nondeterministic generation timestamp, document serial number, and source bom-ref while retaining package, file, and dependency content.
+  - SBOM generation does not determine whether components are vulnerable, acceptably licensed, supported, or actually reachable at runtime.
+runner: oci
+image: ghcr.io/anchore/syft@sha256:d2dc3ec86cb2b4e7ddb226ba0305c4523b7c0694c45d9f576b42b4c2f5ce7aa8
+command:
+  - scan
+  - --quiet
+  - --config=/workspace/.prc/syft-config.yaml
+  - --parallelism=1
+  - --output=cyclonedx-json
+  - dir:/workspace
+capabilities:
+  read_workspace: true
+  write_scratch: false
+  network: deny
+  network_hosts: []
+  secret_handles: []
+  child_processes: true
+resources:
+  timeout_seconds: 180
+  memory_mb: 512
+  cpus: 1
+  pids: 64
+  tmpfs_mb: 1
+  max_line_bytes: 262144
+  max_messages: 10000
+  max_stdin_bytes: 1024
+  max_stdout_bytes: 67108864
+  max_stderr_bytes: 65536

package/bin/catalog/assertions/core-repository.yaml

@@ -0,0 +1,625 @@
+schema_version: prc.assertions/v0.1
+catalog_version: 1.0.0
+assertions:
+  - id: PRC-A-CORE-001
+    revision: 2
+    control_ids: [USEQ-FDCA6C71]
+    title: README is present
+    statement: A nonempty README file exists at the repository root.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty root README file from the scanned commit.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [README.md, README.rst, README.txt]
+      minimum_bytes: 1
+    severity: medium
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-002
+    revision: 1
+    control_ids: [USEQ-6497B434]
+    title: License is present
+    statement: A nonempty license file exists at the repository root.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty root license file from the scanned commit.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [LICENSE, LICENSE.md, LICENSE.txt, COPYING]
+      minimum_bytes: 1
+    severity: medium
+    gate: required
+    remediation_class: R0
+  - id: PRC-A-CORE-003
+    revision: 1
+    control_ids: [USEQ-89F5E97A]
+    title: Contribution guidance is present
+    statement: A nonempty contribution guide exists at the repository root.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty root contribution guide from the scanned commit.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [CONTRIBUTING.md, CONTRIBUTING.rst]
+      minimum_bytes: 1
+    severity: low
+    gate: advisory
+    remediation_class: R0
+  - id: PRC-A-CORE-004
+    revision: 1
+    control_ids: [USEQ-AC6AC548]
+    title: Security policy is present
+    statement: A nonempty security policy exists at the repository root.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty root security policy from the scanned commit.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [SECURITY.md, docs/SECURITY.md]
+      minimum_bytes: 1
+    severity: medium
+    gate: required
+    remediation_class: R0
+  - id: PRC-A-CORE-005
+    revision: 1
+    control_ids: [USEQ-D73106BF]
+    title: Code of conduct is present
+    statement: A nonempty code-of-conduct document exists at the repository root.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty root code-of-conduct document from the scanned commit.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [CODE_OF_CONDUCT.md, CODE_OF_CONDUCT.rst]
+      minimum_bytes: 1
+    severity: low
+    gate: advisory
+    remediation_class: R0
+  - id: PRC-A-CORE-006
+    revision: 1
+    control_ids: [USEQ-CA602113]
+    title: Code ownership is declared
+    statement: A nonempty CODEOWNERS file exists in a supported repository location.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty CODEOWNERS file from the scanned commit.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [.github/CODEOWNERS, CODEOWNERS, docs/CODEOWNERS]
+      minimum_bytes: 1
+    severity: medium
+    gate: required
+    remediation_class: R0
+  - id: PRC-A-CORE-007
+    revision: 1
+    control_ids: [USEQ-D1076D92]
+    title: Dependency resolution is reproducible
+    statement: Each detected package ecosystem has a supported lock or checksum file.
+    applicability: inventory.package_ecosystems.size() > 0
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: Lock or checksum files corresponding to detected dependency manifests.
+    implementation_id: prc.native.dependency-lock@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-008
+    revision: 1
+    control_ids: [USEQ-F4D6E3B3]
+    title: GitHub Actions use immutable references
+    statement: Every external GitHub Action is pinned to a full commit SHA.
+    applicability: inventory.ci.github_actions == true
+    evidence_required:
+      - kind: workflow-parse
+        minimum_authority: repository
+        description: Parsed workflow action references from the scanned commit.
+    implementation_id: prc.native.github-action-pin@0.1
+    parameters:
+      allow_local_actions: true
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-009
+    revision: 1
+    control_ids: [USEQ-12655775]
+    title: Continuous integration is configured
+    statement: The repository contains a supported continuous-integration configuration.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A supported CI configuration from the scanned commit.
+    implementation_id: prc.native.ci-present@0.1
+    parameters: {}
+    severity: medium
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-010
+    revision: 2
+    control_ids: [USEQ-12655775]
+    title: Automated tests are discoverable
+    statement: The repository contains a recognized test location or test command declaration.
+    applicability: inventory.source_files > 0
+    evidence_required:
+      - kind: repository-structure
+        minimum_authority: repository
+        description: Recognized test paths or manifest test commands from the scanned commit.
+    implementation_id: prc.native.test-suite@0.2
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-011
+    revision: 1
+    control_ids: [USEQ-73488048]
+    title: Workflow permissions are explicit
+    statement: GitHub Actions workflows declare explicit least-privilege permissions.
+    applicability: inventory.ci.github_actions == true
+    evidence_required:
+      - kind: workflow-parse
+        minimum_authority: repository
+        description: Parsed top-level and job-level permissions from the scanned commit.
+    implementation_id: prc.native.github-workflow-permissions@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-012
+    revision: 1
+    control_ids: [USEQ-F0F5ACE7]
+    title: Generated code follows normal review controls
+    statement: Generated or suggested code is subject to the project's normal ownership, review, testing, security, licensing, and provenance controls.
+    applicability: "true"
+    evidence_required:
+      - kind: reviewer-attestation
+        minimum_authority: human
+        description: Current scoped review evidence for generated or suggested code.
+    implementation_id: prc.native.manual-evidence@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R0
+  - id: PRC-A-CORE-013
+    revision: 2
+    control_ids: [USEQ-70E9D5AA]
+    title: Configured secret detection has executed
+    statement: The selected profile's pinned secret-detection adapter has a current executed result for the scanned inventory.
+    applicability: inventory.source_files > 0
+    evidence_required:
+      - kind: analysis-result
+        minimum_authority: executed
+        description: Current output from the exact pinned secret-detection adapter selected by this profile.
+    implementation_id: prc.native.analysis-evidence@0.1
+    parameters:
+      adapter_bindings:
+        - adapter_id: prc.adapter.gitleaks@8.30
+          manifest_sha256: ee223fd11f9d32b1799bf2b25c50cea294fd1f7b59686f9d438b351b5c4faac8
+          observation_kind: secret-detection
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-014
+    revision: 1
+    control_ids: [USEQ-DAF77C8F]
+    title: Source files end with a newline
+    statement: Every recognized source file ends with a line-feed byte.
+    applicability: inventory.source_files > 0
+    evidence_required:
+      - kind: source-format
+        minimum_authority: repository
+        description: Current content evidence for every recognized source file in the scanned commit.
+    implementation_id: prc.native.final-newline@0.1
+    parameters: {}
+    severity: low
+    gate: advisory
+    remediation_class: R1
+  - id: PRC-A-CORE-015
+    revision: 1
+    control_ids: [USEQ-72088469]
+    title: Source revision is identifiable
+    statement: The scanned repository resolves to an immutable Git commit identity.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-identity
+        minimum_authority: repository
+        description: The immutable source revision captured by the deterministic inventory.
+    implementation_id: prc.native.git-revision@0.1
+    parameters: {}
+    severity: medium
+    gate: required
+    remediation_class: R0
+  - id: PRC-A-CORE-016
+    revision: 1
+    control_ids: [PRC-36-011]
+    title: Dependency updates are configured
+    statement: A supported dependency-update automation configuration is present.
+    applicability: inventory.package_ecosystems.size() > 0
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty supported dependency-update configuration.
+    implementation_id: prc.native.file-present@0.1
+    parameters:
+      paths: [.github/dependabot.yml, .github/dependabot.yaml, renovate.json, renovate.json5, .renovaterc, .renovaterc.json]
+      minimum_bytes: 1
+    severity: medium
+    gate: advisory
+    remediation_class: R2
+  - id: PRC-A-CORE-017
+    revision: 1
+    control_ids: [USEQ-F4D6E3B3]
+    title: Workflow definitions parse
+    statement: Every detected GitHub Actions workflow is valid YAML with a mapping document root.
+    applicability: inventory.ci.github_actions == true
+    evidence_required:
+      - kind: workflow-parse
+        minimum_authority: repository
+        description: A successful strict parse of every detected workflow file.
+    implementation_id: prc.native.github-workflow-valid@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-018
+    revision: 1
+    control_ids: [USEQ-12655775]
+    title: Workflows define executable jobs
+    statement: Every detected GitHub Actions workflow defines at least one job.
+    applicability: inventory.ci.github_actions == true
+    evidence_required:
+      - kind: workflow-parse
+        minimum_authority: repository
+        description: Parsed nonempty job mappings from every detected workflow.
+    implementation_id: prc.native.github-workflow-jobs@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-019
+    revision: 1
+    control_ids: [USEQ-B66A3064]
+    title: Workflow jobs have bounded runtimes
+    statement: Every directly executed GitHub Actions job declares a positive static timeout no greater than six hours.
+    applicability: inventory.ci.github_actions == true
+    evidence_required:
+      - kind: workflow-parse
+        minimum_authority: repository
+        description: Parsed timeout-minutes values for every job that declares runs-on.
+    implementation_id: prc.native.github-workflow-timeouts@0.1
+    parameters:
+      maximum_minutes: 360
+    severity: medium
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-020
+    revision: 2
+    control_ids: [USEQ-73488048]
+    title: pull_request_target workflows receive security review
+    statement: Each workflow using pull_request_target avoids executing untrusted pull-request code and keeps permissions and secrets least privileged.
+    applicability: inventory.ci.github_actions == true
+    evidence_required:
+      - kind: workflow-parse
+        minimum_authority: repository
+        description: Parsed trigger declarations identify workflows that need data-flow and permission review; trigger presence alone is not proof of unsafe execution.
+    implementation_id: prc.native.github-no-pull-request-target@0.1
+    parameters: {}
+    severity: critical
+    gate: required
+    remediation_class: R0
+  - id: PRC-A-CORE-021
+    revision: 1
+    control_ids: [USEQ-12655775]
+    title: Unresolved merge conflicts are absent
+    statement: Recognized source, build, workflow, container, and infrastructure files contain no complete merge-conflict marker set.
+    applicability: "true"
+    evidence_required:
+      - kind: source-integrity
+        minimum_authority: repository
+        description: Deterministic content inspection of scoped repository files.
+    implementation_id: prc.native.merge-conflict-markers@0.1
+    parameters: {}
+    severity: high
+    gate: no-go
+    remediation_class: R2
+  - id: PRC-A-CORE-022
+    revision: 1
+    control_ids: [USEQ-D60E6950]
+    title: Repository files are not broadly writable
+    statement: Inventoried regular files are not writable by group or other users.
+    applicability: "true"
+    evidence_required:
+      - kind: repository-metadata
+        minimum_authority: repository
+        description: Permission modes captured for every inventoried regular file.
+    implementation_id: prc.native.restrictive-file-modes@0.1
+    parameters: {}
+    severity: medium
+    gate: advisory
+    remediation_class: R1
+  - id: PRC-A-CORE-023
+    revision: 1
+    control_ids: [USEQ-D1076D92]
+    title: Dependency manifests are nonempty
+    statement: Every detected dependency manifest contains data.
+    applicability: inventory.package_ecosystems.size() > 0
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: Current content evidence for every detected dependency manifest.
+    implementation_id: prc.native.inventory-files-nonempty@0.1
+    parameters:
+      inventory_field: manifests
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-024
+    revision: 1
+    control_ids: [USEQ-D1076D92]
+    title: Dependency locks are nonempty
+    statement: Every detected dependency lock or checksum file contains data.
+    applicability: inventory.package_ecosystems.size() > 0
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: Current content evidence for every detected dependency lock or checksum file.
+    implementation_id: prc.native.inventory-files-nonempty@0.1
+    parameters:
+      inventory_field: lock_files
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-025
+    revision: 1
+    control_ids: [USEQ-0B7FDB5F]
+    title: Runtime versions are declared
+    statement: Every detected package ecosystem has a supported runtime or toolchain version declaration.
+    applicability: inventory.package_ecosystems.size() > 0
+    evidence_required:
+      - kind: runtime-declaration
+        minimum_authority: repository
+        description: A supported version declaration for each detected package ecosystem.
+    implementation_id: prc.native.runtime-version@0.1
+    parameters: {}
+    severity: medium
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-026
+    revision: 1
+    control_ids: [USEQ-7D4DA192]
+    title: Container base images are immutable
+    statement: Every Dockerfile build stage uses scratch or a base image pinned by a sha256 digest.
+    applicability: inventory.container_files.size() > 0
+    evidence_required:
+      - kind: containerfile-parse
+        minimum_authority: repository
+        description: Parsed FROM instructions from every detected container build file.
+    implementation_id: prc.native.container-base-pin@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-027
+    revision: 1
+    control_ids: [USEQ-A3559C64]
+    title: Final container stages declare a non-root user
+    statement: Every Dockerfile final stage declares a static USER other than root or zero.
+    applicability: inventory.container_files.size() > 0
+    evidence_required:
+      - kind: containerfile-parse
+        minimum_authority: repository
+        description: Parsed USER instruction in the final stage of every detected container build file.
+    implementation_id: prc.native.container-nonroot@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-028
+    revision: 1
+    control_ids: [USEQ-D1076D92]
+    title: Terraform provider selections are locked
+    statement: Each directory containing Terraform configuration also contains a nonempty provider dependency lock file.
+    applicability: inventory.infrastructure.terraform_files.size() > 0
+    evidence_required:
+      - kind: repository-file
+        minimum_authority: repository
+        description: A nonempty .terraform.lock.hcl next to each detected Terraform configuration root.
+    implementation_id: prc.native.terraform-lock@0.1
+    parameters: {}
+    severity: medium
+    gate: advisory
+    remediation_class: R2
+  - id: PRC-A-CORE-029
+    revision: 1
+    control_ids: [USEQ-A3559C64]
+    title: Kubernetes workloads require non-root containers
+    statement: Every detected Kubernetes workload declares runAsNonRoot for its pod or every container and does not declare user zero.
+    applicability: inventory.infrastructure.kubernetes_files.size() > 0
+    evidence_required:
+      - kind: kubernetes-parse
+        minimum_authority: repository
+        description: Parsed pod and container security contexts from detected workload resources.
+    implementation_id: prc.native.kubernetes-nonroot@0.2
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-030
+    revision: 1
+    control_ids: [USEQ-13CBD6C6]
+    title: Kubernetes containers declare resource policy
+    statement: Every container in a detected Kubernetes workload declares nonempty resource requests and limits.
+    applicability: inventory.infrastructure.kubernetes_files.size() > 0
+    evidence_required:
+      - kind: kubernetes-parse
+        minimum_authority: repository
+        description: Parsed resource requests and limits from detected workload containers.
+    implementation_id: prc.native.kubernetes-resources@0.2
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-K8S-001
+    revision: 1
+    control_ids: [USEQ-A3559C64]
+    title: Kubernetes workloads avoid privileged host access
+    statement: Detected Kubernetes workloads leave host namespace and HostProcess sharing disabled, declare no hostPath volumes, and do not run privileged containers.
+    applicability: inventory.infrastructure.kubernetes_files.size() > 0
+    evidence_required:
+      - kind: kubernetes-parse
+        minimum_authority: repository
+        description: Bounded parsing of pod, volume, and container host-access fields in detected workload resources.
+    implementation_id: prc.native.kubernetes-host-access@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-K8S-002
+    revision: 1
+    control_ids: [USEQ-A3559C64]
+    title: Kubernetes Linux containers disable privilege escalation
+    statement: Every ordinary, init, and ephemeral container in a detected Linux Kubernetes workload explicitly sets allowPrivilegeEscalation to false.
+    applicability: inventory.infrastructure.kubernetes_files.size() > 0
+    evidence_required:
+      - kind: kubernetes-parse
+        minimum_authority: repository
+        description: Bounded parsing of container privilege-escalation fields in detected Linux workload resources.
+    implementation_id: prc.native.kubernetes-privilege-escalation@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-K8S-003
+    revision: 1
+    control_ids: [USEQ-A3559C64]
+    title: Kubernetes Linux containers restrict capabilities
+    statement: Every ordinary, init, and ephemeral container in a detected Linux Kubernetes workload drops ALL capabilities and adds back at most NET_BIND_SERVICE.
+    applicability: inventory.infrastructure.kubernetes_files.size() > 0
+    evidence_required:
+      - kind: kubernetes-parse
+        minimum_authority: repository
+        description: Bounded parsing of container capability add and drop lists in detected Linux workload resources.
+    implementation_id: prc.native.kubernetes-capabilities@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-K8S-004
+    revision: 1
+    control_ids: [USEQ-A3559C64]
+    title: Kubernetes Linux containers use bounded seccomp profiles
+    statement: Every ordinary, init, and ephemeral container in a detected Linux Kubernetes workload inherits or selects a RuntimeDefault or Localhost seccomp profile.
+    applicability: inventory.infrastructure.kubernetes_files.size() > 0
+    evidence_required:
+      - kind: kubernetes-parse
+        minimum_authority: repository
+        description: Bounded parsing of pod and container seccomp profile types in detected Linux workload resources.
+    implementation_id: prc.native.kubernetes-seccomp@0.1
+    parameters: {}
+    severity: medium
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-CORE-031
+    revision: 1
+    control_ids: [USEQ-E85957E3]
+    title: Private-key armor is absent from repository files
+    statement: Recognized armored private-key blocks are absent from bounded source, configuration, documentation, infrastructure, and key-file content in the inventoried repository.
+    applicability: inventory.file_count > 0
+    evidence_required:
+      - kind: sensitive-material-scan
+        minimum_authority: repository
+        description: Content-addressed bounded inspection for standards-defined private-key armor blocks without retaining key material.
+    implementation_id: prc.native.private-key-armor@0.1
+    parameters: {}
+    severity: critical
+    gate: no-go
+    remediation_class: R2
+  - id: PRC-A-GO-001
+    revision: 2
+    control_ids: [USEQ-F6ACEF15]
+    title: Go net/http package helpers do not use the default client
+    statement: Non-test Go source does not call net/http Get, Head, Post, or PostForm package helpers whose end-to-end timeout depends on mutable global DefaultClient state.
+    applicability: '"go" in inventory.package_ecosystems'
+    evidence_required:
+      - kind: go-ast-analysis
+        minimum_authority: repository
+        description: Bounded syntax-aware inspection of inventoried non-test Go source for direct calls to net/http package convenience helpers backed by mutable global DefaultClient state.
+    implementation_id: prc.native.go-http-timeout@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-GO-002
+    revision: 1
+    control_ids: [USEQ-B66A3064]
+    title: Go HTTP servers use configurable Server instances
+    statement: Non-test Go source does not call net/http ListenAndServe, ListenAndServeTLS, Serve, or ServeTLS package helpers whose constructed Server cannot configure request timeout fields.
+    applicability: '"go" in inventory.package_ecosystems'
+    evidence_required:
+      - kind: go-ast-analysis
+        minimum_authority: repository
+        description: Bounded syntax-aware inspection of inventoried non-test Go source for direct calls to net/http package server helpers that construct Server values without configurable timeout fields.
+    implementation_id: prc.native.go-http-server-timeout@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-API-001
+    revision: 1
+    control_ids: [USEQ-13208C54]
+    title: OpenAPI documents expose required root metadata
+    statement: Every detected OpenAPI 3.0, 3.1, or 3.2 document has one bounded YAML or JSON document, required root and info metadata, and the version-specific required structural fields.
+    applicability: 'inventory.components.exists(c, c.kind == "api-description" && c.ecosystem == "openapi")'
+    evidence_required:
+      - kind: openapi-parse
+        minimum_authority: repository
+        description: Content-addressed bounded parsing of detected OpenAPI YAML or JSON documents for required 3.0, 3.1, or 3.2 root structure and metadata.
+    implementation_id: prc.native.openapi-root@0.1
+    parameters: {}
+    severity: medium
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-API-002
+    revision: 1
+    control_ids: [USEQ-13208C54]
+    title: OpenAPI operations define valid responses
+    statement: Every directly declared operation under OpenAPI paths or webhooks has a nonempty Responses Object whose response keys and inline response descriptions satisfy the supported OpenAPI structure.
+    applicability: 'inventory.components.exists(c, c.kind == "api-description" && c.ecosystem == "openapi")'
+    evidence_required:
+      - kind: openapi-parse
+        minimum_authority: repository
+        description: Content-addressed bounded parsing of directly declared OpenAPI path and webhook operations, including 3.2 query and additionalOperations entries.
+    implementation_id: prc.native.openapi-operation-responses@0.1
+    parameters: {}
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-API-003
+    revision: 1
+    control_ids: [USEQ-13208C54]
+    title: Declared OpenAPI operation IDs are unique
+    statement: Every operationId declared by a directly declared OpenAPI path or webhook operation is a nonempty string and is unique within its OpenAPI document.
+    applicability: 'inventory.components.exists(c, c.kind == "api-description" && c.ecosystem == "openapi")'
+    evidence_required:
+      - kind: openapi-parse
+        minimum_authority: repository
+        description: Content-addressed bounded parsing of operationId fields on directly declared OpenAPI path and webhook operations, including 3.2 query and additionalOperations entries.
+    implementation_id: prc.native.openapi-operation-ids@0.1
+    parameters: {}
+    severity: medium
+    gate: required
+    remediation_class: R2