@mitre/hdf-schema 3.6.0-rc.2 → 3.6.0-rc.3

package/dist/go/hdf.go

@@ -682,33 +682,36 @@ type Kev struct {
 // POAMs do NOT change the effectiveStatus - the requirement remains in its current state
 // while the POA&M tracks remediation efforts.
 type PoamElement struct {
-	// Timestamp when this POA&M was created. ISO 8601 format.                                             
-	AppliedAt                                                                                  time.Time   `json:"appliedAt"`
-	// Identity of who created this POA&M. For simple cases, use type 'simple' with just an                
-	// identifier.                                                                                         
-	AppliedBy                                                                                  Identity    `json:"appliedBy"`
-	// Supporting evidence for this POA&M, such as documentation of compensating controls or               
-	// mitigation implementation.                                                                          
-	Evidence                                                                                   []Evidence  `json:"evidence,omitempty"`
-	// Required deadline for this POA&M. A POA&M is a time-boxed acceptance of an open finding;            
-	// without a deadline it lets a failing requirement duck remediation indefinitely. Source a            
-	// real date (e.g. a remediation target or vendor-fix date) — never a wall-clock default.              
-	// ISO 8601 format.                                                                                    
-	ExpiresAt                                                                                  time.Time   `json:"expiresAt"`
-	// Detailed explanation of the plan, including what actions will be taken.                             
-	Explanation                                                                                string      `json:"explanation"`
-	// Optional array of milestones tracking progress toward completion.                                   
-	Milestones                                                                                 []Milestone `json:"milestones,omitempty"`
-	// SHA-256 checksum of the previous amendment in chronological order. Creates a                        
-	// tamper-evident chain of amendments (similar to blockchain). Null for the first amendment            
-	// on a requirement.                                                                                   
-	PreviousChecksum                                                                           *Checksum   `json:"previousChecksum,omitempty"`
-	// Optional digital signature for enhanced trust and non-repudiation.                                  
-	Signature                                                                                  *Signature  `json:"signature,omitempty"`
-	// The type of POA&M. 'remediation' fixes root cause. 'mitigation' reduces risk via                    
-	// compensating controls. 'riskAcceptance' documents decision to accept risk.                          
-	// 'vendorDependency' tracks a fix that depends on a vendor releasing a patch or update.               
-	Type                                                                                       POAMType    `json:"type"`
+	// Timestamp when this POA&M was created. ISO 8601 format.                                              
+	AppliedAt                                                                                   time.Time   `json:"appliedAt"`
+	// Identity of who created this POA&M. For simple cases, use type 'simple' with just an                 
+	// identifier.                                                                                          
+	AppliedBy                                                                                   Identity    `json:"appliedBy"`
+	// Supporting evidence for this POA&M, such as documentation of compensating controls or                
+	// mitigation implementation.                                                                           
+	Evidence                                                                                    []Evidence  `json:"evidence,omitempty"`
+	// Required deadline for this POA&M. A POA&M is a time-boxed acceptance of an open finding;             
+	// without a deadline it lets a failing requirement duck remediation indefinitely. Source a             
+	// real date (e.g. a remediation target or vendor-fix date) — never a wall-clock default.               
+	// ISO 8601 format.                                                                                     
+	ExpiresAt                                                                                   time.Time   `json:"expiresAt"`
+	// Detailed explanation of the plan, including what actions will be taken.                              
+	Explanation                                                                                 string      `json:"explanation"`
+	// Optional array of milestones tracking progress toward completion.                                    
+	Milestones                                                                                  []Milestone `json:"milestones,omitempty"`
+	// SHA-256 checksum of the previous amendment in chronological order. Each amendment's                  
+	// checksum is recorded by the NEXT one, so editing an amendment in place is detectable —               
+	// provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment,            
+	// the document envelope, deleted trailing amendments, and a chain that has been stripped or            
+	// recomputed wholesale are all outside what it can detect. Use signature for                           
+	// non-repudiation. Omitted on the first amendment on a requirement.                                    
+	PreviousChecksum                                                                            *Checksum   `json:"previousChecksum,omitempty"`
+	// Optional digital signature for enhanced trust and non-repudiation.                                   
+	Signature                                                                                   *Signature  `json:"signature,omitempty"`
+	// The type of POA&M. 'remediation' fixes root cause. 'mitigation' reduces risk via                     
+	// compensating controls. 'riskAcceptance' documents decision to accept risk.                           
+	// 'vendorDependency' tracks a fix that depends on a vendor releasing a patch or update.                
+	Type                                                                                        POAMType    `json:"type"`
 }
 
 // A milestone or task within a POA&M remediation plan.
@@ -839,9 +842,12 @@ type StatusOverride struct {
 	// round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the                            
 	// precedent vocabulary and rationale.                                                                          
 	Justification                                                                               *Justification      `json:"justification,omitempty"`
-	// SHA-256 checksum of the previous amendment in chronological order. Creates a                                 
-	// tamper-evident chain of amendments (similar to blockchain). Null for the first amendment                     
-	// on a requirement.                                                                                            
+	// SHA-256 checksum of the previous amendment in chronological order. Each amendment's                          
+	// checksum is recorded by the NEXT one, so editing an amendment in place is detectable —                       
+	// provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment,                    
+	// the document envelope, deleted trailing amendments, and a chain that has been stripped or                    
+	// recomputed wholesale are all outside what it can detect. Use signature for                                   
+	// non-repudiation. Omitted on the first amendment on a requirement.                                            
 	PreviousChecksum                                                                            *Checksum           `json:"previousChecksum,omitempty"`
 	// Explanation for why this override was applied.                                                               
 	Reason                                                                                      string              `json:"reason"`
@@ -2072,8 +2078,12 @@ type StandaloneOverride struct {
 	Justification                                                                               *Justification      `json:"justification,omitempty"`
 	// Remediation milestones (primarily for POA&M type amendments).                                                
 	Milestones                                                                                  []Milestone         `json:"milestones,omitempty"`
-	// Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null                     
-	// for the first amendment.                                                                                     
+	// SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum                    
+	// is recorded by the NEXT one, so editing an amendment in place is detectable — provided a                     
+	// later amendment is chained to it. It is NOT tamper-proof: the final amendment, the                           
+	// document envelope, deleted trailing amendments, and a chain that has been stripped or                        
+	// recomputed wholesale are all outside what it can detect. Use signature for                                   
+	// non-repudiation. Omitted on the first amendment.                                                             
 	PreviousChecksum                                                                            *Checksum           `json:"previousChecksum,omitempty"`
 	// Justification for this amendment.                                                                            
 	Reason                                                                                      string              `json:"reason"`

package/dist/index.js

@@ -15,7 +15,7 @@ export const hdfRequirementChangeEventSchema = {"$schema":"https://json-schema.o
 export const hdfResultsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0","type":"object","unevaluatedProperties":false,"required":["baselines"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"},"description":"Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."},"id":{"type":"string","format":"uuid","description":"Unique identifier for this assessment run."},"timestamp":{"type":"string","format":"date-time","description":"When this assessment was executed."},"components":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"},"description":"The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."},"baselines":{"type":"array","items":{"$ref":"#/$defs/Evaluated_Baseline"},"description":"Information on the baselines that were evaluated, including findings."},"statistics":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0#/$defs/Statistics","description":"Statistics for the assessment run, including duration and result counts."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator","description":"Information about the tool that generated this file."},"tool":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool","description":"The security tool that produced the assessment data in this file."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this file."},"runner":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0#/$defs/Runner","description":"Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."},"remediation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Remediation","description":"Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."},"systemRef":{"type":"string","format":"uri-reference","description":"Reference to an hdf-system document describing the system under assessment. May be a relative path, absolute URI, or fragment identifier."},"planRef":{"type":"string","format":"uri-reference","description":"Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."},"derivation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Derivation","description":"Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."},"extensions":{"type":"object","additionalProperties":true,"description":"Reserved for tool-specific data not defined in the HDF standard. Use this to preserve original tool output, auxiliary data, or custom metadata."}},"examples":[{"baselines":[{"name":"web-server-hardening","title":"Web Server Security Baseline","version":"1.0.0","summary":"Security hardening checks for Apache HTTP Server","requirements":[{"id":"SV-100001","title":"Web server must use TLS 1.2 or higher","impact":0.7,"tags":{"nist":["SC-8","SC-23"]},"descriptions":[{"label":"default","data":"The web server must be configured to use TLS 1.2 or higher for all encrypted connections."}],"results":[{"status":"passed","codeDesc":"SSL configuration is expected to include TLSv1.2","startTime":"2025-06-15T14:30:00Z","runTime":0.042}]},{"id":"SV-100002","title":"Web server must have X-Frame-Options header set","impact":0.5,"tags":{"nist":["SA-11","RA-5"]},"descriptions":[{"label":"default","data":"The anti-clickjacking X-Frame-Options header must be present on all responses."}],"results":[{"status":"failed","codeDesc":"HTTP response headers are expected to include X-Frame-Options","startTime":"2025-06-15T14:30:01Z","message":"X-Frame-Options header not found in response"}]}]}],"components":[{"type":"application","name":"Apache HTTP Server 2.4"}],"generator":{"name":"nikto-to-hdf","version":"1.0.0"},"tool":{"name":"Nikto"}}],"description":"The top level value containing all assessment results.","title":"HDF Results","$defs":{"Evaluated_Baseline":{"type":"object","unevaluatedProperties":false,"required":["name","requirements"],"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Baseline_Metadata"}],"properties":{"depends":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Dependency"},"description":"The set of dependencies this baseline depends on."},"parentBaseline":{"type":"string","description":"The name of the parent baseline if this is a dependency of another."},"description":{"type":"string","description":"The description - should be more detailed than the summary."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this baseline has not been tampered with."},"originalChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."},"resultsChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."},"statusMessage":{"type":"string","description":"An explanation of the baseline status. Example: why it was skipped, failed to load, or any other status details."},"requirements":{"type":"array","items":{"$ref":"#/$defs/Evaluated_Requirement"},"minItems":1,"description":"The set of requirements including any findings. A baseline must have at least one requirement."},"groups":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Group"},"description":"A set of descriptions for the requirement groups."},"inputs":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0#/$defs/Input"},"description":"Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."},"extensions":{"type":"object","additionalProperties":true,"description":"Reserved for tool-specific baseline metadata not defined in the HDF standard."}},"description":"Information on a baseline that was evaluated, including any findings.","title":"Evaluated Baseline"},"Evaluated_Requirement":{"type":"object","unevaluatedProperties":false,"required":["id","impact","tags","results","descriptions"],"allOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Core"}],"properties":{"descriptions":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Description"},"contains":{"type":"object","required":["label"],"properties":{"label":{"const":"default"}}},"description":"Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."},"severity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Severity","description":"Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."},"sourceLocation":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Source_Location","description":"The explicit location of the requirement within the source code."},"results":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Result"},"description":"The set of all tests within the requirement and their results."},"statusOverrides":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Status_Override"},"description":"Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."},"poams":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/POAM"},"description":"Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."},"effectiveStatus":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status","description":"The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."},"effectiveImpact":{"type":"number","minimum":0,"maximum":1,"description":"The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."},"disposition":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type","description":"The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."},"effectiveChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."},"cvss":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss"},"description":"Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."},"epss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0#/$defs/Epss","description":"FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."},"kev":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0#/$defs/Kev","description":"CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."},"cwe":{"type":"array","items":{"type":"string","pattern":"^CWE-[1-9]\\d*$"},"description":"Common Weakness Enumeration IDs associated with this finding. Use CWE-N format with no leading zeros (matches the MITRE catalog convention). For NIST control mappings derived from CWE, see tags.nist."},"affectedPackages":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"},"description":"Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."}},"examples":[{"$comment":"Passing requirement — no overrides, no disposition","id":"SV-230222","title":"RHEL 9 must use SSH protocol version 2","impact":0.7,"tags":{"nist":["SC-8"]},"descriptions":[{"label":"default","data":"SSH must use protocol version 2."}],"results":[{"status":"passed","codeDesc":"sshd_config Protocol is expected to eq 2","startTime":"2026-01-15T10:00:00Z"}],"effectiveStatus":"passed"},{"$comment":"Waiver — AO accepted risk, status overridden to passed","id":"SV-230300","title":"RHEL 9 must enforce password complexity","impact":0.5,"tags":{"nist":["IA-5 (1)"]},"descriptions":[{"label":"default","data":"Passwords must meet complexity requirements."}],"results":[{"status":"failed","codeDesc":"pwquality.conf minlen is expected to be >= 15","startTime":"2026-01-15T10:00:00Z","message":"expected 8 to be >= 15"}],"statusOverrides":[{"type":"waiver","status":"passed","reason":"Compensating control: PIV/CAC smart card authentication enforced for all users, password login disabled","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z"}],"effectiveStatus":"passed","disposition":"waiver","effectiveChecksum":{"algorithm":"sha256","value":"d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"}},{"$comment":"False positive (compliance scan) — STIG check was wrong, requirement actually passes","id":"SV-230410","title":"RHEL 9 must have sshd PermitRootLogin disabled","impact":0.7,"tags":{"nist":["AC-6"]},"descriptions":[{"label":"default","data":"Direct root login via SSH must be disabled."}],"results":[{"status":"failed","codeDesc":"sshd_config PermitRootLogin is expected to eq 'no'","startTime":"2026-01-15T10:00:00Z","message":"expected 'prohibit-password' to eq 'no'"}],"statusOverrides":[{"type":"falsePositive","status":"passed","reason":"Scanner requires literal 'no' but 'prohibit-password' is equally restrictive (disables password-based root login). Manual review confirms root cannot authenticate via SSH.","appliedBy":{"type":"email","identifier":"assessor@agency.gov"},"appliedAt":"2026-01-16T14:00:00Z","expiresAt":"2026-07-16T00:00:00Z"}],"effectiveStatus":"passed","disposition":"falsePositive"},{"$comment":"False positive (CVE scan) — vulnerability does not apply to this build","id":"CVE-2026-12345","title":"libxml2 buffer overflow in xmlParseEntityDecl","impact":0.9,"tags":{"nist":["SI-2","RA-5"]},"descriptions":[{"label":"default","data":"Buffer overflow in libxml2 entity parsing allows remote code execution."}],"results":[{"status":"failed","codeDesc":"libxml2 >= 2.9.0 is expected to be patched for CVE-2026-12345","startTime":"2026-01-15T10:00:00Z"}],"statusOverrides":[{"type":"falsePositive","status":"notApplicable","reason":"CVE scanner matched libxml2 version signature, but the vulnerable entity parsing module is compiled out of our build (--without-legacy flag). The affected code path does not exist in the binary.","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-01-16T09:00:00Z","expiresAt":"2026-07-16T00:00:00Z"}],"effectiveStatus":"notApplicable","disposition":"falsePositive"},{"$comment":"Risk adjustment — impact lowered, pass/fail unchanged","id":"CVE-2026-67890","title":"OpenSSL timing side-channel in RSA decryption","impact":0.7,"tags":{"nist":["SI-2","RA-5"]},"descriptions":[{"label":"default","data":"Timing side-channel may allow RSA private key recovery."}],"results":[{"status":"failed","codeDesc":"openssl >= 3.1.0 is expected to be patched for CVE-2026-67890","startTime":"2026-01-15T10:00:00Z"}],"statusOverrides":[{"type":"riskAdjustment","impact":{"value":0.3},"reason":"The RSA key exchange path is unreachable in our deployment — all TLS connections use ECDHE. Attack requires local network access to the TLS terminator, which is in an isolated VLAN.","appliedBy":{"type":"email","identifier":"security-architect@org.gov"},"appliedAt":"2026-01-17T10:00:00Z","expiresAt":"2026-07-17T00:00:00Z"}],"effectiveStatus":"failed","effectiveImpact":0.3,"disposition":"riskAdjustment"},{"$comment":"Operational requirement — cannot remediate, remains open risk","id":"SV-230500","title":"RHEL 9 must disable USB mass storage","impact":0.5,"tags":{"nist":["MP-7"]},"descriptions":[{"label":"default","data":"USB mass storage kernel module must be disabled."}],"results":[{"status":"failed","codeDesc":"Kernel module 'usb-storage' is expected to be disabled","startTime":"2026-01-15T10:00:00Z","message":"usb-storage module is loaded"}],"statusOverrides":[{"type":"operationalRequirement","status":"failed","reason":"Air-gapped system requires USB transfer for classified data ingestion per operational procedure OP-2026-003. Compensating controls: USB ports are physically secured, all transfers are logged and require two-person integrity.","appliedBy":{"type":"email","identifier":"system-owner@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2026-07-20T00:00:00Z"}],"effectiveStatus":"failed","disposition":"operationalRequirement"},{"$comment":"POAM — remediation tracked, status unchanged","id":"SV-230350","title":"RHEL 9 must be patched within 30 days of release","impact":0.7,"tags":{"nist":["SI-2"]},"descriptions":[{"label":"default","data":"Security patches must be applied within 30 days."}],"results":[{"status":"failed","codeDesc":"Package updates are expected to be current within 30 days","startTime":"2026-01-15T10:00:00Z","message":"15 packages have patches older than 30 days"}],"poams":[{"type":"remediation","explanation":"Patch deployment blocked by vendor compatibility testing. Vendor confirmed fix for Q2 2026.","appliedBy":{"type":"email","identifier":"ops@agency.gov"},"appliedAt":"2026-01-20T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Vendor releases compatible patch","estimatedCompletion":"2026-04-01T00:00:00Z","status":"pending"},{"description":"Deploy to production","estimatedCompletion":"2026-04-15T00:00:00Z","status":"pending"}]}],"effectiveStatus":"failed","disposition":"poam"}],"description":"A requirement that has been evaluated, including any findings.","title":"Evaluated Requirement"}}};
 export const hdfSystemSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/hdf-system/v3.5.0","title":"HDF System","description":"Describes a system's authorization boundary, components, and interconnections. Maps to OSCAL SSP system-characteristics and FedRAMP system inventory.","type":"object","unevaluatedProperties":false,"required":["name","components"],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"},"description":"Optional references to external artifacts describing this system's threat environment or context (CTI/STIX, BOMs, advisories, or any URI-addressable artifact). Inert context; see External_Reference."},"systemId":{"type":"string","format":"uuid","description":"Stable UUID (RFC 4122) for this system. Enables cross-document correlation independent of file location. Optional in casual use, expected in production documents."},"owner":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Team or individual responsible for this system's authorization and compliance. Maps to OSCAL responsible-party with role 'system-owner'."},"name":{"type":"string","description":"Human-readable system name. Example: 'Enterprise Portal Production'."},"identifier":{"type":"string","description":"System identifier from an authoritative source. Example: eMASS system ID, FedRAMP package ID."},"identifierScheme":{"type":"string","format":"uri-reference","description":"URI identifying the scheme of the system identifier. Example: 'https://emass.mil', 'https://fedramp.gov'."},"description":{"type":"string","description":"Description of the system's purpose and mission."},"authorizationStatus":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Authorization_Status","description":"Current Authorization to Operate (ATO) status."},"authorizationDate":{"type":"string","format":"date-time","description":"Date the current authorization status was granted. ISO 8601 format."},"categorizationLevel":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Categorization_Level","description":"FIPS 199 security categorization (impact level)."},"boundaryDescription":{"type":"string","description":"Description of the system's authorization boundary. Example: network CIDR blocks, cloud VPC IDs, physical locations."},"components":{"type":"array","minItems":1,"items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"},"description":"System components within the authorization boundary. Uses the full polymorphic Component type with stable identity (componentId), external references, and generalized BOM attachment (boms[])."},"controlDesignations":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Control_Designation"},"description":"Declares which controls are common, hybrid, or system-specific, and which component provides them. Maps to NIST SP 800-53 control designations and OSCAL leveraged-authorizations."},"dataFlows":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/data-flow/v3.5.0#/$defs/Data_Flow"},"description":"Inter-component data flows describing how components communicate. Supports local, cross-system, and external flows. Replaces the interconnections[] field."},"boms":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0#/$defs/Bom"},"description":"System-scoped Bills of Materials whose subject is the authorization boundary rather than a single component (e.g. a SaaSBOM of services, a KBOM of cluster inventory, an OBOM). Component-scoped BOMs (SBOM, ai-model) attach on the component instead. See primitives/bom.schema.json."},"labels":{"type":"object","additionalProperties":{"type":"string"},"description":"Optional key-value labels for grouping and querying systems."},"integrity":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity","description":"Cryptographic integrity information for verifying this system document has not been tampered with."},"version":{"type":"string","description":"Version of this system document."},"generator":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator","description":"Information about the tool that generated this system document."}},"examples":[{"name":"Enterprise Portal Production","identifier":"SYS-2024-00142","identifierScheme":"https://emass.mil","authorizationStatus":"authorized","authorizationDate":"2025-06-15T00:00:00Z","categorizationLevel":"moderate","boundaryDescription":"All resources in prod VPC (10.0.0.0/16)","components":[{"name":"WebTier","type":"application","componentId":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","description":"RHEL 9 web servers running the portal","baselineRefs":["RHEL9-STIG","DISA-Container-STIG"],"boms":[{"bomType":"sbom","format":"cyclonedx","ref":"https://artifacts.agency.gov/sbom/webtier-2026-03.cdx.json"}]},{"name":"DatabaseTier","type":"database","componentId":"11111111-2222-3333-4444-555555555555","baselineRefs":["PostgreSQL-15-STIG"]}],"dataFlows":[{"from":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","to":"11111111-2222-3333-4444-555555555555","protocol":"jdbc","port":5432,"direction":"unidirectional","description":"Web tier connects to database"}]}]};
 export const affectedPackageSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0","title":"HDF Affected Package Primitives","description":"Types for representing the software package(s) affected by a vulnerability finding.","$defs":{"Affected_Package":{"type":"object","unevaluatedProperties":false,"anyOf":[{"required":["name","version","ecosystem"]},{"required":["purl"]},{"required":["cpe"]}],"properties":{"name":{"type":"string","description":"The package name as published in its ecosystem. Examples: 'openssl' (rpm), 'lodash' (npm), 'org.apache.logging.log4j:log4j-core' (maven, group:artifact)."},"version":{"type":"string","description":"The exact version of the package that the vulnerability scanner observed. Use the ecosystem's native version string verbatim (e.g., '1.1.1k-7.el8_4' for rpm, '4.17.20' for npm)."},"ecosystem":{"type":"string","enum":["npm","pypi","rpm","deb","maven","gem","nuget","go","cargo","generic"],"description":"The packaging ecosystem the package belongs to. Use 'generic' for hardware, firmware, or anything outside the listed language/OS package managers."},"cpe":{"type":"string","pattern":"^cpe:2\\.3:[aho]:.*","description":"Optional CPE 2.3 URI identifying the affected product. Validated leniently: only the 'cpe:2.3:' prefix and the part-type letter ('a' application, 'h' hardware, 'o' operating system) are enforced here. Use `hdf-utilities.parseCpe` for full-grammar parsing. Example: `cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*`."},"purl":{"type":"string","pattern":"^pkg:[A-Za-z0-9.+-]+/.+","description":"Optional Package URL (PURL) identifying the affected package.\n\nValidated leniently: only the 'pkg:TYPE/' scheme prefix is enforced here, where TYPE follows the PURL grammar (a letter followed by letters, digits, '.', '+', or '-') and is matched case-insensitively to mirror `hdf-utilities.parsePurl`'s accept-and-warn behavior.\n\nUse `parsePurl` for full PURL parsing.\n\nExample: 'pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64'."},"fixedInVersion":{"type":"string","description":"Optional version string identifying the first release that contains the fix for the vulnerability. Use the same version syntax as `version`. Example: '1.1.1l' fixes 'openssl@1.1.1k'."}},"examples":[{"$comment":"RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan.","name":"openssl","version":"1.1.1k-7.el8_4","ecosystem":"rpm","cpe":"cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*","purl":"pkg:rpm/redhat/openssl@1.1.1k-7.el8_4?arch=x86_64","fixedInVersion":"1.1.1l"},{"$comment":"NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier.","name":"lodash","version":"4.17.20","ecosystem":"npm","purl":"pkg:npm/lodash@4.17.20","fixedInVersion":"4.17.21"},{"$comment":"Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings.","name":"requests","version":"2.28.1","ecosystem":"pypi"},{"$comment":"Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed.","name":"org.apache.logging.log4j:log4j-core","version":"2.14.1","ecosystem":"maven","cpe":"cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*","purl":"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1","fixedInVersion":"2.17.1"},{"$comment":"purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly.","purl":"pkg:npm/lodash@4.17.20"},{"$comment":"cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.","cpe":"cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*"}],"description":"Represents a package referenced by a vulnerability finding or by an amendment's scope.\n\nOn Evaluated_Requirement.affectedPackages it says 'this CVE affects these package versions'. On Standalone_Override.affectedPackages it says 'this amendment is scoped to these packages' (used by VEX, OSCAL POA&M, FedRAMP component-aware amendments).\n\nNOT a system-level component identifier — see `components[]` on hdf-system for those.\n\nValidity requires at least one of: (name + version + ecosystem), purl alone, or cpe alone.\n\npurl and cpe are self-describing identifiers that encode name/version implicitly, so either may stand on its own; the name+version+ecosystem combination is the explicit form for sources without formal identifiers.","title":"Affected Package"}}};
-export const amendmentsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0","title":"HDF Amendment Primitives","description":"Types for waivers, attestations, and POA&Ms that modify requirement compliance status.","$defs":{"Override_Type":{"type":"string","enum":["waiver","attestation","poam","inherited","falsePositive","riskAdjustment","operationalRequirement"],"description":"The type of amendment, aligned with FedRAMP deviation request categories.\n\n- 'waiver': risk accepted by Authorizing Official.\n- 'attestation': manually verified by assessor.\n- 'poam': remediation tracked (no status change).\n- 'inherited': control provided by another component or system.\n- 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE, SCA), the flagged vulnerability does not apply to this system, so status is typically set to 'notApplicable'. The disposition field on the requirement distinguishes false positives from genuinely not-applicable findings.\n- 'riskAdjustment': impact score adjusted based on environmental context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact field.\n- 'operationalRequirement': deviation required by operational constraints (FedRAMP Operational Requirement); the finding cannot be remediated because the system requires the affected functionality. Remains an open risk.\n\nMigration note: 'exception' was removed in v3.1.0 — use 'waiver' with status 'notApplicable' instead.","title":"Override Type"},"Justification":{"type":"string","enum":["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist","requires_configuration","requires_dependency","requires_environment","protected_by_compiler","protected_at_runtime","protected_at_perimeter"],"description":"Structured controlled-vocabulary reason for an override, complementing the free-text 'reason' field. 'reason' carries the human-readable rationale an auditor reads; 'justification' carries the machine-readable category enabling filtering, aggregation, and lossless round-trip with structured ecosystems (VEX, OSCAL, FedRAMP DR). Both fields may be present simultaneously and are NOT redundant: 'reason' explains the specific circumstance; 'justification' classifies it. Authors SHOULD populate both when a controlled-vocabulary value applies — the enum value alone is not self-explanatory to an auditor.\n\nThe vocabulary is drawn from the VEX ecosystem: the first five values are common across OpenVEX, CSAF VEX, and CycloneDX VEX; the remaining six (requires_configuration / requires_dependency / requires_environment / protected_by_compiler / protected_at_runtime / protected_at_perimeter) are CycloneDX-specific and describe why the vulnerable code path is unreachable in the deployed configuration.\n\nThe enum is extended additively across schema versions as other ecosystems' controlled vocabularies are integrated; documents using values added in a newer schema version will fail validation against an older schema. Consumers SHOULD validate against the schema version declared by the document ($schema) rather than assume a fixed vocabulary.","title":"Justification"},"Impact_Override":{"type":"object","required":["value"],"unevaluatedProperties":false,"properties":{"value":{"type":"number","minimum":0,"maximum":1,"description":"The overridden impact score (0.0–1.0)."}},"description":"An override to the requirement's impact score. The prior impact is the original result value or the preceding override in the chain.","title":"Impact Override"},"Standalone_Override":{"type":"object","description":"A standalone override to a requirement's compliance status or risk impact.\n\nValidation has two branches gated on 'type': when type is 'operationalRequirement', neither 'status' nor 'impact' may be set — the override records accepted risk without changing the finding (documentation-only). For all other types, at least one of 'status' or 'impact' must be set.\n\nThis rule aligns with:\n- OSCAL Assessment Results — finding.target.status and finding.associated-risk[].facet[] are separate axes (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/)\n- FedRAMP deviation request types — Risk Adjustment changes impact only, Operational Requirement documents acceptance only, False Positive changes status (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/)\n- NIST SP 800-37 RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment status (https://csrc.nist.gov/pubs/sp/800/37/r2/final).","unevaluatedProperties":false,"required":["type","requirementId","reason","appliedBy","appliedAt","expiresAt"],"if":{"properties":{"type":{"enum":["operationalRequirement"]}},"required":["type"]},"then":{"not":{"anyOf":[{"required":["status"]},{"required":["impact"]}]}},"else":{"anyOf":[{"required":["status"]},{"required":["impact"]}]},"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"},"description":"Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."},"type":{"$ref":"#/$defs/Override_Type","description":"The type of amendment."},"requirementId":{"type":"string","description":"The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."},"baselineRef":{"type":"string","description":"Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."},"status":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status","description":"The new status this amendment sets. Optional when only impact is being overridden."},"impact":{"$ref":"#/$defs/Impact_Override","description":"Override to the requirement's impact score. At least one of status or impact must be set."},"reason":{"type":"string","description":"Justification for this amendment."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Identity of who applied this amendment."},"appliedAt":{"type":"string","format":"date-time","description":"When this amendment was applied. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"When this amendment expires and must be reviewed. No permanent amendments. ISO 8601 format."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence (screenshots, logs, URLs, documents)."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature","description":"Digital signature for non-repudiation."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."},"cvss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss","$comment":"When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.","description":"Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."},"justification":{"$ref":"#/$defs/Justification","description":"Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."},"milestones":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"},"description":"Remediation milestones (primarily for POA&M type amendments)."},"inheritedFrom":{"type":"string","format":"uuid","description":"componentId of the local component that provides this control. Set when the provider is in the same system. Omit for external or cross-system providers; the reason field explains the source. Primarily used with type 'inherited'."},"componentRef":{"type":"string","format":"uuid","description":"componentId of the component this amendment is scoped to. When set, the amendment only applies to the specified component. When omitted, the amendment applies system-wide."},"affectedPackages":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"},"description":"Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."}},"examples":[{"type":"waiver","requirementId":"SV-257777","baselineRef":"RHEL9-STIG","status":"passed","reason":"Compensating control: session timeout set to 15 min","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-15T10:00:00Z","expiresAt":"2026-06-30T00:00:00Z","evidence":[{"type":"url","data":"https://jira.agency.gov/CYBER-4521","description":"ISSM approval with compensating control documentation"}]},{"type":"falsePositive","requirementId":"SV-258010","baselineRef":"RHEL9-STIG","status":"passed","reason":"STIG check misidentified sshd_config syntax; manual review confirms compliant configuration","appliedBy":{"type":"email","identifier":"assessor@agency.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"falsePositive","requirementId":"CVE-2026-12345","status":"notApplicable","reason":"CVE scanner matched library signature but the vulnerable code path is not present in our build — dependency is compiled with the affected module disabled","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"riskAdjustment","requirementId":"SV-258020","baselineRef":"RHEL9-STIG","impact":{"value":0.3},"reason":"CVE-123 is in a dead code path, unreachable from any entry point","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"poam","requirementId":"SV-258001","baselineRef":"RHEL9-STIG","status":"failed","reason":"Patch requires vendor release, expected Q2 2026","appliedBy":{"type":"email","identifier":"sysadmin@agency.gov"},"appliedAt":"2026-01-20T09:00:00Z","expiresAt":"2026-07-01T00:00:00Z","milestones":[{"description":"Vendor patch release","estimatedCompletion":"2026-04-15T00:00:00Z","status":"pending"},{"description":"Apply patch to all servers","estimatedCompletion":"2026-05-01T00:00:00Z","status":"pending"}]},{"type":"inherited","requirementId":"SV-230368","baselineRef":"RHEL9-STIG","status":"notApplicable","reason":"IA-2 is a common control provided by Keycloak SSO. This application has no local authentication mechanism.","inheritedFrom":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","appliedBy":{"type":"email","identifier":"issm@agency.gov"},"appliedAt":"2026-03-26T10:00:00Z","expiresAt":"2026-09-26T00:00:00Z"},{"$comment":"VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.","type":"falsePositive","requirementId":"CVE-2026-12345","status":"notApplicable","reason":"Vulnerable code path is not present in our build — dependency compiled with the affected module disabled","justification":"vulnerable_code_not_present","appliedBy":{"type":"email","identifier":"secops@org.gov"},"appliedAt":"2026-05-01T10:00:00Z","expiresAt":"2027-05-01T00:00:00Z","affectedPackages":[{"purl":"pkg:npm/lodash@4.17.20"},{"purl":"pkg:rpm/openssl@1.1.1k-2.el8","fixedInVersion":"1.1.1k-3.el8"}]}],"title":"Standalone Override"}}};
+export const amendmentsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0","title":"HDF Amendment Primitives","description":"Types for waivers, attestations, and POA&Ms that modify requirement compliance status.","$defs":{"Override_Type":{"type":"string","enum":["waiver","attestation","poam","inherited","falsePositive","riskAdjustment","operationalRequirement"],"description":"The type of amendment, aligned with FedRAMP deviation request categories.\n\n- 'waiver': risk accepted by Authorizing Official.\n- 'attestation': manually verified by assessor.\n- 'poam': remediation tracked (no status change).\n- 'inherited': control provided by another component or system.\n- 'falsePositive': scanner incorrectly identified a finding — for compliance scans (STIG, CIS), the check actually passes, so status is typically set to 'passed'; for vulnerability scans (CVE, SCA), the flagged vulnerability does not apply to this system, so status is typically set to 'notApplicable'. The disposition field on the requirement distinguishes false positives from genuinely not-applicable findings.\n- 'riskAdjustment': impact score adjusted based on environmental context (FedRAMP Risk Adjustment); does not change pass/fail status, only impact via the impact field.\n- 'operationalRequirement': deviation required by operational constraints (FedRAMP Operational Requirement); the finding cannot be remediated because the system requires the affected functionality. Remains an open risk.\n\nMigration note: 'exception' was removed in v3.1.0 — use 'waiver' with status 'notApplicable' instead.","title":"Override Type"},"Justification":{"type":"string","enum":["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist","requires_configuration","requires_dependency","requires_environment","protected_by_compiler","protected_at_runtime","protected_at_perimeter"],"description":"Structured controlled-vocabulary reason for an override, complementing the free-text 'reason' field. 'reason' carries the human-readable rationale an auditor reads; 'justification' carries the machine-readable category enabling filtering, aggregation, and lossless round-trip with structured ecosystems (VEX, OSCAL, FedRAMP DR). Both fields may be present simultaneously and are NOT redundant: 'reason' explains the specific circumstance; 'justification' classifies it. Authors SHOULD populate both when a controlled-vocabulary value applies — the enum value alone is not self-explanatory to an auditor.\n\nThe vocabulary is drawn from the VEX ecosystem: the first five values are common across OpenVEX, CSAF VEX, and CycloneDX VEX; the remaining six (requires_configuration / requires_dependency / requires_environment / protected_by_compiler / protected_at_runtime / protected_at_perimeter) are CycloneDX-specific and describe why the vulnerable code path is unreachable in the deployed configuration.\n\nThe enum is extended additively across schema versions as other ecosystems' controlled vocabularies are integrated; documents using values added in a newer schema version will fail validation against an older schema. Consumers SHOULD validate against the schema version declared by the document ($schema) rather than assume a fixed vocabulary.","title":"Justification"},"Impact_Override":{"type":"object","required":["value"],"unevaluatedProperties":false,"properties":{"value":{"type":"number","minimum":0,"maximum":1,"description":"The overridden impact score (0.0–1.0)."}},"description":"An override to the requirement's impact score. The prior impact is the original result value or the preceding override in the chain.","title":"Impact Override"},"Standalone_Override":{"type":"object","description":"A standalone override to a requirement's compliance status or risk impact.\n\nValidation has two branches gated on 'type': when type is 'operationalRequirement', neither 'status' nor 'impact' may be set — the override records accepted risk without changing the finding (documentation-only). For all other types, at least one of 'status' or 'impact' must be set.\n\nThis rule aligns with:\n- OSCAL Assessment Results — finding.target.status and finding.associated-risk[].facet[] are separate axes (https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-results/)\n- FedRAMP deviation request types — Risk Adjustment changes impact only, Operational Requirement documents acceptance only, False Positive changes status (https://www.ignyteplatform.com/blog/fedramp/fedramp-deviation-requests-submit/)\n- NIST SP 800-37 RMF — risk response (accept/mitigate/transfer) is a separate step from control assessment status (https://csrc.nist.gov/pubs/sp/800/37/r2/final).","unevaluatedProperties":false,"required":["type","requirementId","reason","appliedBy","appliedAt","expiresAt"],"if":{"properties":{"type":{"enum":["operationalRequirement"]}},"required":["type"]},"then":{"not":{"anyOf":[{"required":["status"]},{"required":["impact"]}]}},"else":{"anyOf":[{"required":["status"]},{"required":["impact"]}]},"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"},"description":"Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."},"type":{"$ref":"#/$defs/Override_Type","description":"The type of amendment."},"requirementId":{"type":"string","description":"The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."},"baselineRef":{"type":"string","description":"Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."},"status":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status","description":"The new status this amendment sets. Optional when only impact is being overridden."},"impact":{"$ref":"#/$defs/Impact_Override","description":"Override to the requirement's impact score. At least one of status or impact must be set."},"reason":{"type":"string","description":"Justification for this amendment."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Identity of who applied this amendment."},"appliedAt":{"type":"string","format":"date-time","description":"When this amendment was applied. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"When this amendment expires and must be reviewed. No permanent amendments. ISO 8601 format."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence (screenshots, logs, URLs, documents)."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature","description":"Digital signature for non-repudiation."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."},"cvss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss","$comment":"When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.","description":"Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."},"justification":{"$ref":"#/$defs/Justification","description":"Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."},"milestones":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"},"description":"Remediation milestones (primarily for POA&M type amendments)."},"inheritedFrom":{"type":"string","format":"uuid","description":"componentId of the local component that provides this control. Set when the provider is in the same system. Omit for external or cross-system providers; the reason field explains the source. Primarily used with type 'inherited'."},"componentRef":{"type":"string","format":"uuid","description":"componentId of the component this amendment is scoped to. When set, the amendment only applies to the specified component. When omitted, the amendment applies system-wide."},"affectedPackages":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"},"description":"Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."}},"examples":[{"type":"waiver","requirementId":"SV-257777","baselineRef":"RHEL9-STIG","status":"passed","reason":"Compensating control: session timeout set to 15 min","appliedBy":{"type":"email","identifier":"ao@agency.gov"},"appliedAt":"2026-01-15T10:00:00Z","expiresAt":"2026-06-30T00:00:00Z","evidence":[{"type":"url","data":"https://jira.agency.gov/CYBER-4521","description":"ISSM approval with compensating control documentation"}]},{"type":"falsePositive","requirementId":"SV-258010","baselineRef":"RHEL9-STIG","status":"passed","reason":"STIG check misidentified sshd_config syntax; manual review confirms compliant configuration","appliedBy":{"type":"email","identifier":"assessor@agency.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"falsePositive","requirementId":"CVE-2026-12345","status":"notApplicable","reason":"CVE scanner matched library signature but the vulnerable code path is not present in our build — dependency is compiled with the affected module disabled","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"riskAdjustment","requirementId":"SV-258020","baselineRef":"RHEL9-STIG","impact":{"value":0.3},"reason":"CVE-123 is in a dead code path, unreachable from any entry point","appliedBy":{"type":"email","identifier":"dev@org.gov"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"poam","requirementId":"SV-258001","baselineRef":"RHEL9-STIG","status":"failed","reason":"Patch requires vendor release, expected Q2 2026","appliedBy":{"type":"email","identifier":"sysadmin@agency.gov"},"appliedAt":"2026-01-20T09:00:00Z","expiresAt":"2026-07-01T00:00:00Z","milestones":[{"description":"Vendor patch release","estimatedCompletion":"2026-04-15T00:00:00Z","status":"pending"},{"description":"Apply patch to all servers","estimatedCompletion":"2026-05-01T00:00:00Z","status":"pending"}]},{"type":"inherited","requirementId":"SV-230368","baselineRef":"RHEL9-STIG","status":"notApplicable","reason":"IA-2 is a common control provided by Keycloak SSO. This application has no local authentication mechanism.","inheritedFrom":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","appliedBy":{"type":"email","identifier":"issm@agency.gov"},"appliedAt":"2026-03-26T10:00:00Z","expiresAt":"2026-09-26T00:00:00Z"},{"$comment":"VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.","type":"falsePositive","requirementId":"CVE-2026-12345","status":"notApplicable","reason":"Vulnerable code path is not present in our build — dependency compiled with the affected module disabled","justification":"vulnerable_code_not_present","appliedBy":{"type":"email","identifier":"secops@org.gov"},"appliedAt":"2026-05-01T10:00:00Z","expiresAt":"2027-05-01T00:00:00Z","affectedPackages":[{"purl":"pkg:npm/lodash@4.17.20"},{"purl":"pkg:rpm/openssl@1.1.1k-2.el8","fixedInVersion":"1.1.1k-3.el8"}]}],"title":"Standalone Override"}}};
 export const bomSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0","title":"HDF BOM Primitives","description":"Generalized Bill-of-Materials / manifest representation.\n\nOne extensible Bom shape, discriminated by bomType, carries any manifest kind (SBOM, AI model/dataset, and reserved future kinds) either by passthrough (opaque ref/embed of the native document) or normalized (converted into HDF's queryable shape).\n\nSubject identity (name, version, componentId) is inherited from the host component or system — the BOM never re-owns it.\n\nSee ADR-0001.","$defs":{"Bom_Type":{"type":"string","title":"BOM Type","anyOf":[{"enum":["sbom","ai-model","dataset","hbom","cbom","saasbom","obom","mbom","kbom"]},{"pattern":"^x-[a-z0-9]+(-[a-z0-9]+)*$"}],"description":"Discriminator for the manifest kind.\n\nReserved, CycloneDX-aligned set: sbom (software), ai-model, dataset, hbom (hardware), cbom (cryptography), saasbom (services), obom (operations), mbom (manufacturing), kbom (Kubernetes).\n\nNormalized now: sbom, ai-model, dataset; reserved + passthrough-capable now, normalized in later releases: the rest.\n\nCustom or experimental kinds MUST use an 'x-' prefix (e.g. 'x-threat-model') so they cannot collide with a value later promoted into the reserved set; a non-'x-' value outside the reserved set is invalid.\n\nAdding a reserved value is a schema version bump.\n\nVEX/VDR/SecurityProfile are vulnerability assertions, not BOMs, and are intentionally excluded."},"Bom":{"type":"object","title":"Bill of Materials","additionalProperties":false,"required":["bomType","format"],"properties":{"bomType":{"$ref":"#/$defs/Bom_Type","description":"The manifest kind. Determines which normalized type-extension (model/dataset/packages) may appear."},"format":{"type":"string","description":"Source manifest format the BOM was produced from or references. Examples: cyclonedx, cyclonedx-ml, spdx, spdx-ai, huggingface, croissant. Free-form so new formats need no schema change; the converter that emits the BOM owns the value."},"ref":{"type":"string","format":"uri-reference","description":"Passthrough by reference: URI (relative path, absolute URI, or fragment) to the native manifest document. Present for externally-hosted BOMs."},"document":{"type":"object","description":"Passthrough by embedding: the native manifest carried opaquely (e.g. a raw CycloneDX or SPDX object). HDF does not constrain its internal shape — full manifest validation is a tool-level concern."},"hashes":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"},"description":"Integrity of the carried BOM *document* itself (the referenced/embedded manifest file), NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model weights, dataset archive) is a component-level concern, not carried here. Subject identity is inherited from the host component/system; per-node identity lives in the type-extension."},"uniqueId":{"type":"string","description":"Optional stable identifier for this BOM document (e.g. CycloneDX serialNumber, SPDX documentNamespace). Correlates the same BOM across evidence packages."},"license":{"type":["string","null"],"description":"Optional license of the BOM document as a whole (SPDX license expression). Nullable and often meaningless (CBOM algorithms, many HBOM parts have no license); per-node licenses live in the type-extension, not here."},"model":{"$ref":"#/$defs/AI_Model_Extension","description":"Normalized ai-model extension. Permitted only when bomType is ai-model."},"dataset":{"$ref":"#/$defs/Dataset_Extension","description":"Normalized dataset extension. Permitted only when bomType is dataset."},"packages":{"type":"array","items":{"$ref":"#/$defs/SBOM_Package"},"description":"Normalized sbom extension: the flattened software package inventory. Permitted only when bomType is sbom."}},"allOf":[{"$comment":"Three-tier discipline: the ai-model extension may appear only on an ai-model BOM.","if":{"properties":{"bomType":{"const":"ai-model"}},"required":["bomType"]},"else":{"properties":{"model":false}}},{"$comment":"The dataset extension may appear only on a dataset BOM.","if":{"properties":{"bomType":{"const":"dataset"}},"required":["bomType"]},"else":{"properties":{"dataset":false}}},{"$comment":"The normalized packages extension may appear only on an sbom BOM.","if":{"properties":{"bomType":{"const":"sbom"}},"required":["bomType"]},"else":{"properties":{"packages":false}}},{"$comment":"A BOM must carry at least one of ref/document/packages/model/dataset. This intentionally checks PRESENCE, not non-emptiness: under the partial-fidelity design a converter MAY emit an empty normalized extension (e.g. model:{}) alongside a raw `document` passthrough when a source has no cleanly-mappable fields, so this constraint deliberately does not require minProperties/minItems on the extension. A bare {bomType, format} carrying none of these keys is unusable and invalid.","anyOf":[{"required":["ref"]},{"required":["document"]},{"required":["packages"]},{"required":["model"]},{"required":["dataset"]}]}],"examples":[{"$comment":"Passthrough SBOM by external reference — the universal escape hatch, available to every bomType.","bomType":"sbom","format":"cyclonedx","ref":"https://artifacts.agency.gov/sbom/webtier.cdx.json","hashes":[{"algorithm":"sha256","value":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}]},{"$comment":"Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships.","bomType":"cbom","format":"cyclonedx","document":{"bomFormat":"CycloneDX","specVersion":"1.6"}},{"$comment":"Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base.","bomType":"ai-model","format":"cyclonedx-ml","model":{"modelArchitecture":"transformer","parameterCount":6738415616,"serializationFormat":"safetensors","adaptationType":"finetune","baseModelRef":"meta-llama/Llama-2-7b-hf","learningApproach":"supervised","task":"text-generation","performanceMetrics":[{"name":"MMLU","value":"0.457"}],"hyperparameters":[{"name":"epochs","value":"3"},{"name":"learning-rate","value":"2e-5"}],"inputOutput":{"dataTypes":["string"],"modality":["text"],"contextLength":4096,"tokenizer":"llama-bpe"}}},{"$comment":"Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.","bomType":"dataset","format":"croissant","dataset":{"recordCount":2500000,"datasetFormat":"parquet","dataClassification":"public","intendedUse":"instruction fine-tuning","modality":"text","provenance":"Filtered from the public UltraChat corpus; low-quality and duplicate turns removed.","statisticalProperties":"Mean 512 tokens/record; 61% single-turn, 39% multi-turn; English-dominant (~92%).","baseDatasetRefs":["HuggingFaceH4/ultrachat_200k"],"derivation":"filtered"}}]},"AI_Model_Extension":{"type":"object","additionalProperties":true,"description":"Normalized AI-model fields, aligned to the CISA/G7 'SBOM for AI' minimum elements. All fields optional (standards-correct; only the EU AI Act makes a subset binding for high-risk/GPAI). Left open (additionalProperties: true) so a converter can carry unmapped native fields opaquely (partial-fidelity pattern). Subject name/version are inherited from the host aiModel component, not repeated here.","title":"AI Model BOM Extension","properties":{"modelArchitecture":{"type":"string","description":"Model architecture family. Examples: transformer, cnn, diffusion, mixture-of-experts."},"parameterCount":{"type":"integer","minimum":0,"description":"Total trainable parameter count. No native CycloneDX/SPDX field exists; first-class here because the EU AI Act keys GPAI obligations off model scale."},"serializationFormat":{"type":"string","description":"On-disk weight serialization format. Security-critical yet under-modeled by BOM specs: pickle/pytorch permits arbitrary code execution on load; safetensors does not. Examples: safetensors, pytorch, gguf, onnx, tensorflow."},"adaptationType":{"type":"string","title":"Model Adaptation Type","enum":["finetune","adapter","quantized","merge"],"description":"Lineage relationship to baseModelRef, adopting Hugging Face's base_model_relation vocabulary (the only typed lineage enum in the ecosystem)."},"baseModelRef":{"type":"string","description":"Reference to the base model this one was adapted from (e.g. a Hugging Face repo id or purl). Correlates the lineage edge; the base model itself may carry its own ai-model BOM."},"datasetRefs":{"type":"array","items":{"type":"string"},"description":"References to the training/evaluation datasets this model was produced from — preferably a dataset component's componentId (correlating to a first-class dataset subject rather than duplicating dataset detail, per ADR §10), or a dataset BOM uniqueId/URI when no component exists."},"intendedUse":{"type":"string","description":"Free-text statement of intended use and out-of-scope uses (CISA/G7 minimum element)."},"learningApproach":{"type":"string","description":"Model's learning/training paradigm. Free-text because the value set varies across standards. Examples: supervised, self-supervised, semi-supervised, reinforcement. Cross-standard intersection: SPDX 3.0 ai_typeOfModel ∩ CycloneDX modelParameters.approach.type ∩ CISA/G7 learning type."},"task":{"type":"string","description":"The ML task the model performs. Free-text. Examples: text-classification, sentiment-analysis, object-detection, translation. Sourced from CycloneDX modelParameters.task (SPDX 3.0 ai_domain is domain-level/adjacent, not the task); CISA/G7 intended-application."},"performanceMetrics":{"type":"array","items":{"type":"object","additionalProperties":true,"properties":{"name":{"type":"string","description":"Metric name. Examples: accuracy, f1, BLEU, latency."},"value":{"type":"string","description":"Reported metric value, free-text because metrics are heterogeneous (percentages, scores, milliseconds)."}}},"description":"Reported evaluation metrics as name/value pairs. Values are free-text because metrics are heterogeneous (accuracy, f1, BLEU, latency). The item stays open (additionalProperties: true) to carry native CycloneDX slice/confidenceInterval detail opaquely. Cross-standard intersection: SPDX 3.0 ai_metric ∩ CycloneDX quantitativeAnalysis.performanceMetrics ∩ CISA/G7 KPI cluster."},"hyperparameters":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Hyper-parameter name. Examples: epochs, learning-rate, batch-size."},"value":{"type":"string","description":"Hyper-parameter value (free-text)."}}},"description":"Training hyper-parameters as name/value pairs (epochs, learning-rate, batch-size). This is the set of training knobs, NOT the model's trainable parameterCount — the two are routinely conflated. CISA/G7 'Model properties: hyper-parameters'; SPDX 3.0 ai_hyperparameter."},"inputOutput":{"type":"object","additionalProperties":true,"description":"Model input/output properties (CISA/G7 minimum element): I/O data types, modality, context/sequence length, and tokenizer. Sourced from CycloneDX modelParameters.inputs[].format / outputs[].format. All sub-fields optional.","properties":{"dataTypes":{"type":"array","items":{"type":"string"},"description":"Input/output data types. Examples: string, byte[], float32, image."},"modality":{"type":["string","array"],"items":{"type":"string"},"description":"Input/output modalities. String or array of strings. Examples: text, image, audio. Symmetric with Dataset_Extension.modality."},"contextLength":{"type":"integer","minimum":0,"description":"Maximum context/sequence length the model accepts, in tokens."},"tokenizer":{"type":"string","description":"Tokenizer used for the model's input encoding. Examples: BPE, SentencePiece, tiktoken."}}}}},"Dataset_Extension":{"type":"object","additionalProperties":true,"description":"Normalized dataset fields (SPDX 3.0 Dataset profile / MLCommons Croissant aligned). All optional; open for partial-fidelity passthrough of unmapped native fields. Symmetric with AI_Model_Extension: carries the dataset's own lineage (baseDatasetRefs/derivation) just as the model extension carries baseModelRef/adaptationType.","title":"Dataset BOM Extension","properties":{"recordCount":{"type":"integer","minimum":0,"description":"Number of records/examples in the dataset."},"datasetFormat":{"type":"string","description":"Physical format of the dataset. Examples: parquet, csv, jsonl, tfrecord, webdataset."},"dataClassification":{"type":"string","description":"Sensitivity/classification of the data. Examples: public, internal, confidential, pii, phi."},"intendedUse":{"type":"string","description":"Free-text statement of the dataset's intended use (CISA/G7 minimum element)."},"modality":{"type":["string","array"],"items":{"type":"string"},"description":"Content modality/kind of the data (CISA/G7 'Dataset content: modality'). Examples: text, image, tabular, timeseries, audio. DISTINCT from datasetFormat, which is the physical encoding (parquet/csv). Resolves SPDX 3.0 dataset_datasetType, which is content-kind, not physical format. String or array of strings."},"provenance":{"type":"string","description":"Free-text description of the dataset's origin and collection process (CISA/G7 'Dataset provenance'; SPDX 3.0 dataset_dataCollectionProcess)."},"statisticalProperties":{"type":"string","description":"Free-text summary of the dataset's statistical properties (CISA/G7 minimum element; open-ended by design). Intentionally free-text and will remain so permanently: recordCount is the one structured statistic, and restructuring this into an object later would break existing consumers, so it stays a string (additive-only)."},"baseDatasetRefs":{"type":"array","items":{"type":"string"},"description":"References to the source dataset(s) this one was derived from — a dataset componentId, or a dataset BOM uniqueId/URI when no component exists. The lineage edge parallel to ai-model's baseModelRef; the base dataset may carry its own dataset BOM."},"derivation":{"type":"string","title":"Dataset Derivation Type","enum":["filtered","augmented","merged","sampled"],"description":"Relationship of this dataset to baseDatasetRefs, parallel to the model extension's adaptationType. Minimal + extensible: filtered (subset by rule), augmented (added/synthesized records), merged (union of sources), sampled (statistical draw)."}}},"SBOM_Package":{"type":"object","additionalProperties":true,"description":"A single normalized software package entry within an sbom BOM. Minimal identity + version for querying/diffing; the full native record remains available via passthrough (document/ref).","title":"SBOM Package","required":["name"],"properties":{"name":{"type":"string","description":"Package name."},"version":{"type":"string","description":"Package version."},"purl":{"type":"string","description":"Package URL (purl) — the preferred cross-BOM identity key when present."},"licenses":{"type":"array","items":{"type":"string"},"description":"SPDX license identifiers/expressions for this package."}}}}};
 export const commonSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0","title":"HDF Common Primitives","description":"Shared building blocks used by hdf-results and hdf-baseline schemas.","$defs":{"External_Reference":{"type":"object","title":"External Reference","description":"A generalized reference to any external artifact by identity and/or location, modeled on the STIX 2.1 `external_references` common property.\n\nPurpose-agnostic: cite a CVE, an ATT&CK technique, a STIX bundle/object, a BOM, a runbook, or any vendor artifact — including kinds with no dedicated HDF reference category.\n\n`sourceName` names the system; `externalId` cites by id within that system; `href` locates it. `sourceName` + `externalId` is equivalently a URN (`urn:<sourceName>:<externalId>`, RFC 8141), so the by-identity and by-location forms stay interconvertible.\n\nA reference is inert context: it overrides nothing, so it carries only lightweight optional `addedBy`/`addedAt` attribution, never override machinery.","required":["sourceName"],"anyOf":[{"required":["externalId"]},{"required":["href"]},{"required":["description"]}],"properties":{"sourceName":{"type":"string","minLength":1,"description":"Name of the external system/source being referenced (e.g., 'cve', 'mitre-att&ck', 'stix', 'taxii', or any vendor label). Open string — not a closed enum. Use the `x-` prefix convention for custom/experimental sources, mirroring `bomType`."},"externalId":{"type":"string","description":"Identifier of the artifact within `sourceName` (e.g., 'CVE-2021-44228' for source 'cve', 'T1059' for 'mitre-att&ck'). Cite by id without needing a URL. Together with `sourceName` this is a URN."},"href":{"type":"string","format":"uri-reference","description":"Location of the artifact. `uri-reference` (not `uri`) so a bare internal `#fragment`/`#uuid` reference is expressible alongside absolute URLs. `checksum`/`mediaType` apply only to a retrievable `href`."},"description":{"type":"string","description":"Human-readable description of what is referenced. Satisfies the at-least-one rule on its own when neither id nor href is available."},"rel":{"type":"string","description":"Open relationship token describing how this reference relates to the referencing object. Deliberately open (cf. OSCAL `rel` allow-other, RFC 8288 extension relations). Documented starter vocabulary: 'reference' (generic), 'definition' (defines the concept), 'evidence' (supporting evidence), 'investigate' (a live pivot to investigate), 'canonical' (the authoritative source)."},"mediaType":{"type":"string","description":"IANA media type of the referenced artifact when retrievable (RFC 6838), e.g., 'application/json'. Meaningful only with `href`."},"checksum":{"$ref":"#/$defs/Checksum","description":"Integrity hash of the referenced artifact. Reuses the HDF `Checksum` primitive (not STIX `hashes`). Meaningful only with a retrievable `href`."},"addedBy":{"$ref":"#/$defs/Identity","description":"Who attached this reference. Lightweight, flat attribution — a reference overrides nothing, so it has no chaining/superseding/disposition."},"addedAt":{"type":"string","format":"date-time","description":"When this reference was attached (RFC 3339 / trimmed-UTC per HDF timestamp convention)."},"kind":{"type":"string","minLength":1,"description":"Open token classifying the referenced/embedded payload, turning a bare reference into an enrichment envelope.\n\nDeliberately open (like `sourceName`/`rel`), not a closed enum.\n\nDocumented starter vocabulary: 'threat-intel' (STIX/CTI object), 'annotation' (human triage note), 'exploitation' (EPSS/KEV signal carried as context), 'advisory' (vendor/security advisory).\n\nUse the `x-` prefix for custom kinds."},"document":{"type":"object","additionalProperties":true,"description":"Optional lossless embedded copy of the referenced artifact — the raw STIX object, EPSS record, advisory, or annotation payload — preserved verbatim.\n\nComposes with `href`/`externalId` (which point at the artifact) and `checksum` (which ties the copy to the source): a single entry can both point and embed.\n\nHDF stays payload-agnostic — the content is carried untouched, never normalized into HDF fields — so this does not duplicate the source ontology (e.g. STIX rides here unchanged)."}},"unevaluatedProperties":false,"examples":[{"$comment":"By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228.","sourceName":"cve","externalId":"CVE-2021-44228","rel":"definition"},{"$comment":"By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL.","sourceName":"mitre-att&ck","externalId":"T1059","href":"https://attack.mitre.org/techniques/T1059/","rel":"canonical"},{"$comment":"By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution.","sourceName":"stix","href":"https://cti.example.org/bundles/log4shell.json","rel":"investigate","mediaType":"application/json","checksum":{"algorithm":"sha256","value":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},"addedBy":{"type":"email","identifier":"analyst@agency.gov"},"addedAt":"2026-07-26T00:00:00Z"},{"$comment":"Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.","sourceName":"stix","externalId":"vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001","href":"https://cti.example.org/bundles/log4shell.json#vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001","rel":"investigate","kind":"threat-intel","document":{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001","name":"CVE-2021-44228","external_references":[{"source_name":"cve","external_id":"CVE-2021-44228"}]}}]},"Hash_Algorithm":{"type":"string","enum":["sha256","sha384","sha512","blake3"],"description":"Supported cryptographic hash algorithms for checksums and integrity verification. blake3 covers container-image and other artifact digests that use it.","title":"Hash Algorithm"},"Requirement_Group":{"type":"object","unevaluatedProperties":false,"required":["id","requirements"],"properties":{"id":{"type":"string","description":"The unique identifier for the group. Example: the relative path to the file specifying the requirements."},"title":{"type":"string","description":"The title of the group - should be human readable."},"requirements":{"type":"array","items":{"type":"string"},"description":"The set of requirements as specified by their ids in this group. Example: 'SV-238196'."}},"description":"Describes a group of requirements, such as those defined in a single file.","title":"Requirement Group"},"Dependency":{"type":"object","unevaluatedProperties":false,"required":[],"properties":{"name":{"type":"string","description":"The name or assigned alias."},"url":{"type":"string","format":"uri-reference","description":"The address of the dependency."},"branch":{"type":"string","description":"The branch name for a git repo."},"path":{"type":"string","description":"The relative path if the dependency is locally available."},"statusMessage":{"type":"string","description":"The reason for the status if it is 'failed' or 'skipped'."},"status":{"type":"string","description":"The status. Should be: 'loaded', 'failed', or 'skipped'."},"git":{"type":"string","format":"uri","description":"The location of the git repo. Example: 'https://github.com/my-org/ubuntu-22.04-stig-baseline.git'."},"supermarket":{"type":"string","description":"The 'user/profilename' attribute for a Supermarket server."},"compliance":{"type":"string","description":"The 'user/profilename' attribute for an Automate server."}},"examples":[{"name":"ubuntu-22.04-baseline","url":"https://github.com/my-org/ubuntu-22.04-stig-baseline","git":"https://github.com/my-org/ubuntu-22.04-stig-baseline.git","branch":"main","status":"loaded"},{"name":"ssl-tls-baseline","path":"../shared-baselines/ssl-tls","status":"loaded"},{"name":"windows-2022-baseline","git":"https://github.com/security-org/windows-2022-stig.git","branch":"v1.2.0","status":"failed","statusMessage":"Unable to clone repository: authentication failed"},{"name":"chef-supermarket-baseline","supermarket":"dev-sec/linux-baseline","status":"loaded"}],"description":"A dependency for a baseline. Can include relative paths or URLs for where to find the dependency.","title":"Dependency"},"Reference":{"anyOf":[{"type":"object","required":["ref"],"properties":{"ref":{"anyOf":[{"type":"string","description":"A human readable/meaningful reference. Example: a book title."},{"type":"array","items":{"type":"object","additionalProperties":true},"description":"An array of reference objects."}]}},"description":"A reference using the 'ref' field."},{"type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri"}},"description":"A URL pointing at the reference."},{"type":"object","required":["uri"],"properties":{"uri":{"type":"string","format":"uri"}},"description":"A URI pointing at the reference."}],"description":"A reference to an external document.","title":"Reference"},"Source_Location":{"type":"object","unevaluatedProperties":false,"required":[],"properties":{"ref":{"type":"string","description":"Path to the file that this requirement originates from."},"line":{"type":"number","description":"The line on which this requirement is located."}},"examples":[{"ref":"controls/SV-260476.rb","line":1},{"ref":"profiles/ubuntu/controls/configure_audit.rb","line":42}],"description":"The explicit location of a requirement within source code.","title":"Source Location"},"Supported_Platform":{"type":"object","unevaluatedProperties":false,"required":[],"properties":{"platformFamily":{"type":"string","description":"The platform family. Example: 'redhat'."},"platformName":{"type":"string","description":"The platform name - can include wildcards. Example: 'debian'."},"platform":{"type":"string","description":"The location of the platform. Can be: 'os', 'aws', 'azure', or 'gcp'."},"release":{"type":"string","description":"The release of the platform. Example: '20.04' for 'ubuntu'."}},"description":"A supported platform target. Example: the platform name being 'ubuntu'.","title":"Supported Platform"},"Checksum":{"type":"object","unevaluatedProperties":false,"required":["algorithm","value"],"properties":{"algorithm":{"$ref":"#/$defs/Hash_Algorithm","description":"The hash algorithm used for the checksum."},"value":{"type":"string","description":"The checksum value."}},"examples":[{"algorithm":"sha256","value":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},{"algorithm":"sha512","value":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"}],"description":"Cryptographic checksum for baseline integrity verification.","title":"Checksum"},"Identity":{"type":"object","unevaluatedProperties":false,"required":["identifier","type"],"properties":{"identifier":{"type":"string","description":"The identifier value. Example: 'user@example.com', 'jdoe', 'automated-scanner-01'."},"type":{"type":"string","title":"Identity Type","enum":["email","username","system","agent","simple","other"],"description":"The type of identifier.\n\nUse 'email' for email addresses, 'username' for user accounts, 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent' for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF, 'simple' for basic string identifiers without additional classification, or 'other' for custom identity systems."},"description":{"type":"string","description":"Optional description of the identity or identity system, particularly useful when type is 'other'."}},"examples":[{"type":"email","identifier":"admin@example.com"},{"type":"username","identifier":"jdoe","description":"Security Operations Analyst"},{"type":"system","identifier":"automated-scanner-01","description":"Nightly compliance scan pipeline"},{"type":"agent","identifier":"cve-enrichment-bot/v0.4.2","description":"OpenAI GPT-4 via internal CVE-enrichment tool; proposes environmental CVSS for human review"}],"description":"Represents an identity that performed an action, such as capturing evidence or applying an override.","title":"Identity"},"Evidence":{"type":"object","unevaluatedProperties":false,"required":["type","data"],"properties":{"type":{"type":"string","title":"Evidence Type","enum":["screenshot","code","log","url","file","other"],"description":"The type of evidence being provided."},"data":{"type":"string","description":"The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string."},"description":{"type":"string","description":"Human-readable description of what this evidence shows."},"mimeType":{"type":"string","description":"MIME type of the evidence. Example: 'image/png', 'text/plain', 'application/json'."},"encoding":{"type":"string","description":"Encoding used for the data. Example: 'base64', 'utf-8'."},"size":{"type":"number","description":"Size of the evidence data in bytes."},"capturedAt":{"type":"string","format":"date-time","description":"Timestamp when this evidence was captured. ISO 8601 format."},"capturedBy":{"$ref":"#/$defs/Identity","description":"Identity of who or what captured this evidence."}},"examples":[{"type":"screenshot","data":"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==","description":"Screenshot showing firewall configuration with required ports blocked","mimeType":"image/png","encoding":"base64","size":95,"capturedAt":"2025-12-14T10:30:00Z","capturedBy":{"identifier":"security-auditor@example.com","type":"email"}},{"type":"code","data":"# Nginx configuration\nserver {\n  listen 443 ssl;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_ciphers HIGH:!aNULL:!MD5;\n}","description":"Server configuration showing TLS 1.2+ enforcement","mimeType":"text/plain","capturedAt":"2025-12-14T10:45:00Z"},{"type":"log","data":"[2025-12-14 10:00:15] INFO: Security scan completed - 0 critical vulnerabilities found\n[2025-12-14 10:00:16] INFO: All required security patches applied\n[2025-12-14 10:00:17] INFO: System compliant with security baseline","description":"Security scan log output","mimeType":"text/plain","size":256},{"type":"url","data":"https://jira.example.com/browse/SEC-12345","description":"Link to security ticket documenting remediation work","capturedAt":"2025-12-14T11:00:00Z"},{"type":"file","data":"UEsDBBQAAAAIAI1ZX1YhQp8FHgAAABIAAAAIAAAAdGVzdC50eHRLy8nPS8lQSgIAUmNEBhQAAAA=","description":"Compliance audit report PDF","mimeType":"application/pdf","encoding":"base64","size":2048,"capturedAt":"2025-12-14T12:00:00Z","capturedBy":{"identifier":"compliance-system","type":"system"}}],"description":"Supporting evidence for a finding or override, such as screenshots, code samples, log excerpts, or URLs.","title":"Evidence"},"Remediation":{"type":"object","unevaluatedProperties":false,"required":["uri"],"properties":{"uri":{"type":"string","format":"uri","description":"URI pointing to automated remediation resources (Ansible playbooks, Terraform scripts, etc.). Examples: GitHub repository, DISA STIG Supplemental Automation Content, vendor-provided scripts."},"checksum":{"$ref":"#/$defs/Checksum","description":"Optional cryptographic checksum for verifying the integrity of remediation resources fetched from the URI. Recommended for security when referencing external automation scripts."}},"examples":[{"uri":"https://github.com/ansible-lockdown/RHEL9-STIG/tree/main/tasks"},{"uri":"https://artifacts.example.com/remediation/ubuntu-22.04-hardening-v1.2.tar.gz","checksum":{"algorithm":"sha256","value":"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"}}],"description":"Reference to automated remediation resources for implementing security controls. Points to external automation content like Ansible playbooks, Terraform scripts, or vendor-provided remediation tools.","title":"Remediation"},"Verification_Method":{"type":"object","unevaluatedProperties":false,"required":["type","controller"],"properties":{"type":{"type":"string","description":"The type of verification method. Example: 'JsonWebKey2020', 'RsaVerificationKey2018', 'Ed25519VerificationKey2020'."},"controller":{"type":"string","description":"The entity that controls this verification method. Can be a DID, URI, or other identifier."},"publicKeyJwk":{"type":"object","additionalProperties":true,"description":"Public key in JSON Web Key format."},"publicKeyPem":{"type":"string","description":"Public key in PEM format. Example: '-----BEGIN PUBLIC KEY-----...-----END PUBLIC KEY-----'."},"publicKeyBase58":{"type":"string","description":"Public key in Base58 format, commonly used with Ed25519 keys."}},"description":"Verification method containing the public key needed to verify a digital signature. Supports multiple key formats including JWK (for RSA, EC), PEM, and Base58.","title":"Verification Method"},"Milestone":{"type":"object","unevaluatedProperties":false,"required":["description","estimatedCompletion","status"],"properties":{"description":{"type":"string","description":"Description of this milestone or task."},"estimatedCompletion":{"type":"string","format":"date-time","description":"Estimated completion date. ISO 8601 format."},"status":{"type":"string","title":"Milestone Status","enum":["pending","inProgress","completed"],"description":"Current status of this milestone."},"completedAt":{"type":"string","format":"date-time","description":"Actual completion timestamp. ISO 8601 format."},"completedBy":{"$ref":"#/$defs/Identity","description":"Identity of who completed this milestone."}},"description":"A milestone or task within a POA&M remediation plan.","title":"Milestone"},"Signature":{"type":"object","unevaluatedProperties":false,"required":["type","created","creator","signatureValue","proofPurpose","verificationMethod"],"properties":{"type":{"type":"string","description":"The signature suite type. Example: 'JsonWebSignature2020', 'RsaSignature2018', 'Ed25519Signature2020'."},"created":{"type":"string","format":"date-time","description":"When the signature was created. ISO 8601 format."},"creator":{"$ref":"#/$defs/Identity","description":"The identity that created this signature."},"signatureValue":{"type":"string","description":"The base64-encoded or base58-encoded signature value."},"proofPurpose":{"type":"string","description":"The purpose of this signature. Example: 'attestation', 'authentication', 'assertionMethod'."},"verificationMethod":{"$ref":"#/$defs/Verification_Method","description":"The verification method containing the public key for signature verification."},"nonce":{"type":"string","description":"Random value to prevent replay attacks."},"challenge":{"type":"string","description":"Challenge value from the verifier, used in challenge-response authentication."},"domain":{"type":"string","description":"Domain restriction for the signature, prevents cross-domain replay attacks."}},"examples":[{"type":"JsonWebSignature2020","created":"2025-12-14T10:00:00Z","creator":{"identifier":"security-team@example.com","type":"email"},"signatureValue":"eyJhbGciOiJSUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..MEYCIQDvKbtLRhWAa","proofPurpose":"attestation","verificationMethod":{"type":"JsonWebKey2020","controller":"did:example:123456789abcdefghi","publicKeyJwk":{"kty":"RSA","n":"0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtV","e":"AQAB"}}},{"type":"RsaSignature2018","created":"2025-12-14T11:30:00Z","creator":{"identifier":"ciso@example.com","type":"email"},"signatureValue":"pY9...Cg==","proofPurpose":"authentication","verificationMethod":{"type":"RsaVerificationKey2018","controller":"https://example.com/issuers/565049","publicKeyPem":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryQICCl6NZ5gDKrnSztO\n-----END PUBLIC KEY-----"},"nonce":"c0ae1c8e-c7e7-469f-b252-86e6a0e7387e"},{"type":"Ed25519Signature2020","created":"2025-12-14T14:00:00Z","creator":{"identifier":"automated-signer","type":"system","description":"Hardware security module (HSM) for automated attestations"},"signatureValue":"z58DAdFfa9SkqZMVMxABEBC59Ck6WibLZ","proofPurpose":"assertionMethod","verificationMethod":{"type":"Ed25519VerificationKey2020","controller":"did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK","publicKeyBase58":"H3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"},"challenge":"1f44d2f3-d16c-47a4-9f5f-1d6e8f4e3a2b","domain":"https://compliance.example.com"}],"description":"A digital signature following W3C Data Integrity Proofs pattern. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other cryptographic signing methods via JWK, PEM, or Base58 key formats.","title":"Signature"},"Baseline_Metadata":{"type":"object","properties":{"externalReferences":{"type":"array","items":{"$ref":"#/$defs/External_Reference"},"description":"Optional references to external artifacts relevant to this baseline (CTI/STIX, advisories, source catalogs, or any URI-addressable artifact). Travels with the baseline definition. Inert context; see External_Reference."},"name":{"type":"string","description":"The name - must be unique."},"title":{"type":"string","description":"The title - should be human readable."},"maintainer":{"type":"string","description":"The maintainer(s)."},"copyright":{"type":"string","description":"The copyright holder(s)."},"copyrightEmail":{"type":"string","description":"The email address or other contact information of the copyright holder(s)."},"license":{"type":"string","description":"The copyright license. Example: 'Apache-2.0'."},"summary":{"type":"string","description":"The summary. Example: the Security Technical Implementation Guide (STIG) header."},"version":{"type":"string","description":"The version of the baseline."},"supports":{"type":"array","items":{"$ref":"#/$defs/Supported_Platform"},"description":"The set of supported platform targets."},"status":{"type":"string","description":"The status. Example: 'loaded'."},"labels":{"type":"object","additionalProperties":{"type":"string"},"description":"Optional key-value labels for flexible grouping. Well-known keys: system, component, environment, region, team. Values must be strings."}},"examples":[{"name":"rhel-9-stig-baseline","title":"Red Hat Enterprise Linux 9 STIG Baseline","maintainer":"MITRE SAF Team","copyright":"The MITRE Corporation","copyrightEmail":"saf@mitre.org","license":"Apache-2.0","summary":"InSpec baseline for RHEL 9 STIG compliance","version":"1.0.0","supports":[{"platformName":"redhat","platformFamily":"redhat","release":"9"}],"status":"loaded"}],"description":"Shared metadata fields for baselines. Used in both standalone baseline documents and evaluated baseline results.","title":"Baseline Metadata"},"Requirement_Core":{"type":"object","properties":{"externalReferences":{"type":"array","items":{"$ref":"#/$defs/External_Reference"},"description":"Optional references to external artifacts relevant to this requirement (CTI/STIX correlation, advisories, control/definition sources, or any URI-addressable artifact). Applies to both baseline requirement definitions and evaluated requirements. Inert context; see External_Reference."},"id":{"type":"string","description":"The requirement identifier. Example: 'SV-238196'."},"title":{"type":"string","description":"The title - is nullable."},"descriptions":{"type":"array","minItems":1,"items":{"type":"object","unevaluatedProperties":false,"required":["label","data"],"properties":{"label":{"type":"string","description":"Description category. The 'default' label is required for the primary description. Common labels: 'default', 'check', 'fix', 'rationale'. Tools may use custom labels."},"data":{"type":"string","description":"The description text content."}}},"description":"Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."},"impact":{"type":"number","minimum":0,"maximum":1,"description":"The impactfulness or severity (0.0 to 1.0)."},"refs":{"type":"array","items":{"$ref":"#/$defs/Reference"},"description":"The set of references to external documents."},"tags":{"type":"object","additionalProperties":true,"description":"A set of tags - usually metadata like CCI, STIG ID, severity."},"code":{"type":"string","description":"The raw source code of the requirement. Set to null for manual-only requirements or requirements not yet implemented; use verificationMethod to disambiguate manual-by-design from manual-pending-automation. Note that if this is an overlay, it does not include the underlying source code."},"sourceLocation":{"$ref":"#/$defs/Source_Location","description":"The explicit location of the requirement within the source code."},"controlType":{"type":"string","title":"Control Type","enum":["policy","procedure","technical","management","operational"],"description":"Classification of the control's nature, aligning with NIST SP 800-53 / SP 800-53A categories.\n\n'policy' = an authored governance statement; 'procedure' = a documented process; 'technical' = an enforced technical configuration; 'management' = a programmatic/management activity; 'operational' = a recurring operational activity (e.g. AT, IR, MA families).\n\nOptional: when omitted, consumers may infer heuristically from family/id but should not assume a default."},"verificationMethod":{"$ref":"#/$defs/Verification_Method_Enum","description":"How this requirement is intended to be verified.\n\nDisambiguates the two cases that null 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule lacking a fix).\n\n'automated' = a check exists and runs without operator action; 'hybrid' = part automated, part manual.\n\nOptional: when omitted, consumers should not infer a default."},"applicability":{"type":"string","title":"Applicability","enum":["required","optional","advisory"],"description":"Whether the requirement is mandatory within its baseline.\n\nDistinct from severity (risk weight) and status (lifecycle state).\n\nMaps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).\n\nOptional: when omitted, consumers should treat the requirement as 'required' by convention."}},"examples":[{"$comment":"v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.5.0 (backward compatibility).","id":"SV-238196","title":"The Ubuntu operating system must enforce password complexity","impact":0.5,"tags":{"nist":["IA-5"],"severity":"medium","cci":["CCI-000192"]},"refs":[{"url":"https://public.cyber.mil/stigs/"}],"descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password."},{"label":"check","data":"Verify the value of 'minlen' in /etc/security/pwquality.conf."}]},{"$comment":"v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline.","id":"AC-3","title":"Access Enforcement","impact":0.7,"tags":{"nist":["AC-3"],"severity":"high"},"descriptions":[{"label":"default","data":"The information system enforces approved authorizations for logical access to information and system resources."}],"code":"control 'AC-3' do; impact 0.7; end","controlType":"technical","verificationMethod":"automated","applicability":"required"},{"$comment":"v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement.","id":"KSI-CNA-01","title":"Cyber Security Plan documents the system","impact":0.5,"tags":{"ksi":["KSI-CNA"]},"descriptions":[{"label":"default","data":"The Cyber Security Plan documents the system, its boundary, and its components."}],"controlType":"policy","verificationMethod":"manual-by-design","applicability":"required"},{"$comment":"v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.","id":"SV-999999","title":"Example STIG rule pending automation","impact":0.3,"tags":{"stig_id":"SV-999999"},"descriptions":[{"label":"default","data":"Example requirement that is intended to be automated but currently lacks a fix block."},{"label":"check","data":"Manual review of system configuration is required."}],"verificationMethod":"manual-pending-automation","applicability":"advisory"}],"description":"Core requirement fields shared between baseline requirements and evaluated requirements. Contains the fundamental requirement definition without assessment results.","title":"Requirement Core"},"Verification_Method_Enum":{"type":"string","enum":["automated","manual-by-design","manual-pending-automation","hybrid"],"description":"How a requirement is intended to be verified.\n\nDisambiguates the two cases that null 'code' overloads: 'manual-by-design' (the requirement is statement-form and not amenable to automation, e.g. FedRAMP 20x KSIs); 'manual-pending-automation' (automation could exist but does not yet, e.g. a STIG rule lacking a fix).\n\n'automated' = a check exists and runs without operator action; 'hybrid' = part automated, part manual.\n\nNamed '_Enum' to disambiguate from the unrelated Verification_Method DID-context struct.","title":"Verification Method Enum"},"Severity":{"type":"string","enum":["critical","high","medium","low","informational"],"description":"Severity rating for a requirement. Typically derived from the numeric impact score.","title":"Severity"},"Cloud_Provider":{"type":["string","null"],"enum":["aws","azure","gcp","oci","other",null],"description":"Cloud service provider identifier.","title":"Cloud Provider"}}};
 export const comparisonSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0","title":"HDF Comparison Primitives","description":"Types for representing structured comparisons between HDF security assessment documents.","$defs":{"Requirement_State":{"type":"string","enum":["new","absent","unchanged","updated","fixed","regressed","moved","split","merged"],"description":"SARIF-compatible vocabulary extended for security. 'new' = present only in new source, 'absent' = present only in old, 'unchanged' = same effective status, 'updated' = status changed (generic), 'fixed' = was failing now passing, 'regressed' = was passing now failing, 'moved' = reorganized same content, 'split'/'merged' = reserved for v1.1.","title":"Requirement State"},"Change_Reason":{"type":"string","enum":["resultChanged","overrideAdded","overrideExpired","overrideRemoved","overrideModified","impactChanged","dispositionChanged","effectiveImpactChanged","baselineUpgraded","controlMapped","scannerChanged","targetChanged","configChanged","metadataChanged"],"description":"The reason a requirement's state changed between sources. 'dispositionChanged' = the governing override type differs between the sources (e.g. a waiver replaced a riskAdjustment); 'effectiveImpactChanged' = the post-override impact score differs while the base impact may be unchanged.","title":"Change Reason"},"Comparison_Mode":{"type":"string","enum":["temporal","baseline","fleet","multiSource","baselineEvolution","systemDrift"],"description":"The mode of comparison. 'temporal' compares the same target over time. 'baseline' compares against a golden reference. 'fleet' compares across multiple systems. 'multiSource' compares outputs from different scanners. 'baselineEvolution' compares two baseline documents to detect requirement changes between versions. 'systemDrift' compares two system documents to detect component-level changes.","title":"Comparison Mode"},"Source_Role":{"type":"string","enum":["old","new","golden","reference","system"],"description":"The role of a source document in the comparison.","title":"Source Role"},"Original_Format":{"type":"string","enum":["hdf-v2","inspec-v1","sarif","oscal-ar","xccdf"],"description":"The original format of the source document before conversion to HDF.","title":"Original Format"},"Match_Strategy":{"type":"string","enum":["exactId","mappedId","cciMatch","nistMatch","fuzzyTitle","fuzzyContent"],"description":"The strategy used to match requirements across sources. 'exactId' matches by identical IDs. 'mappedId' uses an ID mapping table. 'cciMatch'/'nistMatch' match by framework identifiers. 'fuzzyTitle'/'fuzzyContent' use text similarity.","title":"Match Strategy"},"Conflict_Resolution":{"type":"string","enum":["mostSevere","mostRecent","manual","unresolved"],"description":"How a conflict between multiple scanner results was resolved.","title":"Conflict Resolution"},"Annotation_Category":{"type":"string","enum":["remediation","drift","waiver","baselineChange","scannerNote"],"description":"The category of an annotation attached to a comparison.","title":"Annotation Category"},"Field_Change":{"type":"object","unevaluatedProperties":false,"required":["op","path"],"properties":{"op":{"type":"string","title":"Op","enum":["add","remove","replace"],"description":"The type of change operation."},"path":{"type":"string","description":"JSON Pointer path to the changed field."},"oldValue":{"description":"The previous value of the field (for 'remove' and 'replace' operations)."},"newValue":{"description":"The new value of the field (for 'add' and 'replace' operations)."}},"description":"A single field-level change between two versions of a requirement.","title":"Field Change"},"Source":{"type":"object","unevaluatedProperties":false,"required":["role","label"],"properties":{"role":{"$ref":"#/$defs/Source_Role","description":"The role of this source in the comparison."},"label":{"type":"string","description":"Human-readable label for this source. Example: 'Before remediation scan'."},"uri":{"type":"string","format":"uri","description":"URI pointing to the source document."},"originalFormat":{"$ref":"#/$defs/Original_Format","description":"The original format of the source document before conversion to HDF."},"checksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"Cryptographic checksum of the source document for integrity verification."},"assessmentTimestamp":{"type":"string","format":"date-time","description":"When the source assessment was performed. ISO 8601 format."},"tool":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool","description":"The security tool that produced the assessment data in this source."},"components":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"},"description":"The components assessed in this source."},"baselineRef":{"type":"object","unevaluatedProperties":false,"required":["name"],"properties":{"name":{"type":"string","description":"Name of the baseline used in this source."},"version":{"type":"string","description":"Version of the baseline used in this source."}},"description":"Reference to the baseline used in this source assessment."}},"description":"A source document participating in the comparison.","title":"Source"},"Matching_Config":{"type":"object","unevaluatedProperties":false,"required":["primaryStrategy"],"properties":{"primaryStrategy":{"$ref":"#/$defs/Match_Strategy","description":"The primary strategy used to match requirements across sources."},"fallbackStrategies":{"type":"array","items":{"$ref":"#/$defs/Match_Strategy"},"description":"Ordered list of fallback strategies tried when the primary strategy fails to find a match."},"minimumConfidence":{"type":"number","minimum":0,"maximum":1,"description":"Minimum confidence score (0-1) required to accept a match."},"mappingTableUri":{"type":"string","format":"uri","description":"URI pointing to an external mapping table used for ID translation."},"fingerprintFields":{"type":"array","items":{"type":"string"},"description":"Fields used to compute a fingerprint for fuzzy matching."}},"description":"Configuration for how requirements are matched across sources.","title":"Matching Config"},"State_Counts":{"type":"object","unevaluatedProperties":false,"properties":{"fixed":{"type":"integer","minimum":0,"description":"Number of requirements that changed from failing to passing."},"regressed":{"type":"integer","minimum":0,"description":"Number of requirements that changed from passing to failing."},"new":{"type":"integer","minimum":0,"description":"Number of requirements present only in the new source."},"absent":{"type":"integer","minimum":0,"description":"Number of requirements present only in the old source."},"unchanged":{"type":"integer","minimum":0,"description":"Number of requirements with the same effective status."},"updated":{"type":"integer","minimum":0,"description":"Number of requirements with a generic status change."},"moved":{"type":"integer","minimum":0,"description":"Number of requirements that were reorganized without content change."}},"description":"Counts of requirements in each state.","title":"State Counts"},"Severity_Breakdown":{"type":"object","unevaluatedProperties":false,"properties":{"critical":{"$ref":"#/$defs/State_Counts","description":"State counts for critical severity requirements."},"high":{"$ref":"#/$defs/State_Counts","description":"State counts for high severity requirements."},"medium":{"$ref":"#/$defs/State_Counts","description":"State counts for medium severity requirements."},"low":{"$ref":"#/$defs/State_Counts","description":"State counts for low severity requirements."}},"description":"Breakdown of state counts by severity level.","title":"Severity Breakdown"},"Per_Source_Summary":{"type":"object","unevaluatedProperties":false,"required":["sourceIndex","label"],"properties":{"sourceIndex":{"type":"integer","minimum":0,"description":"Zero-based index into the sources array identifying which source this summary is for."},"label":{"type":"string","description":"Human-readable label for this source."},"fixed":{"type":"integer","minimum":0,"description":"Number of requirements that changed from failing to passing."},"regressed":{"type":"integer","minimum":0,"description":"Number of requirements that changed from passing to failing."},"new":{"type":"integer","minimum":0,"description":"Number of requirements present only in the new source."},"absent":{"type":"integer","minimum":0,"description":"Number of requirements present only in the old source."},"unchanged":{"type":"integer","minimum":0,"description":"Number of requirements with the same effective status."},"updated":{"type":"integer","minimum":0,"description":"Number of requirements with a generic status change."},"moved":{"type":"integer","minimum":0,"description":"Number of requirements that were reorganized without content change."}},"description":"Summary statistics for a single source in a multi-source comparison.","title":"Per Source Summary"},"Comparison_Summary":{"type":"object","unevaluatedProperties":false,"required":["total","matchedCount","unmatchedOldCount","unmatchedNewCount"],"properties":{"total":{"type":"integer","minimum":0,"description":"Total number of unique requirements across all sources."},"matchedCount":{"type":"integer","minimum":0,"description":"Number of requirements successfully matched between sources."},"unmatchedOldCount":{"type":"integer","minimum":0,"description":"Number of requirements in the old source with no match in the new source."},"unmatchedNewCount":{"type":"integer","minimum":0,"description":"Number of requirements in the new source with no match in the old source."},"new":{"type":"integer","minimum":0,"description":"Number of requirements present only in the new source."},"absent":{"type":"integer","minimum":0,"description":"Number of requirements present only in the old source."},"unchanged":{"type":"integer","minimum":0,"description":"Number of requirements with the same effective status."},"updated":{"type":"integer","minimum":0,"description":"Number of requirements with a generic status change."},"fixed":{"type":"integer","minimum":0,"description":"Number of requirements that changed from failing to passing."},"regressed":{"type":"integer","minimum":0,"description":"Number of requirements that changed from passing to failing."},"moved":{"type":"integer","minimum":0,"description":"Number of requirements that were reorganized without content change."},"oldCompliancePercent":{"type":"number","description":"Compliance percentage of the old source (0-100)."},"newCompliancePercent":{"type":"number","description":"Compliance percentage of the new source (0-100)."},"complianceDelta":{"type":"number","description":"Change in compliance percentage (new - old)."},"averageMatchConfidence":{"type":"number","minimum":0,"maximum":1,"description":"Average confidence score across all requirement matches (0-1)."},"bySeverity":{"$ref":"#/$defs/Severity_Breakdown","description":"State counts broken down by severity level."},"perSource":{"type":"array","items":{"$ref":"#/$defs/Per_Source_Summary"},"description":"Summary statistics for each individual source in a multi-source comparison."}},"description":"Summary statistics for the overall comparison.","title":"Comparison Summary"},"Baseline_Diff":{"type":"object","unevaluatedProperties":false,"required":["name","state"],"properties":{"name":{"type":"string","description":"Name of the baseline being compared."},"state":{"type":"string","title":"Baseline Diff State","enum":["new","absent","unchanged","updated"],"description":"The state of this baseline in the comparison."},"oldVersion":{"type":"string","description":"Version of the baseline in the old source."},"newVersion":{"type":"string","description":"Version of the baseline in the new source."},"mappingSource":{"type":"string","description":"The source of any ID mapping used to correlate requirements across baseline versions."}},"description":"Comparison of a baseline between sources.","title":"Baseline Diff"},"Component_Diff":{"type":"object","unevaluatedProperties":false,"required":["name","state"],"properties":{"name":{"type":"string","description":"Component name used for matching across system versions."},"state":{"type":"string","title":"Baseline Diff State","enum":["new","absent","unchanged","updated"],"description":"The state of this component in the comparison."},"before":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"},{"type":"null"}],"description":"Component snapshot from the old system document. Null when state is 'new'."},"after":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"},{"type":"null"}],"description":"Component snapshot from the new system document. Null when state is 'absent'."},"fieldChanges":{"type":"array","items":{"$ref":"#/$defs/Field_Change"},"description":"Detailed field-level changes between the before and after component snapshots."}},"description":"Comparison of a single component between two system document versions.","title":"Component Diff"},"Package_Diff":{"type":"object","unevaluatedProperties":false,"required":["state"],"anyOf":[{"required":["purl"]},{"required":["identifier"]}],"properties":{"purl":{"type":"string","description":"Package URL (purl) — the preferred identity key for matching software packages across BOMs. Optional: BOM nodes without a purl (AI models, datasets, hardware parts, crypto algorithms) key on identifier instead."},"identifier":{"type":"string","description":"Generic identity key for matching a BOM node across versions when no purl applies — e.g. a Hugging Face model ref, dataset uniqueId, crypto algorithm OID, or hardware part number. At least one of purl or identifier is required."},"name":{"type":"string","description":"Human-readable node name."},"state":{"type":"string","title":"Package Diff State","enum":["added","removed","updated","unchanged"],"description":"The state of this package: added (new in new SBOM), removed (absent from new SBOM), updated (version changed), unchanged."},"oldVersion":{"type":"string","description":"Package version in the old SBOM."},"newVersion":{"type":"string","description":"Package version in the new SBOM."},"licenses":{"type":"array","items":{"type":"string"},"description":"License identifiers for this package."}},"examples":[{"$comment":"Software package diff keyed by purl (the SBOM case).","purl":"pkg:npm/express@4.18.2","name":"express","state":"updated","oldVersion":"4.18.1","newVersion":"4.18.2"},{"$comment":"AI-model node diff keyed by identifier when no purl applies.","identifier":"acme/llama-2-7b-chat-support","name":"Llama-2-7b-chat (finetuned)","state":"added","newVersion":"1.2.0"}],"description":"Comparison of a single BOM node between two BOM versions, matched by purl (software) or identifier (models, datasets, hardware, crypto).","title":"Package Diff"},"Scanner_Conflict":{"type":"object","unevaluatedProperties":false,"required":["field","values"],"properties":{"field":{"type":"string","description":"The field where the conflict occurs."},"values":{"type":"array","items":{"type":"object","unevaluatedProperties":false,"required":["sourceIndex","sourceLabel","value"],"properties":{"sourceIndex":{"type":"integer","minimum":0,"description":"Zero-based index into the sources array."},"sourceLabel":{"type":"string","description":"Human-readable label for the source."},"value":{"description":"The value reported by this source for the conflicting field."}}},"description":"The conflicting values from each source."},"resolvedIndex":{"type":"integer","minimum":0,"description":"Index of the source whose value was chosen as the resolution."},"resolution":{"$ref":"#/$defs/Conflict_Resolution","description":"How the conflict was resolved."}},"description":"A conflict between scanner results for the same requirement.","title":"Scanner Conflict"},"Annotation":{"type":"object","unevaluatedProperties":false,"required":["label"],"properties":{"label":{"type":"string","description":"Human-readable label for this annotation."},"description":{"type":"string","description":"Detailed description of the annotation."},"category":{"$ref":"#/$defs/Annotation_Category","description":"The category of this annotation."},"needsConfirmation":{"type":"boolean","description":"Whether this annotation requires human confirmation before acting on it."}},"description":"An annotation attached to a comparison, providing context or action items.","title":"Annotation"},"Requirement_Diff":{"type":"object","unevaluatedProperties":false,"required":["id","state","changeReasons","before","after","fieldChanges"],"properties":{"id":{"type":"string","description":"The canonical requirement identifier used for this diff."},"state":{"$ref":"#/$defs/Requirement_State","description":"The state of this requirement in the comparison."},"changeReasons":{"type":"array","items":{"$ref":"#/$defs/Change_Reason"},"description":"The reasons for the state change."},"before":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"},{"type":"null"}],"description":"The requirement as it appeared in the old/reference source. Null when state is 'new'."},"after":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"},{"type":"null"}],"description":"The requirement as it appeared in the new source. Null when state is 'absent'."},"fieldChanges":{"type":"array","items":{"$ref":"#/$defs/Field_Change"},"description":"Detailed field-level changes between the before and after versions."},"oldId":{"type":"string","description":"The requirement ID in the old source, if different from the canonical id."},"newId":{"type":"string","description":"The requirement ID in the new source, if different from the canonical id."},"title":{"type":"string","description":"The requirement title for human readability."},"oldEffectiveStatus":{"type":"string","description":"The effective status of the requirement in the old source."},"newEffectiveStatus":{"type":"string","description":"The effective status of the requirement in the new source."},"oldImpact":{"type":"number","minimum":0,"maximum":1,"description":"The impact score of the requirement in the old source (0-1)."},"newImpact":{"type":"number","minimum":0,"maximum":1,"description":"The impact score of the requirement in the new source (0-1)."},"matchStrategy":{"$ref":"#/$defs/Match_Strategy","description":"The strategy that was used to match this requirement across sources."},"matchConfidence":{"type":"number","minimum":0,"maximum":1,"description":"Confidence score for the match (0-1)."},"matchManual":{"type":"boolean","description":"Whether the match was manually confirmed by a human."},"annotationIds":{"type":"array","items":{"type":"string"},"description":"IDs of annotations attached to this requirement diff."},"sourceIndex":{"type":"integer","minimum":0,"description":"Index into the sources array for multi-source comparisons."},"conflicts":{"type":"array","items":{"$ref":"#/$defs/Scanner_Conflict"},"description":"Conflicts between multiple scanner results for this requirement."},"beforeSensitive":{"type":"object","additionalProperties":true,"description":"Sensitive data from the old source that should not be included in the main before snapshot."},"afterSensitive":{"type":"object","additionalProperties":true,"description":"Sensitive data from the new source that should not be included in the main after snapshot."}},"description":"A comparison of a single requirement between sources, including state, changes, and full before/after snapshots.","title":"Requirement Diff"}}};
@@ -24,7 +24,7 @@ export const cvssSchema = {"$schema":"https://json-schema.org/draft/2020-12/sche
 export const dataFlowSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/data-flow/v3.5.0","title":"HDF Data Flow Primitives","description":"Types for describing data flows between components within a system and across system boundaries. Data flows model network connections, API calls, database queries, and other inter-component communication.","$defs":{"Cross_System_Reference":{"type":"object","unevaluatedProperties":false,"required":["systemRef","componentId"],"properties":{"systemRef":{"type":"string","format":"uri-reference","description":"URI reference to the hdf-system document containing the target component. May be a relative path, absolute URI, or fragment identifier."},"componentId":{"type":"string","format":"uuid","description":"UUID of the component in the referenced system."}},"description":"Reference to a component in a different system document, enabling cross-boundary data flow modeling.","title":"Cross-System Reference"},"External_Endpoint":{"type":"object","unevaluatedProperties":false,"required":["external","description"],"properties":{"external":{"type":"boolean","const":true,"description":"Must be true. Discriminator indicating this endpoint is outside all modeled systems."},"description":{"type":"string","description":"Human-readable description of the external endpoint. Example: 'Third-party payment gateway (Stripe API)'."}},"description":"An endpoint outside all modeled systems (e.g., a third-party API, public internet, or partner system not represented in HDF).","title":"External Endpoint"},"Data_Flow_Endpoint":{"description":"A data flow endpoint: either a local component (UUID), a component in another system (cross-system reference), or an external endpoint outside all modeled systems.","title":"Data Flow Endpoint","oneOf":[{"type":"string","format":"uuid","description":"UUID of a component in the current system."},{"$ref":"#/$defs/Cross_System_Reference"},{"$ref":"#/$defs/External_Endpoint"}]},"Data_Flow":{"type":"object","unevaluatedProperties":false,"required":["from","to"],"properties":{"from":{"type":"string","format":"uuid","description":"UUID of the local component that is one end of this data flow. Always references a component in the current system document."},"to":{"$ref":"#/$defs/Data_Flow_Endpoint","description":"The other end of this data flow. Can be a local component (UUID), a cross-system component reference, or an external endpoint."},"protocol":{"type":"string","description":"Communication protocol. Examples: 'http', 'https', 'grpc', 'ssh', 'jdbc', 'k8s-api', 'socket', 'sftp'."},"port":{"type":"integer","minimum":1,"maximum":65535,"description":"Network port number."},"direction":{"type":"string","title":"Direction","enum":["unidirectional","bidirectional"],"description":"Data flow direction. 'unidirectional' means data flows from→to only. 'bidirectional' means data flows in both directions (e.g., request/response)."},"description":{"type":"string","description":"Human-readable description of this data flow's purpose and the data exchanged."},"authentication":{"type":"string","description":"Authentication mechanism used for this connection. Examples: 'mTLS', 'OAuth2', 'API key', 'SAML', 'Kerberos'."}},"examples":[{"from":"f47ac10b-58cc-4372-a567-0e02b2c3d479","to":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","protocol":"https","port":443,"direction":"bidirectional","description":"REST API calls from WebTier to API Gateway","authentication":"mTLS"},{"from":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","to":"c3d4e5f6-a7b8-9012-cdef-123456789012","protocol":"jdbc","port":5432,"direction":"unidirectional","description":"Database queries from API Gateway to PostgreSQL","authentication":"username/password + TLS"},{"from":"f47ac10b-58cc-4372-a567-0e02b2c3d479","to":{"systemRef":"https://systems.agency.gov/auth-system.json","componentId":"b2c3d4e5-f6a7-8901-bcde-f12345678901"},"protocol":"https","direction":"bidirectional","description":"SAML authentication requests to central auth system","authentication":"SAML 2.0"},{"from":"f47ac10b-58cc-4372-a567-0e02b2c3d479","to":{"external":true,"description":"Stripe payment processing API"},"protocol":"https","port":443,"direction":"bidirectional","description":"Payment processing via Stripe","authentication":"API key + TLS"}],"description":"A data flow between two endpoints. The 'from' endpoint is always a local component; the 'to' endpoint can be local, cross-system, or external. Use 'direction' to indicate whether data flows one-way or both ways.","title":"Data Flow"}}};
 export const epssSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0","title":"HDF EPSS Primitive","description":"Type for representing FIRST.org's Exploit Prediction Scoring System (EPSS) data for a vulnerability. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days. See https://www.first.org/epss/ for the underlying model and methodology.","$defs":{"Epss":{"type":"object","unevaluatedProperties":false,"required":["score","percentile","date"],"properties":{"score":{"type":"number","minimum":0,"maximum":1,"description":"Exploit probability as a value between 0.0 and 1.0 inclusive. Higher values indicate greater predicted likelihood of exploitation in the next 30 days. Example: 0.97532 means roughly a 97.5% predicted probability."},"percentile":{"type":"number","minimum":0,"maximum":1,"description":"Rank of this score relative to all scored CVEs, expressed as a value between 0.0 and 1.0 inclusive. A percentile of 0.99 means this CVE is scored at or above 99% of all scored CVEs."},"date":{"type":"string","format":"date","$comment":"This is the date FIRST.org published the score, not the date the underlying CVE was discovered or disclosed. EPSS scores are recomputed daily and shift as new exploitation evidence is observed.","description":"ISO 8601 date (YYYY-MM-DD) on which FIRST.org published this EPSS score."}},"examples":[{"$comment":"High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure.","score":0.97532,"percentile":0.99987,"date":"2026-05-26"},{"$comment":"Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation.","score":0.04521,"percentile":0.78432,"date":"2026-05-26"},{"$comment":"Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.","score":0.00042,"percentile":0.10215,"date":"2026-05-26"}],"description":"FIRST.org Exploit Prediction Scoring System (EPSS) data for a single vulnerability. All three fields are required when an Epss object is present; the date disambiguates which day's score this is, since EPSS recomputes daily.","title":"EPSS"}}};
 export const eventsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0","title":"HDF Change Event Primitives","description":"Shared building blocks for HDF change-event wire documents. The envelope is entity-agnostic: hdf-requirement-change-event composes it today, and any future sibling event type (e.g. component change events — hdf-comparison already models componentDiffs alongside requirementDiffs) reuses it verbatim.","$defs":{"Change_Event_Envelope":{"type":"object","required":["eventId","source","sequence","systemRef","componentId","timestamp","priorChecksum"],"properties":{"eventId":{"type":"string","format":"uuid","description":"Identity of this event occurrence, unique per source. (source, eventId) is the deduplication key: consumers may treat events with identical source and eventId as duplicates. UUIDv7 (time-ordered) is recommended but not required."},"source":{"type":"string","format":"uri-reference","description":"URI identifying the producer context that emitted this event (for example, a scanner instance and profile). eventId uniqueness and sequence numbering are scoped per source."},"sequence":{"type":"integer","minimum":0,"description":"Monotonically increasing sequence number per entity key. The ONLY ordering authority for folding: consumers keep the greatest sequence per key regardless of arrival order or timestamp. Deliberately per-entity-key (event-sourcing aggregate-version practice) rather than per-source."},"systemRef":{"type":"string","format":"uri-reference","description":"URI to the hdf-system document (authorization boundary) this event applies to. Resolves to the latest version of the evolving system document."},"componentId":{"type":"string","format":"uuid","description":"componentId of the system component this event concerns."},"timestamp":{"type":"string","format":"date-time","description":"Occurrence time of the observed change (RFC 3339, trimmed UTC). Display and audit metadata only — NEVER an ordering key; ordering is sequence's job."},"schemaRef":{"type":"string","format":"uri","description":"The versioned schema $id this event validates against, so events self-describe on heterogeneous streams. Recommended on every wire event."},"priorChecksum":{"oneOf":[{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"},{"type":"null"}],"description":"The effectiveChecksum of the entity state this event supersedes, forming a per-key hash chain: a mismatch or gap against stored state is detectable, letting a consumer mark the key unverified instead of serving stale posture.\n\nNull at chain start (no prior state, e.g. a new entity or the first event after a seed).\n\nThe chain provides tamper/gap evidence given a trusted head; completeness is anchored out-of-band by periodic re-centering rescans."}},"examples":[{"$comment":"Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key.","eventId":"0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01","source":"inspec://web01/rhel9-stig","sequence":412,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-22T14:03:11Z","schemaRef":"https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0","priorChecksum":{"algorithm":"sha256","value":"704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"}},{"$comment":"Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.","eventId":"0190f6f2-2a5b-7e4d-b1c8-4f2e6a8b0d12","source":"inspec://web01/rhel9-stig","sequence":1,"systemRef":"apptier.hdf-system.json","componentId":"6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60","timestamp":"2026-07-22T09:00:00Z","priorChecksum":null}],"description":"Entity-agnostic transport identity for a change event: dedup ((source, eventId)), ordering (per-key sequence), system anchor (systemRef + componentId), occurrence time, schema self-description, and the prior-state hash-chain link. Composed into each concrete event type via allOf; entity-specific keys and payload live on the event type.","title":"Change Event Envelope"},"Event_Requirement_State":{"type":"string","enum":["new","absent","updated","fixed","regressed"],"description":"The producer-computable subset of the comparison vocabulary's Requirement_State. Kept value-identical with the parent enum (test-enforced): the batch-only states (moved, split, merged) are outputs of cross-document identity resolution a per-key producer cannot compute. Declared as a distinct named type (rather than a $ref intersection) so generated Go/TS types keep stable, distinct enum names.","title":"Event Requirement State"},"Event_Change_Reason":{"type":"string","enum":["resultChanged","overrideAdded","overrideExpired","overrideRemoved","overrideModified","impactChanged","configChanged"],"description":"The producer-computable subset of the comparison vocabulary's Change_Reason, value-identical with the parent enum (test-enforced). Batch-only reasons (baselineUpgraded, controlMapped, scannerChanged, targetChanged, metadataChanged) require cross-corpus context and are excluded.","title":"Event Change Reason"},"Effective_Projection":{"type":"object","unevaluatedProperties":false,"required":["effectiveStatus","effectiveImpact"],"properties":{"effectiveStatus":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status","description":"The resolved effective compliance status at this point in the chain."},"effectiveImpact":{"type":"number","minimum":0,"maximum":1,"description":"The resolved effective impact score (0.0–1.0) at this point in the chain."}},"examples":[{"$comment":"Prior posture of a failing SSH-cipher control before remediation.","effectiveStatus":"failed","effectiveImpact":0.5},{"$comment":"Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).","effectiveStatus":"passed","effectiveImpact":0.5}],"description":"The minimal resolved-posture projection — the same field set the per-requirement effectiveChecksum hashes (status and impact; the governing disposition is carried by the full requirement payload).","title":"Effective Projection"},"Derivation":{"type":"object","unevaluatedProperties":false,"required":["seed","source","throughSequence","eventsApplied","asOf"],"properties":{"seed":{"type":"object","unevaluatedProperties":false,"required":["uri","checksum"],"properties":{"uri":{"type":"string","format":"uri-reference","description":"URI to the seed snapshot document (relative path or absolute URL)."},"checksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by content, not just location."}},"$comment":"Location + expected-hash reference (the SRI/OCI/SPDX pattern). Shares its core shape with hdf-evidence-package's Content_Reference and ADR-0006's proposed External_Reference; consolidation onto one reference primitive is tracked by bead hdf-libs-avp2.","description":"The authoritative snapshot this document was reassembled from, pinned by content."},"source":{"type":"string","format":"uri-reference","description":"URI of the event-stream producer context whose events were applied (matches the events' envelope source)."},"throughSequence":{"type":"integer","minimum":0,"description":"The event watermark: the highest per-key sequence number applied. Downstream precedence rule: a full-scan document supersedes the reconciled view as of its scan time; between scans, the reconciled document with the highest throughSequence is the current posture."},"eventsApplied":{"type":"integer","minimum":0,"description":"Number of change events applied to the seed to produce this document."},"asOf":{"type":"string","format":"date-time","description":"The posture-as-of time of this reconciled view (RFC 3339, trimmed UTC) — the analog of PROV's generatedAtTime."}},"examples":[{"$comment":"A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.","seed":{"uri":"apptier-seed-scan.hdf.json","checksum":{"algorithm":"sha256","value":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}},"source":"inspec://web01/rhel9-stig","throughSequence":414,"eventsApplied":3,"asOf":"2026-07-24T10:15:00Z"}],"description":"Derived-document lineage for a reconciled result set (an hdf-results produced by applyChangeEvents rather than a scanner). Records exactly which seed and event horizon the document represents so it can never masquerade as primary scan evidence. Conceptually PROV qualified derivation: derived entity, used entity (seed), activity (event application), generation time (asOf).","title":"Derivation"}}};
-export const extensionsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0","title":"HDF Extension Primitives","description":"Extension types for waivers, attestations, generators, and integrity.","$defs":{"Status_Override":{"type":"object","unevaluatedProperties":false,"required":["type","reason","appliedBy","appliedAt","expiresAt"],"anyOf":[{"required":["status"]},{"required":["impact"]}],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"},"description":"Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."},"type":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type","description":"The type of override applied to this requirement."},"status":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status","description":"The new status this override sets for the requirement. Optional when only impact is being overridden."},"impact":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Impact_Override","description":"Override to the requirement's impact score. At least one of status or impact must be set."},"reason":{"type":"string","description":"Explanation for why this override was applied."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."},"appliedAt":{"type":"string","format":"date-time","description":"Timestamp when this override was applied. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature","description":"Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."},"cvss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss","$comment":"When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.","description":"Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."},"justification":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Justification","description":"Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."}},"examples":[{"type":"waiver","status":"notApplicable","reason":"This control does not apply to containerized environments as the application runs in ephemeral containers without persistent storage","appliedBy":{"identifier":"security-team@example.com","type":"email"},"appliedAt":"2025-12-01T10:00:00Z","expiresAt":"2026-12-01T00:00:00Z"},{"type":"riskAdjustment","impact":{"value":0.3},"reason":"CVE-123 is in a dead code path, unreachable from any entry point","appliedBy":{"identifier":"dev@org.gov","type":"email"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"$comment":"Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.","type":"riskAdjustment","impact":{"value":0.9},"reason":"CVE-2021-44228 actively exploited in the wild per STIX threat intelligence","appliedBy":{"identifier":"secops@agency.gov","type":"email"},"appliedAt":"2026-07-27T00:00:00Z","expiresAt":"2026-10-25T00:00:00Z","externalReferences":[{"sourceName":"stix","externalId":"sighting--a1b2c3d4-0000-4a2b-9c3d-000000000002","kind":"threat-intel","rel":"evidence","document":{"type":"sighting","spec_version":"2.1","id":"sighting--a1b2c3d4-0000-4a2b-9c3d-000000000002","sighting_of_ref":"vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001"}}]},{"type":"falsePositive","status":"passed","reason":"STIG check misidentified sshd_config syntax; manual review confirms compliant configuration","appliedBy":{"identifier":"assessor@agency.gov","type":"email"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"falsePositive","status":"notApplicable","reason":"CVE scanner matched library signature but the vulnerable code path is not present — dependency compiled with affected module disabled","appliedBy":{"identifier":"dev@org.gov","type":"email"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"attestation","status":"passed","reason":"Manual verification completed: Reviewed firewall rules and confirmed all required ports are properly restricted per security policy","appliedBy":{"identifier":"john.doe","type":"username","description":"Senior Security Engineer"},"appliedAt":"2025-11-30T14:30:00Z","expiresAt":"2026-05-30T00:00:00Z","evidence":[{"type":"screenshot","data":"base64-encoded-screenshot-data-here","description":"Screenshot showing firewall configuration","mimeType":"image/png","encoding":"base64","capturedAt":"2025-11-30T14:25:00Z","capturedBy":{"identifier":"john.doe","type":"username"}}]}],"description":"An intentional change to a requirement's compliance status and/or impact score. At least one of status or impact must be set. Overrides change the effectiveStatus or impact of the requirement. All overrides must have an expiration date to enforce periodic review.","title":"Status Override"},"POAM":{"type":"object","unevaluatedProperties":false,"required":["type","explanation","appliedBy","appliedAt","expiresAt"],"properties":{"type":{"type":"string","title":"POAM Type","enum":["remediation","mitigation","riskAcceptance","vendorDependency"],"description":"The type of POA&M. 'remediation' fixes root cause. 'mitigation' reduces risk via compensating controls. 'riskAcceptance' documents decision to accept risk. 'vendorDependency' tracks a fix that depends on a vendor releasing a patch or update."},"explanation":{"type":"string","description":"Detailed explanation of the plan, including what actions will be taken."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."},"appliedAt":{"type":"string","format":"date-time","description":"Timestamp when this POA&M was created. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"Required deadline for this POA&M. A POA&M is a time-boxed acceptance of an open finding; without a deadline it lets a failing requirement duck remediation indefinitely. Source a real date (e.g. a remediation target or vendor-fix date) — never a wall-clock default. ISO 8601 format."},"milestones":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"},"description":"Optional array of milestones tracking progress toward completion."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature","description":"Optional digital signature for enhanced trust and non-repudiation."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."}},"examples":[{"type":"remediation","explanation":"Upgrade OpenSSL to version 3.0.x to address CVE-2024-XXXXX vulnerability. Root cause: outdated dependency version in base image.","appliedBy":{"identifier":"devops-team@example.com","type":"email"},"appliedAt":"2025-12-01T09:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Update base Docker image to use OpenSSL 3.0.x","estimatedCompletion":"2025-12-15T00:00:00Z","status":"completed","completedAt":"2025-12-10T16:30:00Z","completedBy":{"identifier":"alice.smith","type":"username"}},{"description":"Deploy updated image to production","estimatedCompletion":"2025-12-20T00:00:00Z","status":"inProgress"},{"description":"Verify vulnerability no longer present via security scan","estimatedCompletion":"2025-12-22T00:00:00Z","status":"pending"}]},{"type":"mitigation","explanation":"Implement network segmentation as compensating control while awaiting vendor patch for database vulnerability. Traffic to vulnerable database server is restricted to internal management VLAN only.","appliedBy":{"identifier":"security-architect","type":"system","description":"Automated POA&M creation from vulnerability scan"},"appliedAt":"2025-11-28T14:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Configure firewall rules to restrict database access to management VLAN","estimatedCompletion":"2025-12-02T00:00:00Z","status":"completed","completedAt":"2025-11-29T11:15:00Z","completedBy":{"identifier":"network-ops@example.com","type":"email"}},{"description":"Monitor for vendor security patch release","estimatedCompletion":"2026-02-28T00:00:00Z","status":"inProgress"}],"evidence":[{"type":"code","data":"# Firewall rule configuration\niptables -A INPUT -s 10.0.1.0/24 -p tcp --dport 5432 -j ACCEPT\niptables -A INPUT -p tcp --dport 5432 -j DROP","description":"Firewall rules restricting database access","mimeType":"text/plain"}]},{"type":"riskAcceptance","explanation":"Risk accepted for legacy system scheduled for decommissioning in Q1 2026. Cost of remediation ($50K for emergency upgrade) exceeds residual risk given 3-month remaining lifespan. Compensating controls: isolated network segment, enhanced monitoring.","appliedBy":{"identifier":"ciso@example.com","type":"email"},"appliedAt":"2025-12-05T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Complete migration to replacement system","estimatedCompletion":"2026-03-15T00:00:00Z","status":"inProgress"},{"description":"Decommission legacy system","estimatedCompletion":"2026-03-31T00:00:00Z","status":"pending"}]}],"description":"Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change the effectiveStatus - the requirement remains in its current state while the POA&M tracks remediation efforts.","title":"POAM"},"Generator":{"type":"object","unevaluatedProperties":false,"required":["name","version"],"properties":{"name":{"type":"string","description":"The name of the software that produced this HDF file. Example: 'gosec-to-hdf'."},"version":{"type":"string","description":"The version of the tool. Example: '5.22.3'."}},"description":"Information about the tool that generated this HDF file.","title":"Generator"},"Tool":{"type":"object","unevaluatedProperties":false,"properties":{"name":{"type":"string","description":"The name of the security tool that produced the data. Examples: 'gosec', 'Semgrep', 'OpenSCAP', 'AWS Config', 'Nessus'. Omit if the tool cannot be identified."},"version":{"type":"string","description":"Version of the source tool, if available in the tool's output. Example: '5.22.3'."},"format":{"type":"string","description":"The named format of the source data, when it follows a recognized format specification with its own identity: an interchange format emitted by many tools ('SARIF', 'XCCDF', 'OSCAL') or one of several named output formats a single tool produces ('FVDL', 'exec-json', 'FPF').\n\nNever a serialization structure — 'JSON', 'XML', and 'CSV' are encodings, not formats.\n\nOmit for a tool's native output: an absent format means the tool's own shape, and data arriving as a named format is converted by that format's converter, which sets this field alongside the producing tool's name.","$comment":"Format-not-serialization rule decided 2026-08-01; bare JSON/XML/CSV labels were swept from the converters at the same time."}},"description":"The security tool that produced the assessment data represented in this HDF file. Aligns with SARIF, OSCAL, and CycloneDX terminology.","title":"Tool"},"Integrity":{"type":"object","unevaluatedProperties":false,"dependentRequired":{"algorithm":["checksum"],"checksum":["algorithm"]},"properties":{"algorithm":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Hash_Algorithm","description":"The hash algorithm used for the checksum."},"checksum":{"type":"string","description":"The checksum value."},"signature":{"type":"string","description":"Optional cryptographic signature."},"signedBy":{"type":"string","description":"Identifier of who signed this file."}},"examples":[{"algorithm":"sha256","checksum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},{"algorithm":"sha512","checksum":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","signature":"MEUCIQDx1y2hKl3mN8vP9qRz4tJ2sW5nX6cY8bD9aE3fG4hI5wIgK7mN8oP9qR0zS1tU2vW3xY4zA5bC6dD7eE8fG9hI0jK=","signedBy":"security-automation@example.com"}],"description":"Cryptographic integrity information for verifying the HDF file has not been tampered with. If algorithm is provided, checksum must also be provided, and vice versa.","title":"Integrity"}}};
+export const extensionsSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0","title":"HDF Extension Primitives","description":"Extension types for waivers, attestations, generators, and integrity.","$defs":{"Status_Override":{"type":"object","unevaluatedProperties":false,"required":["type","reason","appliedBy","appliedAt","expiresAt"],"anyOf":[{"required":["status"]},{"required":["impact"]}],"properties":{"externalReferences":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"},"description":"Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."},"type":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type","description":"The type of override applied to this requirement."},"status":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status","description":"The new status this override sets for the requirement. Optional when only impact is being overridden."},"impact":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Impact_Override","description":"Override to the requirement's impact score. At least one of status or impact must be set."},"reason":{"type":"string","description":"Explanation for why this override was applied."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."},"appliedAt":{"type":"string","format":"date-time","description":"Timestamp when this override was applied. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature","description":"Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."},"cvss":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss","$comment":"When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.","description":"Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."},"justification":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Justification","description":"Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."}},"examples":[{"type":"waiver","status":"notApplicable","reason":"This control does not apply to containerized environments as the application runs in ephemeral containers without persistent storage","appliedBy":{"identifier":"security-team@example.com","type":"email"},"appliedAt":"2025-12-01T10:00:00Z","expiresAt":"2026-12-01T00:00:00Z"},{"type":"riskAdjustment","impact":{"value":0.3},"reason":"CVE-123 is in a dead code path, unreachable from any entry point","appliedBy":{"identifier":"dev@org.gov","type":"email"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"$comment":"Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.","type":"riskAdjustment","impact":{"value":0.9},"reason":"CVE-2021-44228 actively exploited in the wild per STIX threat intelligence","appliedBy":{"identifier":"secops@agency.gov","type":"email"},"appliedAt":"2026-07-27T00:00:00Z","expiresAt":"2026-10-25T00:00:00Z","externalReferences":[{"sourceName":"stix","externalId":"sighting--a1b2c3d4-0000-4a2b-9c3d-000000000002","kind":"threat-intel","rel":"evidence","document":{"type":"sighting","spec_version":"2.1","id":"sighting--a1b2c3d4-0000-4a2b-9c3d-000000000002","sighting_of_ref":"vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001"}}]},{"type":"falsePositive","status":"passed","reason":"STIG check misidentified sshd_config syntax; manual review confirms compliant configuration","appliedBy":{"identifier":"assessor@agency.gov","type":"email"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"falsePositive","status":"notApplicable","reason":"CVE scanner matched library signature but the vulnerable code path is not present — dependency compiled with affected module disabled","appliedBy":{"identifier":"dev@org.gov","type":"email"},"appliedAt":"2026-04-14T10:00:00Z","expiresAt":"2026-10-14T00:00:00Z"},{"type":"attestation","status":"passed","reason":"Manual verification completed: Reviewed firewall rules and confirmed all required ports are properly restricted per security policy","appliedBy":{"identifier":"john.doe","type":"username","description":"Senior Security Engineer"},"appliedAt":"2025-11-30T14:30:00Z","expiresAt":"2026-05-30T00:00:00Z","evidence":[{"type":"screenshot","data":"base64-encoded-screenshot-data-here","description":"Screenshot showing firewall configuration","mimeType":"image/png","encoding":"base64","capturedAt":"2025-11-30T14:25:00Z","capturedBy":{"identifier":"john.doe","type":"username"}}]}],"description":"An intentional change to a requirement's compliance status and/or impact score. At least one of status or impact must be set. Overrides change the effectiveStatus or impact of the requirement. All overrides must have an expiration date to enforce periodic review.","title":"Status Override"},"POAM":{"type":"object","unevaluatedProperties":false,"required":["type","explanation","appliedBy","appliedAt","expiresAt"],"properties":{"type":{"type":"string","title":"POAM Type","enum":["remediation","mitigation","riskAcceptance","vendorDependency"],"description":"The type of POA&M. 'remediation' fixes root cause. 'mitigation' reduces risk via compensating controls. 'riskAcceptance' documents decision to accept risk. 'vendorDependency' tracks a fix that depends on a vendor releasing a patch or update."},"explanation":{"type":"string","description":"Detailed explanation of the plan, including what actions will be taken."},"appliedBy":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity","description":"Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."},"appliedAt":{"type":"string","format":"date-time","description":"Timestamp when this POA&M was created. ISO 8601 format."},"expiresAt":{"type":"string","format":"date-time","description":"Required deadline for this POA&M. A POA&M is a time-boxed acceptance of an open finding; without a deadline it lets a failing requirement duck remediation indefinitely. Source a real date (e.g. a remediation target or vendor-fix date) — never a wall-clock default. ISO 8601 format."},"milestones":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"},"description":"Optional array of milestones tracking progress toward completion."},"signature":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature","description":"Optional digital signature for enhanced trust and non-repudiation."},"evidence":{"type":"array","items":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"},"description":"Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."},"previousChecksum":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum","description":"SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."}},"examples":[{"type":"remediation","explanation":"Upgrade OpenSSL to version 3.0.x to address CVE-2024-XXXXX vulnerability. Root cause: outdated dependency version in base image.","appliedBy":{"identifier":"devops-team@example.com","type":"email"},"appliedAt":"2025-12-01T09:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Update base Docker image to use OpenSSL 3.0.x","estimatedCompletion":"2025-12-15T00:00:00Z","status":"completed","completedAt":"2025-12-10T16:30:00Z","completedBy":{"identifier":"alice.smith","type":"username"}},{"description":"Deploy updated image to production","estimatedCompletion":"2025-12-20T00:00:00Z","status":"inProgress"},{"description":"Verify vulnerability no longer present via security scan","estimatedCompletion":"2025-12-22T00:00:00Z","status":"pending"}]},{"type":"mitigation","explanation":"Implement network segmentation as compensating control while awaiting vendor patch for database vulnerability. Traffic to vulnerable database server is restricted to internal management VLAN only.","appliedBy":{"identifier":"security-architect","type":"system","description":"Automated POA&M creation from vulnerability scan"},"appliedAt":"2025-11-28T14:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Configure firewall rules to restrict database access to management VLAN","estimatedCompletion":"2025-12-02T00:00:00Z","status":"completed","completedAt":"2025-11-29T11:15:00Z","completedBy":{"identifier":"network-ops@example.com","type":"email"}},{"description":"Monitor for vendor security patch release","estimatedCompletion":"2026-02-28T00:00:00Z","status":"inProgress"}],"evidence":[{"type":"code","data":"# Firewall rule configuration\niptables -A INPUT -s 10.0.1.0/24 -p tcp --dport 5432 -j ACCEPT\niptables -A INPUT -p tcp --dport 5432 -j DROP","description":"Firewall rules restricting database access","mimeType":"text/plain"}]},{"type":"riskAcceptance","explanation":"Risk accepted for legacy system scheduled for decommissioning in Q1 2026. Cost of remediation ($50K for emergency upgrade) exceeds residual risk given 3-month remaining lifespan. Compensating controls: isolated network segment, enhanced monitoring.","appliedBy":{"identifier":"ciso@example.com","type":"email"},"appliedAt":"2025-12-05T10:00:00Z","expiresAt":"2099-12-31T00:00:00Z","milestones":[{"description":"Complete migration to replacement system","estimatedCompletion":"2026-03-15T00:00:00Z","status":"inProgress"},{"description":"Decommission legacy system","estimatedCompletion":"2026-03-31T00:00:00Z","status":"pending"}]}],"description":"Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change the effectiveStatus - the requirement remains in its current state while the POA&M tracks remediation efforts.","title":"POAM"},"Generator":{"type":"object","unevaluatedProperties":false,"required":["name","version"],"properties":{"name":{"type":"string","description":"The name of the software that produced this HDF file. Example: 'gosec-to-hdf'."},"version":{"type":"string","description":"The version of the tool. Example: '5.22.3'."}},"description":"Information about the tool that generated this HDF file.","title":"Generator"},"Tool":{"type":"object","unevaluatedProperties":false,"properties":{"name":{"type":"string","description":"The name of the security tool that produced the data. Examples: 'gosec', 'Semgrep', 'OpenSCAP', 'AWS Config', 'Nessus'. Omit if the tool cannot be identified."},"version":{"type":"string","description":"Version of the source tool, if available in the tool's output. Example: '5.22.3'."},"format":{"type":"string","description":"The named format of the source data, when it follows a recognized format specification with its own identity: an interchange format emitted by many tools ('SARIF', 'XCCDF', 'OSCAL') or one of several named output formats a single tool produces ('FVDL', 'exec-json', 'FPF').\n\nNever a serialization structure — 'JSON', 'XML', and 'CSV' are encodings, not formats.\n\nOmit for a tool's native output: an absent format means the tool's own shape, and data arriving as a named format is converted by that format's converter, which sets this field alongside the producing tool's name.","$comment":"Format-not-serialization rule decided 2026-08-01; bare JSON/XML/CSV labels were swept from the converters at the same time."}},"description":"The security tool that produced the assessment data represented in this HDF file. Aligns with SARIF, OSCAL, and CycloneDX terminology.","title":"Tool"},"Integrity":{"type":"object","unevaluatedProperties":false,"dependentRequired":{"algorithm":["checksum"],"checksum":["algorithm"]},"properties":{"algorithm":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Hash_Algorithm","description":"The hash algorithm used for the checksum."},"checksum":{"type":"string","description":"The checksum value."},"signature":{"type":"string","description":"Optional cryptographic signature."},"signedBy":{"type":"string","description":"Identifier of who signed this file."}},"examples":[{"algorithm":"sha256","checksum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},{"algorithm":"sha512","checksum":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","signature":"MEUCIQDx1y2hKl3mN8vP9qRz4tJ2sW5nX6cY8bD9aE3fG4hI5wIgK7mN8oP9qR0zS1tU2vW3xY4zA5bC6dD7eE8fG9hI0jK=","signedBy":"security-automation@example.com"}],"description":"Cryptographic integrity information for verifying the HDF file has not been tampered with. If algorithm is provided, checksum must also be provided, and vice versa.","title":"Integrity"}}};
 export const kevSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0","title":"HDF Kev Primitives","description":"Types for representing CISA Known Exploited Vulnerabilities (KEV) catalog membership. The KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) flags CVEs that are confirmed actively exploited in the wild and drives federal patching urgency under CISA Binding Operational Directive 22-01.","$defs":{"Kev":{"type":"object","unevaluatedProperties":false,"required":["inKev"],"if":{"properties":{"inKev":{"const":true}},"required":["inKev"]},"then":{"required":["dateAdded","dueDate"]},"properties":{"inKev":{"type":"boolean","description":"Whether this vulnerability is currently in the CISA Known Exploited Vulnerabilities catalog. When true, dateAdded and dueDate are required."},"dateAdded":{"type":"string","format":"date","description":"ISO 8601 calendar date (YYYY-MM-DD) the vulnerability was added to the CISA KEV catalog. Required when inKev is true."},"dueDate":{"type":"string","format":"date","description":"ISO 8601 calendar date (YYYY-MM-DD) by which federal agencies must remediate per CISA BOD 22-01. Normally later than dateAdded, but the schema does not enforce ordering because CISA occasionally adjusts published dates. Required when inKev is true."},"notes":{"type":"string","description":"CISA's notes describing the vulnerability, observed exploitation, or remediation guidance."}},"examples":[{"$comment":"High-urgency case: recently added KEV entry with a short federal patching deadline.","inKev":true,"dateAdded":"2026-03-15","dueDate":"2026-04-05","notes":"Active ransomware exploitation observed; apply vendor patch immediately."},{"$comment":"Older KEV entry whose due date has already passed — useful for reporting overdue remediation.","inKev":true,"dateAdded":"2023-11-07","dueDate":"2023-11-28","notes":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."},{"$comment":"Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.","inKev":false}],"title":"Kev"}}};
 export const parameterSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0","title":"HDF Parameter Primitives","description":"Input/parameter type definitions for typed, traceable configuration values that bridge governance prose and scanner automation.","$defs":{"Input_Type":{"type":"string","enum":["String","Numeric","Boolean","Array","Hash","Regexp"],"description":"The data type of the input value. Aligns with InSpec input types.","title":"Input Type"},"Comparison_Operator":{"type":"string","enum":["eq","ne","lt","le","gt","ge","contains","matches","in","notIn"],"description":"Comparison operator for evaluating the input value against observed values. Numeric: eq/ne/lt/le/gt/ge. String: eq/ne/contains/matches. Collection: in/notIn.","title":"Comparison Operator"},"Input_Constraints":{"type":"object","unevaluatedProperties":false,"properties":{"min":{"type":"number","description":"Minimum allowed value (for Numeric inputs)."},"max":{"type":"number","description":"Maximum allowed value (for Numeric inputs)."},"pattern":{"type":"string","description":"Regular expression pattern the value must match (for String inputs)."},"allowedValues":{"type":"array","description":"Enumeration of permitted values."}},"description":"Validation constraints for an input value.","title":"Input Constraints"},"Input":{"type":"object","unevaluatedProperties":false,"required":["name"],"properties":{"name":{"type":"string","description":"The input name. Must be unique within a baseline or results document. Example: 'max_concurrent_sessions'."},"type":{"$ref":"#/$defs/Input_Type","description":"The data type of this input."},"value":{"description":"The input value. Type should match the declared type field. Accepts any JSON value."},"description":{"type":"string","description":"Human-readable description of what this input controls."},"required":{"type":"boolean","description":"Whether this input must be provided. Defaults to false if omitted."},"sensitive":{"type":"boolean","description":"Whether this input contains sensitive data (passwords, keys). Sensitive values should be redacted in output. Defaults to false if omitted."},"operator":{"$ref":"#/$defs/Comparison_Operator","description":"The comparison operator used when evaluating this input against observed values."},"constraints":{"$ref":"#/$defs/Input_Constraints","description":"Validation constraints for the input value."}},"examples":[{"name":"max_concurrent_sessions","type":"Numeric","value":3,"description":"Maximum concurrent sessions per user","required":true,"sensitive":false,"operator":"le","constraints":{"min":1,"max":100}},{"name":"allowed_ciphers","type":"String","value":"AES256-GCM","description":"Permitted TLS cipher suite","constraints":{"pattern":"^AES"}},{"name":"db_password","type":"String","sensitive":true}],"description":"A typed input parameter that bridges governance requirements and scanner automation. Inputs carry expected configuration values with type information, comparison operators, and validation constraints, enabling traceability from policy through to scan results.","title":"Input"}}};
 export const planSchema = {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mitre.github.io/hdf-libs/schemas/primitives/plan/v3.5.0","title":"HDF Plan Primitives","description":"Types for defining assessment plans — what to scan, how to configure it, and when to run.","$defs":{"Plan_Type":{"type":"string","enum":["automated","manual","hybrid"],"description":"The type of assessment. 'automated' for scanner-driven, 'manual' for human-performed, 'hybrid' for both.","title":"Plan Type"},"Runner_Config":{"type":"object","unevaluatedProperties":false,"properties":{"name":{"type":"string","description":"Name of the assessment runner. Example: 'cinc-auditor', 'inspec', 'openscap'."},"version":{"type":"string","description":"Version of the runner."}},"description":"Configuration for the assessment runner/scanner.","title":"Runner Config"},"Assessment":{"type":"object","unevaluatedProperties":false,"required":["baselineRef"],"properties":{"baselineRef":{"type":"string","format":"uri-reference","description":"Reference to the baseline to evaluate. May be a baseline name (e.g. 'RHEL9-STIG'), a relative path to an HDF Baseline document (e.g. 'rhel9-stig.hdf-baseline.json'), or an absolute URI."},"componentRef":{"type":"string","format":"uuid","description":"componentId of the system component this assessment targets. Use for direct component binding. Alternative to targetSelector."},"targetSelector":{"$ref":"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Target_Selector","description":"Label selector to match targets for this assessment. Overrides the system component's targetSelector if provided."},"inputs":{"type":"object","additionalProperties":true,"description":"Resolved input values for this assessment. Keys are input names, values are the final resolved values (after baseline defaults + system overrides)."},"runner":{"$ref":"#/$defs/Runner_Config","description":"Runner/scanner configuration for this assessment."},"description":{"type":"string","description":"Description of this assessment's purpose."}},"examples":[{"baselineRef":"RHEL9-STIG","targetSelector":{"labels.component":"WebTier"},"inputs":{"max_concurrent_sessions":5,"password_min_length":15},"runner":{"name":"cinc-auditor","version":"6.8.1"}}],"description":"A single assessment within a plan — defines which baseline to run against which targets with what configuration.","title":"Assessment"},"Schedule":{"type":"object","unevaluatedProperties":false,"properties":{"cron":{"type":"string","description":"Cron expression for recurring assessments. Example: '0 2 1 * *' (2 AM on the 1st of each month)."},"startDate":{"type":"string","format":"date-time","description":"Earliest date to begin assessments. ISO 8601 format."},"endDate":{"type":"string","format":"date-time","description":"Date after which assessments should no longer run. ISO 8601 format."},"notifyOnRegression":{"type":"array","items":{"type":"string"},"description":"Email addresses or notification endpoints to alert when regressions are detected."},"notifyOnCompletion":{"type":"array","items":{"type":"string"},"description":"Email addresses or notification endpoints to alert when assessments complete."}},"examples":[{"cron":"0 2 1 * *","notifyOnRegression":["security-team@agency.gov"]}],"description":"Scheduling configuration for recurring assessments.","title":"Schedule"}}};

package/dist/schemas/hdf-amendments.schema.json

@@ -1340,7 +1340,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -2035,7 +2035,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -2212,7 +2212,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [

package/dist/schemas/hdf-baseline.schema.json

@@ -1476,7 +1476,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -1653,7 +1653,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -2006,7 +2006,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/schemas/hdf-comparison.schema.json

@@ -2127,7 +2127,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -2304,7 +2304,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -2657,7 +2657,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/schemas/hdf-evidence-package.schema.json

@@ -1508,7 +1508,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -1685,7 +1685,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -2038,7 +2038,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/schemas/hdf-plan.schema.json

@@ -1518,7 +1518,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -1695,7 +1695,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -2048,7 +2048,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/schemas/hdf-requirement-change-event.schema.json

@@ -3914,7 +3914,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -4091,7 +4091,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -4444,7 +4444,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/schemas/hdf-results.schema.json

@@ -3191,7 +3191,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -3368,7 +3368,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -3721,7 +3721,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/schemas/hdf-system.schema.json

@@ -2791,7 +2791,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
@@ -2968,7 +2968,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "SHA-256 checksum of the previous amendment in chronological order. Creates a tamper-evident chain of amendments (similar to blockchain). Null for the first amendment on a requirement."
+              "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
           "examples": [
@@ -3321,7 +3321,7 @@
             },
             "previousChecksum": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
-              "description": "Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null for the first amendment."
+              "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
               "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",

package/dist/ts/hdf.d.ts

@@ -1103,9 +1103,12 @@ export interface Poam {
      */
     milestones?: Milestone[];
     /**
-     * SHA-256 checksum of the previous amendment in chronological order. Creates a
-     * tamper-evident chain of amendments (similar to blockchain). Null for the first amendment
-     * on a requirement.
+     * SHA-256 checksum of the previous amendment in chronological order. Each amendment's
+     * checksum is recorded by the NEXT one, so editing an amendment in place is detectable —
+     * provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment,
+     * the document envelope, deleted trailing amendments, and a chain that has been stripped or
+     * recomputed wholesale are all outside what it can detect. Use signature for
+     * non-repudiation. Omitted on the first amendment on a requirement.
      */
     previousChecksum?: Checksum;
     /**
@@ -1372,9 +1375,12 @@ export interface StatusOverride {
      */
     justification?: Justification;
     /**
-     * SHA-256 checksum of the previous amendment in chronological order. Creates a
-     * tamper-evident chain of amendments (similar to blockchain). Null for the first amendment
-     * on a requirement.
+     * SHA-256 checksum of the previous amendment in chronological order. Each amendment's
+     * checksum is recorded by the NEXT one, so editing an amendment in place is detectable —
+     * provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment,
+     * the document envelope, deleted trailing amendments, and a chain that has been stripped or
+     * recomputed wholesale are all outside what it can detect. Use signature for
+     * non-repudiation. Omitted on the first amendment on a requirement.
      */
     previousChecksum?: Checksum;
     /**
@@ -3745,8 +3751,12 @@ export interface StandaloneOverride {
      */
     milestones?: Milestone[];
     /**
-     * Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null
-     * for the first amendment.
+     * SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum
+     * is recorded by the NEXT one, so editing an amendment in place is detectable — provided a
+     * later amendment is chained to it. It is NOT tamper-proof: the final amendment, the
+     * document envelope, deleted trailing amendments, and a chain that has been stripped or
+     * recomputed wholesale are all outside what it can detect. Use signature for
+     * non-repudiation. Omitted on the first amendment.
      */
     previousChecksum?: Checksum;
     /**

package/dist/ts/hdf.ts

@@ -1122,9 +1122,12 @@ export interface Poam {
      */
     milestones?: Milestone[];
     /**
-     * SHA-256 checksum of the previous amendment in chronological order. Creates a
-     * tamper-evident chain of amendments (similar to blockchain). Null for the first amendment
-     * on a requirement.
+     * SHA-256 checksum of the previous amendment in chronological order. Each amendment's
+     * checksum is recorded by the NEXT one, so editing an amendment in place is detectable —
+     * provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment,
+     * the document envelope, deleted trailing amendments, and a chain that has been stripped or
+     * recomputed wholesale are all outside what it can detect. Use signature for
+     * non-repudiation. Omitted on the first amendment on a requirement.
      */
     previousChecksum?: Checksum;
     /**
@@ -1397,9 +1400,12 @@ export interface StatusOverride {
      */
     justification?: Justification;
     /**
-     * SHA-256 checksum of the previous amendment in chronological order. Creates a
-     * tamper-evident chain of amendments (similar to blockchain). Null for the first amendment
-     * on a requirement.
+     * SHA-256 checksum of the previous amendment in chronological order. Each amendment's
+     * checksum is recorded by the NEXT one, so editing an amendment in place is detectable —
+     * provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment,
+     * the document envelope, deleted trailing amendments, and a chain that has been stripped or
+     * recomputed wholesale are all outside what it can detect. Use signature for
+     * non-repudiation. Omitted on the first amendment on a requirement.
      */
     previousChecksum?: Checksum;
     /**
@@ -3810,8 +3816,12 @@ export interface StandaloneOverride {
      */
     milestones?: Milestone[];
     /**
-     * Checksum of the prior amendment in the chain. Creates a tamper-evident linked list. Null
-     * for the first amendment.
+     * SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum
+     * is recorded by the NEXT one, so editing an amendment in place is detectable — provided a
+     * later amendment is chained to it. It is NOT tamper-proof: the final amendment, the
+     * document envelope, deleted trailing amendments, and a chain that has been stripped or
+     * recomputed wholesale are all outside what it can detect. Use signature for
+     * non-repudiation. Omitted on the first amendment.
      */
     previousChecksum?: Checksum;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/hdf-schema",
-  "version": "3.6.0-rc.2",
+  "version": "3.6.0-rc.3",
   "description": "JSON schemas and multi-language type definitions for Heimdall Data Format (HDF)",
   "publishConfig": {
     "access": "public"
@@ -65,7 +65,7 @@
   "dependencies": {
     "ajv": "^8.17.0",
     "ajv-formats": "^3.0.0",
-    "@mitre/hdf-utilities": "^3.6.0-rc.2"
+    "@mitre/hdf-utilities": "^3.6.0-rc.3"
   },
   "devDependencies": {
     "@hyperjump/json-schema": "^1.17.2",
@@ -102,8 +102,6 @@
     "test:go": "cd testhdf/go && go test ./...",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "type-check": "tsc --noEmit",
-    "lint": "eslint src test",
-    "lint:fix": "eslint src test --fix"
+    "type-check": "tsc --noEmit"
   }
 }

package/testhdf/index.js

@@ -109,6 +109,27 @@ export function baselineDoc(name, ...reqs) {
 
 // ===== HDF Amendments =====
 
+/**
+ * The status/impact axis Standalone_Override requires, which is type-dependent:
+ * operationalRequirement may carry neither, riskAdjustment moves impact only,
+ * poam tracks a finding that stays open, and the remaining types neutralize it.
+ *
+ * @param {string} type
+ * @returns {{status?: string, impact?: {value: number}}}
+ */
+function defaultOverrideOutcome(type) {
+  switch (type) {
+    case 'operationalRequirement':
+      return {};
+    case 'riskAdjustment':
+      return { impact: { value: 0 } };
+    case 'poam':
+      return { status: 'failed' };
+    default:
+      return { status: 'passed' };
+  }
+}
+
 /**
  * @param {string} type - override type (waiver, falsePositive, poam, ...)
  * @param {string} reqId
@@ -123,6 +144,7 @@ export function override(type, reqId, opts = {}) {
     expiresAt: DEFAULT_EXPIRY,
     appliedBy: opts.appliedBy ?? { type: 'simple', identifier: 'test' },
     reason: opts.reason ?? 'test override',
+    ...defaultOverrideOutcome(type),
   };
   if (opts.status !== undefined) o.status = opts.status;
   if (opts.milestones !== undefined) o.milestones = opts.milestones;