@mitre/hdf-schema 3.6.0-rc.4 → 3.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +2 -2
  2. package/dist/go/hdf.go +10 -0
  3. package/dist/index.js +28 -28
  4. package/dist/schemas/hdf-amendments.schema.json +50 -66
  5. package/dist/schemas/hdf-baseline.schema.json +55 -71
  6. package/dist/schemas/hdf-comparison.schema.json +151 -173
  7. package/dist/schemas/hdf-evidence-package.schema.json +55 -72
  8. package/dist/schemas/hdf-plan.schema.json +56 -72
  9. package/dist/schemas/hdf-requirement-change-event.schema.json +141 -166
  10. package/dist/schemas/hdf-results.schema.json +126 -147
  11. package/dist/schemas/hdf-system.schema.json +73 -93
  12. package/dist/ts/hdf.d.ts +12 -0
  13. package/dist/ts/hdf.ts +12 -0
  14. package/package.json +2 -2
package/dist/schemas/hdf-requirement-change-event.schema.json CHANGED
@@ -1,13 +1,13 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
3
+ "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
4
4
  "title": "HDF Requirement Change Event",
5
5
  "description": "A single continuous-monitoring wire event: one requirement's effective posture changed on one system component.\n\nThe streaming increment of a systemDrift hdf-comparison — events fold into comparisons and reassemble into hdf-results, they never mutate documents in place.\n\nOne event per wire document (NDJSON-friendly).\n\nThe envelope (identity, ordering, hash chain) is the shared Change_Event_Envelope primitive; the payload carries the producer-computable change state, a thin before projection, and the full after requirement (the evidence a responder opens the event for).\n\nDesign: ADR-0005.",
6
6
  "type": "object",
7
7
  "unevaluatedProperties": false,
8
8
  "allOf": [
9
9
  {
10
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Change_Event_Envelope"
10
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Change_Event_Envelope"
11
11
  },
12
12
  {
13
13
  "if": {
@@ -30,7 +30,7 @@
30
30
  "else": {
31
31
  "properties": {
32
32
  "after": {
33
- "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"
33
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0#/$defs/Evaluated_Requirement"
34
34
  }
35
35
  }
36
36
  }
@@ -56,7 +56,7 @@
56
56
  "else": {
57
57
  "properties": {
58
58
  "before": {
59
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Effective_Projection"
59
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Effective_Projection"
60
60
  }
61
61
  }
62
62
  }
@@ -74,20 +74,20 @@
74
74
  "description": "Canonical requirement identifier — the same identity as Requirement_Diff.id and the requirement's id in hdf-results. Together with the envelope's (systemRef, componentId) this forms the durable entity key. A requirement renumbering is emitted as absent + new under the two keys, never an in-place key change; batch comparison reconciles renames via its oldId/newId matching."
75
75
  },
76
76
  "state": {
77
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Event_Requirement_State",
77
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Event_Requirement_State",
78
78
  "description": "The producer-computable subset of Requirement_State: new | absent | updated | fixed | regressed. fixed and regressed carry the direction SARIF's baselineState lacks; project down to SARIF's closed 4 values for external interop."
79
79
  },
80
80
  "changeReasons": {
81
81
  "type": "array",
82
82
  "items": {
83
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Event_Change_Reason"
83
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Event_Change_Reason"
84
84
  },
85
85
  "description": "Why the state changed. An overrideExpired flip is a different triage than resultChanged: the control did not get worse, a waiver lapsed."
86
86
  },
87
87
  "before": {
88
88
  "oneOf": [
89
89
  {
90
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Effective_Projection"
90
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Effective_Projection"
91
91
  },
92
92
  {
93
93
  "type": "null"
@@ -98,7 +98,7 @@
98
98
  "after": {
99
99
  "oneOf": [
100
100
  {
101
- "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"
101
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0#/$defs/Evaluated_Requirement"
102
102
  },
103
103
  {
104
104
  "type": "null"
@@ -107,16 +107,16 @@
107
107
  "description": "The full requirement as evaluated after the change — required and non-null for every state except absent (null there: the requirement left the assessment scope). Full content is load-bearing twice over: reassembly parity (applyChangeEvents cannot reproduce changed result content from a projection) and triage (the failing results[] ARE the 'why' a responder opens the event for)."
108
108
  }
109
109
  },
110
+ "$comment": "Examples, in order: 1) fixed — the common remediation event: a failing SSH FIPS-cipher control was fixed and rescanned. priorChecksum is the effectiveChecksum of the prior failed posture; after carries the full passing requirement including its new effectiveChecksum (the next chain link); 2) regressed via overrideExpired — the waiver that held this control at passed lapsed, so effective posture regressed to failed with NO new scan finding. A different triage than resultChanged: renew or remediate. priorChecksum is the waived posture's checksum; the expired override remains in statusOverrides as the audit record; 3) new — a requirement entered assessment scope (chain start for this key): before is null, priorChecksum is null. The full after payload is what makes the new key materializable by applyChangeEvents; 4) absent — the requirement left assessment scope (component decommissioned or benchmark rule retired): after is null by definition; the thin before preserves the last observed posture for downstream views; 5) updated via impactChanged — a riskAdjustment override lowered effective impact while the control stayed failed: status unchanged, so neither fixed nor regressed. after carries the override and the recomputed effectiveChecksum over the adjusted posture.",
110
111
  "examples": [
111
112
  {
112
- "$comment": "fixed — the common remediation event: a failing SSH FIPS-cipher control was fixed and rescanned. priorChecksum is the effectiveChecksum of the prior failed posture; after carries the full passing requirement including its new effectiveChecksum (the next chain link).",
113
113
  "eventId": "0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01",
114
114
  "source": "inspec://web01/rhel9-stig",
115
115
  "sequence": 412,
116
116
  "systemRef": "apptier.hdf-system.json",
117
117
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
118
118
  "timestamp": "2026-07-22T14:03:11Z",
119
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
119
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
120
120
  "priorChecksum": {
121
121
  "algorithm": "sha256",
122
122
  "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
@@ -160,14 +160,13 @@
160
160
  }
161
161
  },
162
162
  {
163
- "$comment": "regressed via overrideExpired — the waiver that held this control at passed lapsed, so effective posture regressed to failed with NO new scan finding. A different triage than resultChanged: renew or remediate. priorChecksum is the waived posture's checksum; the expired override remains in statusOverrides as the audit record.",
164
163
  "eventId": "0190f6f2-3b6c-7f5e-c2d9-5a3f7b9c1e23",
165
164
  "source": "reconciler://apptier/override-sweep",
166
165
  "sequence": 97,
167
166
  "systemRef": "apptier.hdf-system.json",
168
167
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
169
168
  "timestamp": "2026-07-21T00:00:05Z",
170
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
169
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
171
170
  "priorChecksum": {
172
171
  "algorithm": "sha256",
173
172
  "value": "d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"
@@ -225,14 +224,13 @@
225
224
  }
226
225
  },
227
226
  {
228
- "$comment": "new — a requirement entered assessment scope (chain start for this key): before is null, priorChecksum is null. The full after payload is what makes the new key materializable by applyChangeEvents.",
229
227
  "eventId": "0190f6f2-4c7d-8a6f-d3ea-6b4a8c0d2f34",
230
228
  "source": "inspec://web01/rhel9-stig",
231
229
  "sequence": 1,
232
230
  "systemRef": "apptier.hdf-system.json",
233
231
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
234
232
  "timestamp": "2026-07-22T14:03:12Z",
235
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
233
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
236
234
  "priorChecksum": null,
237
235
  "requirementId": "RHEL-09-671010",
238
236
  "state": "new",
@@ -267,14 +265,13 @@
267
265
  }
268
266
  },
269
267
  {
270
- "$comment": "absent — the requirement left assessment scope (component decommissioned or benchmark rule retired): after is null by definition; the thin before preserves the last observed posture for downstream views.",
271
268
  "eventId": "0190f6f2-5d8e-9b7a-e4fb-7c5b9d1e3a45",
272
269
  "source": "inspec://web01/rhel9-stig",
273
270
  "sequence": 413,
274
271
  "systemRef": "apptier.hdf-system.json",
275
272
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
276
273
  "timestamp": "2026-07-23T08:00:00Z",
277
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
274
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
278
275
  "priorChecksum": {
279
276
  "algorithm": "sha256",
280
277
  "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
@@ -288,14 +285,13 @@
288
285
  "after": null
289
286
  },
290
287
  {
291
- "$comment": "updated via impactChanged — a riskAdjustment override lowered effective impact while the control stayed failed: status unchanged, so neither fixed nor regressed. after carries the override and the recomputed effectiveChecksum over the adjusted posture.",
292
288
  "eventId": "0190f6f2-6e9f-0c8b-f5ac-8d6c0e2f4b56",
293
289
  "source": "reconciler://apptier/amend-apply",
294
290
  "sequence": 414,
295
291
  "systemRef": "apptier.hdf-system.json",
296
292
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
297
293
  "timestamp": "2026-07-24T10:15:00Z",
298
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
294
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
299
295
  "priorChecksum": {
300
296
  "algorithm": "sha256",
301
297
  "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
@@ -358,9 +354,9 @@
358
354
  }
359
355
  ],
360
356
  "$defs": {
361
- "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0": {
357
+ "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0": {
362
358
  "$schema": "https://json-schema.org/draft/2020-12/schema",
363
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0",
359
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0",
364
360
  "title": "HDF Change Event Primitives",
365
361
  "description": "Shared building blocks for HDF change-event wire documents. The envelope is entity-agnostic: hdf-requirement-change-event composes it today, and any future sibling event type (e.g. component change events — hdf-comparison already models componentDiffs alongside requirementDiffs) reuses it verbatim.",
366
362
  "$defs": {
@@ -414,7 +410,7 @@
414
410
  "priorChecksum": {
415
411
  "oneOf": [
416
412
  {
417
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
413
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
418
414
  },
419
415
  {
420
416
  "type": "null"
@@ -423,23 +419,22 @@
423
419
  "description": "The effectiveChecksum of the entity state this event supersedes, forming a per-key hash chain: a mismatch or gap against stored state is detectable, letting a consumer mark the key unverified instead of serving stale posture.\n\nNull at chain start (no prior state, e.g. a new entity or the first event after a seed).\n\nThe chain provides tamper/gap evidence given a trusted head; completeness is anchored out-of-band by periodic re-centering rescans."
424
420
  }
425
421
  },
422
+ "$comment": "Examples, in order: 1) Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key; 2) Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
426
423
  "examples": [
427
424
  {
428
- "$comment": "Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key.",
429
425
  "eventId": "0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01",
430
426
  "source": "inspec://web01/rhel9-stig",
431
427
  "sequence": 412,
432
428
  "systemRef": "apptier.hdf-system.json",
433
429
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
434
430
  "timestamp": "2026-07-22T14:03:11Z",
435
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
431
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
436
432
  "priorChecksum": {
437
433
  "algorithm": "sha256",
438
434
  "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
439
435
  }
440
436
  },
441
437
  {
442
- "$comment": "Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
443
438
  "eventId": "0190f6f2-2a5b-7e4d-b1c8-4f2e6a8b0d12",
444
439
  "source": "inspec://web01/rhel9-stig",
445
440
  "sequence": 1,
@@ -487,7 +482,7 @@
487
482
  ],
488
483
  "properties": {
489
484
  "effectiveStatus": {
490
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
485
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
491
486
  "description": "The resolved effective compliance status at this point in the chain."
492
487
  },
493
488
  "effectiveImpact": {
@@ -497,14 +492,13 @@
497
492
  "description": "The resolved effective impact score (0.0–1.0) at this point in the chain."
498
493
  }
499
494
  },
495
+ "$comment": "Examples, in order: 1) Prior posture of a failing SSH-cipher control before remediation; 2) Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
500
496
  "examples": [
501
497
  {
502
- "$comment": "Prior posture of a failing SSH-cipher control before remediation.",
503
498
  "effectiveStatus": "failed",
504
499
  "effectiveImpact": 0.5
505
500
  },
506
501
  {
507
- "$comment": "Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
508
502
  "effectiveStatus": "passed",
509
503
  "effectiveImpact": 0.5
510
504
  }
@@ -537,7 +531,7 @@
537
531
  "description": "URI to the seed snapshot document (relative path or absolute URL)."
538
532
  },
539
533
  "checksum": {
540
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
534
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
541
535
  "description": "Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by content, not just location."
542
536
  }
543
537
  },
@@ -565,9 +559,9 @@
565
559
  "description": "The posture-as-of time of this reconciled view (RFC 3339, trimmed UTC) — the analog of PROV's generatedAtTime."
566
560
  }
567
561
  },
562
+ "$comment": "Examples, in order: 1) A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
568
563
  "examples": [
569
564
  {
570
- "$comment": "A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
571
565
  "seed": {
572
566
  "uri": "apptier-seed-scan.hdf.json",
573
567
  "checksum": {
@@ -586,9 +580,9 @@
586
580
  }
587
581
  }
588
582
  },
589
- "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0": {
583
+ "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0": {
590
584
  "$schema": "https://json-schema.org/draft/2020-12/schema",
591
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0",
585
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0",
592
586
  "title": "HDF Common Primitives",
593
587
  "description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
594
588
  "$defs": {
@@ -668,22 +662,20 @@
668
662
  }
669
663
  },
670
664
  "unevaluatedProperties": false,
665
+ "$comment": "Examples, in order: 1) By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228; 2) By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL; 3) By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution; 4) Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
671
666
  "examples": [
672
667
  {
673
- "$comment": "By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228.",
674
668
  "sourceName": "cve",
675
669
  "externalId": "CVE-2021-44228",
676
670
  "rel": "definition"
677
671
  },
678
672
  {
679
- "$comment": "By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL.",
680
673
  "sourceName": "mitre-att&ck",
681
674
  "externalId": "T1059",
682
675
  "href": "https://attack.mitre.org/techniques/T1059/",
683
676
  "rel": "canonical"
684
677
  },
685
678
  {
686
- "$comment": "By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution.",
687
679
  "sourceName": "stix",
688
680
  "href": "https://cti.example.org/bundles/log4shell.json",
689
681
  "rel": "investigate",
@@ -699,7 +691,6 @@
699
691
  "addedAt": "2026-07-26T00:00:00Z"
700
692
  },
701
693
  {
702
- "$comment": "Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
703
694
  "sourceName": "stix",
704
695
  "externalId": "vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
705
696
  "href": "https://cti.example.org/bundles/log4shell.json#vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
@@ -1518,9 +1509,9 @@
1518
1509
  "description": "Whether the requirement is mandatory within its baseline.\n\nDistinct from severity (risk weight) and status (lifecycle state).\n\nMaps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).\n\nOptional: when omitted, consumers should treat the requirement as 'required' by convention."
1519
1510
  }
1520
1511
  },
1512
+ "$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.6.0 (backward compatibility); 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
1521
1513
  "examples": [
1522
1514
  {
1523
- "$comment": "v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.5.0 (backward compatibility).",
1524
1515
  "id": "SV-238196",
1525
1516
  "title": "The Ubuntu operating system must enforce password complexity",
1526
1517
  "impact": 0.5,
@@ -1550,7 +1541,6 @@
1550
1541
  ]
1551
1542
  },
1552
1543
  {
1553
- "$comment": "v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline.",
1554
1544
  "id": "AC-3",
1555
1545
  "title": "Access Enforcement",
1556
1546
  "impact": 0.7,
@@ -1572,7 +1562,6 @@
1572
1562
  "applicability": "required"
1573
1563
  },
1574
1564
  {
1575
- "$comment": "v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement.",
1576
1565
  "id": "KSI-CNA-01",
1577
1566
  "title": "Cyber Security Plan documents the system",
1578
1567
  "impact": 0.5,
@@ -1592,7 +1581,6 @@
1592
1581
  "applicability": "required"
1593
1582
  },
1594
1583
  {
1595
- "$comment": "v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
1596
1584
  "id": "SV-999999",
1597
1585
  "title": "Example STIG rule pending automation",
1598
1586
  "impact": 0.3,
@@ -1657,9 +1645,9 @@
1657
1645
  }
1658
1646
  }
1659
1647
  },
1660
- "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0": {
1648
+ "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0": {
1661
1649
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1662
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0",
1650
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0",
1663
1651
  "title": "HDF Result Primitives",
1664
1652
  "description": "Types for representing assessment results and statuses.",
1665
1653
  "$defs": {
@@ -1790,9 +1778,9 @@
1790
1778
  }
1791
1779
  }
1792
1780
  },
1793
- "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0": {
1781
+ "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0": {
1794
1782
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1795
- "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0",
1783
+ "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0",
1796
1784
  "type": "object",
1797
1785
  "unevaluatedProperties": false,
1798
1786
  "required": [
@@ -1802,7 +1790,7 @@
1802
1790
  "externalReferences": {
1803
1791
  "type": "array",
1804
1792
  "items": {
1805
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
1793
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
1806
1794
  },
1807
1795
  "description": "Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."
1808
1796
  },
@@ -1819,7 +1807,7 @@
1819
1807
  "components": {
1820
1808
  "type": "array",
1821
1809
  "items": {
1822
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
1810
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
1823
1811
  },
1824
1812
  "description": "The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."
1825
1813
  },
@@ -1831,27 +1819,38 @@
1831
1819
  "description": "Information on the baselines that were evaluated, including findings."
1832
1820
  },
1833
1821
  "statistics": {
1834
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0#/$defs/Statistics",
1822
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0#/$defs/Statistics",
1835
1823
  "description": "Statistics for the assessment run, including duration and result counts."
1836
1824
  },
1837
1825
  "generator": {
1838
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator",
1826
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Generator",
1839
1827
  "description": "Information about the tool that generated this file."
1840
1828
  },
1841
1829
  "tool": {
1842
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool",
1830
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Tool",
1843
1831
  "description": "The security tool that produced the assessment data in this file."
1844
1832
  },
1845
1833
  "integrity": {
1846
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
1834
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
1847
1835
  "description": "Cryptographic integrity information for verifying this file."
1848
1836
  },
1837
+ "preAmendmentChecksum": {
1838
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
1839
+ "description": "Hash of this results document as it stood immediately before the most recent amendment application. Written by `hdf amend apply` when it applies at least one override; an apply that matches nothing leaves the document untouched. The hash covers the results file's RAW BYTES as read, not a canonical form, so reproducing it requires the byte-identical original — reformatting or re-serializing the source changes the value. Only the most recent pre-application state is recorded: applying amendments to an already-amended document REPLACES this value, so it is a single link back one step, not a growing chain. Distinct from the `previousChecksum` inside an override, which chains amendments to each other and is computed over a canonical JSON form.",
1840
+ "$comment": "Example 1: the real SHA-256 of hdf-converters/converters/nessus-to-hdf/fixtures/expected/sample.nessus.hdf.json, reproducible with `shasum -a 256` on that file — chosen over a synthetic digest so a reader can verify the hash basis is the raw file bytes.",
1841
+ "examples": [
1842
+ {
1843
+ "algorithm": "sha256",
1844
+ "value": "9599ce7889e99b70ef5d0f3efa4215e35059c10a7e89b9314cbf4ded8fdbad38"
1845
+ }
1846
+ ]
1847
+ },
1849
1848
  "runner": {
1850
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0#/$defs/Runner",
1849
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0#/$defs/Runner",
1851
1850
  "description": "Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."
1852
1851
  },
1853
1852
  "remediation": {
1854
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Remediation",
1853
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Remediation",
1855
1854
  "description": "Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."
1856
1855
  },
1857
1856
  "systemRef": {
@@ -1865,7 +1864,7 @@
1865
1864
  "description": "Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."
1866
1865
  },
1867
1866
  "derivation": {
1868
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Derivation",
1867
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Derivation",
1869
1868
  "description": "Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."
1870
1869
  },
1871
1870
  "extensions": {
@@ -1963,14 +1962,14 @@
1963
1962
  ],
1964
1963
  "allOf": [
1965
1964
  {
1966
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Baseline_Metadata"
1965
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Baseline_Metadata"
1967
1966
  }
1968
1967
  ],
1969
1968
  "properties": {
1970
1969
  "depends": {
1971
1970
  "type": "array",
1972
1971
  "items": {
1973
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Dependency"
1972
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Dependency"
1974
1973
  },
1975
1974
  "description": "The set of dependencies this baseline depends on."
1976
1975
  },
@@ -1983,15 +1982,15 @@
1983
1982
  "description": "The description - should be more detailed than the summary."
1984
1983
  },
1985
1984
  "integrity": {
1986
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
1985
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
1987
1986
  "description": "Cryptographic integrity information for verifying this baseline has not been tampered with."
1988
1987
  },
1989
1988
  "originalChecksum": {
1990
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
1989
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
1991
1990
  "description": "SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."
1992
1991
  },
1993
1992
  "resultsChecksum": {
1994
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
1993
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
1995
1994
  "description": "SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."
1996
1995
  },
1997
1996
  "statusMessage": {
@@ -2009,14 +2008,14 @@
2009
2008
  "groups": {
2010
2009
  "type": "array",
2011
2010
  "items": {
2012
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Group"
2011
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Requirement_Group"
2013
2012
  },
2014
2013
  "description": "A set of descriptions for the requirement groups."
2015
2014
  },
2016
2015
  "inputs": {
2017
2016
  "type": "array",
2018
2017
  "items": {
2019
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0#/$defs/Input"
2018
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0#/$defs/Input"
2020
2019
  },
2021
2020
  "description": "Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."
2022
2021
  },
@@ -2041,7 +2040,7 @@
2041
2040
  ],
2042
2041
  "allOf": [
2043
2042
  {
2044
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Core"
2043
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Requirement_Core"
2045
2044
  }
2046
2045
  ],
2047
2046
  "properties": {
@@ -2049,7 +2048,7 @@
2049
2048
  "type": "array",
2050
2049
  "minItems": 1,
2051
2050
  "items": {
2052
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Description"
2051
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Requirement_Description"
2053
2052
  },
2054
2053
  "contains": {
2055
2054
  "type": "object",
@@ -2065,37 +2064,37 @@
2065
2064
  "description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
2066
2065
  },
2067
2066
  "severity": {
2068
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Severity",
2067
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Severity",
2069
2068
  "description": "Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."
2070
2069
  },
2071
2070
  "sourceLocation": {
2072
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Source_Location",
2071
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Source_Location",
2073
2072
  "description": "The explicit location of the requirement within the source code."
2074
2073
  },
2075
2074
  "results": {
2076
2075
  "type": "array",
2077
2076
  "minItems": 1,
2078
2077
  "items": {
2079
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Result"
2078
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Requirement_Result"
2080
2079
  },
2081
2080
  "description": "The set of all tests within the requirement and their results."
2082
2081
  },
2083
2082
  "statusOverrides": {
2084
2083
  "type": "array",
2085
2084
  "items": {
2086
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Status_Override"
2085
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Status_Override"
2087
2086
  },
2088
2087
  "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
2089
2088
  },
2090
2089
  "poams": {
2091
2090
  "type": "array",
2092
2091
  "items": {
2093
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/POAM"
2092
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/POAM"
2094
2093
  },
2095
2094
  "description": "Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."
2096
2095
  },
2097
2096
  "effectiveStatus": {
2098
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
2097
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
2099
2098
  "description": "The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."
2100
2099
  },
2101
2100
  "effectiveImpact": {
@@ -2105,33 +2104,33 @@
2105
2104
  "description": "The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."
2106
2105
  },
2107
2106
  "disposition": {
2108
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type",
2107
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
2109
2108
  "description": "The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."
2110
2109
  },
2111
2110
  "effectiveChecksum": {
2112
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
2111
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
2113
2112
  "description": "Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."
2114
2113
  },
2115
2114
  "evidence": {
2116
2115
  "type": "array",
2117
2116
  "items": {
2118
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
2117
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
2119
2118
  },
2120
2119
  "description": "Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."
2121
2120
  },
2122
2121
  "cvss": {
2123
2122
  "type": "array",
2124
2123
  "items": {
2125
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss"
2124
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss"
2126
2125
  },
2127
2126
  "description": "Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."
2128
2127
  },
2129
2128
  "epss": {
2130
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0#/$defs/Epss",
2129
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0#/$defs/Epss",
2131
2130
  "description": "FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."
2132
2131
  },
2133
2132
  "kev": {
2134
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0#/$defs/Kev",
2133
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0#/$defs/Kev",
2135
2134
  "description": "CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."
2136
2135
  },
2137
2136
  "cwe": {
@@ -2145,14 +2144,14 @@
2145
2144
  "affectedPackages": {
2146
2145
  "type": "array",
2147
2146
  "items": {
2148
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"
2147
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
2149
2148
  },
2150
2149
  "description": "Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."
2151
2150
  }
2152
2151
  },
2152
+ "$comment": "Examples, in order: 1) Passing requirement — no overrides, no disposition; 2) Waiver — AO accepted risk, status overridden to passed; 3) False positive (compliance scan) — STIG check was wrong, requirement actually passes; 4) False positive (CVE scan) — vulnerability does not apply to this build; 5) Risk adjustment — impact lowered, pass/fail unchanged; 6) Operational requirement — cannot remediate, remains open risk; 7) POAM — remediation tracked, status unchanged.",
2153
2153
  "examples": [
2154
2154
  {
2155
- "$comment": "Passing requirement — no overrides, no disposition",
2156
2155
  "id": "SV-230222",
2157
2156
  "title": "RHEL 9 must use SSH protocol version 2",
2158
2157
  "impact": 0.7,
@@ -2177,7 +2176,6 @@
2177
2176
  "effectiveStatus": "passed"
2178
2177
  },
2179
2178
  {
2180
- "$comment": "Waiver — AO accepted risk, status overridden to passed",
2181
2179
  "id": "SV-230300",
2182
2180
  "title": "RHEL 9 must enforce password complexity",
2183
2181
  "impact": 0.5,
@@ -2221,7 +2219,6 @@
2221
2219
  }
2222
2220
  },
2223
2221
  {
2224
- "$comment": "False positive (compliance scan) — STIG check was wrong, requirement actually passes",
2225
2222
  "id": "SV-230410",
2226
2223
  "title": "RHEL 9 must have sshd PermitRootLogin disabled",
2227
2224
  "impact": 0.7,
@@ -2261,7 +2258,6 @@
2261
2258
  "disposition": "falsePositive"
2262
2259
  },
2263
2260
  {
2264
- "$comment": "False positive (CVE scan) — vulnerability does not apply to this build",
2265
2261
  "id": "CVE-2026-12345",
2266
2262
  "title": "libxml2 buffer overflow in xmlParseEntityDecl",
2267
2263
  "impact": 0.9,
@@ -2301,7 +2297,6 @@
2301
2297
  "disposition": "falsePositive"
2302
2298
  },
2303
2299
  {
2304
- "$comment": "Risk adjustment — impact lowered, pass/fail unchanged",
2305
2300
  "id": "CVE-2026-67890",
2306
2301
  "title": "OpenSSL timing side-channel in RSA decryption",
2307
2302
  "impact": 0.7,
@@ -2344,7 +2339,6 @@
2344
2339
  "disposition": "riskAdjustment"
2345
2340
  },
2346
2341
  {
2347
- "$comment": "Operational requirement — cannot remediate, remains open risk",
2348
2342
  "id": "SV-230500",
2349
2343
  "title": "RHEL 9 must disable USB mass storage",
2350
2344
  "impact": 0.5,
@@ -2384,7 +2378,6 @@
2384
2378
  "disposition": "operationalRequirement"
2385
2379
  },
2386
2380
  {
2387
- "$comment": "POAM — remediation tracked, status unchanged",
2388
2381
  "id": "SV-230350",
2389
2382
  "title": "RHEL 9 must be patched within 30 days of release",
2390
2383
  "impact": 0.7,
@@ -2440,9 +2433,9 @@
2440
2433
  }
2441
2434
  }
2442
2435
  },
2443
- "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0": {
2436
+ "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0": {
2444
2437
  "$schema": "https://json-schema.org/draft/2020-12/schema",
2445
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0",
2438
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0",
2446
2439
  "title": "HDF Component Primitives",
2447
2440
  "description": "First-class system component with identity, polymorphic type, generalized BOM attachment (boms[]), and system-binding properties. Components are the successor to Targets, adding stable identity (componentId), external system cross-references, and manifest inventory (SBOM, AI model/dataset, and reserved future BOM kinds).",
2448
2441
  "$defs": {
@@ -2488,7 +2481,7 @@
2488
2481
  "description": "Description of this component's role or purpose."
2489
2482
  },
2490
2483
  "owner": {
2491
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
2484
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
2492
2485
  "description": "Team or individual responsible for this component. Enables per-component ownership when different teams manage different parts of a system."
2493
2486
  },
2494
2487
  "externalIds": {
@@ -2508,14 +2501,14 @@
2508
2501
  "boms": {
2509
2502
  "type": "array",
2510
2503
  "items": {
2511
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0#/$defs/Bom"
2504
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0#/$defs/Bom"
2512
2505
  },
2513
2506
  "description": "Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType), each carried by passthrough (ref/document) or normalized. Replaces the former sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an ai-model BOM). See primitives/bom.schema.json."
2514
2507
  },
2515
2508
  "integrity": {
2516
2509
  "type": "array",
2517
2510
  "items": {
2518
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
2511
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
2519
2512
  },
2520
2513
  "description": "Cryptographic integrity of this component's underlying artifact — model weights or shards, dataset archive, container image, or package bytes.\n\nAn array supports multi-file/sharded artifacts.\n\nThis is the single, generic home for artifact/subject integrity across all component types (it replaced the former per-type Container_Image digest and Artifact checksum fields).\n\nDistinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence Integrity type."
2521
2514
  },
@@ -2529,12 +2522,12 @@
2529
2522
  "inputOverrides": {
2530
2523
  "type": "array",
2531
2524
  "items": {
2532
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Input_Override"
2525
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0#/$defs/Input_Override"
2533
2526
  },
2534
2527
  "description": "System-specific overrides for baseline input values."
2535
2528
  },
2536
2529
  "targetSelector": {
2537
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Target_Selector",
2530
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0#/$defs/Target_Selector",
2538
2531
  "description": "Label selector to match targets belonging to this component during migration. Targets with matching labels are automatically included."
2539
2532
  }
2540
2533
  },
@@ -2665,9 +2658,9 @@
2665
2658
  }
2666
2659
  }
2667
2660
  ],
2661
+ "$comment": "Examples, in order: 1) Domain-joined host carrying all three identity fields separately: short hostname, FQDN, and the (distinct) directory domain. HOST_NAME and HOST_FQDN from a STIG checklist map here; note the AD domain differs from the FQDN's DNS suffix; 2) Standalone/workgroup host: has a short hostname but no directory domain — 'domain' is omitted rather than fabricated from the FQDN suffix.",
2668
2662
  "examples": [
2669
2663
  {
2670
- "$comment": "Domain-joined host carrying all three identity fields separately: short hostname, FQDN, and the (distinct) directory domain. HOST_NAME and HOST_FQDN from a STIG checklist map here; note the AD domain differs from the FQDN's DNS suffix.",
2671
2664
  "type": "host",
2672
2665
  "name": "web-server-prod-01",
2673
2666
  "componentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
@@ -2683,7 +2676,6 @@
2683
2676
  }
2684
2677
  },
2685
2678
  {
2686
- "$comment": "Standalone/workgroup host: has a short hostname but no directory domain — 'domain' is omitted rather than fabricated from the FQDN suffix.",
2687
2679
  "type": "host",
2688
2680
  "name": "kiosk-lab-07",
2689
2681
  "hostname": "kiosk-lab-07",
@@ -2818,7 +2810,7 @@
2818
2810
  "const": "cloudAccount"
2819
2811
  },
2820
2812
  "provider": {
2821
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Cloud_Provider",
2813
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Cloud_Provider",
2822
2814
  "description": "Cloud provider."
2823
2815
  },
2824
2816
  "accountId": {
@@ -2857,7 +2849,7 @@
2857
2849
  "const": "cloudResource"
2858
2850
  },
2859
2851
  "provider": {
2860
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Cloud_Provider",
2852
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Cloud_Provider",
2861
2853
  "description": "Cloud provider."
2862
2854
  },
2863
2855
  "resourceType": {
@@ -3156,9 +3148,9 @@
3156
3148
  }
3157
3149
  }
3158
3150
  },
3159
- "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0": {
3151
+ "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0": {
3160
3152
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3161
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0",
3153
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0",
3162
3154
  "title": "HDF BOM Primitives",
3163
3155
  "description": "Generalized Bill-of-Materials / manifest representation.\n\nOne extensible Bom shape, discriminated by bomType, carries any manifest kind (SBOM, AI model/dataset, and reserved future kinds) either by passthrough (opaque ref/embed of the native document) or normalized (converted into HDF's queryable shape).\n\nSubject identity (name, version, componentId) is inherited from the host component or system — the BOM never re-owns it.\n\nSee ADR-0001.",
3164
3156
  "$defs": {
@@ -3214,7 +3206,7 @@
3214
3206
  "hashes": {
3215
3207
  "type": "array",
3216
3208
  "items": {
3217
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
3209
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
3218
3210
  },
3219
3211
  "description": "Integrity of the carried BOM *document* itself (the referenced/embedded manifest file), NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model weights, dataset archive) is a component-level concern, not carried here. Subject identity is inherited from the host component/system; per-node identity lives in the type-extension."
3220
3212
  },
@@ -3331,9 +3323,9 @@
3331
3323
  ]
3332
3324
  }
3333
3325
  ],
3326
+ "$comment": "Examples, in order: 1) Passthrough SBOM by external reference — the universal escape hatch, available to every bomType; 2) Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships; 3) Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base; 4) Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.",
3334
3327
  "examples": [
3335
3328
  {
3336
- "$comment": "Passthrough SBOM by external reference — the universal escape hatch, available to every bomType.",
3337
3329
  "bomType": "sbom",
3338
3330
  "format": "cyclonedx",
3339
3331
  "ref": "https://artifacts.agency.gov/sbom/webtier.cdx.json",
@@ -3345,7 +3337,6 @@
3345
3337
  ]
3346
3338
  },
3347
3339
  {
3348
- "$comment": "Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships.",
3349
3340
  "bomType": "cbom",
3350
3341
  "format": "cyclonedx",
3351
3342
  "document": {
@@ -3354,7 +3345,6 @@
3354
3345
  }
3355
3346
  },
3356
3347
  {
3357
- "$comment": "Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base.",
3358
3348
  "bomType": "ai-model",
3359
3349
  "format": "cyclonedx-ml",
3360
3350
  "model": {
@@ -3394,7 +3384,6 @@
3394
3384
  }
3395
3385
  },
3396
3386
  {
3397
- "$comment": "Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.",
3398
3387
  "bomType": "dataset",
3399
3388
  "format": "croissant",
3400
3389
  "dataset": {
@@ -3629,9 +3618,9 @@
3629
3618
  }
3630
3619
  }
3631
3620
  },
3632
- "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0": {
3621
+ "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0": {
3633
3622
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3634
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0",
3623
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0",
3635
3624
  "title": "HDF System Primitives",
3636
3625
  "description": "Types for describing system architecture, authorization boundaries, and components.",
3637
3626
  "$defs": {
@@ -3682,7 +3671,7 @@
3682
3671
  "description": "Rationale for why this override is needed."
3683
3672
  },
3684
3673
  "approvedBy": {
3685
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
3674
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
3686
3675
  "description": "Identity of the person or system that approved this override."
3687
3676
  }
3688
3677
  },
@@ -3764,9 +3753,9 @@
3764
3753
  }
3765
3754
  }
3766
3755
  },
3767
- "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0": {
3756
+ "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0": {
3768
3757
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3769
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0",
3758
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0",
3770
3759
  "title": "HDF Statistics Primitives",
3771
3760
  "description": "Statistics types for tracking assessment run metrics.",
3772
3761
  "$defs": {
@@ -3835,9 +3824,9 @@
3835
3824
  }
3836
3825
  }
3837
3826
  },
3838
- "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0": {
3827
+ "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0": {
3839
3828
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3840
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0",
3829
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0",
3841
3830
  "title": "HDF Extension Primitives",
3842
3831
  "description": "Extension types for waivers, attestations, generators, and integrity.",
3843
3832
  "$defs": {
@@ -3867,20 +3856,20 @@
3867
3856
  "externalReferences": {
3868
3857
  "type": "array",
3869
3858
  "items": {
3870
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
3859
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
3871
3860
  },
3872
3861
  "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."
3873
3862
  },
3874
3863
  "type": {
3875
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type",
3864
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
3876
3865
  "description": "The type of override applied to this requirement."
3877
3866
  },
3878
3867
  "status": {
3879
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
3868
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
3880
3869
  "description": "The new status this override sets for the requirement. Optional when only impact is being overridden."
3881
3870
  },
3882
3871
  "impact": {
3883
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Impact_Override",
3872
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Impact_Override",
3884
3873
  "description": "Override to the requirement's impact score. At least one of status or impact must be set."
3885
3874
  },
3886
3875
  "reason": {
@@ -3888,7 +3877,7 @@
3888
3877
  "description": "Explanation for why this override was applied."
3889
3878
  },
3890
3879
  "appliedBy": {
3891
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
3880
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
3892
3881
  "description": "Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."
3893
3882
  },
3894
3883
  "appliedAt": {
@@ -3902,30 +3891,31 @@
3902
3891
  "description": "Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."
3903
3892
  },
3904
3893
  "signature": {
3905
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
3894
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
3906
3895
  "description": "Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."
3907
3896
  },
3908
3897
  "evidence": {
3909
3898
  "type": "array",
3910
3899
  "items": {
3911
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
3900
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
3912
3901
  },
3913
3902
  "description": "Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."
3914
3903
  },
3915
3904
  "previousChecksum": {
3916
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
3905
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
3917
3906
  "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
3918
3907
  },
3919
3908
  "cvss": {
3920
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
3909
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
3921
3910
  "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
3922
3911
  "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
3923
3912
  },
3924
3913
  "justification": {
3925
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Justification",
3914
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Justification",
3926
3915
  "description": "Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."
3927
3916
  }
3928
3917
  },
3918
+ "$comment": "Example 3: Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
3929
3919
  "examples": [
3930
3920
  {
3931
3921
  "type": "waiver",
@@ -3952,7 +3942,6 @@
3952
3942
  "expiresAt": "2026-10-14T00:00:00Z"
3953
3943
  },
3954
3944
  {
3955
- "$comment": "Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
3956
3945
  "type": "riskAdjustment",
3957
3946
  "impact": {
3958
3947
  "value": 0.9
@@ -4058,7 +4047,7 @@
4058
4047
  "description": "Detailed explanation of the plan, including what actions will be taken."
4059
4048
  },
4060
4049
  "appliedBy": {
4061
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
4050
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
4062
4051
  "description": "Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."
4063
4052
  },
4064
4053
  "appliedAt": {
@@ -4074,23 +4063,23 @@
4074
4063
  "milestones": {
4075
4064
  "type": "array",
4076
4065
  "items": {
4077
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"
4066
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
4078
4067
  },
4079
4068
  "description": "Optional array of milestones tracking progress toward completion."
4080
4069
  },
4081
4070
  "signature": {
4082
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
4071
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
4083
4072
  "description": "Optional digital signature for enhanced trust and non-repudiation."
4084
4073
  },
4085
4074
  "evidence": {
4086
4075
  "type": "array",
4087
4076
  "items": {
4088
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
4077
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
4089
4078
  },
4090
4079
  "description": "Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."
4091
4080
  },
4092
4081
  "previousChecksum": {
4093
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
4082
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
4094
4083
  "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
4095
4084
  }
4096
4085
  },
@@ -4243,7 +4232,7 @@
4243
4232
  },
4244
4233
  "properties": {
4245
4234
  "algorithm": {
4246
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Hash_Algorithm",
4235
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Hash_Algorithm",
4247
4236
  "description": "The hash algorithm used for the checksum."
4248
4237
  },
4249
4238
  "checksum": {
@@ -4276,9 +4265,9 @@
4276
4265
  }
4277
4266
  }
4278
4267
  },
4279
- "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0": {
4268
+ "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0": {
4280
4269
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4281
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0",
4270
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0",
4282
4271
  "title": "HDF Amendment Primitives",
4283
4272
  "description": "Types for waivers, attestations, and POA&Ms that modify requirement compliance status.",
4284
4273
  "$defs": {
@@ -4389,7 +4378,7 @@
4389
4378
  "externalReferences": {
4390
4379
  "type": "array",
4391
4380
  "items": {
4392
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
4381
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
4393
4382
  },
4394
4383
  "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."
4395
4384
  },
@@ -4406,7 +4395,7 @@
4406
4395
  "description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
4407
4396
  },
4408
4397
  "status": {
4409
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
4398
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
4410
4399
  "description": "The new status this amendment sets. Optional when only impact is being overridden."
4411
4400
  },
4412
4401
  "impact": {
@@ -4418,7 +4407,7 @@
4418
4407
  "description": "Justification for this amendment."
4419
4408
  },
4420
4409
  "appliedBy": {
4421
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
4410
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
4422
4411
  "description": "Identity of who applied this amendment."
4423
4412
  },
4424
4413
  "appliedAt": {
@@ -4434,20 +4423,20 @@
4434
4423
  "evidence": {
4435
4424
  "type": "array",
4436
4425
  "items": {
4437
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
4426
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
4438
4427
  },
4439
4428
  "description": "Supporting evidence (screenshots, logs, URLs, documents)."
4440
4429
  },
4441
4430
  "signature": {
4442
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
4431
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
4443
4432
  "description": "Digital signature for non-repudiation."
4444
4433
  },
4445
4434
  "previousChecksum": {
4446
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
4435
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
4447
4436
  "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
4448
4437
  },
4449
4438
  "cvss": {
4450
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
4439
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
4451
4440
  "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
4452
4441
  "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
4453
4442
  },
@@ -4458,7 +4447,7 @@
4458
4447
  "milestones": {
4459
4448
  "type": "array",
4460
4449
  "items": {
4461
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"
4450
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
4462
4451
  },
4463
4452
  "description": "Remediation milestones (primarily for POA&M type amendments)."
4464
4453
  },
@@ -4475,11 +4464,12 @@
4475
4464
  "affectedPackages": {
4476
4465
  "type": "array",
4477
4466
  "items": {
4478
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"
4467
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
4479
4468
  },
4480
4469
  "description": "Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."
4481
4470
  }
4482
4471
  },
4472
+ "$comment": "Example 7: VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.",
4483
4473
  "examples": [
4484
4474
  {
4485
4475
  "type": "waiver",
@@ -4581,7 +4571,6 @@
4581
4571
  "expiresAt": "2026-09-26T00:00:00Z"
4582
4572
  },
4583
4573
  {
4584
- "$comment": "VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.",
4585
4574
  "type": "falsePositive",
4586
4575
  "requirementId": "CVE-2026-12345",
4587
4576
  "status": "notApplicable",
@@ -4608,9 +4597,9 @@
4608
4597
  }
4609
4598
  }
4610
4599
  },
4611
- "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0": {
4600
+ "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0": {
4612
4601
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4613
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0",
4602
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0",
4614
4603
  "title": "HDF CVSS Primitives",
4615
4604
  "description": "Types for representing CVSS (Common Vulnerability Scoring System) data attached to assessment findings. Supports CVSS v2.0, v3.0, v3.1, and v4.0 metric groups (Base, Threat, Environmental, Supplemental).",
4616
4605
  "$defs": {
@@ -4674,7 +4663,7 @@
4674
4663
  ]
4675
4664
  }
4676
4665
  ],
4677
- "$comment": "Only `version` is required; every metric/score field is optional because a single Cvss instance may represent vendor-supplied Base data (on a finding's cvss[]), consumer-supplied enrichment (on a riskAdjustment override — Environmental/Threat/Supplemental deltas with NO base, since base is the finding's scan-specific vendor data), or a fully-resolved effectiveCvss. The Base/Threat/Environmental/Supplemental groups do not partition cleanly into vendor-vs-consumer (Threat straddles: vendor temporal data and consumer exploit-maturity both live here), so a single permissive type is more honest than separate vendor/consumer types. The anyOf guardrail rejects a content-free object (e.g. {version} alone) by requiring at least one substantive metric or score. baseVector remains optional even when baseScore is present: some vendor tools (Twistlock/Prisma Cloud) emit a final score without the vector that derived it — that score is captured structurally rather than lost.",
4666
+ "$comment": "Only `version` is required; every metric/score field is optional because a single Cvss instance may represent vendor-supplied Base data (on a finding's cvss[]), consumer-supplied enrichment (on a riskAdjustment override — Environmental/Threat/Supplemental deltas with NO base, since base is the finding's scan-specific vendor data), or a fully-resolved effectiveCvss. The Base/Threat/Environmental/Supplemental groups do not partition cleanly into vendor-vs-consumer (Threat straddles: vendor temporal data and consumer exploit-maturity both live here), so a single permissive type is more honest than separate vendor/consumer types. The anyOf guardrail rejects a content-free object (e.g. {version} alone) by requiring at least one substantive metric or score. baseVector remains optional even when baseScore is present: some vendor tools (Twistlock/Prisma Cloud) emit a final score without the vector that derived it — that score is captured structurally rather than lost. Examples, in order: 1) Base-only: vendor-supplied CVSS 3.1 data exactly as a scanner (e.g., Nessus, Grype) would emit it. No consumer enrichment yet; 2) Base + Threat: consumer added Exploit Maturity ('E:U' = Unproven) and Remediation Level ('RL:O' = Official Fix) to a HTTP/2 'Rapid Reset' DoS finding. Threat score drops from base 7.5 to 5.5; 3) Base + Environmental: consumer asserts the affected system is high-criticality (CR:H, IR:H, AR:H) AND network-reachable in their environment (MAV:N). Environmental score reflects deployment risk for the xz-utils backdoor; 4) Full CVSS 4.0: vendor base + consumer threat (E:A = Attacked, exploits seen in the wild) + environmental (high CIA requirements) + supplemental context (S:P = present safety impact, AU:N = no autonomous spread, RE:M = moderate response effort) for the Fortinet FortiOS pre-auth RCE. computedScore reflects post-mitigation final risk; 5) CVSS 2.0 legacy: Heartbleed (CVE-2014-0160) as still reported by older scanner output and legacy NVD data. CVSS 2.0 vectors have no 'CVSS:2.0/' prefix.",
4678
4667
  "properties": {
4679
4668
  "version": {
4680
4669
  "type": "string",
@@ -4754,7 +4743,6 @@
4754
4743
  },
4755
4744
  "examples": [
4756
4745
  {
4757
- "$comment": "Base-only: vendor-supplied CVSS 3.1 data exactly as a scanner (e.g., Nessus, Grype) would emit it. No consumer enrichment yet.",
4758
4746
  "version": "3.1",
4759
4747
  "source": "CVE-2024-12345",
4760
4748
  "baseVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
@@ -4762,7 +4750,6 @@
4762
4750
  "baseSeverity": "critical"
4763
4751
  },
4764
4752
  {
4765
- "$comment": "Base + Threat: consumer added Exploit Maturity ('E:U' = Unproven) and Remediation Level ('RL:O' = Official Fix) to a HTTP/2 'Rapid Reset' DoS finding. Threat score drops from base 7.5 to 5.5.",
4766
4753
  "version": "3.1",
4767
4754
  "source": "CVE-2023-44487",
4768
4755
  "baseVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
@@ -4772,7 +4759,6 @@
4772
4759
  "threatScore": 5.5
4773
4760
  },
4774
4761
  {
4775
- "$comment": "Base + Environmental: consumer asserts the affected system is high-criticality (CR:H, IR:H, AR:H) AND network-reachable in their environment (MAV:N). Environmental score reflects deployment risk for the xz-utils backdoor.",
4776
4762
  "version": "3.1",
4777
4763
  "source": "CVE-2024-3094",
4778
4764
  "baseVector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
@@ -4784,7 +4770,6 @@
4784
4770
  "computedSeverity": "critical"
4785
4771
  },
4786
4772
  {
4787
- "$comment": "Full CVSS 4.0: vendor base + consumer threat (E:A = Attacked, exploits seen in the wild) + environmental (high CIA requirements) + supplemental context (S:P = present safety impact, AU:N = no autonomous spread, RE:M = moderate response effort) for the Fortinet FortiOS pre-auth RCE. computedScore reflects post-mitigation final risk.",
4788
4773
  "version": "4.0",
4789
4774
  "source": "CVE-2024-21762",
4790
4775
  "baseVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
@@ -4799,7 +4784,6 @@
4799
4784
  "computedSeverity": "medium"
4800
4785
  },
4801
4786
  {
4802
- "$comment": "CVSS 2.0 legacy: Heartbleed (CVE-2014-0160) as still reported by older scanner output and legacy NVD data. CVSS 2.0 vectors have no 'CVSS:2.0/' prefix.",
4803
4787
  "version": "2.0",
4804
4788
  "source": "CVE-2014-0160",
4805
4789
  "baseVector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
@@ -4812,9 +4796,9 @@
4812
4796
  }
4813
4797
  }
4814
4798
  },
4815
- "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0": {
4799
+ "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0": {
4816
4800
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4817
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0",
4801
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0",
4818
4802
  "title": "HDF Affected Package Primitives",
4819
4803
  "description": "Types for representing the software package(s) affected by a vulnerability finding.",
4820
4804
  "$defs": {
@@ -4880,9 +4864,9 @@
4880
4864
  "description": "Optional version string identifying the first release that contains the fix for the vulnerability. Use the same version syntax as `version`. Example: '1.1.1l' fixes 'openssl@1.1.1k'."
4881
4865
  }
4882
4866
  },
4867
+ "$comment": "Examples, in order: 1) RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan; 2) NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier; 3) Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings; 4) Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed; 5) purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly; 6) cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.",
4883
4868
  "examples": [
4884
4869
  {
4885
- "$comment": "RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan.",
4886
4870
  "name": "openssl",
4887
4871
  "version": "1.1.1k-7.el8_4",
4888
4872
  "ecosystem": "rpm",
@@ -4891,7 +4875,6 @@
4891
4875
  "fixedInVersion": "1.1.1l"
4892
4876
  },
4893
4877
  {
4894
- "$comment": "NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier.",
4895
4878
  "name": "lodash",
4896
4879
  "version": "4.17.20",
4897
4880
  "ecosystem": "npm",
@@ -4899,13 +4882,11 @@
4899
4882
  "fixedInVersion": "4.17.21"
4900
4883
  },
4901
4884
  {
4902
- "$comment": "Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings.",
4903
4885
  "name": "requests",
4904
4886
  "version": "2.28.1",
4905
4887
  "ecosystem": "pypi"
4906
4888
  },
4907
4889
  {
4908
- "$comment": "Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed.",
4909
4890
  "name": "org.apache.logging.log4j:log4j-core",
4910
4891
  "version": "2.14.1",
4911
4892
  "ecosystem": "maven",
@@ -4914,11 +4895,9 @@
4914
4895
  "fixedInVersion": "2.17.1"
4915
4896
  },
4916
4897
  {
4917
- "$comment": "purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly.",
4918
4898
  "purl": "pkg:npm/lodash@4.17.20"
4919
4899
  },
4920
4900
  {
4921
- "$comment": "cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.",
4922
4901
  "cpe": "cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*"
4923
4902
  }
4924
4903
  ],
@@ -4927,9 +4906,9 @@
4927
4906
  }
4928
4907
  }
4929
4908
  },
4930
- "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0": {
4909
+ "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0": {
4931
4910
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4932
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0",
4911
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0",
4933
4912
  "title": "HDF Runner Primitive",
4934
4913
  "description": "Information about the test execution environment where the security tool/scanner was executed.",
4935
4914
  "$defs": {
@@ -4973,7 +4952,7 @@
4973
4952
  "description": "The container instance identifier. Example: 'a1b2c3d4e5f6', 'security-scan-job-xyz123'. Can be a Docker container ID, Kubernetes pod name, or other container runtime identifier."
4974
4953
  },
4975
4954
  "operator": {
4976
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
4955
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
4977
4956
  "description": "The identity of the person or system responsible for executing the test. This could be a human auditor manually completing a checklist, an automated CI/CD system, or a security tool. Optional field to support both automated and manual HDF generation."
4978
4957
  }
4979
4958
  },
@@ -5022,9 +5001,9 @@
5022
5001
  }
5023
5002
  }
5024
5003
  },
5025
- "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0": {
5004
+ "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0": {
5026
5005
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5027
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0",
5006
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0",
5028
5007
  "title": "HDF Parameter Primitives",
5029
5008
  "description": "Input/parameter type definitions for typed, traceable configuration values that bridge governance prose and scanner automation.",
5030
5009
  "$defs": {
@@ -5155,9 +5134,9 @@
5155
5134
  }
5156
5135
  }
5157
5136
  },
5158
- "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0": {
5137
+ "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0": {
5159
5138
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5160
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0",
5139
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0",
5161
5140
  "title": "HDF EPSS Primitive",
5162
5141
  "description": "Type for representing FIRST.org's Exploit Prediction Scoring System (EPSS) data for a vulnerability. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days. See https://www.first.org/epss/ for the underlying model and methodology.",
5163
5142
  "$defs": {
@@ -5189,21 +5168,19 @@
5189
5168
  "description": "ISO 8601 date (YYYY-MM-DD) on which FIRST.org published this EPSS score."
5190
5169
  }
5191
5170
  },
5171
+ "$comment": "Examples, in order: 1) High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure; 2) Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation; 3) Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.",
5192
5172
  "examples": [
5193
5173
  {
5194
- "$comment": "High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure.",
5195
5174
  "score": 0.97532,
5196
5175
  "percentile": 0.99987,
5197
5176
  "date": "2026-05-26"
5198
5177
  },
5199
5178
  {
5200
- "$comment": "Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation.",
5201
5179
  "score": 0.04521,
5202
5180
  "percentile": 0.78432,
5203
5181
  "date": "2026-05-26"
5204
5182
  },
5205
5183
  {
5206
- "$comment": "Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.",
5207
5184
  "score": 0.00042,
5208
5185
  "percentile": 0.10215,
5209
5186
  "date": "2026-05-26"
@@ -5214,9 +5191,9 @@
5214
5191
  }
5215
5192
  }
5216
5193
  },
5217
- "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0": {
5194
+ "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0": {
5218
5195
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5219
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0",
5196
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0",
5220
5197
  "title": "HDF Kev Primitives",
5221
5198
  "description": "Types for representing CISA Known Exploited Vulnerabilities (KEV) catalog membership. The KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) flags CVEs that are confirmed actively exploited in the wild and drives federal patching urgency under CISA Binding Operational Directive 22-01.",
5222
5199
  "$defs": {
@@ -5262,23 +5239,21 @@
5262
5239
  "description": "CISA's notes describing the vulnerability, observed exploitation, or remediation guidance."
5263
5240
  }
5264
5241
  },
5242
+ "$comment": "Examples, in order: 1) High-urgency case: recently added KEV entry with a short federal patching deadline; 2) Older KEV entry whose due date has already passed — useful for reporting overdue remediation; 3) Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.",
5265
5243
  "examples": [
5266
5244
  {
5267
- "$comment": "High-urgency case: recently added KEV entry with a short federal patching deadline.",
5268
5245
  "inKev": true,
5269
5246
  "dateAdded": "2026-03-15",
5270
5247
  "dueDate": "2026-04-05",
5271
5248
  "notes": "Active ransomware exploitation observed; apply vendor patch immediately."
5272
5249
  },
5273
5250
  {
5274
- "$comment": "Older KEV entry whose due date has already passed — useful for reporting overdue remediation.",
5275
5251
  "inKev": true,
5276
5252
  "dateAdded": "2023-11-07",
5277
5253
  "dueDate": "2023-11-28",
5278
5254
  "notes": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
5279
5255
  },
5280
5256
  {
5281
- "$comment": "Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.",
5282
5257
  "inKev": false
5283
5258
  }
5284
5259
  ],