@mitre/hdf-schema 3.6.0 → 3.7.0-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +8 -2
  2. package/dist/go/hdf.go +20 -12
  3. package/dist/index.js +28 -28
  4. package/dist/schemas/hdf-amendments.schema.json +95 -48
  5. package/dist/schemas/hdf-baseline.schema.json +100 -53
  6. package/dist/schemas/hdf-comparison.schema.json +177 -130
  7. package/dist/schemas/hdf-evidence-package.schema.json +96 -49
  8. package/dist/schemas/hdf-plan.schema.json +101 -54
  9. package/dist/schemas/hdf-requirement-change-event.schema.json +167 -120
  10. package/dist/schemas/hdf-results.schema.json +153 -106
  11. package/dist/schemas/hdf-system.schema.json +116 -69
  12. package/dist/ts/hdf.d.ts +12 -2
  13. package/dist/ts/hdf.ts +12 -2
  14. package/package.json +2 -2
package/dist/schemas/hdf-amendments.schema.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-amendments/v3.6.0",
3
+ "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-amendments/v3.7.0",
4
4
  "title": "HDF Amendments",
5
5
  "description": "Waivers, attestations, and POA&Ms that modify requirement compliance status or impact. Amendments are standalone documents that can be applied to results via merge operations.",
6
6
  "type": "object",
@@ -29,18 +29,18 @@
29
29
  "description": "URI to the hdf-system document these amendments apply to."
30
30
  },
31
31
  "appliedBy": {
32
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
32
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
33
33
  "description": "Default identity of who created this amendments document. Individual overrides may specify their own appliedBy."
34
34
  },
35
35
  "approvedBy": {
36
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
36
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
37
37
  "description": "Identity of the authorizing official who approved these amendments."
38
38
  },
39
39
  "overrides": {
40
40
  "type": "array",
41
41
  "minItems": 1,
42
42
  "items": {
43
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Standalone_Override"
43
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Standalone_Override"
44
44
  },
45
45
  "description": "The set of amendments (waivers, attestations, POA&Ms, and other overrides)."
46
46
  },
@@ -52,11 +52,11 @@
52
52
  "description": "Optional key-value labels for grouping and querying amendments."
53
53
  },
54
54
  "integrity": {
55
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
55
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity",
56
56
  "description": "Cryptographic integrity information for verifying this amendments document has not been tampered with."
57
57
  },
58
58
  "signature": {
59
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
59
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
60
60
  "description": "Document-level digital signature covering all amendments."
61
61
  },
62
62
  "version": {
@@ -64,7 +64,7 @@
64
64
  "description": "Version of this amendments document."
65
65
  },
66
66
  "generator": {
67
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Generator",
67
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator",
68
68
  "description": "Information about the tool that generated this document."
69
69
  }
70
70
  },
@@ -101,9 +101,9 @@
101
101
  }
102
102
  ],
103
103
  "$defs": {
104
- "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0": {
104
+ "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0": {
105
105
  "$schema": "https://json-schema.org/draft/2020-12/schema",
106
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0",
106
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0",
107
107
  "title": "HDF Common Primitives",
108
108
  "description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
109
109
  "$defs": {
@@ -543,6 +543,24 @@
543
543
  "type",
544
544
  "data"
545
545
  ],
546
+ "if": {
547
+ "properties": {
548
+ "encoding": {
549
+ "const": "base64"
550
+ }
551
+ },
552
+ "required": [
553
+ "encoding"
554
+ ]
555
+ },
556
+ "then": {
557
+ "properties": {
558
+ "data": {
559
+ "pattern": "^[0-9A-Za-z+/]+={0,2}$",
560
+ "contentEncoding": "base64"
561
+ }
562
+ }
563
+ },
546
564
  "properties": {
547
565
  "type": {
548
566
  "type": "string",
@@ -559,7 +577,8 @@
559
577
  },
560
578
  "data": {
561
579
  "type": "string",
562
- "description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string."
580
+ "minLength": 1,
581
+ "description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string. Must not be empty. When encoding is 'base64', data must be bare base64 matching ^[0-9A-Za-z+/]+={0,2}$ (OSCAL's Base64Datatype): no data: URI prefix, URL, or line breaks."
563
582
  },
564
583
  "description": {
565
584
  "type": "string",
@@ -571,7 +590,7 @@
571
590
  },
572
591
  "encoding": {
573
592
  "type": "string",
574
- "description": "Encoding used for the data. Example: 'base64', 'utf-8'."
593
+ "description": "Encoding used for the data. Example: 'base64', 'utf-8'. The value 'base64' (exactly, lowercase) requires data to be bare base64."
575
594
  },
576
595
  "size": {
577
596
  "type": "number",
@@ -635,6 +654,7 @@
635
654
  }
636
655
  }
637
656
  ],
657
+ "$comment": "Examples, in order: 1) base64-encoded PNG screenshot with full capture provenance; 2) raw configuration text; 3) log excerpt; 4) URL to an external ticket; 5) base64-encoded file captured by an automated system.",
638
658
  "description": "Supporting evidence for a finding or override, such as screenshots, code samples, log excerpts, or URLs.",
639
659
  "title": "Evidence"
640
660
  },
@@ -712,6 +732,13 @@
712
732
  "status"
713
733
  ],
714
734
  "properties": {
735
+ "title": {
736
+ "type": "string",
737
+ "minLength": 1,
738
+ "pattern": "^[^ \\t\\n\\r]([^\\n\\r]*[^ \\t\\n\\r])?$",
739
+ "$comment": "The pattern is OSCAL's StringDatatype (\\S(.*\\S)?) as its XSD defines \\S and '.', spelled with explicit classes so ECMA-262 and Go regexp engines agree: \\S and '.' differ between them on CR and non-ASCII whitespace.",
740
+ "description": "Short single-line label for this milestone, suitable where a consumer needs a title (for example an OSCAL POA&M remediation or task). No line breaks, and no leading or trailing whitespace. The description remains the full text of the milestone; the title does not replace it."
741
+ },
715
742
  "description": {
716
743
  "type": "string",
717
744
  "description": "Description of this milestone or task."
@@ -741,6 +768,25 @@
741
768
  "description": "Identity of who completed this milestone."
742
769
  }
743
770
  },
771
+ "examples": [
772
+ {
773
+ "title": "Deploy OpenSSH 9.8p1",
774
+ "description": "Upgrade OpenSSH to 9.8p1 on every RHEL 9 host in the web tier to remediate CVE-2024-6387, then restart sshd during the Saturday maintenance window.",
775
+ "estimatedCompletion": "2026-10-31T00:00:00Z",
776
+ "status": "inProgress"
777
+ },
778
+ {
779
+ "description": "Isolate the affected host on a restricted VLAN until the vendor patch is available.",
780
+ "estimatedCompletion": "2026-09-05T00:00:00Z",
781
+ "status": "completed",
782
+ "completedAt": "2026-09-04T14:30:00Z",
783
+ "completedBy": {
784
+ "identifier": "network-admin@example.com",
785
+ "type": "email"
786
+ }
787
+ }
788
+ ],
789
+ "$comment": "Examples, in order: 1) titled milestone in progress — the title is the short label, the description the full remediation text; 2) untitled completed milestone with completion provenance — title is optional, and a consumer needing one derives it.",
744
790
  "description": "A milestone or task within a POA&M remediation plan.",
745
791
  "title": "Milestone"
746
792
  },
@@ -1030,7 +1076,7 @@
1030
1076
  "description": "Whether the requirement is mandatory within its baseline.\n\nDistinct from severity (risk weight) and status (lifecycle state).\n\nMaps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).\n\nOptional: when omitted, consumers should treat the requirement as 'required' by convention."
1031
1077
  }
1032
1078
  },
1033
- "$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.6.0 (backward compatibility); 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
1079
+ "$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape for backward compatibility; 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
1034
1080
  "examples": [
1035
1081
  {
1036
1082
  "id": "SV-238196",
@@ -1166,9 +1212,9 @@
1166
1212
  }
1167
1213
  }
1168
1214
  },
1169
- "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0": {
1215
+ "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0": {
1170
1216
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1171
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0",
1217
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0",
1172
1218
  "title": "HDF Amendment Primitives",
1173
1219
  "description": "Types for waivers, attestations, and POA&Ms that modify requirement compliance status.",
1174
1220
  "$defs": {
@@ -1279,7 +1325,7 @@
1279
1325
  "externalReferences": {
1280
1326
  "type": "array",
1281
1327
  "items": {
1282
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
1328
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
1283
1329
  },
1284
1330
  "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."
1285
1331
  },
@@ -1289,6 +1335,7 @@
1289
1335
  },
1290
1336
  "requirementId": {
1291
1337
  "type": "string",
1338
+ "minLength": 1,
1292
1339
  "description": "The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."
1293
1340
  },
1294
1341
  "baselineRef": {
@@ -1296,7 +1343,7 @@
1296
1343
  "description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
1297
1344
  },
1298
1345
  "status": {
1299
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
1346
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
1300
1347
  "description": "The new status this amendment sets. Optional when only impact is being overridden."
1301
1348
  },
1302
1349
  "impact": {
@@ -1308,7 +1355,7 @@
1308
1355
  "description": "Justification for this amendment."
1309
1356
  },
1310
1357
  "appliedBy": {
1311
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
1358
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
1312
1359
  "description": "Identity of who applied this amendment."
1313
1360
  },
1314
1361
  "appliedAt": {
@@ -1324,20 +1371,20 @@
1324
1371
  "evidence": {
1325
1372
  "type": "array",
1326
1373
  "items": {
1327
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
1374
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
1328
1375
  },
1329
1376
  "description": "Supporting evidence (screenshots, logs, URLs, documents)."
1330
1377
  },
1331
1378
  "signature": {
1332
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
1379
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
1333
1380
  "description": "Digital signature for non-repudiation."
1334
1381
  },
1335
1382
  "previousChecksum": {
1336
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
1383
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
1337
1384
  "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
1338
1385
  },
1339
1386
  "cvss": {
1340
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
1387
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss",
1341
1388
  "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
1342
1389
  "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
1343
1390
  },
@@ -1348,7 +1395,7 @@
1348
1395
  "milestones": {
1349
1396
  "type": "array",
1350
1397
  "items": {
1351
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
1398
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"
1352
1399
  },
1353
1400
  "description": "Remediation milestones (primarily for POA&M type amendments)."
1354
1401
  },
@@ -1365,7 +1412,7 @@
1365
1412
  "affectedPackages": {
1366
1413
  "type": "array",
1367
1414
  "items": {
1368
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
1415
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"
1369
1416
  },
1370
1417
  "description": "Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."
1371
1418
  }
@@ -1498,9 +1545,9 @@
1498
1545
  }
1499
1546
  }
1500
1547
  },
1501
- "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0": {
1548
+ "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0": {
1502
1549
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1503
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0",
1550
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0",
1504
1551
  "title": "HDF Result Primitives",
1505
1552
  "description": "Types for representing assessment results and statuses.",
1506
1553
  "$defs": {
@@ -1631,9 +1678,9 @@
1631
1678
  }
1632
1679
  }
1633
1680
  },
1634
- "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0": {
1681
+ "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0": {
1635
1682
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1636
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0",
1683
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0",
1637
1684
  "title": "HDF CVSS Primitives",
1638
1685
  "description": "Types for representing CVSS (Common Vulnerability Scoring System) data attached to assessment findings. Supports CVSS v2.0, v3.0, v3.1, and v4.0 metric groups (Base, Threat, Environmental, Supplemental).",
1639
1686
  "$defs": {
@@ -1830,9 +1877,9 @@
1830
1877
  }
1831
1878
  }
1832
1879
  },
1833
- "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0": {
1880
+ "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0": {
1834
1881
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1835
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0",
1882
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0",
1836
1883
  "title": "HDF Affected Package Primitives",
1837
1884
  "description": "Types for representing the software package(s) affected by a vulnerability finding.",
1838
1885
  "$defs": {
@@ -1940,9 +1987,9 @@
1940
1987
  }
1941
1988
  }
1942
1989
  },
1943
- "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0": {
1990
+ "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0": {
1944
1991
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1945
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0",
1992
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0",
1946
1993
  "title": "HDF Extension Primitives",
1947
1994
  "description": "Extension types for waivers, attestations, generators, and integrity.",
1948
1995
  "$defs": {
@@ -1972,20 +2019,20 @@
1972
2019
  "externalReferences": {
1973
2020
  "type": "array",
1974
2021
  "items": {
1975
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
2022
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
1976
2023
  },
1977
2024
  "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."
1978
2025
  },
1979
2026
  "type": {
1980
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
2027
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type",
1981
2028
  "description": "The type of override applied to this requirement."
1982
2029
  },
1983
2030
  "status": {
1984
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
2031
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
1985
2032
  "description": "The new status this override sets for the requirement. Optional when only impact is being overridden."
1986
2033
  },
1987
2034
  "impact": {
1988
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Impact_Override",
2035
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Impact_Override",
1989
2036
  "description": "Override to the requirement's impact score. At least one of status or impact must be set."
1990
2037
  },
1991
2038
  "reason": {
@@ -1993,7 +2040,7 @@
1993
2040
  "description": "Explanation for why this override was applied."
1994
2041
  },
1995
2042
  "appliedBy": {
1996
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
2043
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
1997
2044
  "description": "Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."
1998
2045
  },
1999
2046
  "appliedAt": {
@@ -2007,27 +2054,27 @@
2007
2054
  "description": "Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."
2008
2055
  },
2009
2056
  "signature": {
2010
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
2057
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
2011
2058
  "description": "Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."
2012
2059
  },
2013
2060
  "evidence": {
2014
2061
  "type": "array",
2015
2062
  "items": {
2016
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
2063
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
2017
2064
  },
2018
2065
  "description": "Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."
2019
2066
  },
2020
2067
  "previousChecksum": {
2021
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
2068
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
2022
2069
  "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
2023
2070
  },
2024
2071
  "cvss": {
2025
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
2072
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss",
2026
2073
  "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
2027
2074
  "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
2028
2075
  },
2029
2076
  "justification": {
2030
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Justification",
2077
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Justification",
2031
2078
  "description": "Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."
2032
2079
  }
2033
2080
  },
@@ -2120,7 +2167,7 @@
2120
2167
  "evidence": [
2121
2168
  {
2122
2169
  "type": "screenshot",
2123
- "data": "base64-encoded-screenshot-data-here",
2170
+ "data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
2124
2171
  "description": "Screenshot showing firewall configuration",
2125
2172
  "mimeType": "image/png",
2126
2173
  "encoding": "base64",
@@ -2163,7 +2210,7 @@
2163
2210
  "description": "Detailed explanation of the plan, including what actions will be taken."
2164
2211
  },
2165
2212
  "appliedBy": {
2166
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
2213
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
2167
2214
  "description": "Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."
2168
2215
  },
2169
2216
  "appliedAt": {
@@ -2179,23 +2226,23 @@
2179
2226
  "milestones": {
2180
2227
  "type": "array",
2181
2228
  "items": {
2182
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
2229
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"
2183
2230
  },
2184
2231
  "description": "Optional array of milestones tracking progress toward completion."
2185
2232
  },
2186
2233
  "signature": {
2187
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
2234
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
2188
2235
  "description": "Optional digital signature for enhanced trust and non-repudiation."
2189
2236
  },
2190
2237
  "evidence": {
2191
2238
  "type": "array",
2192
2239
  "items": {
2193
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
2240
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
2194
2241
  },
2195
2242
  "description": "Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."
2196
2243
  },
2197
2244
  "previousChecksum": {
2198
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
2245
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
2199
2246
  "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
2200
2247
  }
2201
2248
  },
@@ -2348,7 +2395,7 @@
2348
2395
  },
2349
2396
  "properties": {
2350
2397
  "algorithm": {
2351
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Hash_Algorithm",
2398
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Hash_Algorithm",
2352
2399
  "description": "The hash algorithm used for the checksum."
2353
2400
  },
2354
2401
  "checksum": {