npm - @mitre/hdf-schema - Versions diffs - 3.6.0 → 3.7.0 - Mend

@mitre/hdf-schema 3.6.0 → 3.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/README.md +8 -2
package/dist/go/hdf.go +20 -12
package/dist/index.js +28 -28
package/dist/schemas/hdf-amendments.schema.json +95 -48
package/dist/schemas/hdf-baseline.schema.json +100 -53
package/dist/schemas/hdf-comparison.schema.json +177 -130
package/dist/schemas/hdf-evidence-package.schema.json +96 -49
package/dist/schemas/hdf-plan.schema.json +101 -54
package/dist/schemas/hdf-requirement-change-event.schema.json +167 -120
package/dist/schemas/hdf-results.schema.json +153 -106
package/dist/schemas/hdf-system.schema.json +116 -69
package/dist/ts/hdf.d.ts +12 -2
package/dist/ts/hdf.ts +12 -2
package/package.json +2 -2

package/dist/schemas/hdf-comparison.schema.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-comparison/v3.6.0",
+  "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-comparison/v3.7.0",
   "type": "object",
   "unevaluatedProperties": false,
   "required": [
@@ -14,7 +14,7 @@
     "externalReferences": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
       },
       "description": "Optional references to external artifacts relevant to this comparison (CTI/STIX, advisories, or any URI-addressable artifact). Inert context; see External_Reference."
     },
@@ -24,7 +24,7 @@
       "description": "Schema version for this comparison format."
     },
     "comparisonMode": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Comparison_Mode",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Comparison_Mode",
       "description": "The mode of comparison being performed."
     },
     "timestamp": {
@@ -33,50 +33,50 @@
       "description": "When this comparison was performed."
     },
     "generator": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Generator",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator",
       "description": "Information about the tool that generated this comparison."
     },
     "sources": {
       "type": "array",
       "minItems": 2,
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Source"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Source"
       },
       "description": "The source documents being compared. At least two sources are required."
     },
     "matching": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Matching_Config",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Matching_Config",
       "description": "Configuration for how requirements were matched across sources."
     },
     "summary": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Comparison_Summary",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Comparison_Summary",
       "description": "Summary statistics for the overall comparison."
     },
     "baselineDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Baseline_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Baseline_Diff"
       },
       "description": "Comparison of baselines between sources."
     },
     "requirementDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Requirement_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Requirement_Diff"
       },
       "description": "Detailed comparison of individual requirements between sources."
     },
     "componentDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Component_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Component_Diff"
       },
       "description": "Comparison of components between two system documents. Used in systemDrift mode. A component's BOM changes surface as a field change on its boms[] here."
     },
     "packageDiffs": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Package_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Package_Diff"
       },
       "description": "RESERVED — not emitted by the current systemDrift comparison. systemDrift now reports a component's BOM changes as a field change on its boms[] (see componentDiffs), and standalone SBOM package diffing is a separate `hdf diff <sbom> <sbom>` output shape. This field is retained for a future normalized package-level diff; consumers must not expect it from today's systemDrift output."
     },
@@ -88,19 +88,19 @@
     "drift": {
       "type": "array",
       "items": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Requirement_Diff"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Requirement_Diff"
       },
       "description": "External/metadata changes separate from status changes (Terraform pattern)."
     },
     "annotations": {
       "type": "object",
       "additionalProperties": {
-        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Annotation"
+        "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0#/$defs/Annotation"
       },
       "description": "Map of annotation IDs to annotation objects, providing context or action items for requirement diffs."
     },
     "integrity": {
-      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
+      "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity",
       "description": "Cryptographic integrity information for verifying this comparison document."
     },
     "extensions": {
@@ -112,9 +112,9 @@
   "description": "Structured comparison between two or more HDF security assessment documents. Supports temporal, baseline, fleet, and multi-source comparison modes.",
   "title": "HDF Comparison",
   "$defs": {
-    "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0",
       "title": "HDF Common Primitives",
       "description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
       "$defs": {
@@ -554,6 +554,24 @@
             "type",
             "data"
           ],
+          "if": {
+            "properties": {
+              "encoding": {
+                "const": "base64"
+              }
+            },
+            "required": [
+              "encoding"
+            ]
+          },
+          "then": {
+            "properties": {
+              "data": {
+                "pattern": "^[0-9A-Za-z+/]+={0,2}$",
+                "contentEncoding": "base64"
+              }
+            }
+          },
           "properties": {
             "type": {
               "type": "string",
@@ -570,7 +588,8 @@
             },
             "data": {
               "type": "string",
-              "description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string."
+              "minLength": 1,
+              "description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string. Must not be empty. When encoding is 'base64', data must be bare base64 matching ^[0-9A-Za-z+/]+={0,2}$ (OSCAL's Base64Datatype): no data: URI prefix, URL, or line breaks."
             },
             "description": {
               "type": "string",
@@ -582,7 +601,7 @@
             },
             "encoding": {
               "type": "string",
-              "description": "Encoding used for the data. Example: 'base64', 'utf-8'."
+              "description": "Encoding used for the data. Example: 'base64', 'utf-8'. The value 'base64' (exactly, lowercase) requires data to be bare base64."
             },
             "size": {
               "type": "number",
@@ -646,6 +665,7 @@
               }
             }
           ],
+          "$comment": "Examples, in order: 1) base64-encoded PNG screenshot with full capture provenance; 2) raw configuration text; 3) log excerpt; 4) URL to an external ticket; 5) base64-encoded file captured by an automated system.",
           "description": "Supporting evidence for a finding or override, such as screenshots, code samples, log excerpts, or URLs.",
           "title": "Evidence"
         },
@@ -723,6 +743,13 @@
             "status"
           ],
           "properties": {
+            "title": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^[^ \\t\\n\\r]([^\\n\\r]*[^ \\t\\n\\r])?$",
+              "$comment": "The pattern is OSCAL's StringDatatype (\\S(.*\\S)?) as its XSD defines \\S and '.', spelled with explicit classes so ECMA-262 and Go regexp engines agree: \\S and '.' differ between them on CR and non-ASCII whitespace.",
+              "description": "Short single-line label for this milestone, suitable where a consumer needs a title (for example an OSCAL POA&M remediation or task). No line breaks, and no leading or trailing whitespace. The description remains the full text of the milestone; the title does not replace it."
+            },
             "description": {
               "type": "string",
               "description": "Description of this milestone or task."
@@ -752,6 +779,25 @@
               "description": "Identity of who completed this milestone."
             }
           },
+          "examples": [
+            {
+              "title": "Deploy OpenSSH 9.8p1",
+              "description": "Upgrade OpenSSH to 9.8p1 on every RHEL 9 host in the web tier to remediate CVE-2024-6387, then restart sshd during the Saturday maintenance window.",
+              "estimatedCompletion": "2026-10-31T00:00:00Z",
+              "status": "inProgress"
+            },
+            {
+              "description": "Isolate the affected host on a restricted VLAN until the vendor patch is available.",
+              "estimatedCompletion": "2026-09-05T00:00:00Z",
+              "status": "completed",
+              "completedAt": "2026-09-04T14:30:00Z",
+              "completedBy": {
+                "identifier": "network-admin@example.com",
+                "type": "email"
+              }
+            }
+          ],
+          "$comment": "Examples, in order: 1) titled milestone in progress — the title is the short label, the description the full remediation text; 2) untitled completed milestone with completion provenance — title is optional, and a consumer needing one derives it.",
           "description": "A milestone or task within a POA&M remediation plan.",
           "title": "Milestone"
         },
@@ -1041,7 +1087,7 @@
               "description": "Whether the requirement is mandatory within its baseline.\n\nDistinct from severity (risk weight) and status (lifecycle state).\n\nMaps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).\n\nOptional: when omitted, consumers should treat the requirement as 'required' by convention."
             }
           },
-          "$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.6.0 (backward compatibility); 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
+          "$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape for backward compatibility; 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
           "examples": [
             {
               "id": "SV-238196",
@@ -1177,9 +1223,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.7.0",
       "title": "HDF Comparison Primitives",
       "description": "Types for representing structured comparisons between HDF security assessment documents.",
       "$defs": {
@@ -1351,7 +1397,7 @@
               "description": "The original format of the source document before conversion to HDF."
             },
             "checksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "Cryptographic checksum of the source document for integrity verification."
             },
             "assessmentTimestamp": {
@@ -1360,13 +1406,13 @@
               "description": "When the source assessment was performed. ISO 8601 format."
             },
             "tool": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Tool",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Tool",
               "description": "The security tool that produced the assessment data in this source."
             },
             "components": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"
               },
               "description": "The components assessed in this source."
             },
@@ -1718,7 +1764,7 @@
             "before": {
               "oneOf": [
                 {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"
                 },
                 {
                   "type": "null"
@@ -1729,7 +1775,7 @@
             "after": {
               "oneOf": [
                 {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"
                 },
                 {
                   "type": "null"
@@ -1934,7 +1980,7 @@
             "before": {
               "oneOf": [
                 {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0#/$defs/Evaluated_Requirement"
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0#/$defs/Evaluated_Requirement"
                 },
                 {
                   "type": "null"
@@ -1945,7 +1991,7 @@
             "after": {
               "oneOf": [
                 {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0#/$defs/Evaluated_Requirement"
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0#/$defs/Evaluated_Requirement"
                 },
                 {
                   "type": "null"
@@ -2041,9 +2087,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0",
       "title": "HDF Extension Primitives",
       "description": "Extension types for waivers, attestations, generators, and integrity.",
       "$defs": {
@@ -2073,20 +2119,20 @@
             "externalReferences": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
               },
               "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."
             },
             "type": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type",
               "description": "The type of override applied to this requirement."
             },
             "status": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
               "description": "The new status this override sets for the requirement. Optional when only impact is being overridden."
             },
             "impact": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Impact_Override",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Impact_Override",
               "description": "Override to the requirement's impact score. At least one of status or impact must be set."
             },
             "reason": {
@@ -2094,7 +2140,7 @@
               "description": "Explanation for why this override was applied."
             },
             "appliedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
               "description": "Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."
             },
             "appliedAt": {
@@ -2108,27 +2154,27 @@
               "description": "Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."
             },
             "signature": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
               "description": "Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."
             },
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
               },
               "description": "Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."
             },
             "previousChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             },
             "cvss": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss",
               "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
               "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
             },
             "justification": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Justification",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Justification",
               "description": "Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."
             }
           },
@@ -2221,7 +2267,7 @@
               "evidence": [
                 {
                   "type": "screenshot",
-                  "data": "base64-encoded-screenshot-data-here",
+                  "data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
                   "description": "Screenshot showing firewall configuration",
                   "mimeType": "image/png",
                   "encoding": "base64",
@@ -2264,7 +2310,7 @@
               "description": "Detailed explanation of the plan, including what actions will be taken."
             },
             "appliedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
               "description": "Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."
             },
             "appliedAt": {
@@ -2280,23 +2326,23 @@
             "milestones": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"
               },
               "description": "Optional array of milestones tracking progress toward completion."
             },
             "signature": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
               "description": "Optional digital signature for enhanced trust and non-repudiation."
             },
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
               },
               "description": "Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."
             },
             "previousChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
             }
           },
@@ -2449,7 +2495,7 @@
           },
           "properties": {
             "algorithm": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Hash_Algorithm",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Hash_Algorithm",
               "description": "The hash algorithm used for the checksum."
             },
             "checksum": {
@@ -2482,9 +2528,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0",
       "title": "HDF Amendment Primitives",
       "description": "Types for waivers, attestations, and POA&Ms that modify requirement compliance status.",
       "$defs": {
@@ -2595,7 +2641,7 @@
             "externalReferences": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
               },
               "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."
             },
@@ -2605,6 +2651,7 @@
             },
             "requirementId": {
               "type": "string",
+              "minLength": 1,
               "description": "The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."
             },
             "baselineRef": {
@@ -2612,7 +2659,7 @@
               "description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
             },
             "status": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
               "description": "The new status this amendment sets. Optional when only impact is being overridden."
             },
             "impact": {
@@ -2624,7 +2671,7 @@
               "description": "Justification for this amendment."
             },
             "appliedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
               "description": "Identity of who applied this amendment."
             },
             "appliedAt": {
@@ -2640,20 +2687,20 @@
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
               },
               "description": "Supporting evidence (screenshots, logs, URLs, documents)."
             },
             "signature": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
               "description": "Digital signature for non-repudiation."
             },
             "previousChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
             },
             "cvss": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss",
               "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
               "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
             },
@@ -2664,7 +2711,7 @@
             "milestones": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"
               },
               "description": "Remediation milestones (primarily for POA&M type amendments)."
             },
@@ -2681,7 +2728,7 @@
             "affectedPackages": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"
               },
               "description": "Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."
             }
@@ -2814,9 +2861,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0",
       "title": "HDF Result Primitives",
       "description": "Types for representing assessment results and statuses.",
       "$defs": {
@@ -2947,9 +2994,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0",
       "title": "HDF CVSS Primitives",
       "description": "Types for representing CVSS (Common Vulnerability Scoring System) data attached to assessment findings. Supports CVSS v2.0, v3.0, v3.1, and v4.0 metric groups (Base, Threat, Environmental, Supplemental).",
       "$defs": {
@@ -3146,9 +3193,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0",
       "title": "HDF Affected Package Primitives",
       "description": "Types for representing the software package(s) affected by a vulnerability finding.",
       "$defs": {
@@ -3256,9 +3303,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0",
       "title": "HDF Component Primitives",
       "description": "First-class system component with identity, polymorphic type, generalized BOM attachment (boms[]), and system-binding properties. Components are the successor to Targets, adding stable identity (componentId), external system cross-references, and manifest inventory (SBOM, AI model/dataset, and reserved future BOM kinds).",
       "$defs": {
@@ -3304,7 +3351,7 @@
               "description": "Description of this component's role or purpose."
             },
             "owner": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
               "description": "Team or individual responsible for this component. Enables per-component ownership when different teams manage different parts of a system."
             },
             "externalIds": {
@@ -3324,14 +3371,14 @@
             "boms": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0#/$defs/Bom"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0#/$defs/Bom"
               },
               "description": "Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType), each carried by passthrough (ref/document) or normalized. Replaces the former sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an ai-model BOM). See primitives/bom.schema.json."
             },
             "integrity": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum"
               },
               "description": "Cryptographic integrity of this component's underlying artifact — model weights or shards, dataset archive, container image, or package bytes.\n\nAn array supports multi-file/sharded artifacts.\n\nThis is the single, generic home for artifact/subject integrity across all component types (it replaced the former per-type Container_Image digest and Artifact checksum fields).\n\nDistinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence Integrity type."
             },
@@ -3345,12 +3392,12 @@
             "inputOverrides": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0#/$defs/Input_Override"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Input_Override"
               },
               "description": "System-specific overrides for baseline input values."
             },
             "targetSelector": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0#/$defs/Target_Selector",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Target_Selector",
               "description": "Label selector to match targets belonging to this component during migration. Targets with matching labels are automatically included."
             }
           },
@@ -3633,7 +3680,7 @@
                   "const": "cloudAccount"
                 },
                 "provider": {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Cloud_Provider",
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Cloud_Provider",
                   "description": "Cloud provider."
                 },
                 "accountId": {
@@ -3672,7 +3719,7 @@
                   "const": "cloudResource"
                 },
                 "provider": {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Cloud_Provider",
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Cloud_Provider",
                   "description": "Cloud provider."
                 },
                 "resourceType": {
@@ -3971,9 +4018,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0",
       "title": "HDF BOM Primitives",
       "description": "Generalized Bill-of-Materials / manifest representation.\n\nOne extensible Bom shape, discriminated by bomType, carries any manifest kind (SBOM, AI model/dataset, and reserved future kinds) either by passthrough (opaque ref/embed of the native document) or normalized (converted into HDF's queryable shape).\n\nSubject identity (name, version, componentId) is inherited from the host component or system — the BOM never re-owns it.\n\nSee ADR-0001.",
       "$defs": {
@@ -4029,7 +4076,7 @@
             "hashes": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum"
               },
               "description": "Integrity of the carried BOM *document* itself (the referenced/embedded manifest file), NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model weights, dataset archive) is a component-level concern, not carried here. Subject identity is inherited from the host component/system; per-node identity lives in the type-extension."
             },
@@ -4441,9 +4488,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0",
       "title": "HDF System Primitives",
       "description": "Types for describing system architecture, authorization boundaries, and components.",
       "$defs": {
@@ -4494,7 +4541,7 @@
               "description": "Rationale for why this override is needed."
             },
             "approvedBy": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
               "description": "Identity of the person or system that approved this override."
             }
           },
@@ -4576,9 +4623,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0",
       "type": "object",
       "unevaluatedProperties": false,
       "required": [
@@ -4588,7 +4635,7 @@
         "externalReferences": {
           "type": "array",
           "items": {
-            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
+            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
           },
           "description": "Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."
         },
@@ -4605,7 +4652,7 @@
         "components": {
           "type": "array",
           "items": {
-            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
+            "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"
           },
           "description": "The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."
         },
@@ -4617,23 +4664,23 @@
           "description": "Information on the baselines that were evaluated, including findings."
         },
         "statistics": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0#/$defs/Statistics",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0#/$defs/Statistics",
           "description": "Statistics for the assessment run, including duration and result counts."
         },
         "generator": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Generator",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator",
           "description": "Information about the tool that generated this file."
         },
         "tool": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Tool",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Tool",
           "description": "The security tool that produced the assessment data in this file."
         },
         "integrity": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity",
           "description": "Cryptographic integrity information for verifying this file."
         },
         "preAmendmentChecksum": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
           "description": "Hash of this results document as it stood immediately before the most recent amendment application. Written by `hdf amend apply` when it applies at least one override; an apply that matches nothing leaves the document untouched. The hash covers the results file's RAW BYTES as read, not a canonical form, so reproducing it requires the byte-identical original — reformatting or re-serializing the source changes the value. Only the most recent pre-application state is recorded: applying amendments to an already-amended document REPLACES this value, so it is a single link back one step, not a growing chain. Distinct from the `previousChecksum` inside an override, which chains amendments to each other and is computed over a canonical JSON form.",
           "$comment": "Example 1: the real SHA-256 of hdf-converters/converters/nessus-to-hdf/fixtures/expected/sample.nessus.hdf.json, reproducible with `shasum -a 256` on that file — chosen over a synthetic digest so a reader can verify the hash basis is the raw file bytes.",
           "examples": [
@@ -4644,11 +4691,11 @@
           ]
         },
         "runner": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0#/$defs/Runner",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0#/$defs/Runner",
           "description": "Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."
         },
         "remediation": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Remediation",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Remediation",
           "description": "Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."
         },
         "systemRef": {
@@ -4662,7 +4709,7 @@
           "description": "Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."
         },
         "derivation": {
-          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Derivation",
+          "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Derivation",
           "description": "Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."
         },
         "extensions": {
@@ -4760,14 +4807,14 @@
           ],
           "allOf": [
             {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Baseline_Metadata"
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Baseline_Metadata"
             }
           ],
           "properties": {
             "depends": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Dependency"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Dependency"
               },
               "description": "The set of dependencies this baseline depends on."
             },
@@ -4780,15 +4827,15 @@
               "description": "The description - should be more detailed than the summary."
             },
             "integrity": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity",
               "description": "Cryptographic integrity information for verifying this baseline has not been tampered with."
             },
             "originalChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."
             },
             "resultsChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."
             },
             "statusMessage": {
@@ -4806,14 +4853,14 @@
             "groups": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Requirement_Group"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Group"
               },
               "description": "A set of descriptions for the requirement groups."
             },
             "inputs": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0#/$defs/Input"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0#/$defs/Input"
               },
               "description": "Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."
             },
@@ -4838,7 +4885,7 @@
           ],
           "allOf": [
             {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Requirement_Core"
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Core"
             }
           ],
           "properties": {
@@ -4846,7 +4893,7 @@
               "type": "array",
               "minItems": 1,
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Requirement_Description"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Description"
               },
               "contains": {
                 "type": "object",
@@ -4862,37 +4909,37 @@
               "description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
             },
             "severity": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Severity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Severity",
               "description": "Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."
             },
             "sourceLocation": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Source_Location",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Source_Location",
               "description": "The explicit location of the requirement within the source code."
             },
             "results": {
               "type": "array",
               "minItems": 1,
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Requirement_Result"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Result"
               },
               "description": "The set of all tests within the requirement and their results."
             },
             "statusOverrides": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Status_Override"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"
               },
               "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
             },
             "poams": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/POAM"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/POAM"
               },
               "description": "Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."
             },
             "effectiveStatus": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
               "description": "The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."
             },
             "effectiveImpact": {
@@ -4902,33 +4949,33 @@
               "description": "The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."
             },
             "disposition": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type",
               "description": "The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."
             },
             "effectiveChecksum": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
               "description": "Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."
             },
             "evidence": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
               },
               "description": "Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."
             },
             "cvss": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss"
               },
               "description": "Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."
             },
             "epss": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0#/$defs/Epss",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0#/$defs/Epss",
               "description": "FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."
             },
             "kev": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0#/$defs/Kev",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0#/$defs/Kev",
               "description": "CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."
             },
             "cwe": {
@@ -4942,7 +4989,7 @@
             "affectedPackages": {
               "type": "array",
               "items": {
-                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
+                "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"
               },
               "description": "Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."
             }
@@ -5231,9 +5278,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0",
       "title": "HDF Statistics Primitives",
       "description": "Statistics types for tracking assessment run metrics.",
       "$defs": {
@@ -5302,9 +5349,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0",
       "title": "HDF Runner Primitive",
       "description": "Information about the test execution environment where the security tool/scanner was executed.",
       "$defs": {
@@ -5348,7 +5395,7 @@
               "description": "The container instance identifier. Example: 'a1b2c3d4e5f6', 'security-scan-job-xyz123'. Can be a Docker container ID, Kubernetes pod name, or other container runtime identifier."
             },
             "operator": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
               "description": "The identity of the person or system responsible for executing the test. This could be a human auditor manually completing a checklist, an automated CI/CD system, or a security tool. Optional field to support both automated and manual HDF generation."
             }
           },
@@ -5397,9 +5444,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0",
       "title": "HDF Change Event Primitives",
       "description": "Shared building blocks for HDF change-event wire documents. The envelope is entity-agnostic: hdf-requirement-change-event composes it today, and any future sibling event type (e.g. component change events — hdf-comparison already models componentDiffs alongside requirementDiffs) reuses it verbatim.",
       "$defs": {
@@ -5453,7 +5500,7 @@
             "priorChecksum": {
               "oneOf": [
                 {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum"
                 },
                 {
                   "type": "null"
@@ -5471,7 +5518,7 @@
               "systemRef": "apptier.hdf-system.json",
               "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
               "timestamp": "2026-07-22T14:03:11Z",
-              "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
+              "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
               "priorChecksum": {
                 "algorithm": "sha256",
                 "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
@@ -5525,7 +5572,7 @@
           ],
           "properties": {
             "effectiveStatus": {
-              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
+              "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
               "description": "The resolved effective compliance status at this point in the chain."
             },
             "effectiveImpact": {
@@ -5574,7 +5621,7 @@
                   "description": "URI to the seed snapshot document (relative path or absolute URL)."
                 },
                 "checksum": {
-                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
+                  "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
                   "description": "Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by content, not just location."
                 }
               },
@@ -5623,9 +5670,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0",
       "title": "HDF Parameter Primitives",
       "description": "Input/parameter type definitions for typed, traceable configuration values that bridge governance prose and scanner automation.",
       "$defs": {
@@ -5756,9 +5803,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0",
       "title": "HDF EPSS Primitive",
       "description": "Type for representing FIRST.org's Exploit Prediction Scoring System (EPSS) data for a vulnerability. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days. See https://www.first.org/epss/ for the underlying model and methodology.",
       "$defs": {
@@ -5813,9 +5860,9 @@
         }
       }
     },
-    "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0": {
+    "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
-      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0",
+      "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0",
       "title": "HDF Kev Primitives",
       "description": "Types for representing CISA Known Exploited Vulnerabilities (KEV) catalog membership. The KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) flags CVEs that are confirmed actively exploited in the wild and drives federal patching urgency under CISA Binding Operational Directive 22-01.",
       "$defs": {