npm - @shiftleftpt/sbd-toe-mcp - Versions diffs - 0.10.2 → 0.10.4 - Mend

@shiftleftpt/sbd-toe-mcp 0.10.2 → 0.10.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (36) hide show

package/consumed-bundle.json +12 -12
package/data/entities/proportionality.json +3 -3
package/data/entities/sdlc_integration.json +3 -3
package/data/publish/indexes/bundle_catalog.jsonl +1 -1
package/data/publish/indexes/canonical_chunks.jsonl +4903 -4902
package/data/publish/indexes/chunk_entity_mentions.jsonl +9 -25
package/data/publish/indexes/mcp_chunks.jsonl +125 -124
package/data/publish/indexes/publication_manifest.json +9 -9
package/data/publish/ontology/sbdtoe-ontology.yaml +1699 -21
package/data/publish/overlay/framework_overlay_index.json +136 -8
package/data/publish/overlay/overlay_mappings.jsonl +1033 -669
package/data/publish/runtime/artifact_requirements.json +218 -311
package/data/publish/runtime/artifacts.json +82 -55
package/data/publish/runtime/controls.json +883 -322
package/data/publish/runtime/deterministic_manifest.json +2 -2
package/data/publish/runtime/evidence_patterns.json +182 -182
package/data/publish/runtime/requirement_control_links.json +2534 -1799
package/data/publish/runtime/v1/manual_maturity_progression.jsonl +336 -336
package/data/publish/runtime/v1/manual_rastreabilidade.jsonl +1105 -1105
package/data/publish/runtime/v1/manual_threat_mitigation.jsonl +523 -523
package/data/publish/runtime/v1/v1_manifest.json +9 -7
package/data/reports/run_manifest.json +8 -8
package/dist/index.js +8 -6
package/dist/index.js.map +1 -1
package/dist/tools/get-threat-landscape.js +36 -13
package/dist/tools/get-threat-landscape.js.map +1 -1
package/dist/tools/ontology-loader.d.ts +8 -0
package/dist/tools/ontology-loader.js +9 -0
package/dist/tools/ontology-loader.js.map +1 -1
package/dist/tools/plan-repo-governance.d.ts +1 -2
package/dist/tools/plan-repo-governance.js +19 -49
package/dist/tools/plan-repo-governance.js.map +1 -1
package/dist/tools/structured-tools.d.ts +4 -5
package/dist/tools/structured-tools.js +87 -122
package/dist/tools/structured-tools.js.map +1 -1
package/package.json +3 -2

package/data/publish/runtime/v1/manual_maturity_progression.jsonl CHANGED Viewed

@@ -1,336 +1,336 @@
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:compliance-mapping", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:governance-metrics", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:risk-management", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:security-requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Derivação de requisitos, rastreabilidade, decisão proporcion", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:owasp-samm-governance-risk-management:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:owasp-samm-governance-risk-management:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:owasp-samm-governance-risk-management:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Classificação de risco por eixos, integração no SDLC", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Definição proporcional de requisitos à criticidade", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Rastreabilidade a frameworks de referência presente", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Não define KPIs quantitativos nem reporting formal", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Modelo de classificação estruturado e aplicado sistematicamente", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Permite derivação proporcional baseada em risco", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Derivação de requisitos, rastreabilidade, decisão proporcional", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Realiza-se classificação básica dos riscos das aplicações", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com processos organizacionais e rastreabilidade", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Análise quantitativa e retroalimentação contínua", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Classificação de risco por eixos, integração no SDLC", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Classificação por eixos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Coberto noutros capítulos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Coberto noutros capítulos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Definição proporcional de requisitos à criticidade", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:owasp-dsomm-requirements-architecture-verification:architecture", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:owasp-dsomm-requirements-architecture-verification:requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:owasp-dsomm-requirements-architecture-verification:verification", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Catálogo validado, derivação por risco, critérios de aceitaç", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:owasp-samm-design-security-requirements:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:owasp-samm-design-security-requirements:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:owasp-samm-design-security-requirements:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Requisitos proporcionais, rastreáveis, com validação formal", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build & Verification Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:slsa-build-verification-requirements:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build & Verification Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:slsa-build-verification-requirements:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build & Verification Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:slsa-build-verification-requirements:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Definição de critérios de aceitação com base em requisitos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Mapeamento por risco e dependência com arquitetura", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos testáveis, rastreáveis e validados", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Critérios definidos para validação dos requisitos", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Catálogo validado, derivação por risco, critérios de aceitação", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Definir requisitos de segurança mínimos", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos definidos com base em riscos", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos ligados a métricas e controlos de eficácia", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos proporcionais, rastreáveis, com validação formal", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Aplicação explícita de critérios", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build & Verification Requirements"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build & Verification Requirements"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Implementado noutros capítulos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build & Verification Requirements"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Definição de critérios de aceitação com base em requisitos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:owasp-dsomm-architecture-risk-analysis-requirements:architecture", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:owasp-dsomm-architecture-risk-analysis-requirements:requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:owasp-dsomm-architecture-risk-analysis-requirements:risk-analysis", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Integração no SDLC, rastreabilidade, threat maps reutilizáve", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:owasp-samm-design-threat-assessment:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:owasp-samm-design-threat-assessment:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:owasp-samm-design-threat-assessment:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Modelação estruturada com STRIDE, DFDs e análise por risco", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Risk Awareness", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:slsa-supply-chain-risk-awareness:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Risk Awareness", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:slsa-supply-chain-risk-awareness:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Risk Awareness", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:slsa-supply-chain-risk-awareness:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Apoio indireto à definição proporcional de controlos", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Análise de arquitetura e dependências com mapeamento de ameaças", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Geração de requisitos a partir do threat modeling e sua validação", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com classificação e aceitação de risco", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração no SDLC, rastreabilidade, threat maps reutilizáveis", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ameaças identificadas de forma sistemática", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Análise estruturada com modelos formais e rastreabilidade", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua e automação organizacional", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Modelação estruturada com STRIDE, DFDs e análise por risco", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Classificação e threat modeling", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Risk Awareness"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Risk Awareness"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Tratado noutros capítulos (CI/CD)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Risk Awareness"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Apoio indireto à definição proporcional de controlos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:owasp-dsomm-architecture-requirements-risk:architecture", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:owasp-dsomm-architecture-requirements-risk:requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:owasp-dsomm-architecture-requirements-risk:risk-analysis", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requisitos ARC-XXX, rastreabilidade, zonas de confiança", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:owasp-samm-design-architecture-design:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:owasp-samm-design-architecture-design:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:owasp-samm-design-architecture-design:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Princípios formais, validação e documentação da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Isolation", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:slsa-provenance-isolation:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Isolation", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:slsa-provenance-isolation:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Isolation", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:slsa-provenance-isolation:34", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Segmentação e isolamento da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Segmentação, zonas de confiança, tratamento explícito", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos formais por tipo de componente (ARC-XXX)", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com threat modeling e aceitação de risco por exceção", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos ARC-XXX, rastreabilidade, zonas de confiança", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Arquitetura definida informalmente", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Documentação com validação proporcional", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua e revisão automatizada", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Princípios formais, validação e documentação da arquitetura", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Segmentação e zonas de confiança", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Isolation"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Requisitos documentados", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Isolation"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito (ver Cap. 06 e 08)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Isolation"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Segmentação e isolamento da arquitetura", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:owasp-dsomm-policy-build-deploy-tooling:build-deploy", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:owasp-dsomm-policy-build-deploy-tooling:policy", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:owasp-dsomm-policy-build-deploy-tooling:tooling", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Políticas de risco, hardening, bloqueios CI/CD, rastreabilid", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:owasp-samm-construction-dependency-management:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:owasp-samm-construction-dependency-management:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:owasp-samm-construction-dependency-management:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "SBOM, políticas de aceitação, exceções, validação e bloqueio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Dependency Control", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:slsa-provenance-dependency-control:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Dependency Control", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:slsa-provenance-dependency-control:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Dependency Control", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:slsa-provenance-dependency-control:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "SBOM, pinning, proveniência de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Geração e publicação de SBOM com integração na pipeline", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Definição formal de critérios de aceitação e exceções", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ferramentas recomendadas para SCA, validação de findings", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Políticas de risco, hardening, bloqueios CI/CD, rastreabilidade SCA", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Identificação e listagem manual de dependências", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Processo formal de aceitação, rastreio e controlo de risco", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Automação e integração contínua", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "SBOM, políticas de aceitação, exceções, validação e bloqueio", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "SBOM gerado por build", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Dependency Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Critérios de controlo formal", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Dependency Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito (ver Cap. 06 e 08)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Dependency Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "SBOM, pinning, proveniência de dependências", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:owasp-dsomm-design-development-tooling-metrics:design-dev", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:owasp-dsomm-design-development-tooling-metrics:metrics", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:owasp-dsomm-design-development-tooling-metrics:tooling", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Práticas estruturadas, validações automáticas, evidência e o", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:owasp-samm-implementation:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:owasp-samm-implementation:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:owasp-samm-implementation:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Linters, validação automática, rastreabilidade, PR validatio", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Validation & Provenance", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:slsa-build-validation-provenance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Validation & Provenance", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:slsa-build-validation-provenance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Validation & Provenance", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:slsa-build-validation-provenance:34", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Integração de validações e proveniência no build", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Práticas estruturadas de desenvolvimento seguro", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Rastreabilidade, evidência, ownership e tratamento de exceções", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Linters, validações automáticas integráveis", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Práticas estruturadas, validações automáticas, evidência e ownership", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Práticas básicas de verificação manual", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração de validações automatizadas no pipeline", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua e testes estruturados", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Linters, validação automática, rastreabilidade, PR validation", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Linters e PR validation", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Validation & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Tracking de alterações e ownership", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Validation & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito deste capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Validation & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Integração de validações e proveniência no build", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:build", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:operate", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:release", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:test", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Execução segura, validação de artefactos, assinaturas, rastr", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:owasp-samm-build-deployment-automation:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:owasp-samm-build-deployment-automation:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:owasp-samm-build-deployment-automation:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Segurança integrada no pipeline, segregação de ambientes", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Proveniência, trusted builders, controlo de execução, harden", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Execução autenticada, trusted runners, proveniência", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Logs, auditoria e controlo de fluxo CI/CD", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Assinatura e integridade do artefacto", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação e rastreabilidade contínua dos resultados", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Execução segura, validação de artefactos, assinaturas, rastreabilidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formalização mínima exigida", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Execução autenticada e validada", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Parcial - depende de controlo externo à pipeline", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Segurança integrada no pipeline, segregação de ambientes", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Execução autenticada com logs", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Validação e assinatura de artefactos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Trusted environments e runners", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito do capítulo (ver Cap. 08 e 09)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Proveniência, trusted builders, controlo de execução, hardening de pipelines", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:owasp-dsomm-aplicacao-a-projetos-iac:build-test", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:owasp-dsomm-aplicacao-a-projetos-iac:design-dev", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:owasp-dsomm-aplicacao-a-projetos-iac:tooling", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Validação, segregação de ambientes, controlo de estado", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:owasp-samm-secure-build-para-iac:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:owasp-samm-secure-build-para-iac:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:owasp-samm-secure-build-para-iac:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Controlo de pipelines IaC, linting, enforcement", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Validação de planos, proveniência, segregação, controlo de b", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Linting, validação de planos, pipelines de teste", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos IaC, separação de ambientes, arquitetura segura", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ferramentas de análise estática e validação automatizada", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação, segregação de ambientes, controlo de estado", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Configuração manual, sem rastreabilidade", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Uso de linters, controlo automatizado e pipelines", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua com artefactos rastreáveis", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Controlo de pipelines IaC, linting, enforcement", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Validadores e aprovação manual formal", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Controlo de planos e ambientes", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito deste capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito deste capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Validação de planos, proveniência, segregação, controlo de builds", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:owasp-dsomm-build-deploy-supply-chain-ops-monitoring:build-deploy", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:owasp-dsomm-build-deploy-supply-chain-ops-monitoring:ops-monitoring", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:owasp-dsomm-build-deploy-supply-chain-ops-monitoring:supply-chain", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Construção determinística, proveniência, hardening e observa", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:owasp-samm-deployment-verification-e-governance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:owasp-samm-deployment-verification-e-governance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:owasp-samm-deployment-verification-e-governance:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build seguro, policy-as-code, assinatura, controlo de regist", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Assinaturas, attestations, pipelines confiáveis e digest pin", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Pipelines determinísticos, verificação de proveniência e attestation.", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Observabilidade, deteção de drift e shadow containers.", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Assinatura, rastreabilidade e governação de registos e dependências.", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Construção determinística, proveniência, hardening e observabilidade de runtime", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Governação mínima de imagens e registos", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Scanning e assinatura no CI/CD", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Policy-as-code, admission controllers, rastreabilidade auditável", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Build seguro, policy-as-code, assinatura, controlo de registos e validação de ma", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Dockerfiles versionados e CI/CD auditável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Digest pinning e attestation de origem", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Assinaturas, attestations e verificação automática", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito (nível de integração infraestrutural)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Assinaturas, attestations, pipelines confiáveis e digest pinning", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-dsomm:owasp-dsomm-dominios-testing-design-development:design-development", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-dsomm:owasp-dsomm-dominios-testing-design-development:testing", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Integração contínua, rastreabilidade por release, gates auto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:owasp-samm-verification-security-testing:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:owasp-samm-verification-security-testing:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:owasp-samm-verification-security-testing:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Testes automatizados, gates de validação, gestão de findings", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Cobertura limitada, validação de artefactos antes de deploy", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação por release, controlo de findings, reporting técnico", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "SAST/DAST integrados, fuzzing, feedback, gates", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua, rastreabilidade por release, gates automáticos", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Testes manuais básicos de segurança", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração de testes automatizados no pipeline", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Gestão ativa de findings e feedback contínuo", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Testes automatizados, gates de validação, gestão de findings", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Cobertura mínima via pipelines", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Evidência e análise rastreável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - depende de governance", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Não abrangido pelo capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Cobertura limitada, validação de artefactos antes de deploy", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Deploy Seguro como Domínio Técnico", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-dsomm:owasp-dsomm-deploy-seguro-como-dominio-tecnico:design-development", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Deploy seguro, rastreabilidade, controlo formal de produção", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:owasp-samm-verification-security-testing:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:owasp-samm-verification-security-testing:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:owasp-samm-verification-security-testing:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Gates, validação final, rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlos de promoção e artefactos, validações", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Deploy seguro, rollback rastreável, controlo de exceções", "framework": "OWASP DSOMM", "framework_area": "Deploy Seguro como Domínio Técnico", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Deploy seguro, rastreabilidade, controlo formal de produção", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Checklist e gates de readiness", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Rollback com validação integrada", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Justificação de deploy, bloqueio e auditoria", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Gates, validação final, rollback", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Pré-condições e triggers definidos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Validação de release e rollback rastreável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - depende de integração com Cap. 07 e 12", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Não abordado", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Controlos de promoção e artefactos, validações", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Operations", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-dsomm:owasp-dsomm-operations:operations", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Monitorização, deteção, alertas, IR, correlação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:owasp-samm-operations-incident-management:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:owasp-samm-operations-incident-management:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:owasp-samm-operations-incident-management:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Logging, alertas, KPIs, integração com resposta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Logging e métricas integradas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Cobertura completa: logging, deteção, correlação, integração IR", "framework": "OWASP DSOMM", "framework_area": "Operations", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Monitorização, deteção, alertas, IR, correlação", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Logging básico e manual", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Monitorização contínua e alertas", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com resposta a incidentes", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Logging, alertas, KPIs, integração com resposta", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Logging mínimo em pipelines", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "KPIs operacionais e deteção automatizada", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - não aborda verificação criptográfica", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Não aplicável neste contexto", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Logging e métricas integradas", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Education & Training", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-dsomm:owasp-dsomm-education-training:education-training", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Formação adaptativa, feedback contínuo, integração com matur", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:owasp-samm-governance-education-guidance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:owasp-samm-governance-education-guidance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:owasp-samm-governance-education-guidance:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Trilhos formativos por função e risco, rastreabilidade, cham", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formação adaptada, prática, feedback contínuo, integração com rastreio", "framework": "OWASP DSOMM", "framework_area": "Education & Training", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formação adaptativa, feedback contínuo, integração com maturidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formação de awareness para todos os perfis", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Trilhos por função e nível de risco, KPIs", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Parcial - não é ainda integrada com ciclos de gestão", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Trilhos formativos por função e risco, rastreabilidade, champions", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Validação de fornecedores, requisitos contratuais, rastreabi", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:3rd-party", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Definição clara de ownership, políticas, controlo contínuo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:governance", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "KPIs de governação e feedback contínuo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:tooling-metrics", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Onboarding formal de stakeholders", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:training", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Exceções, KPIs, onboarding, validação, maturidade", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:owasp-samm-governance-e-education:education-guidance", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:owasp-samm-governance-e-education:governance", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:owasp-samm-governance-e-education:incident-management", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Ownership, exceções, rastreabilidade, formação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Requisitos contratuais, aceitação de risco, rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação de fornecedores, requisitos contratuais, rastreabilidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Definição clara de ownership, políticas, controlo contínuo", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "KPIs de governação e feedback contínuo", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Onboarding formal de stakeholders", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Exceções, KPIs, onboarding, validação, maturidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "—", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "—", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "—", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ownership, exceções, rastreabilidade, formação", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Papéis e terceiros registados", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Cláusulas de segurança formais", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - validações sem atestado externo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Não aplicável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
-{"coverage_status": "maturity_substantive", "coverage_summary": "Requisitos contratuais, aceitação de risco, rastreabilidade", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "d5c2586ae2cd12ab2e31b65febb2e85ed20e1bce", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:compliance-mapping", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:governance-metrics", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:risk-management", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:owasp-dsomm-governance-risk-management-requirements:security-requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Derivação de requisitos, rastreabilidade, decisão proporcion", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:owasp-samm-governance-risk-management:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:owasp-samm-governance-risk-management:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:owasp-samm-governance-risk-management:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Classificação de risco por eixos, integração no SDLC", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Levels for Software Artifacts", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:slsa-supply-chain-levels-for-software-artifacts:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Definição proporcional de requisitos à criticidade", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "01-classificacao-aplicacoes:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Rastreabilidade a frameworks de referência presente", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Não define KPIs quantitativos nem reporting formal", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Modelo de classificação estruturado e aplicado sistematicamente", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Permite derivação proporcional baseada em risco", "framework": "OWASP DSOMM", "framework_area": "Governance, Risk Management, Requirements", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Derivação de requisitos, rastreabilidade, decisão proporcional", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Realiza-se classificação básica dos riscos das aplicações", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com processos organizacionais e rastreabilidade", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Análise quantitativa e retroalimentação contínua", "framework": "OWASP SAMM", "framework_area": "Governance → Risk Management", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Classificação de risco por eixos, integração no SDLC", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Classificação por eixos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Coberto noutros capítulos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Coberto noutros capítulos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Levels for Software Artifacts"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Definição proporcional de requisitos à criticidade", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:owasp-dsomm-requirements-architecture-verification:architecture", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:owasp-dsomm-requirements-architecture-verification:requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:owasp-dsomm-requirements-architecture-verification:verification", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Catálogo validado, derivação por risco, critérios de aceitaç", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:owasp-samm-design-security-requirements:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:owasp-samm-design-security-requirements:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:owasp-samm-design-security-requirements:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Requisitos proporcionais, rastreáveis, com validação formal", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build & Verification Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:slsa-build-verification-requirements:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build & Verification Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:slsa-build-verification-requirements:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build & Verification Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:slsa-build-verification-requirements:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Definição de critérios de aceitação com base em requisitos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "02-requisitos-seguranca:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Mapeamento por risco e dependência com arquitetura", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos testáveis, rastreáveis e validados", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Critérios definidos para validação dos requisitos", "framework": "OWASP DSOMM", "framework_area": "Requirements, Architecture, Verification", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Catálogo validado, derivação por risco, critérios de aceitação", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Definir requisitos de segurança mínimos", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos definidos com base em riscos", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos ligados a métricas e controlos de eficácia", "framework": "OWASP SAMM", "framework_area": "Design → Security Requirements", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos proporcionais, rastreáveis, com validação formal", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Aplicação explícita de critérios", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build & Verification Requirements"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build & Verification Requirements"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Implementado noutros capítulos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build & Verification Requirements"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Definição de critérios de aceitação com base em requisitos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:owasp-dsomm-architecture-risk-analysis-requirements:architecture", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:owasp-dsomm-architecture-risk-analysis-requirements:requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:owasp-dsomm-architecture-risk-analysis-requirements:risk-analysis", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Integração no SDLC, rastreabilidade, threat maps reutilizáve", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:owasp-samm-design-threat-assessment:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:owasp-samm-design-threat-assessment:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:owasp-samm-design-threat-assessment:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Modelação estruturada com STRIDE, DFDs e análise por risco", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Risk Awareness", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:slsa-supply-chain-risk-awareness:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Risk Awareness", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:slsa-supply-chain-risk-awareness:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain Risk Awareness", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:slsa-supply-chain-risk-awareness:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Apoio indireto à definição proporcional de controlos", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "03-threat-modeling:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Análise de arquitetura e dependências com mapeamento de ameaças", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Geração de requisitos a partir do threat modeling e sua validação", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com classificação e aceitação de risco", "framework": "OWASP DSOMM", "framework_area": "Architecture, Risk Analysis, Requirements", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração no SDLC, rastreabilidade, threat maps reutilizáveis", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ameaças identificadas de forma sistemática", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Análise estruturada com modelos formais e rastreabilidade", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua e automação organizacional", "framework": "OWASP SAMM", "framework_area": "Design → Threat Assessment", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Modelação estruturada com STRIDE, DFDs e análise por risco", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Classificação e threat modeling", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Risk Awareness"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Risk Awareness"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Tratado noutros capítulos (CI/CD)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain Risk Awareness"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Apoio indireto à definição proporcional de controlos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:owasp-dsomm-architecture-requirements-risk:architecture", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:owasp-dsomm-architecture-requirements-risk:requirements", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:owasp-dsomm-architecture-requirements-risk:risk-analysis", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Requisitos ARC-XXX, rastreabilidade, zonas de confiança", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:owasp-samm-design-architecture-design:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:owasp-samm-design-architecture-design:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:owasp-samm-design-architecture-design:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Princípios formais, validação e documentação da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Isolation", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:slsa-provenance-isolation:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Isolation", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:slsa-provenance-isolation:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Isolation", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:slsa-provenance-isolation:34", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Segmentação e isolamento da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "04-arquitetura-segura:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Segmentação, zonas de confiança, tratamento explícito", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos formais por tipo de componente (ARC-XXX)", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com threat modeling e aceitação de risco por exceção", "framework": "OWASP DSOMM", "framework_area": "Architecture, Requirements, Risk", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos ARC-XXX, rastreabilidade, zonas de confiança", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Arquitetura definida informalmente", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Documentação com validação proporcional", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua e revisão automatizada", "framework": "OWASP SAMM", "framework_area": "Design → Architecture & Design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Princípios formais, validação e documentação da arquitetura", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Segmentação e zonas de confiança", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Isolation"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Requisitos documentados", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Isolation"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito (ver Cap. 06 e 08)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Isolation"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Segmentação e isolamento da arquitetura", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:owasp-dsomm-policy-build-deploy-tooling:build-deploy", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:owasp-dsomm-policy-build-deploy-tooling:policy", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:owasp-dsomm-policy-build-deploy-tooling:tooling", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Políticas de risco, hardening, bloqueios CI/CD, rastreabilid", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:owasp-samm-construction-dependency-management:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:owasp-samm-construction-dependency-management:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:owasp-samm-construction-dependency-management:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "SBOM, políticas de aceitação, exceções, validação e bloqueio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Dependency Control", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:slsa-provenance-dependency-control:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Dependency Control", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:slsa-provenance-dependency-control:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & Dependency Control", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:slsa-provenance-dependency-control:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "SBOM, pinning, proveniência de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "05-dependencias-sbom-sca:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Geração e publicação de SBOM com integração na pipeline", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Definição formal de critérios de aceitação e exceções", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ferramentas recomendadas para SCA, validação de findings", "framework": "OWASP DSOMM", "framework_area": "Policy, Build & Deploy, Tooling", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Políticas de risco, hardening, bloqueios CI/CD, rastreabilidade SCA", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Identificação e listagem manual de dependências", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Processo formal de aceitação, rastreio e controlo de risco", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Automação e integração contínua", "framework": "OWASP SAMM", "framework_area": "Construction → Dependency Management", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "SBOM, políticas de aceitação, exceções, validação e bloqueio", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "SBOM gerado por build", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Dependency Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Critérios de controlo formal", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Dependency Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito (ver Cap. 06 e 08)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & Dependency Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "SBOM, pinning, proveniência de dependências", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:owasp-dsomm-design-development-tooling-metrics:design-dev", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:owasp-dsomm-design-development-tooling-metrics:metrics", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:owasp-dsomm-design-development-tooling-metrics:tooling", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Práticas estruturadas, validações automáticas, evidência e o", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:owasp-samm-implementation:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:owasp-samm-implementation:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:owasp-samm-implementation:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Linters, validação automática, rastreabilidade, PR validatio", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Validation & Provenance", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:slsa-build-validation-provenance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Validation & Provenance", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:slsa-build-validation-provenance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Validation & Provenance", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:slsa-build-validation-provenance:34", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Integração de validações e proveniência no build", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "06-desenvolvimento-seguro:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Práticas estruturadas de desenvolvimento seguro", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Rastreabilidade, evidência, ownership e tratamento de exceções", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Linters, validações automáticas integráveis", "framework": "OWASP DSOMM", "framework_area": "Design & Development, Tooling, Metrics", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Práticas estruturadas, validações automáticas, evidência e ownership", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Práticas básicas de verificação manual", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração de validações automatizadas no pipeline", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua e testes estruturados", "framework": "OWASP SAMM", "framework_area": "Implementation", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Linters, validação automática, rastreabilidade, PR validation", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Linters e PR validation", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Validation & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Tracking de alterações e ownership", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Validation & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito deste capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Validation & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Integração de validações e proveniência no build", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:build", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:operate", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:release", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:owasp-dsomm-build-test-release-operate:test", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Execução segura, validação de artefactos, assinaturas, rastr", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:owasp-samm-build-deployment-automation:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:owasp-samm-build-deployment-automation:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:owasp-samm-build-deployment-automation:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Segurança integrada no pipeline, segregação de ambientes", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Provenance & CI/CD Control", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:slsa-provenance-ci-cd-control:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Proveniência, trusted builders, controlo de execução, harden", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "07-cicd-seguro:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Execução autenticada, trusted runners, proveniência", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Logs, auditoria e controlo de fluxo CI/CD", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Assinatura e integridade do artefacto", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação e rastreabilidade contínua dos resultados", "framework": "OWASP DSOMM", "framework_area": "Build, Test, Release, Operate", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Execução segura, validação de artefactos, assinaturas, rastreabilidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formalização mínima exigida", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Execução autenticada e validada", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Parcial - depende de controlo externo à pipeline", "framework": "OWASP SAMM", "framework_area": "Build & Deployment Automation", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Segurança integrada no pipeline, segregação de ambientes", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Execução autenticada com logs", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Validação e assinatura de artefactos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Trusted environments e runners", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito do capítulo (ver Cap. 08 e 09)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Provenance & CI/CD Control"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Proveniência, trusted builders, controlo de execução, hardening de pipelines", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:owasp-dsomm-aplicacao-a-projetos-iac:build-test", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:owasp-dsomm-aplicacao-a-projetos-iac:design-dev", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:owasp-dsomm-aplicacao-a-projetos-iac:tooling", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Validação, segregação de ambientes, controlo de estado", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:owasp-samm-secure-build-para-iac:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:owasp-samm-secure-build-para-iac:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:owasp-samm-secure-build-para-iac:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Controlo de pipelines IaC, linting, enforcement", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Fonte, Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:slsa-fonte-build-e-proveniencia:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Validação de planos, proveniência, segregação, controlo de b", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "08-iac-infraestrutura:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Linting, validação de planos, pipelines de teste", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Requisitos IaC, separação de ambientes, arquitetura segura", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ferramentas de análise estática e validação automatizada", "framework": "OWASP DSOMM", "framework_area": "Aplicação a Projetos IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação, segregação de ambientes, controlo de estado", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Configuração manual, sem rastreabilidade", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Uso de linters, controlo automatizado e pipelines", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua com artefactos rastreáveis", "framework": "OWASP SAMM", "framework_area": "Secure Build para IaC", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Controlo de pipelines IaC, linting, enforcement", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Validadores e aprovação manual formal", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Controlo de planos e ambientes", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito deste capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito deste capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Fonte, Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Validação de planos, proveniência, segregação, controlo de builds", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:owasp-dsomm-build-deploy-supply-chain-ops-monitoring:build-deploy", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:owasp-dsomm-build-deploy-supply-chain-ops-monitoring:ops-monitoring", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:owasp-dsomm-build-deploy-supply-chain-ops-monitoring:supply-chain", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Construção determinística, proveniência, hardening e observa", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-dsomm:visao-geral-de-alinhamento:owasp-dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:owasp-samm-deployment-verification-e-governance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:owasp-samm-deployment-verification-e-governance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:owasp-samm-deployment-verification-e-governance:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Build seguro, policy-as-code, assinatura, controlo de regist", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:owasp-samm:visao-geral-de-alinhamento:owasp-samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build Integrity & Provenance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:slsa-v1-0-build-integrity-provenance:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Assinaturas, attestations, pipelines confiáveis e digest pin", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "09-containers-imagens:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Pipelines determinísticos, verificação de proveniência e attestation.", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Observabilidade, deteção de drift e shadow containers.", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Assinatura, rastreabilidade e governação de registos e dependências.", "framework": "OWASP DSOMM", "framework_area": "Build & Deploy / Supply Chain / Ops Monitoring", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Construção determinística, proveniência, hardening e observabilidade de runtime", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Governação mínima de imagens e registos", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Scanning e assinatura no CI/CD", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Policy-as-code, admission controllers, rastreabilidade auditável", "framework": "OWASP SAMM", "framework_area": "Deployment, Verification e Governance", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Build seguro, policy-as-code, assinatura, controlo de registos e validação de ma", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Dockerfiles versionados e CI/CD auditável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Digest pinning e attestation de origem", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Assinaturas, attestations e verificação automática", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Fora do âmbito (nível de integração infraestrutural)", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build Integrity & Provenance"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Assinaturas, attestations, pipelines confiáveis e digest pinning", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-dsomm:owasp-dsomm-dominios-testing-design-development:design-development", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-dsomm:owasp-dsomm-dominios-testing-design-development:testing", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Integração contínua, rastreabilidade por release, gates auto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:owasp-samm-verification-security-testing:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:owasp-samm-verification-security-testing:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:owasp-samm-verification-security-testing:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Testes automatizados, gates de validação, gestão de findings", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Build/Test Coverage", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:slsa-build-test-coverage:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Cobertura limitada, validação de artefactos antes de deploy", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "10-testes-seguranca:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação por release, controlo de findings, reporting técnico", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "SAST/DAST integrados, fuzzing, feedback, gates", "framework": "OWASP DSOMM", "framework_area": "Domínios Testing + Design & Development", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração contínua, rastreabilidade por release, gates automáticos", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Testes manuais básicos de segurança", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração de testes automatizados no pipeline", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Gestão ativa de findings e feedback contínuo", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Testes automatizados, gates de validação, gestão de findings", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Cobertura mínima via pipelines", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Evidência e análise rastreável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - depende de governance", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Não abrangido pelo capítulo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Build/Test Coverage"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Cobertura limitada, validação de artefactos antes de deploy", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Deploy Seguro como Domínio Técnico", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-dsomm:owasp-dsomm-deploy-seguro-como-dominio-tecnico:design-development", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Deploy seguro, rastreabilidade, controlo formal de produção", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:owasp-samm-verification-security-testing:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:owasp-samm-verification-security-testing:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:owasp-samm-verification-security-testing:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Gates, validação final, rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlo de Build e Proveniência", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:slsa-controlo-de-build-e-proveniencia:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Controlos de promoção e artefactos, validações", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "11-deploy-seguro:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Deploy seguro, rollback rastreável, controlo de exceções", "framework": "OWASP DSOMM", "framework_area": "Deploy Seguro como Domínio Técnico", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Deploy seguro, rastreabilidade, controlo formal de produção", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Checklist e gates de readiness", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Rollback com validação integrada", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Justificação de deploy, bloqueio e auditoria", "framework": "OWASP SAMM", "framework_area": "Verification → Security Testing", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Gates, validação final, rollback", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Pré-condições e triggers definidos", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Validação de release e rollback rastreável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - depende de integração com Cap. 07 e 12", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Não abordado", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Controlo de Build e Proveniência"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Controlos de promoção e artefactos, validações", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Operations", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-dsomm:owasp-dsomm-operations:operations", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Monitorização, deteção, alertas, IR, correlação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:owasp-samm-operations-incident-management:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:owasp-samm-operations-incident-management:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:owasp-samm-operations-incident-management:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Logging, alertas, KPIs, integração com resposta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Observabilidade", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:slsa-observabilidade:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Logging e métricas integradas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "12-monitorizacao-operacoes:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Cobertura completa: logging, deteção, correlação, integração IR", "framework": "OWASP DSOMM", "framework_area": "Operations", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Monitorização, deteção, alertas, IR, correlação", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Logging básico e manual", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Monitorização contínua e alertas", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Integração com resposta a incidentes", "framework": "OWASP SAMM", "framework_area": "Operations → Incident Management", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Logging, alertas, KPIs, integração com resposta", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Logging mínimo em pipelines", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "KPIs operacionais e deteção automatizada", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - não aborda verificação criptográfica", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Não aplicável neste contexto", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Observabilidade"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Logging e métricas integradas", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Education & Training", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-dsomm:owasp-dsomm-education-training:education-training", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Formação adaptativa, feedback contínuo, integração com matur", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:owasp-samm-governance-education-guidance:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:owasp-samm-governance-education-guidance:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:owasp-samm-governance-education-guidance:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Trilhos formativos por função e risco, rastreabilidade, cham", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "13-formacao-onboarding:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formação adaptada, prática, feedback contínuo, integração com rastreio", "framework": "OWASP DSOMM", "framework_area": "Education & Training", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formação adaptativa, feedback contínuo, integração com maturidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Formação de awareness para todos os perfis", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Trilhos por função e nível de risco, KPIs", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Parcial - não é ainda integrada com ciclos de gestão", "framework": "OWASP SAMM", "framework_area": "Governance → Education & Guidance", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Trilhos formativos por função e risco, rastreabilidade, champions", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Validação de fornecedores, requisitos contratuais, rastreabi", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:3rd-party", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Definição clara de ownership, políticas, controlo contínuo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:governance", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "KPIs de governação e feedback contínuo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:tooling-metrics", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Onboarding formal de stakeholders", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:owasp-dsomm:training", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP DSOMM", "framework_area": "Exceções, KPIs, onboarding, validação, maturidade", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-dsomm:visao-geral-de-alinhamento:dsomm", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:owasp-samm-governance-e-education:education-guidance", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:owasp-samm-governance-e-education:governance", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:owasp-samm-governance-e-education:incident-management", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "OWASP SAMM", "framework_area": "Ownership, exceções, rastreabilidade, formação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:owasp-samm:visao-geral-de-alinhamento:samm-v2-1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:1", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:2", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:3", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Supply Chain", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:slsa-supply-chain:4", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"coverage_status": "v2_entity_index", "framework": "SLSA", "framework_area": "Requisitos contratuais, aceitação de risco, rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_v2_authority_class": "external", "manual_v2_entity_id": "14-governanca-contratacao:maturity:slsa:visao-geral-de-alinhamento:slsa-v1-0", "manual_v2_entity_type": "MaturityMapping", "manual_v2_source_mode": "derived", "rastreabilidade_role": "manual_v2_entity"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Validação de fornecedores, requisitos contratuais, rastreabilidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Definição clara de ownership, políticas, controlo contínuo", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "KPIs de governação e feedback contínuo", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Onboarding formal de stakeholders", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Exceções, KPIs, onboarding, validação, maturidade", "framework": "OWASP DSOMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "—", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "—", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "—", "framework": "OWASP SAMM", "framework_area": "Governance e Education", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"confidence": "0.90", "coverage_status": "maturity_substantive", "coverage_summary": "Ownership, exceções, rastreabilidade, formação", "framework": "OWASP SAMM", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Papéis e terceiros registados", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Cláusulas de segurança formais", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Parcial - validações sem atestado externo", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Não aplicável", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "Supply Chain"}
+{"coverage_status": "maturity_substantive", "coverage_summary": "Requisitos contratuais, aceitação de risco, rastreabilidade", "framework": "SLSA", "framework_area": "—", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "achievable-maturity.md", "manual_section_anchor": "`achievable-maturity.md`", "methodology_label": "Explícito", "rastreabilidade_role": "maturity_progression", "slsa_level": "—"}