npm - @shiftleftpt/sbd-toe-mcp - Versions diffs - 0.10.3 → 0.11.0 - Mend

@shiftleftpt/sbd-toe-mcp 0.10.3 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (47) hide show

package/assets/agent-guide.md +33 -0
package/consumed-bundle.json +8 -8
package/data/entities/proportionality.json +2 -2
package/data/entities/sdlc_integration.json +2 -2
package/data/publish/indexes/canonical_chunks.jsonl +4903 -4903
package/data/publish/indexes/publication_manifest.json +4 -4
package/data/publish/ontology/sbdtoe-ontology.yaml +1699 -21
package/data/publish/overlay/framework_overlay_index.json +121 -11
package/data/publish/overlay/overlay_mappings.jsonl +935 -646
package/data/publish/runtime/artifact_requirements.json +218 -311
package/data/publish/runtime/artifacts.json +82 -55
package/data/publish/runtime/controls.json +870 -311
package/data/publish/runtime/deterministic_manifest.json +2 -2
package/data/publish/runtime/evidence_patterns.json +162 -162
package/data/publish/runtime/requirement_control_links.json +2271 -1708
package/data/publish/runtime/v1/manual_threat_mitigation.jsonl +233 -233
package/data/publish/runtime/v1/v1_manifest.json +6 -4
package/data/reports/run_manifest.json +4 -4
package/dist/index.js +107 -4
package/dist/index.js.map +1 -1
package/dist/serving/affordances.d.ts +1 -0
package/dist/serving/affordances.js +12 -3
package/dist/serving/affordances.js.map +1 -1
package/dist/serving/selection.d.ts +56 -0
package/dist/serving/selection.js +289 -0
package/dist/serving/selection.js.map +1 -0
package/dist/tools/consult-security-requirements.d.ts +7 -0
package/dist/tools/consult-security-requirements.js +38 -0
package/dist/tools/consult-security-requirements.js.map +1 -1
package/dist/tools/generate-sbd-toe-skill.js +7 -2
package/dist/tools/generate-sbd-toe-skill.js.map +1 -1
package/dist/tools/get-threat-landscape.js +36 -13
package/dist/tools/get-threat-landscape.js.map +1 -1
package/dist/tools/map-review-scope.d.ts +6 -0
package/dist/tools/map-review-scope.js +19 -0
package/dist/tools/map-review-scope.js.map +1 -1
package/dist/tools/ontology-loader.d.ts +8 -0
package/dist/tools/ontology-loader.js +9 -0
package/dist/tools/ontology-loader.js.map +1 -1
package/dist/tools/prepare-codegen-context.d.ts +625 -5
package/dist/tools/prepare-codegen-context.js +1185 -81
package/dist/tools/prepare-codegen-context.js.map +1 -1
package/dist/tools/select-requirements.d.ts +53 -0
package/dist/tools/select-requirements.js +99 -0
package/dist/tools/select-requirements.js.map +1 -0
package/package.json +4 -3
package/prompts/sbd-toe-grounded-codegen.md +10 -0

package/data/publish/runtime/v1/manual_threat_mitigation.jsonl CHANGED Viewed

@@ -20,26 +20,26 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-020", "manual_v2_entity_label": "Decisões de risco sem feedback do negócio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:aceitacao-de-risco-invalida", "manual_v2_entity_label": "aceitação de risco inválida", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:alteracao-na-exposicao-dados-impacto-ou-forma-de-decisoes-e-validacoes", "manual_v2_entity_label": "alteração na exposição, dados, impacto ou forma de decisões e validações", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-001"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-002"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-003"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-004"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-005"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-006"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-007"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-008"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-009"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-010"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-011"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-012"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-013"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-014"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-015"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-016"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-017"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-018"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-019"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-020"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-001"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-002"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-003"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-004"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-005"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-006"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-007"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-008"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-009"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-010"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-011"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-012"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-013"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-014"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-015"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-016"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-017"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-018"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-019"}
+{"associated_control_ids": ["CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-020"}
 {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-009`", "0.70", "alias_match, bundle_grounding, risk_match"]}
 {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-020`", "0.76", "alias_match, bundle_grounding, how_it_arises_match"]}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-021", "manual_v2_entity_label": "Ausência de requisitos de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -60,24 +60,24 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-036", "manual_v2_entity_label": "Requisitos aplicados mas não testados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-037", "manual_v2_entity_label": "Mudanças de requisitos não propagadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-038", "manual_v2_entity_label": "Ambiguidade entre requisito e controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-021"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-022"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-023"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-024"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-025"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-026"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-027"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-028"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-029"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-030"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-031"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-032"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-033"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-034"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-035"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-036"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-037"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-038"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-021"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-022"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-023"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-024"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-025"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-026"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-027"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-028"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-029"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-030"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-031"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-032"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-033"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-034"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-035"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-036"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-037"}
+{"associated_control_ids": ["CTRL-code-integrity-ambiente-e-tooling-de-desenvolvimento-governados-77015fa38a", "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460", "CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-data-protection-criptografia-aplicacional-e-proteccao-de-dados-a4afa5b411", "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29", "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af", "CTRL-identity-identidade-autenticacao-e-sessoes-aplicacionais-c9d3f51e82", "CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0", "CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9", "CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-038"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-039", "manual_v2_entity_label": "Ameaças desconhecidas e não tratadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-040", "manual_v2_entity_label": "Prioridades de segurança mal definidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-041", "manual_v2_entity_label": "Requisitos definidos sem base em ameaças", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -96,22 +96,22 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-054", "manual_v2_entity_label": "Ferramentas desconectadas do ciclo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ausencia-de-ameaca-no-modelo", "manual_v2_entity_label": "Ausência de ameaça no modelo", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:omissao-estrutural-de-ameacas", "manual_v2_entity_label": "Omissão estrutural de ameaças", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-039"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-040"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-041"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "LINDDUN", "threat_id": "MT-042"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-043"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-044"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-045"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-046"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-047"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-048"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-049"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-050"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-051"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-052"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-053"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-054"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-039"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-040"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-041"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "LINDDUN", "threat_id": "MT-042"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-043"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-044"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-045"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-046"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-047"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-048"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-049"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-050"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-051"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-052"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-053"}
+{"associated_control_ids": ["CTRL-governance-threat-modeling-e-gestao-de-risco-272c9a8ed0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-054"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-055", "manual_v2_entity_label": "Interfaces expostas sem isolamento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-056", "manual_v2_entity_label": "Mistura de dados e controlo na mesma zona", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-057", "manual_v2_entity_label": "Acesso lateral não controlado entre módulos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -134,24 +134,24 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:excecoes-nao-documentadas", "manual_v2_entity_label": "Exceções não documentadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:modelos-inconsistentes-incompletos-ou-desatualizados", "manual_v2_entity_label": "Modelos inconsistentes, incompletos ou desatualizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:threat-modeling-sem-arquitetura-clara", "manual_v2_entity_label": "Threat modeling sem arquitetura clara", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-055"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-056"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-057"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-058"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-059"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-060"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-061"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-062"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-063"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-064"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-065"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-066"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-067"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-068"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-069"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-070"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-071"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-072"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-055"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-056"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-057"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-058"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-059"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-060"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-061"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-062"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-063"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-064"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-065"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-066"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-067"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-068"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-069"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-070"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-071"}
+{"associated_control_ids": ["CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4", "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-072"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-073", "manual_v2_entity_label": "Inclusão de bibliotecas com CVEs ativos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-074", "manual_v2_entity_label": "Dependências desatualizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-075", "manual_v2_entity_label": "Ausência de registo de versões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -172,26 +172,26 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-090", "manual_v2_entity_label": "Confusão de dependências", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-091", "manual_v2_entity_label": "Backdoor via ferramenta de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-092", "manual_v2_entity_label": "Drift de composição entre builds", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-073"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-074"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-075"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-076"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-077"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-078"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-079"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-080"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-081"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-082"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-083"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-084"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-085"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-086"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-087"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-088"}
-{"associated_controls": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-089"}
-{"associated_controls": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-090"}
-{"associated_controls": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-091"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-092"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-073"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-074"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-075"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-076"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-077"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-078"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-079"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-080"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-081"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-082"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-083"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-084"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-085"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-086"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-087"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-088"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "SBOM boundary, revisão de dependências", "associated_controls_text": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-089"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "SCA, validação de origem", "associated_controls_text": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-090"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Governance de tooling", "associated_controls_text": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-091"}
+{"associated_control_ids": ["CTRL-supply-chain-inventario-e-analise-de-dependencias-6b0fd9f7fb"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-092"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-093", "manual_v2_entity_label": "Inclusão de padrões inseguros por hábito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-094", "manual_v2_entity_label": "Uso de funções descontinuadas ou perigosas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-095", "manual_v2_entity_label": "Injeção de código sem escape adequado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -210,24 +210,24 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-108", "manual_v2_entity_label": "Inconsistência entre equipas e projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-109", "manual_v2_entity_label": "Inexistência de baseline de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-110", "manual_v2_entity_label": "Fraca responsabilização pela segurança do código", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-093"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-094"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-095"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-096"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-097"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-098"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-099"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-100"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-101"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-102"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-103"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-104"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-105"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-106"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-107"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-108"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-109"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-110"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-093"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-094"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-095"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-096"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-097"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-098"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-099"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-100"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-101"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-102"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-103"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-104"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-105"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-106"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-107"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-108"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-109"}
+{"associated_control_ids": ["CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-110"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-111", "manual_v2_entity_label": "Execução de código não autorizado em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-112", "manual_v2_entity_label": "Comprometimento do ambiente de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-113", "manual_v2_entity_label": "Elevação de privilégios no pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -252,27 +252,27 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:exposicao-excessiva-de-contexto-em-logs-e-artefactos", "manual_v2_entity_label": "exposição excessiva de contexto em logs e artefactos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-segredos-estaticos", "manual_v2_entity_label": "uso de segredos estáticos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:sinal-automatico", "manual_v2_entity_label": "sinal automático", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-111"}
-{"associated_controls": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-112"}
-{"associated_controls": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-113"}
-{"associated_controls": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-114"}
-{"associated_controls": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-115"}
-{"associated_controls": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-116"}
-{"associated_controls": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-117"}
-{"associated_controls": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-118"}
-{"associated_controls": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-119"}
-{"associated_controls": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-120"}
-{"associated_controls": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-121"}
-{"associated_controls": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-122"}
-{"associated_controls": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-123"}
-{"associated_controls": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-124"}
-{"associated_controls": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-125"}
-{"associated_controls": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-126"}
-{"associated_controls": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-127"}
-{"associated_controls": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-128"}
-{"associated_controls": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-129"}
-{"associated_controls": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-130"}
-{"associated_controls": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-131"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Design seguro de pipelines; isolamento de runners", "associated_controls_text": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-111"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Isolamento e efemeridade de runners", "associated_controls_text": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-112"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Hardening de pipelines", "associated_controls_text": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-113"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão segura de código-fonte", "associated_controls_text": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-114"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Políticas de execução", "associated_controls_text": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-115"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Rastreabilidade e assinaturas", "associated_controls_text": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-116"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Integridade e proveniência", "associated_controls_text": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-117"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Segurança do código de pipeline", "associated_controls_text": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-118"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Controlo de dependências", "associated_controls_text": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-119"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-120"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão de segredos", "associated_controls_text": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-121"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Lifecycle de segredos", "associated_controls_text": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-122"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Políticas de gates", "associated_controls_text": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-123"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Validações integradas", "associated_controls_text": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-124"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Rastreabilidade", "associated_controls_text": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-125"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gestão de exceções", "associated_controls_text": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-126"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Governação contínua", "associated_controls_text": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-127"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Gates e governação", "associated_controls_text": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-128"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Evidência empírica", "associated_controls_text": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-129"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Reprodutibilidade", "associated_controls_text": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-130"}
+{"associated_control_ids": ["CTRL-code-integrity-integridade-e-governacao-de-pipelines-d5b14eeef2", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "Controlo de integrações", "associated_controls_text": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-131"}
 {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`uso-de-segredos-estaticos`", "`MT-121`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-132", "manual_v2_entity_label": "Defaults inseguros ou permissivos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-133", "manual_v2_entity_label": "Configurações sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -302,23 +302,23 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:gestao-centralizada-de-excecoes", "manual_v2_entity_label": "Gestão centralizada de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:pipelines-ci-cd-obrigatorios", "manual_v2_entity_label": "Pipelines CI/CD obrigatórios", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:uso-de-ferramentas-de-scanning", "manual_v2_entity_label": "Uso de ferramentas de scanning", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-132"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-133"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-134"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-135"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-136"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-137"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-138"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-139"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-140"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-141"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-142"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-143"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-144"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-145"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-146"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-147"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-148"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-132"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-133"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-134"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-135"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-136"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-137"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-138"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-139"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-140"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-141"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-142"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-143"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-144"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-145"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-146"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-147"}
+{"associated_control_ids": ["CTRL-infrastructure-infraestrutura-como-codigo-governada-5228bca905", "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-148"}
 {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`permissoes-excessivas`", "`MT-139`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-149", "manual_v2_entity_label": "Imagens base vulneráveis/obsoletas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-150", "manual_v2_entity_label": "Inclusão de dependências inseguras no build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -338,24 +338,24 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-164", "manual_v2_entity_label": "Falta de rastreabilidade de deploys", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-165", "manual_v2_entity_label": "_Shadow containers_ fora do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-166", "manual_v2_entity_label": "_Drift_ de configuração", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-149"}
-{"associated_controls": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-150"}
-{"associated_controls": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-151"}
-{"associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-152"}
-{"associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-153"}
-{"associated_controls": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-154"}
-{"associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-155"}
-{"associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-156"}
-{"associated_controls": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-157"}
-{"associated_controls": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-158"}
-{"associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-159"}
-{"associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-160"}
-{"associated_controls": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-161"}
-{"associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-162"}
-{"associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-163"}
-{"associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-164"}
-{"associated_controls": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-165"}
-{"associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-166"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "associated_controls_text": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-149"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 3–4*", "associated_controls_text": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-150"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Construção Segura de Imagens*", "associated_controls_text": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-151"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "associated_controls_text": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-152"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "associated_controls_text": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-153"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Repositórios*", "associated_controls_text": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-154"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "associated_controls_text": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-155"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "associated_controls_text": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-156"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Hardening de Runtime*", "associated_controls_text": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-157"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Runtime*, *Checklist 8*", "associated_controls_text": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-158"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-159"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "associated_controls_text": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-160"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Segredos*", "associated_controls_text": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-161"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "associated_controls_text": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-162"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "associated_controls_text": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-163"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "associated_controls_text": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-164"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Rastreabilidade: DSOMM*", "associated_controls_text": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-165"}
+{"associated_control_ids": ["CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "associated_controls_text": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-166"}
 {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-1104`", "`?`", "supporting reference; primary anchor é Manual threat"]}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-167", "manual_v2_entity_label": "Injeções (SQLi, OS Command, etc.)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-168", "manual_v2_entity_label": "Falhas de controlo de acesso", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -372,21 +372,21 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-179", "manual_v2_entity_label": "Classes novas não detetadas por SAST/DAST", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-180", "manual_v2_entity_label": "Testes superficiais sem contexto técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-181", "manual_v2_entity_label": "Ferramentas não calibradas por contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-167"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-168"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-169"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-170"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-171"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-172"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-173"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-174"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-175"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-176"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-177"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-178"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-179"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-180"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-181"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-167"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-168"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-169"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-170"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-171"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-172"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-173"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-174"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-175"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-176"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-177"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-178"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-179"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-180"}
+{"associated_control_ids": ["CTRL-testing-testes-de-seguranca-baseados-em-risco-55dcb62d34"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-181"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-182", "manual_v2_entity_label": "Código em produção sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-183", "manual_v2_entity_label": "Ativação funcional sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-184", "manual_v2_entity_label": "Promoção manual fora do CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -402,21 +402,21 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-194", "manual_v2_entity_label": "Toggle ativado inadvertidamente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-195", "manual_v2_entity_label": "Release sem segmentação geográfica ou lógica", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-196", "manual_v2_entity_label": "Execução de função crítica não validada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-182"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-183"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-184"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-185"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-186"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-187"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-188"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-189"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-190"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-191"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-192"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-193"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-194"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-195"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-196"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-182"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-183"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-184"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-185"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-186"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-187"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-188"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-189"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-190"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-191"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-192"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-193"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-194"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-195"}
+{"associated_control_ids": ["CTRL-infrastructure-deploy-seguro-e-reversivel-ae204be5f0"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-196"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-197", "manual_v2_entity_label": "Eventos críticos não registados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-198", "manual_v2_entity_label": "Logs voláteis ou truncados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-199", "manual_v2_entity_label": "Falta de rastreabilidade de execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -442,21 +442,21 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:falhas-de-login", "manual_v2_entity_label": "Falhas de login", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:logs", "manual_v2_entity_label": "Logs", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:metricas-mttd-mttr", "manual_v2_entity_label": "Métricas MTTD/MTTR", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-197"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-198"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-199"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-200"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-201"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-202"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-203"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-204"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-205"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-206"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-207"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-208"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-209"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-210"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-211"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-197"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-198"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-199"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-200"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-201"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-202"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-203"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-204"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-205"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-206"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-207"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-208"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-209"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-210"}
+{"associated_control_ids": ["CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-211"}
 {"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`alertas-nao-acionaveis`", "`MT-200`", "0.70", "alias_match, bundle_grounding, risk_match"]}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-212", "manual_v2_entity_label": "Configuração insegura por desconhecimento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-213", "manual_v2_entity_label": "Reutilização indevida de segredos ou tokens", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -474,16 +474,16 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-eficacia-formativa", "manual_v2_entity_label": "KPIs de eficácia formativa", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-formacao", "manual_v2_entity_label": "KPIs de Formação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:resultados-de-quiz", "manual_v2_entity_label": "Resultados de Quizzes", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-212"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-213"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-214"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-215"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-216"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-217"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-218"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-219"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-220"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-221"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-212"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-213"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-214"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-215"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-216"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-217"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-218"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-219"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-220"}
+{"associated_control_ids": ["CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-221"}
 {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-693`", "`?`", "supporting reference; primary anchor é Manual threat"]}
 {"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-798`", "`?`", "supporting reference; primary anchor é Manual threat"]}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-222", "manual_v2_entity_label": "Adoção de fornecedor sem avaliação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
@@ -509,15 +509,15 @@
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:registo-e-aprovacao-de-excecoes", "manual_v2_entity_label": "registo e aprovação de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:reporting-periodico-a-gestao", "manual_v2_entity_label": "reporting periódico à gestão", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
 {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:validacao-continua-de-fornecedores", "manual_v2_entity_label": "validação contínua de fornecedores", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-222"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-223"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-224"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-225"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-226"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-227"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-228"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-229"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-230"}
-{"associated_controls": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-231"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-232"}
-{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-233"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-222"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-223"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-224"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-225"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-226"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-227"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-228"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-229"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-230"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "30, 90", "associated_controls_text": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-231"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-232"}
+{"associated_control_ids": ["CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628", "CTRL-governance-governacao-organizacional-ownership-e-conformidade-761d416ead", "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af"], "associated_control_ids_derivation": "chapter_requirements_primary_controls", "associated_controls": "", "associated_controls_text": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-233"}