@shiftleftpt/sbd-toe-mcp 0.20.0-beta.13 → 0.20.0-beta.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/assets/agent-guide.md +2 -0
  2. package/consumed-bundle.json +10 -11
  3. package/data/entities/proportionality.json +2 -2
  4. package/data/entities/sdlc_integration.json +2 -2
  5. package/data/publish/indexes/canonical_chunks.jsonl +4907 -4907
  6. package/data/publish/indexes/publication_manifest.json +1 -1
  7. package/data/publish/ontology/sbdtoe-ontology.yaml +555 -2
  8. package/data/publish/runtime/deterministic_manifest.json +1 -1
  9. package/data/publish/runtime/requirements.json +798 -0
  10. package/data/publish/runtime/v1/manual_rastreabilidade.jsonl +202 -202
  11. package/data/publish/runtime/v1/v1_manifest.json +19 -3
  12. package/data/publish/semantic/ctrl_acore_alignment.jsonl +267 -0
  13. package/data/publish/semantic/requirement_source_coverage.jsonl +274 -0
  14. package/data/reports/run_manifest.json +5 -5
  15. package/dist/index.js +34 -1
  16. package/dist/index.js.map +1 -1
  17. package/dist/serving/affordances.d.ts +1 -1
  18. package/dist/serving/affordances.js +5 -3
  19. package/dist/serving/affordances.js.map +1 -1
  20. package/dist/tools/get-verification-matrix.d.ts +3 -0
  21. package/dist/tools/get-verification-matrix.js +18 -1
  22. package/dist/tools/get-verification-matrix.js.map +1 -1
  23. package/dist/tools/resolve-entities.d.ts +4 -0
  24. package/dist/tools/resolve-entities.js +22 -1
  25. package/dist/tools/resolve-entities.js.map +1 -1
  26. package/dist/tools/select-requirements.js +1 -1
  27. package/dist/tools/select-requirements.js.map +1 -1
  28. package/dist/tools/trace-requirement-sources.d.ts +32 -0
  29. package/dist/tools/trace-requirement-sources.js +105 -0
  30. package/dist/tools/trace-requirement-sources.js.map +1 -0
  31. package/package.json +3 -1
package/data/publish/runtime/v1/manual_rastreabilidade.jsonl CHANGED
@@ -206,31 +206,31 @@
206
206
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:mechanism:trust-boundaries", "manual_v2_entity_label": "trust boundaries", "manual_v2_entity_type": "Mechanism", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
207
207
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:antipattern:ausencia-de-ameaca-no-modelo", "manual_v2_entity_label": "Ausência de ameaça no modelo", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
208
208
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:antipattern:omissao-estrutural-de-ameacas", "manual_v2_entity_label": "Omissão estrutural de ameaças", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
209
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-8.10", "SP800-53-SA-8.16"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-807"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-3.2"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-001", "v1_entity_name": "Threat Representation Models", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
210
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-12", "SP800-53-IR-10"]}, {"source_display_name": "EU DORA", "substrate_source": "eu_dora", "visible_refs": ["DORA-ART-6", "DORA-ART-13"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-TASK-PW.1.1", "SSDF-TASK-RV.2.1"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-002", "v1_entity_name": "Structured Threat Analysis Frameworks", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
211
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0006", "AML.T0010.003"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CP-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-166", "CAPEC-186"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_TA_2_B"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-003", "v1_entity_name": "Threat Model Versioning Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
212
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a6"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-2.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_SM_1_A"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-004", "v1_entity_name": "Explicit Threat Disposition Register", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
213
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 17, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-37", "CAPEC-38"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0003", "AML.T0008"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-5", "PCI-1.2.3"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-005", "v1_entity_name": "Threat Mitigation Linkage Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
214
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AC-6.7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-8.1", "CIS-8.11"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a8"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-006", "v1_entity_name": "Reviewer Accountability And Consistency Gates", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
215
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PL-2", "SP800-53-PM-3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-8", "PCI-1.2.4"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.3"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-007", "v1_entity_name": "Requirements Registry And Derivation Traceability", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
216
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.4", "CIS-7.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-008", "v1_entity_name": "Compliance Monitoring And Regulatory Change Feeds", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
217
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PM-9"]}, {"source_display_name": "SAFECode Agile", "substrate_source": "safecode", "visible_refs": ["SCAGILE-EXP-3"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-001", "v1_entity_name": "Threat Modeling Scope And Trigger Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
218
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PL-8.1", "SP800-53-PM-7"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0017"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-002", "v1_entity_name": "Architecture-Grounded Threat Representation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
219
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-4.13", "SP800-53-PM-28"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-RV.3", "SSDF-TASK-RV.2.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-6.2.4", "PCI-11.4.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-425"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-003", "v1_entity_name": "Structured Threat Analysis Method Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
220
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1230", "CWE-212"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-2.2", "SP800-53-IR-4.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-414", "CAPEC-418"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0048", "AML.T0051.001"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-004", "v1_entity_name": "Threat Disposition, Risk Acceptance And Ownership", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
221
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 22, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.13", "SP800-53-AC-25"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-51", "CAPEC-81"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0002", "AML.TA0007"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.4.3", "PCI-5.2.1"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-005", "v1_entity_name": "Threat-To-Mitigation And Validation Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
222
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.3", "SP800-53-AU-10.3"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.5"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_3_B"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-006", "v1_entity_name": "Independent Review And Threat Model Lifecycle Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
223
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A"]}, {"source_display_name": "EU NIS2", "substrate_source": "eu_nis2", "visible_refs": ["NIS2-ART-20"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-007", "v1_entity_name": "Threat Modeling And Risk Governance Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
224
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3.3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-4"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-008", "v1_entity_name": "Security Requirements Lifecycle Management", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
225
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0006", "AML.T0018"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-2", "SP800-53-SA-3.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-2.3.4", "NIST-AI-100-2-E2025-3.2.2"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-001", "v1_entity_name": "Threat Model Creation And Triggered Refresh", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
226
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-8.10", "SP800-53-SA-9.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.9"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-807"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-3.2"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-002", "v1_entity_name": "DFD And Trust-Boundary Grounding", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
227
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-2.6", "SP800-53-CP-6.1"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-RV.2", "SSDF-TASK-PW.1.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-I_DM_2_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-420", "CAPEC-427"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-003", "v1_entity_name": "Structured Threat Analysis Method Selection", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
228
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_SM_1_A"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-004", "v1_entity_name": "Threat Disposition And Accepted Risk Governance", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
229
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 22, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-AC-17.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-37", "CAPEC-51"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0011", "AML.T0002"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V1.5.2"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-005", "v1_entity_name": "Threat Traceability Into Requirements And Validation", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
230
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-13", "SP800-53-AU-2.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17.8"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_3_A"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (go-live, model, models kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-006", "v1_entity_name": "Independent Review And Threat Model Approval", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
231
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_SM_1_A"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (access, artifacts, lifecycle kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-007", "v1_entity_name": "Threat Model Artifact Governance", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
232
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-3.5"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-1.2", "PCISSLC-1.3"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (models, policies, requirements kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-008", "v1_entity_name": "Security Requirements Identification And Derivation", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
233
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-6.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_PC_1_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.2", "PCI-2.1.2"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-2.1", "PCISSLC-5.1"]}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (compliance, development, requirements kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-009", "v1_entity_name": "Requirements Communication And Compliance Monitoring", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
209
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 4, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-8.10", "SP800-53-SA-8.16"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-807"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-3.2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CWE-807"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-SA-8.10", "SP800-53-SA-8.16"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-001", "v1_entity_name": "Threat Representation Models", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
210
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 49, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-12", "SP800-53-IR-10"]}, {"source_display_name": "EU DORA", "substrate_source": "eu_dora", "visible_refs": ["DORA-ART-6", "DORA-ART-13"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-TASK-PW.1.1", "SSDF-TASK-RV.2.1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 1, "refs": ["CIS-17.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 5, "ref_count": 4, "refs": ["DORA-ART-13", "DORA-ART-15", "DORA-ART-18", "DORA-ART-6"], "substrate_source_key": "eu_dora"}, {"claim_count": 4, "ref_count": 2, "refs": ["NIS2-ART-20", "NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 48, "ref_count": 28, "refs": ["SP800-53-CP-12", "SP800-53-IR-10", "SP800-53-PE-23", "SP800-53-PL-2", "SP800-53-PM-28", "SP800-53-PM-29", "SP800-53-PM-30", "SP800-53-PM-4", "SP800-53-PM-9", "SP800-53-PS-2", "SP800-53-RA-1", "SP800-53-RA-10", "SP800-53-RA-2.1", "SP800-53-RA-3", "SP800-53-RA-3.1", "SP800-53-RA-3.2", "SP800-53-RA-3.3", "SP800-53-RA-4", "SP800-53-RA-5", "SP800-53-RA-5.3", "SP800-53-RA-5.6", "SP800-53-RA-5.9", "SP800-53-RA-7", "SP800-53-SA-11.2", "SP800-53-SA-15.4", "SP800-53-SA-9.1", "SP800-53-SR-1", "SP800-53-SR-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-6217FE115ED74CF49DE4555BCFA6FE87"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-I_DM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-12.10.6", "PCI-12.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-FINDINGS", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-TASK-PW.1.1", "SSDF-TASK-RV.2.1", "SSDF-TASK-RV.2.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-002", "v1_entity_name": "Structured Threat Analysis Frameworks", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
211
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 28, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0006", "AML.T0010.003"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CP-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-166", "CAPEC-186"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_TA_2_B"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-166", "CAPEC-186", "CAPEC-447", "CAPEC-692"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 1, "refs": ["CIS-7.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-CM-2.3", "SP800-53-CP-10.4", "SP800-53-CP-2", "SP800-53-RA-5.1", "SP800-53-SA-10.4", "SP800-53-SA-10.5", "SP800-53-SA-3.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-066084C6113546359CC59E75C7C5459F", "DSOMM-ACTIVITY-5C61FD6B81064C68AC28A8A42F1C67DC", "DSOMM-ACTIVITY-F8E80F1825034E3EB3BC7F67BB28DEFE"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_TA_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A06-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-5.3.1", "PCI-6.5.1", "PCI-7.2.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-COMPILER", "SCFPSSD-SECURITY-CONTROLS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PS.3", "SSDF-TASK-PS.3.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-003", "v1_entity_name": "Threat Model Versioning Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
212
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 3, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a6"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-2.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_SM_1_A"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-AT-2.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-G_SM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-004", "v1_entity_name": "Explicit Threat Disposition Register", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
213
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 17, "es_grounding_resolution": {"authored_more_sources_count": 17, "authored_visible_source_count": 4, "resolved_ref_count": 238, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-37", "CAPEC-38"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0003", "AML.T0008"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-5", "PCI-1.2.3"]}], "es_grounding_sources_full": [{"claim_count": 11, "ref_count": 11, "refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.4", "ASVS-REQ-V15.3.7", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 62, "ref_count": 62, "refs": ["CAPEC-107", "CAPEC-122", "CAPEC-132", "CAPEC-139", "CAPEC-143", "CAPEC-144", "CAPEC-154", "CAPEC-157", "CAPEC-159", "CAPEC-169", "CAPEC-170", "CAPEC-178", "CAPEC-187", "CAPEC-188", "CAPEC-198", "CAPEC-201", "CAPEC-207", "CAPEC-212", "CAPEC-219", "CAPEC-221", "CAPEC-274", "CAPEC-278", "CAPEC-37", "CAPEC-38", "CAPEC-386", "CAPEC-387", "CAPEC-446", "CAPEC-448", "CAPEC-491", "CAPEC-51", "CAPEC-511", "CAPEC-519", "CAPEC-520", "CAPEC-522", "CAPEC-523", "CAPEC-524", "CAPEC-529", "CAPEC-530", "CAPEC-532", "CAPEC-533", "CAPEC-537", "CAPEC-54", "CAPEC-548", "CAPEC-562", "CAPEC-57", "CAPEC-571", "CAPEC-578", "CAPEC-582", "CAPEC-583", "CAPEC-62", "CAPEC-643", "CAPEC-646", "CAPEC-655", "CAPEC-662", "CAPEC-682", "CAPEC-690", "CAPEC-693", "CAPEC-695", "CAPEC-702", "CAPEC-72", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 22, "ref_count": 13, "refs": ["CIS-10", "CIS-10.2", "CIS-10.5", "CIS-14.8", "CIS-16", "CIS-3", "CIS-3.1", "CIS-3.13", "CIS-3.14", "CIS-3.2", "CIS-3.7", "CIS-3.8", "CIS-9.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 11, "ref_count": 11, "refs": ["CWE-1230", "CWE-209", "CWE-215", "CWE-222", "CWE-223", "CWE-268", "CWE-348", "CWE-360", "CWE-426", "CWE-497", "CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 106, "ref_count": 100, "refs": ["SP800-53-AC-16.3", "SP800-53-AC-16.9", "SP800-53-AC-17.6", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-4.12", "SP800-53-AC-4.13", "SP800-53-AC-4.25", "SP800-53-AC-4.27", "SP800-53-AC-4.31", "SP800-53-AU-12.4", "SP800-53-AU-13.3", "SP800-53-AU-3.3", "SP800-53-AU-5.3", "SP800-53-AU-9", "SP800-53-CP-9.4", "SP800-53-CP-9.8", "SP800-53-IA-4.9", "SP800-53-IR-4.5", "SP800-53-IR-6.2", "SP800-53-IR-7.2", "SP800-53-IR-9.4", "SP800-53-MA-3.3", "SP800-53-MP-6.1", "SP800-53-MP-6.4", "SP800-53-PE-3.5", "SP800-53-PE-6.2", "SP800-53-PE-8.3", "SP800-53-PM-1", "SP800-53-PS-3.3", "SP800-53-PS-4.2", "SP800-53-PS-6.1", "SP800-53-RA-5", "SP800-53-RA-5.11", "SP800-53-RA-5.7", "SP800-53-SA-18", "SP800-53-SC-11", "SP800-53-SC-11.1", "SP800-53-SC-15.3", "SP800-53-SC-16.1", "SP800-53-SC-16.2", "SP800-53-SC-18.1", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-28", "SP800-53-SC-3", "SP800-53-SC-30.4", "SP800-53-SC-30.5", "SP800-53-SC-35", "SP800-53-SC-4", "SP800-53-SC-4.2", "SP800-53-SC-40", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-47", "SP800-53-SC-7.14", "SP800-53-SC-7.16", "SP800-53-SC-7.17", "SP800-53-SC-7.23", "SP800-53-SC-7.24", "SP800-53-SC-7.4", "SP800-53-SC-7.6", "SP800-53-SC-7.9", "SP800-53-SI-1", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-11", "SP800-53-SI-12.1", "SP800-53-SI-12.2", "SP800-53-SI-13.5", "SP800-53-SI-16", "SP800-53-SI-18", "SP800-53-SI-19.4", "SP800-53-SI-19.5", "SP800-53-SI-2", "SP800-53-SI-2.2", "SP800-53-SI-2.7", "SP800-53-SI-20", "SP800-53-SI-22", "SP800-53-SI-3", "SP800-53-SI-3.10", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.1", "SP800-53-SI-4.10", "SP800-53-SI-4.19", "SP800-53-SI-4.7", "SP800-53-SI-4.8", "SP800-53-SI-6.3", "SP800-53-SI-7.1", "SP800-53-SI-7.10", "SP800-53-SI-7.11", "SP800-53-SI-7.17", "SP800-53-SI-7.3", "SP800-53-SI-7.6", "SP800-53-SI-7.7", "SP800-53-SI-8", "SP800-53-SI-8.2", "SP800-53-SI-9", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-TOOL-INTERFERENCE"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 6, "ref_count": 6, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_IM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 19, "ref_count": 17, "refs": ["PCI-1.2.3", "PCI-1.4.2", "PCI-1.4.3", "PCI-10.3.2", "PCI-10.7.3", "PCI-11.4.4", "PCI-12.10.4", "PCI-5.3.1", "PCI-5.3.4", "PCI-5.3.5", "PCI-6.4.1", "PCI-6.4.2", "PCI-8.2.4", "PCI-8.3.6", "PCI-9.2.2", "PCI-9.3.2", "PCI-REQ-5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.2", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-9"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-DATA-HANDLING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRINCIPLE-TRUST-CODE"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-RV.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-005", "v1_entity_name": "Threat Mitigation Linkage Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
214
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 19, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AC-6.7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-8.1", "CIS-8.11"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a8"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CIS-17.8", "CIS-8.1", "CIS-8.11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a8"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 16, "ref_count": 13, "refs": ["SP800-53-AC-13", "SP800-53-AC-4.9", "SP800-53-AC-6.7", "SP800-53-AU-1", "SP800-53-AU-10.3", "SP800-53-AU-10.4", "SP800-53-AU-2.3", "SP800-53-AU-3.2", "SP800-53-AU-6", "SP800-53-AU-6.10", "SP800-53-AU-6.7", "SP800-53-AU-7", "SP800-53-AU-9.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-006", "v1_entity_name": "Reviewer Accountability And Consistency Gates", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
215
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 88, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PL-2", "SP800-53-PM-3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-8", "PCI-1.2.4"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.3"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V14.1.2", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.2.3", "ASVS-REQ-V8.1.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-671", "CAPEC-80"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-27"], "substrate_source_key": "eu_dora"}, {"claim_count": 26, "ref_count": 26, "refs": ["SP800-53-PL-2", "SP800-53-PM-3", "SP800-53-PS-3.4", "SP800-53-SA-11", "SP800-53-SA-11.3", "SP800-53-SA-15", "SP800-53-SA-15.12", "SP800-53-SA-15.13", "SP800-53-SA-15.3", "SP800-53-SA-17", "SP800-53-SA-17.2", "SP800-53-SA-17.3", "SP800-53-SA-17.4", "SP800-53-SA-17.5", "SP800-53-SA-2", "SP800-53-SA-21", "SP800-53-SA-3", "SP800-53-SA-4", "SP800-53-SA-4.2", "SP800-53-SA-4.3", "SP800-53-SA-4.7", "SP800-53-SA-6", "SP800-53-SA-8.1", "SP800-53-SA-8.32", "SP800-53-SA-9.3", "SP800-53-SA-9.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-2B7CC923BDAF43E38FB4A995B7783969", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C1"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 33, "ref_count": 16, "refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_2_B", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 16, "ref_count": 15, "refs": ["PCI-1.2.4", "PCI-12.5.3", "PCI-12.6.1", "PCI-12.6.2", "PCI-12.9.1", "PCI-2.2.6", "PCI-3.3.3", "PCI-3.6.1", "PCI-3.7.9", "PCI-6.2.1", "PCI-6.3.2", "PCI-6.5.3", "PCI-8.2.3", "PCI-8.3.10", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCISSLC-1.3", "PCISSLC-2.2", "PCISSLC-2.4", "PCISSLC-8.1", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 12, "ref_count": 10, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.3", "SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PW.1", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.4.1", "SSDF-TASK-PS.3.2", "SSDF-TASK-PW.1.2", "SSDF-TASK-PW.4.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-007", "v1_entity_name": "Requirements Registry And Derivation Traceability", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
216
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 98, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.4", "CIS-7.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["CIS-13.1", "CIS-14.7", "CIS-15.2", "CIS-15.6", "CIS-16.4", "CIS-4.4", "CIS-7.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CRA-ART-13", "CRA-ART-14"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-23"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-316b1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 68, "ref_count": 54, "refs": ["SP800-53-AU-1", "SP800-53-AU-12.3", "SP800-53-AU-13", "SP800-53-AU-13.1", "SP800-53-AU-2", "SP800-53-AU-5.2", "SP800-53-AU-6.1", "SP800-53-AU-6.2", "SP800-53-CA-1", "SP800-53-CA-3", "SP800-53-CA-5.1", "SP800-53-CA-7", "SP800-53-CA-7.3", "SP800-53-CA-7.4", "SP800-53-CA-7.6", "SP800-53-CA-9.1", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-11", "SP800-53-CM-11.3", "SP800-53-CM-3", "SP800-53-CM-3.1", "SP800-53-CM-3.3", "SP800-53-CM-4", "SP800-53-CM-6", "SP800-53-CM-6.3", "SP800-53-CM-7.5", "SP800-53-CM-7.9", "SP800-53-CM-8.2", "SP800-53-MA-1", "SP800-53-MA-2", "SP800-53-MA-3", "SP800-53-MA-3.6", "SP800-53-PE-13.4", "SP800-53-PE-14.2", "SP800-53-PM-1", "SP800-53-PM-24", "SP800-53-PM-25", "SP800-53-PM-27", "SP800-53-PM-31", "SP800-53-PS-7", "SP800-53-PT-3", "SP800-53-RA-5", "SP800-53-SA-1", "SP800-53-SA-10", "SP800-53-SA-4.8", "SP800-53-SA-9", "SP800-53-SI-4", "SP800-53-SI-4.12", "SP800-53-SI-4.17", "SP800-53-SI-4.21", "SP800-53-SI-5", "SP800-53-SI-7.2", "SP800-53-SR-8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-10E23A8C22FF4487A70687CCC9D0798E", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-77FFC53E9F3D41F492D302F04F9B6B0F", "DSOMM-ACTIVITY-8A442D8E0EB14793A513571AEF982EDD", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 30, "ref_count": 15, "refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-G_SM_2_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_A", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCI-10.2.1", "PCI-10.3.4", "PCI-12.10.2", "PCI-12.8.4", "PCI-REQ-11"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-10.1", "PCISSLC-2.1", "PCISSLC-5.1", "PCISSLC-9.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TMR-008", "v1_entity_name": "Compliance Monitoring And Regulatory Change Feeds", "v1_entity_type": "Mechanism", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
217
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 7, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PM-9"]}, {"source_display_name": "SAFECode Agile", "substrate_source": "safecode", "visible_refs": ["SCAGILE-EXP-3"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-PM-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B", "SAMM-ACTIVITY-D_TA_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-3"], "substrate_source_key": "safecode_agile_2012"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-001", "v1_entity_name": "Threat Modeling Scope And Trigger Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
218
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 9, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PL-8.1", "SP800-53-PM-7"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0017"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 5, "refs": ["SP800-53-PL-8.1", "SP800-53-PM-7", "SP800-53-SA-8.10", "SP800-53-SC-3.5", "SP800-53-SC-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 11, "ref_count": 4, "refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_2_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-002", "v1_entity_name": "Architecture-Grounded Threat Representation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
219
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 25, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-4.13", "SP800-53-PM-28"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-RV.3", "SSDF-TASK-RV.2.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-6.2.4", "PCI-11.4.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-425"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-425"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-17.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 14, "ref_count": 13, "refs": ["SP800-53-IR-4.13", "SP800-53-PM-28", "SP800-53-RA-1", "SP800-53-RA-10", "SP800-53-RA-3.2", "SP800-53-RA-5.10", "SP800-53-RA-5.3", "SP800-53-RA-5.6", "SP800-53-RA-5.9", "SP800-53-RA-9", "SP800-53-SA-15.7", "SP800-53-SI-3.10", "SP800-53-SR-5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-297BE0018D9441EEAB29207020D423C0"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_TA_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-11.4.1", "PCI-12.3.2", "PCI-6.2.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-4"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-RV.3", "SSDF-TASK-RV.2.1", "SSDF-TASK-RV.2.2", "SSDF-TASK-RV.3.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-003", "v1_entity_name": "Structured Threat Analysis Method Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
220
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 18, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1230", "CWE-212"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-2.2", "SP800-53-IR-4.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-414", "CAPEC-418"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0048", "AML.T0051.001"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-414", "CAPEC-418", "CAPEC-423", "CAPEC-439"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 8, "refs": ["CWE-1230", "CWE-212", "CWE-213", "CWE-224", "CWE-267", "CWE-278", "CWE-538", "CWE-654"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["SP800-53-AT-2.2", "SP800-53-IR-4.6", "SP800-53-IR-4.7", "SP800-53-IR-9.4", "SP800-53-PS-2", "SP800-53-SR-3.2"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-004", "v1_entity_name": "Threat Disposition, Risk Acceptance And Ownership", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
221
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 22, "es_grounding_resolution": {"authored_more_sources_count": 22, "authored_visible_source_count": 4, "resolved_ref_count": 222, "resolved_source_count": 21, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.13", "SP800-53-AC-25"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-51", "CAPEC-81"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0002", "AML.TA0007"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.4.3", "PCI-5.2.1"]}], "es_grounding_sources_full": [{"claim_count": 12, "ref_count": 12, "refs": ["ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.3", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V17.3.2", "ASVS-REQ-V2.2.2", "ASVS-REQ-V2.4.1", "ASVS-REQ-V6.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 56, "ref_count": 56, "refs": ["CAPEC-144", "CAPEC-169", "CAPEC-170", "CAPEC-187", "CAPEC-203", "CAPEC-212", "CAPEC-224", "CAPEC-270", "CAPEC-278", "CAPEC-293", "CAPEC-422", "CAPEC-440", "CAPEC-442", "CAPEC-444", "CAPEC-445", "CAPEC-446", "CAPEC-447", "CAPEC-51", "CAPEC-511", "CAPEC-516", "CAPEC-517", "CAPEC-518", "CAPEC-519", "CAPEC-520", "CAPEC-522", "CAPEC-529", "CAPEC-530", "CAPEC-537", "CAPEC-548", "CAPEC-573", "CAPEC-574", "CAPEC-575", "CAPEC-578", "CAPEC-580", "CAPEC-581", "CAPEC-582", "CAPEC-583", "CAPEC-623", "CAPEC-638", "CAPEC-646", "CAPEC-647", "CAPEC-648", "CAPEC-665", "CAPEC-669", "CAPEC-670", "CAPEC-673", "CAPEC-678", "CAPEC-679", "CAPEC-682", "CAPEC-690", "CAPEC-691", "CAPEC-692", "CAPEC-693", "CAPEC-702", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 6, "ref_count": 6, "refs": ["CIS-10.5", "CIS-16.4", "CIS-16.6", "CIS-18.4", "CIS-3", "CIS-7.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 12, "ref_count": 12, "refs": ["CWE-179", "CWE-182", "CWE-183", "CWE-184", "CWE-209", "CWE-215", "CWE-242", "CWE-348", "CWE-360", "CWE-391", "CWE-676", "CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["ENISA-AI-FAICP-LAYER-III", "ENISA-AI-FAICP-SURVEY"], "substrate_source_key": "enisa_multilayer_ai_cybersecurity_practices_2023"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-10"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-23"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 79, "ref_count": 75, "refs": ["SP800-53-AC-2.13", "SP800-53-AC-25", "SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-AU-5.3", "SP800-53-AU-6", "SP800-53-AU-9", "SP800-53-CA-7.5", "SP800-53-CM-3", "SP800-53-CM-4.2", "SP800-53-CM-8", "SP800-53-CM-8.3", "SP800-53-CP-10.6", "SP800-53-CP-2", "SP800-53-CP-9.4", "SP800-53-CP-9.8", "SP800-53-IR-4.5", "SP800-53-MP-8.3", "SP800-53-PE-3.5", "SP800-53-PL-2", "SP800-53-RA-10", "SP800-53-RA-3.4", "SP800-53-RA-5", "SP800-53-RA-5.1", "SP800-53-RA-5.2", "SP800-53-RA-5.4", "SP800-53-RA-5.7", "SP800-53-RA-6", "SP800-53-RA-8", "SP800-53-SA-10.4", "SP800-53-SA-15.5", "SP800-53-SC-1", "SP800-53-SC-11.1", "SP800-53-SC-15.3", "SP800-53-SC-16.2", "SP800-53-SC-18", "SP800-53-SC-18.1", "SP800-53-SC-30.5", "SP800-53-SC-42.1", "SP800-53-SC-5.1", "SP800-53-SC-7.16", "SP800-53-SC-7.23", "SP800-53-SC-7.24", "SP800-53-SC-7.6", "SP800-53-SC-7.9", "SP800-53-SI-1", "SP800-53-SI-10.3", "SP800-53-SI-10.5", "SP800-53-SI-12.2", "SP800-53-SI-15", "SP800-53-SI-19.5", "SP800-53-SI-19.7", "SP800-53-SI-2", "SP800-53-SI-2.2", "SP800-53-SI-2.3", "SP800-53-SI-2.7", "SP800-53-SI-20", "SP800-53-SI-3", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.7", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-5.1", "SP800-53-SI-7", "SP800-53-SI-7.10", "SP800-53-SI-7.17", "SP800-53-SI-7.2", "SP800-53-SI-7.6", "SP800-53-SI-7.7", "SP800-53-SI-9", "SP800-53-SR-10", "SP800-53-SR-11", "SP800-53-SR-4.3", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 9, "ref_count": 9, "refs": ["DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DATA-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY", "OWASP-MCP-3P-GOVERNANCE-REGISTRY", "OWASP-MCP-3P-TOOL-INTERFERENCE"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP02-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 11, "ref_count": 7, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 19, "ref_count": 17, "refs": ["PCI-1.4.3", "PCI-10.3.2", "PCI-10.4.3", "PCI-10.7.2", "PCI-10.7.3", "PCI-11.4.4", "PCI-11.5.2", "PCI-11.6.1", "PCI-5.2.1", "PCI-5.3.4", "PCI-5.4.1", "PCI-6.4.1", "PCI-6.5.1", "PCI-7.3.1", "PCI-7.3.2", "PCI-9.2.2", "PCI-9.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-3.2", "PCISSLC-4.1", "PCISSLC-4.2", "PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-2", "SCAGILE-OPS-1"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 4, "ref_count": 4, "refs": ["SLSA-BUILD-L3", "SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS", "SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 5, "ref_count": 5, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-RV.1", "SSDF-PRACTICE-RV.2", "SSDF-TASK-PW.2.1", "SSDF-TASK-RV.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-005", "v1_entity_name": "Threat-To-Mitigation And Validation Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
222
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 4, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.3", "SP800-53-AU-10.3"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.5"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_3_B"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-AU-10.3", "SP800-53-AU-2.3", "SP800-53-RA-1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-G_PC_3_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-006", "v1_entity_name": "Independent Review And Threat Model Lifecycle Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
223
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 4, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A"]}, {"source_display_name": "EU NIS2", "substrate_source": "eu_nis2", "visible_refs": ["NIS2-ART-20"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-20"], "substrate_source_key": "eu_nis2"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_SM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-007", "v1_entity_name": "Threat Modeling And Risk Governance Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
224
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_resolution": {"authored_more_sources_count": 13, "authored_visible_source_count": 4, "resolved_ref_count": 284, "resolved_source_count": 17, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3.3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-4"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V11.1.1", "ASVS-REQ-V13.1.4", "ASVS-REQ-V14.1.2", "ASVS-REQ-V15.1.2", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 48, "ref_count": 23, "refs": ["CIS-13.5", "CIS-14.1", "CIS-14.9", "CIS-15.4", "CIS-16", "CIS-16.1", "CIS-16.12", "CIS-16.2", "CIS-16.4", "CIS-16.6", "CIS-16.9", "CIS-18.1", "CIS-2.2", "CIS-4", "CIS-4.1", "CIS-4.2", "CIS-4.6", "CIS-6.3", "CIS-6.5", "CIS-6.6", "CIS-7.1", "CIS-7.5", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 3, "ref_count": 2, "refs": ["NIS2-ART-21", "NIS2-ART-22"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a1", "HIPAA-164-308a2"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 114, "ref_count": 85, "refs": ["SP800-53-AC-1", "SP800-53-AC-16", "SP800-53-AC-16.3", "SP800-53-AC-16.6", "SP800-53-AC-3.3", "SP800-53-AC-4.11", "SP800-53-AC-4.14", "SP800-53-AC-4.32", "SP800-53-AU-1", "SP800-53-CA-1", "SP800-53-CA-3", "SP800-53-CA-3.2", "SP800-53-CA-4", "SP800-53-CA-7", "SP800-53-CA-9", "SP800-53-CA-9.1", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-11", "SP800-53-CM-2", "SP800-53-CM-3.4", "SP800-53-CM-3.6", "SP800-53-CM-6", "SP800-53-CM-7.3", "SP800-53-CM-8.6", "SP800-53-CP-13", "SP800-53-IA-1", "SP800-53-IA-8.4", "SP800-53-MA-1", "SP800-53-MA-5.1", "SP800-53-MA-5.2", "SP800-53-MA-5.3", "SP800-53-MA-5.4", "SP800-53-PL-2", "SP800-53-PL-3", "SP800-53-PL-6", "SP800-53-PM-1", "SP800-53-PM-3", "SP800-53-PM-30.1", "SP800-53-PM-4", "SP800-53-PS-1", "SP800-53-PS-3.4", "SP800-53-PS-4.1", "SP800-53-PS-6", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-PS-6.3", "SP800-53-PS-7", "SP800-53-PT-1", "SP800-53-SA-1", "SP800-53-SA-10.7", "SP800-53-SA-11", "SP800-53-SA-12.9", "SP800-53-SA-15", "SP800-53-SA-15.11", "SP800-53-SA-17", "SP800-53-SA-17.1", "SP800-53-SA-17.2", "SP800-53-SA-17.4", "SP800-53-SA-2", "SP800-53-SA-21", "SP800-53-SA-3", "SP800-53-SA-4", "SP800-53-SA-4.5", "SP800-53-SA-4.7", "SP800-53-SA-5.1", "SP800-53-SA-8", "SP800-53-SA-8.19", "SP800-53-SA-8.20", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SA-8.32", "SP800-53-SA-8.4", "SP800-53-SA-8.8", "SP800-53-SA-9.3", "SP800-53-SC-12", "SP800-53-SC-16", "SP800-53-SC-3.4", "SP800-53-SC-7.4", "SP800-53-SI-1", "SP800-53-SR-9.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 13, "ref_count": 13, "refs": ["DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0", "DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-2B7CC923BDAF43E38FB4A995B7783969", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-6217FE115ED74CF49DE4555BCFA6FE87", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-746025A6DBFB4087A000E46ACAB64EE1", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C1", "OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 54, "ref_count": 34, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_2_B", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-G_EG_1_A", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_SM_1_B", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_2_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_2_B", "SAMM-ACTIVITY-V_RT_3_A", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 80, "ref_count": 76, "refs": ["PCI-1.1.1", "PCI-1.2.3", "PCI-1.2.4", "PCI-1.2.6", "PCI-1.4.1", "PCI-1.4.4", "PCI-10.1.1", "PCI-10.7.1", "PCI-11.1.1", "PCI-11.4.6", "PCI-12.1.2", "PCI-12.1.3", "PCI-12.1.4", "PCI-12.10.2", "PCI-12.10.3", "PCI-12.2.1", "PCI-12.3.1", "PCI-12.3.4", "PCI-12.4.1", "PCI-12.4.2", "PCI-12.5.1", "PCI-12.5.2", "PCI-12.5.3", "PCI-12.6.1", "PCI-12.6.2", "PCI-12.6.3", "PCI-12.7.1", "PCI-12.8.1", "PCI-12.8.2", "PCI-12.8.3", "PCI-12.8.5", "PCI-12.9.1", "PCI-12.9.2", "PCI-2.1.1", "PCI-2.2.1", "PCI-2.2.3", "PCI-2.2.5", "PCI-2.2.6", "PCI-2.2.7", "PCI-2.3.1", "PCI-3.1.1", "PCI-3.3.3", "PCI-3.6.1", "PCI-3.7.1", "PCI-3.7.2", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.5", "PCI-3.7.7", "PCI-3.7.9", "PCI-4.1.1", "PCI-5.1.1", "PCI-5.3.1", "PCI-6.1.1", "PCI-6.2.1", "PCI-6.3.1", "PCI-6.3.2", "PCI-6.5.4", "PCI-7.1.1", "PCI-7.2.3", "PCI-7.2.5", "PCI-7.3.1", "PCI-8.1.1", "PCI-8.2.3", "PCI-8.3.10", "PCI-8.3.11", "PCI-8.3.8", "PCI-8.6.3", "PCI-REQ-1", "PCI-REQ-12", "PCI-REQ-2", "PCI-REQ-3", "PCI-REQ-6", "PCI-REQ-7", "PCI-REQ-8", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 11, "ref_count": 11, "refs": ["PCISSLC-1.1", "PCISSLC-1.2", "PCISSLC-1.3", "PCISSLC-2.1", "PCISSLC-2.2", "PCISSLC-2.3", "PCISSLC-2.4", "PCISSLC-3.1", "PCISSLC-8.1", "PCISSLC-8.2", "PCISSLC-9.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-8", "SCAGILE-EXP-9"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCFPSSD-LIFECYCLE-FEEDBACK", "SCFPSSD-LOGGING", "SCFPSSD-PLANNING", "SCFPSSD-SECURITY-CONTROLS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DEV-REPO", "SCSIC-SOURCING-CONTRACT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 23, "ref_count": 19, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.2", "SSDF-PRACTICE-PO.3", "SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.1.3", "SSDF-TASK-PO.3.3", "SSDF-TASK-PO.4.1", "SSDF-TASK-PW.1.3", "SSDF-TASK-PW.4.1", "SSDF-TASK-PW.4.2", "SSDF-TASK-PW.4.4", "SSDF-TASK-RV.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TMR-008", "v1_entity_name": "Security Requirements Lifecycle Management", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
225
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 11, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0006", "AML.T0018"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-2", "SP800-53-SA-3.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-2.3.4", "NIST-AI-100-2-E2025-3.2.2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-166"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 1, "refs": ["CIS-7.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-CP-2", "SP800-53-SA-3.3", "SP800-53-SI-4.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-F8E80F1825034E3EB3BC7F67BB28DEFE"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B", "SAMM-ACTIVITY-V_AA_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-3"], "substrate_source_key": "safecode_agile_2012"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-001", "v1_entity_name": "Threat Model Creation And Triggered Refresh", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
226
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 6, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-8.10", "SP800-53-SA-9.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.9"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-807"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-3.2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-4.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-807"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-SA-13", "SP800-53-SA-8.10", "SP800-53-SA-9.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-002", "v1_entity_name": "DFD And Trust-Boundary Grounding", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
227
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 45, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-2.6", "SP800-53-CP-6.1"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-RV.2", "SSDF-TASK-PW.1.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-I_DM_2_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-420", "CAPEC-427"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-420", "CAPEC-427"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-17.9", "CIS-7.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-6"], "substrate_source_key": "eu_dora"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 45, "ref_count": 30, "refs": ["SP800-53-AT-2.6", "SP800-53-CP-12", "SP800-53-CP-6.1", "SP800-53-CP-7.1", "SP800-53-PE-23", "SP800-53-PE-3.6", "SP800-53-PL-2", "SP800-53-PM-12", "SP800-53-PM-28", "SP800-53-PM-29", "SP800-53-PM-4", "SP800-53-PM-9", "SP800-53-PS-2", "SP800-53-RA-1", "SP800-53-RA-10", "SP800-53-RA-2.1", "SP800-53-RA-3", "SP800-53-RA-3.1", "SP800-53-RA-3.2", "SP800-53-RA-3.3", "SP800-53-RA-4", "SP800-53-RA-5", "SP800-53-RA-5.3", "SP800-53-RA-5.6", "SP800-53-RA-5.9", "SP800-53-SA-11.2", "SP800-53-SA-15.4", "SP800-53-SR-1", "SP800-53-SR-2", "SP800-53-SR-5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-O_IM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-12.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-RV.2", "SSDF-TASK-PW.1.1", "SSDF-TASK-RV.2.1", "SSDF-TASK-RV.2.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-003", "v1_entity_name": "Structured Threat Analysis Method Selection", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
228
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 1, "resolved_ref_count": 1, "resolved_source_count": 1, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_SM_1_A"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 1, "refs": ["SAMM-ACTIVITY-G_SM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-004", "v1_entity_name": "Threat Disposition And Accepted Risk Governance", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
229
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 22, "es_grounding_resolution": {"authored_more_sources_count": 22, "authored_visible_source_count": 4, "resolved_ref_count": 298, "resolved_source_count": 21, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-AC-17.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-37", "CAPEC-51"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0011", "AML.T0002"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V1.5.2"]}], "es_grounding_sources_full": [{"claim_count": 26, "ref_count": 26, "refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V1.5.2", "ASVS-REQ-V13.4.4", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.7", "ASVS-REQ-V15.1.1", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.1.3", "ASVS-REQ-V15.1.4", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.2.2", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.7", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.3.1", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.3", "ASVS-REQ-V2.2.2", "ASVS-REQ-V2.3.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 56, "ref_count": 56, "refs": ["CAPEC-107", "CAPEC-143", "CAPEC-144", "CAPEC-169", "CAPEC-170", "CAPEC-187", "CAPEC-188", "CAPEC-198", "CAPEC-201", "CAPEC-212", "CAPEC-215", "CAPEC-224", "CAPEC-271", "CAPEC-293", "CAPEC-330", "CAPEC-37", "CAPEC-443", "CAPEC-445", "CAPEC-446", "CAPEC-51", "CAPEC-511", "CAPEC-516", "CAPEC-518", "CAPEC-519", "CAPEC-520", "CAPEC-522", "CAPEC-523", "CAPEC-524", "CAPEC-529", "CAPEC-532", "CAPEC-537", "CAPEC-54", "CAPEC-548", "CAPEC-574", "CAPEC-575", "CAPEC-578", "CAPEC-580", "CAPEC-581", "CAPEC-643", "CAPEC-646", "CAPEC-647", "CAPEC-648", "CAPEC-655", "CAPEC-669", "CAPEC-670", "CAPEC-673", "CAPEC-678", "CAPEC-682", "CAPEC-690", "CAPEC-691", "CAPEC-692", "CAPEC-693", "CAPEC-695", "CAPEC-702", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 11, "ref_count": 10, "refs": ["CIS-16.11", "CIS-16.5", "CIS-16.6", "CIS-17.2", "CIS-17.3", "CIS-3", "CIS-3.1", "CIS-3.13", "CIS-3.14", "CIS-8.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 14, "ref_count": 14, "refs": ["CWE-1118", "CWE-1230", "CWE-209", "CWE-215", "CWE-222", "CWE-223", "CWE-224", "CWE-348", "CWE-349", "CWE-353", "CWE-354", "CWE-426", "CWE-547", "CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 117, "ref_count": 105, "refs": ["SP800-53-AC-17.6", "SP800-53-AC-4.19", "SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-AU-12.1", "SP800-53-AU-12.4", "SP800-53-AU-15", "SP800-53-AU-2", "SP800-53-AU-3.3", "SP800-53-AU-5.1", "SP800-53-AU-5.3", "SP800-53-AU-6.2", "SP800-53-AU-9", "SP800-53-AU-9.3", "SP800-53-CP-9.1", "SP800-53-IR-4.12", "SP800-53-IR-4.5", "SP800-53-IR-5.1", "SP800-53-IR-6.2", "SP800-53-MA-4", "SP800-53-PE-3.5", "SP800-53-PE-8", "SP800-53-PE-8.3", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-25", "SP800-53-PT-2.2", "SP800-53-PT-3", "SP800-53-PT-3.2", "SP800-53-RA-5", "SP800-53-RA-5.11", "SP800-53-RA-5.2", "SP800-53-RA-5.4", "SP800-53-RA-5.5", "SP800-53-RA-5.7", "SP800-53-RA-5.8", "SP800-53-SA-10", "SP800-53-SA-10.4", "SP800-53-SA-12.14", "SP800-53-SA-8.22", "SP800-53-SC-11.1", "SP800-53-SC-16.1", "SP800-53-SC-18.1", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-26", "SP800-53-SC-30.4", "SP800-53-SC-35", "SP800-53-SC-7.16", "SP800-53-SC-7.23", "SP800-53-SC-7.24", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-10.4", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-11", "SP800-53-SI-12.1", "SP800-53-SI-12.2", "SP800-53-SI-13.5", "SP800-53-SI-14.2", "SP800-53-SI-15", "SP800-53-SI-17", "SP800-53-SI-18", "SP800-53-SI-19", "SP800-53-SI-19.5", "SP800-53-SI-19.7", "SP800-53-SI-2", "SP800-53-SI-2.2", "SP800-53-SI-2.3", "SP800-53-SI-2.5", "SP800-53-SI-2.7", "SP800-53-SI-20", "SP800-53-SI-22", "SP800-53-SI-3", "SP800-53-SI-3.10", "SP800-53-SI-3.2", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.19", "SP800-53-SI-4.7", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-5.1", "SP800-53-SI-6.1", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.10", "SP800-53-SI-7.11", "SP800-53-SI-7.12", "SP800-53-SI-7.13", "SP800-53-SI-7.17", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.4", "SP800-53-SI-7.5", "SP800-53-SI-7.6", "SP800-53-SI-7.7", "SP800-53-SI-8.2", "SP800-53-SI-9", "SP800-53-SR-10", "SP800-53-SR-4", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 14, "ref_count": 14, "refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-27337442E4B14E878DC9CE86FBB79A39", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-7A82020C94D1471CBBD35F7FE7DF4876", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-DATA-VALIDATION", "OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY", "OWASP-MCP-3P-GOVERNANCE-REGISTRY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["MCP01-2025", "MCP04-2025", "MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 28, "ref_count": 18, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_3_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["TOP10-A08-2021", "TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 19, "ref_count": 16, "refs": ["PCI-10.3.2", "PCI-10.3.3", "PCI-10.4.1", "PCI-11.4.4", "PCI-11.6.1", "PCI-5.2.1", "PCI-5.3.1", "PCI-5.3.4", "PCI-6.2.3", "PCI-6.4.1", "PCI-6.5.2", "PCI-6.5.5", "PCI-7.3.1", "PCI-7.3.2", "PCI-9.3.2", "PCI-9.4.5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCISSLC-2.6", "PCISSLC-3.2", "PCISSLC-4.1", "PCISSLC-4.2", "PCISSLC-6.1", "PCISSLC-6.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-EXP-2", "SCAGILE-OPS-1", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-DATA-HANDLING", "SCFPSSD-THIRD-PARTY"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 6, "ref_count": 6, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L3", "SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS", "SLSA-VERIFY-BUILD-LEVEL", "SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 9, "ref_count": 9, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PW.7", "SSDF-PRACTICE-RV.1", "SSDF-TASK-PO.5.2", "SSDF-TASK-PS.2.1", "SSDF-TASK-PW.2.1", "SSDF-TASK-RV.1.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-005", "v1_entity_name": "Threat Traceability Into Requirements And Validation", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
230
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 4, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-13", "SP800-53-AU-2.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17.8"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_3_A"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-17.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-AC-13", "SP800-53-AU-2.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-G_EG_3_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (go-live, model, models kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-006", "v1_entity_name": "Independent Review And Threat Model Approval", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
231
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 1, "resolved_source_count": 1, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_SM_1_A"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-G_SM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (access, artifacts, lifecycle kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-007", "v1_entity_name": "Threat Model Artifact Governance", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
232
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_resolution": {"authored_more_sources_count": 11, "authored_visible_source_count": 4, "resolved_ref_count": 136, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-3.5"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-1.2", "PCISSLC-1.3"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V14.1.2", "ASVS-REQ-V3.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-671"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 10, "ref_count": 6, "refs": ["CIS-12.2", "CIS-14.9", "CIS-15.4", "CIS-16.1", "CIS-4.1", "CIS-4.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 69, "ref_count": 62, "refs": ["SP800-53-AC-16", "SP800-53-AC-16.8", "SP800-53-AC-2", "SP800-53-AC-3.5", "SP800-53-AC-4.1", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AT-3.2", "SP800-53-CA-3.2", "SP800-53-IA-1", "SP800-53-IA-12", "SP800-53-MA-5.2", "SP800-53-MA-5.3", "SP800-53-PL-2", "SP800-53-PL-6", "SP800-53-PL-8", "SP800-53-PM-1", "SP800-53-PM-3", "SP800-53-PS-1", "SP800-53-PS-3.4", "SP800-53-PS-6.2", "SP800-53-PS-7", "SP800-53-RA-2", "SP800-53-SA-12.9", "SP800-53-SA-17", "SP800-53-SA-17.1", "SP800-53-SA-17.2", "SP800-53-SA-17.3", "SP800-53-SA-17.4", "SP800-53-SA-17.5", "SP800-53-SA-17.7", "SP800-53-SA-2", "SP800-53-SA-3", "SP800-53-SA-4", "SP800-53-SA-4.11", "SP800-53-SA-4.7", "SP800-53-SA-5.1", "SP800-53-SA-5.2", "SP800-53-SA-8", "SP800-53-SA-8.11", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.14", "SP800-53-SA-8.2", "SP800-53-SA-8.21", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SA-8.3", "SP800-53-SA-8.31", "SP800-53-SA-8.32", "SP800-53-SA-8.4", "SP800-53-SA-8.7", "SP800-53-SA-8.8", "SP800-53-SA-9.2", "SP800-53-SC-12", "SP800-53-SC-16", "SP800-53-SC-38", "SP800-53-SC-4.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C1", "OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 20, "ref_count": 14, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-G_EG_1_A", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 28, "ref_count": 28, "refs": ["PCI-1.2.3", "PCI-1.2.6", "PCI-1.5.1", "PCI-12.1.1", "PCI-12.1.2", "PCI-12.1.3", "PCI-12.1.4", "PCI-12.10.3", "PCI-12.10.6", "PCI-12.2.1", "PCI-12.3.1", "PCI-12.4.2", "PCI-12.5.3", "PCI-12.6.1", "PCI-12.6.2", "PCI-12.6.3", "PCI-12.7.1", "PCI-12.9.1", "PCI-12.9.2", "PCI-2.2.3", "PCI-2.2.6", "PCI-5.1.1", "PCI-6.3.1", "PCI-8.3.8", "PCI-REQ-12", "PCI-REQ-2", "PCI-REQ-6", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 7, "ref_count": 7, "refs": ["PCISSLC-1.2", "PCISSLC-1.3", "PCISSLC-2.2", "PCISSLC-2.3", "PCISSLC-3.1", "PCISSLC-3.3", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 6, "ref_count": 5, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PW.1", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PW.9.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (models, policies, requirements kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-008", "v1_entity_name": "Security Requirements Identification And Derivation", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
233
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 55, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-6.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_PC_1_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.2", "PCI-2.1.2"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-2.1", "PCISSLC-5.1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CIS-15", "CIS-15.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 43, "ref_count": 33, "refs": ["SP800-53-AU-1", "SP800-53-AU-6.1", "SP800-53-CA-1", "SP800-53-CA-3", "SP800-53-CA-5", "SP800-53-CA-7", "SP800-53-CA-7.4", "SP800-53-CA-7.5", "SP800-53-CA-9.1", "SP800-53-CM-1", "SP800-53-CM-11", "SP800-53-CM-11.3", "SP800-53-CM-3", "SP800-53-CM-3.1", "SP800-53-CM-3.7", "SP800-53-CM-4.2", "SP800-53-CM-6", "SP800-53-CM-6.1", "SP800-53-CM-7.3", "SP800-53-CM-8", "SP800-53-CM-8.6", "SP800-53-MA-1", "SP800-53-PM-1", "SP800-53-PM-24", "SP800-53-PM-30.1", "SP800-53-PM-31", "SP800-53-PT-3", "SP800-53-SA-1", "SP800-53-SA-10", "SP800-53-SA-15.1", "SP800-53-SA-4.8", "SP800-53-SC-1", "SP800-53-SR-8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 22, "ref_count": 10, "refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCI-1.1.2", "PCI-11.1.2", "PCI-2.1.2", "PCI-4.1.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-10.1", "PCISSLC-2.1", "PCISSLC-5.1", "PCISSLC-9.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PO.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (compliance, development, requirements kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TMR-009", "v1_entity_name": "Requirements Communication And Compliance Monitoring", "v1_entity_type": "Practice", "v1_family": "ACO-TMR", "v1_slice": "ASC-05"}
234
234
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 maturity dimensions; DSOMM activities", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
235
235
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de Threat Modeling (organizational)", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
236
236
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "KPIs e métricas operacionais", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/11-kpis-metricas.md", "manual_v2_anchor": "ExternalFramework", "rastreabilidade_role": "manual_only_coverage"}
@@ -304,62 +304,62 @@
304
304
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:antipattern:excecoes-nao-documentadas", "manual_v2_entity_label": "Exceções não documentadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
305
305
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:antipattern:modelos-inconsistentes-incompletos-ou-desatualizados", "manual_v2_entity_label": "Modelos inconsistentes, incompletos ou desatualizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
306
306
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:antipattern:threat-modeling-sem-arquitetura-clara", "manual_v2_entity_label": "Threat modeling sem arquitetura clara", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
307
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2", "CIS-2.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SR_2_A"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-001", "v1_entity_name": "Versioned Diagrams And ADR Records", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
308
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-CP-7.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "SAFECode FPSSD", "substrate_source": "safecode", "visible_refs": ["SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-THREAT-MODELING"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-002", "v1_entity_name": "Trust-Boundary And DFD Modeling", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
309
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-3.1", "SP800-53-CP-10.3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-497", "CWE-654"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-003", "v1_entity_name": "Boundary Mediation Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
310
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.3", "SP800-53-CM-2.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-O_OM_3_B"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-004", "v1_entity_name": "Architecture Review Gates", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
311
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-5.1", "SP800-53-CM-2.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-V_RT_2_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0008", "AML.M0033"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-005", "v1_entity_name": "Automated Topology Validation Jobs", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
312
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-5.3"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-001", "v1_entity_name": "Architecture Baseline And Decision Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
313
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 18, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-1.2.2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-182"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-002", "v1_entity_name": "Trust Boundary Clarity And Protected Data Flows", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
314
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0048", "AML.T0048.002"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-9.4", "SP800-53-MP-5.1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-003", "v1_entity_name": "External Exposure Justification And Boundary Mediation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
315
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.23", "SP800-53-AC-6.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-390", "CAPEC-516"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.12", "CIS-16.8"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-653"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-004", "v1_entity_name": "Technical Segmentation And Sensitive Domain Isolation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
316
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-V_AA_3_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17.8"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.5"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-005", "v1_entity_name": "Architecture Review And Change Trigger Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
317
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-3.2", "SP800-53-CM-6.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-80", "CAPEC-231"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0042", "AML.M0008"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-006", "v1_entity_name": "Architectural Topology Validation And Pattern Conformance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
318
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PL-2", "SP800-53-PL-8"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4", "CIS-4.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-184", "CAPEC-440"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-007", "v1_entity_name": "Secure Architecture Governance And Boundary Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
319
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-I_SB_3_A"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2", "SP800-53-PL-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-12.2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-001", "v1_entity_name": "Architecture Baseline Definition", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
320
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-12.1", "SP800-53-CM-8"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-O_EM_1_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-580", "CAPEC-581"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-8", "PCI-10.4.2"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-002", "v1_entity_name": "Architectural Decision And Solution Traceability", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
321
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4", "SP800-53-AC-4.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-003", "v1_entity_name": "Trust-Boundary And Flow Review", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
322
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-9.4", "SP800-53-MP-5.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1230", "CWE-497"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a6"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0048"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-004", "v1_entity_name": "External Exposure And Boundary Mediation Design", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
323
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_SM_1_A"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MA-3", "SP800-53-PL-2.2"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-005", "v1_entity_name": "Architecture Review And Approval Governance", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
324
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (architecture, governance, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-006", "v1_entity_name": "Architecture Change Trigger Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
325
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.2", "SP800-53-CM-3.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-48E92BB1FDBA40E8B6C235DE0D431833", "DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-80"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 03, Cap. 08, Cap. 13", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-007", "v1_entity_name": "Automatable Topology And Pattern Validation", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
326
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-7.4", "SP800-53-CP-13"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.5"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-294"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-90", "CAPEC-151"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-001", "v1_entity_name": "Authentication And Federation Protocols", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
327
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 20, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-8"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0000", "AML.TA0012"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-7", "PCI-REQ-9"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-002", "v1_entity_name": "Access Policy Enforcement", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
328
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-5.5", "CIS-6.2"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a8", "HIPAA-164-312b"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-003", "v1_entity_name": "Periodic Review And Access Audit", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
329
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-39", "CAPEC-59"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V7.2.3", "ASVS-REQ-V7.2.4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-12", "SP800-53-AC-12.1"]}, {"source_display_name": "OWASP MCP Top 10", "substrate_source": "owasp_mcp", "visible_refs": ["MCP01-2025", "MCP10-2025"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-004", "v1_entity_name": "Short-Lived Token Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
330
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.2", "ASVS-REQ-V4.1.3"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IA-2.11", "SP800-53-SA-9.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-384", "CAPEC-461"]}, {"source_display_name": "MCP Official 2025", "substrate_source": "unknown", "visible_refs": ["MCP-CONFUSED-DEPUTY"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (boundaries, gateway, identity kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-005", "v1_entity_name": "API Gateway Mutual Authentication", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
331
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 18, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-4.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10", "PCI-1.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-3.1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 03, Cap. 12, Cap. 14", "manual_v2_anchor": "Mechanism", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-006", "v1_entity_name": "Structured Logging And Effective Configuration Recording", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
332
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.3.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-4", "PCI-REQ-8"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-7", "SP800-53-AC-7.4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-290", "CWE-305"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-001", "v1_entity_name": "Authentication Strength And Identity Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
333
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-7", "PCI-REQ-9"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-13"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-183"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-002", "v1_entity_name": "Authorization Policy Integrity And Least Privilege", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
334
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-447", "CAPEC-675"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-6", "CIS-6.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V10.4.9"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-003", "v1_entity_name": "Access Revocation And Privilege Lifecycle Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
335
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.4.3", "ASVS-REQ-V4.4.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-31", "CAPEC-39"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IA-13.3", "SP800-53-SC-12.5"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-488", "CWE-565"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-004", "v1_entity_name": "Session And Token Trust Boundaries", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
336
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.2", "ASVS-REQ-V3.5.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-8.10", "SP800-53-SA-9.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-461"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-005", "v1_entity_name": "API Caller Trust And Service Boundary Enforcement", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
337
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.12"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-2.3.2", "PCI-8.2.7"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-5", "CAPEC-54"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-BACF85B65BC0405DB5BAA5D971467CC1", "DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-006", "v1_entity_name": "Access Abuse Detection And Auditability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
338
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.17", "SP800-53-AC-17.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.8.1", "ASVS-REQ-V8.4.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-113", "CAPEC-277"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0021", "AML.T0073"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-007", "v1_entity_name": "Identity And Access Control Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
339
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-7", "SP800-53-AC-7.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.1.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-16"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-290"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-001", "v1_entity_name": "Strong Authentication And Step-Up Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
340
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-183"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-13"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-002", "v1_entity_name": "Least-Privilege Authorization Governance", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
341
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V10.4.9", "ASVS-REQ-V12.1.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-5.5", "CIS-6.6"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a4", "HIPAA-164-312a1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-003", "v1_entity_name": "Access Review And Timely Revocation", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
342
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.4.3", "ASVS-REQ-V4.4.4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-10", "SP800-53-AC-12"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-39"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-312", "CWE-488"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-004", "v1_entity_name": "Bounded Session And Token Management", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
343
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V2.2.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-8", "CAPEC-14"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.7", "SP800-53-AC-4.29"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0040", "AML.T0011.000"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-005", "v1_entity_name": "Authenticated API Boundary Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
344
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 20, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-11", "PCI-1.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-2.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SR_1_B"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-006", "v1_entity_name": "Access Abuse Monitoring And Audit Trail", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
345
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.2", "ASVS-REQ-V4.1.2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3.5", "SP800-53-CM-3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-14", "CAPEC-21"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0012", "AML.T0075"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-001", "v1_entity_name": "API Gateway With Mutual Authentication", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
346
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.3", "SP800-53-AU-10.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-3", "NIST-AI-RMF-MEASURE-4"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-002", "v1_entity_name": "Trust Boundary Models", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
347
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-REQ-7"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-312"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 14", "manual_v2_anchor": "Mechanism", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-003", "v1_entity_name": "Transport Security Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
348
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.12", "SP800-53-AC-8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-1.2.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.3.5", "ASVS-REQ-V4.1.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-330", "CAPEC-418"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-004", "v1_entity_name": "Message Integrity And Authorized Peer Policies", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
349
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-8", "CIS-8.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10", "PCI-5.3.4"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (calls, context, logging kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-005", "v1_entity_name": "Structured External Call Logging", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
350
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-4.17"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.6.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-36"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-289"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-001", "v1_entity_name": "Authenticated Service Interaction And Machine Identity Binding", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
351
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.3", "SP800-53-AC-3.5"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-4"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-29318D6018CE452680EAF5928E49F639"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V3.4.1", "ASVS-REQ-V12.1.2"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-002", "v1_entity_name": "Secure Transport And Insecure Protocol Exclusion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
352
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.12", "SP800-53-AC-4.19"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.5.2", "ASVS-REQ-V2.3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-12", "CAPEC-22"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-179", "CWE-209"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-003", "v1_entity_name": "Message Integrity And Authorized Peer Validation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
353
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MP-5.1", "SP800-53-PE-3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-433"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-73"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-004", "v1_entity_name": "Boundary-Mediated External Exposure And Integration Path Control", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
354
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4", "CIS-4.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3", "SP800-53-CA-4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_B"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a1", "HIPAA-164-308b1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-005", "v1_entity_name": "Integration Security Review And Contract Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
355
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-2.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.3.3", "PCI-10.4.2"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-006", "v1_entity_name": "External Interaction Auditability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
356
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-6.1", "SP800-53-CA-6.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V8.4.2", "ASVS-REQ-V12.2.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-677"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-MEASURE-4"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-007", "v1_entity_name": "Integration Trust And Service Interaction Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
357
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_SM_1_A"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-MEASURE-4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-13"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-001", "v1_entity_name": "Trust Boundary And Integration Review", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
358
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.2", "SP800-53-AC-17.10"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.5.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-36"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0012", "AML.T0083"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-002", "v1_entity_name": "Machine Identity And Mutual Authentication Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
359
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-1.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-36", "CAPEC-57"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-4"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-003", "v1_entity_name": "Transport And Protocol Hardening", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
360
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-AC-22"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.2", "ASVS-REQ-V2.3.3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-209", "CWE-294"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.2", "PCI-1.2.4"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-004", "v1_entity_name": "Message Integrity And Authorized Peer Validation", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
361
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3", "SP800-53-CM-1"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308b1", "HIPAA-164-314a1"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (integration, interface, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-005", "v1_entity_name": "Integration Contract And Change Assurance", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
362
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.4", "SP800-53-AC-3.10"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10", "PCI-5.3.4"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-8"]}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (calls, context, logging kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-006", "v1_entity_name": "External Interaction Audit Logging", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
307
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 288, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2", "CIS-2.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SR_2_A"]}], "es_grounding_sources_full": [{"claim_count": 8, "ref_count": 8, "refs": ["ASVS-REQ-V14.2.4", "ASVS-REQ-V15.1.1", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.2.2", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.5.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 16, "ref_count": 16, "refs": ["CAPEC-445", "CAPEC-518", "CAPEC-519", "CAPEC-521", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-669", "CAPEC-671", "CAPEC-673", "CAPEC-678", "CAPEC-680", "CAPEC-681", "CAPEC-692", "CAPEC-702", "CAPEC-75"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 26, "ref_count": 21, "refs": ["CIS-10.2", "CIS-11.4", "CIS-12.3", "CIS-12.4", "CIS-13.5", "CIS-13.7", "CIS-16.1", "CIS-16.11", "CIS-16.12", "CIS-16.2", "CIS-16.5", "CIS-16.7", "CIS-2", "CIS-2.2", "CIS-2.5", "CIS-3", "CIS-3.1", "CIS-3.8", "CIS-4.1", "CIS-4.2", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-215"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-316b1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 129, "ref_count": 119, "refs": ["SP800-53-AC-1", "SP800-53-AC-16.3", "SP800-53-AC-16.7", "SP800-53-AC-2", "SP800-53-AC-25", "SP800-53-AC-3.6", "SP800-53-AC-4.3", "SP800-53-AC-4.7", "SP800-53-AU-1", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-9.2", "SP800-53-AU-9.7", "SP800-53-CA-1", "SP800-53-CA-5", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-11", "SP800-53-CM-12.1", "SP800-53-CM-13", "SP800-53-CM-14", "SP800-53-CM-2", "SP800-53-CM-2.3", "SP800-53-CM-2.5", "SP800-53-CM-3", "SP800-53-CM-3.6", "SP800-53-CM-4", "SP800-53-CM-4.2", "SP800-53-CM-5.1", "SP800-53-CM-5.4", "SP800-53-CM-5.7", "SP800-53-CM-6", "SP800-53-CM-6.4", "SP800-53-CM-8", "SP800-53-CM-8.4", "SP800-53-CM-8.6", "SP800-53-CM-8.7", "SP800-53-CP-10.4", "SP800-53-IA-1", "SP800-53-IA-4.9", "SP800-53-IR-4.2", "SP800-53-MA-4", "SP800-53-PE-2", "SP800-53-PE-3.4", "SP800-53-PL-2", "SP800-53-PT-3", "SP800-53-RA-5.1", "SP800-53-RA-5.2", "SP800-53-RA-5.5", "SP800-53-SA-1", "SP800-53-SA-10", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-10.4", "SP800-53-SA-10.5", "SP800-53-SA-10.7", "SP800-53-SA-11.9", "SP800-53-SA-12.14", "SP800-53-SA-15", "SP800-53-SA-15.11", "SP800-53-SA-15.12", "SP800-53-SA-15.13", "SP800-53-SA-15.2", "SP800-53-SA-15.5", "SP800-53-SA-15.8", "SP800-53-SA-17.2", "SP800-53-SA-17.3", "SP800-53-SA-17.4", "SP800-53-SA-17.5", "SP800-53-SA-17.7", "SP800-53-SA-3.1", "SP800-53-SA-3.2", "SP800-53-SA-4.2", "SP800-53-SA-5.3", "SP800-53-SA-5.4", "SP800-53-SA-5.5", "SP800-53-SA-6", "SP800-53-SA-8.1", "SP800-53-SA-8.20", "SP800-53-SA-8.22", "SP800-53-SA-8.29", "SP800-53-SA-8.31", "SP800-53-SA-8.32", "SP800-53-SC-1", "SP800-53-SC-18.2", "SP800-53-SC-2.1", "SP800-53-SC-2.2", "SP800-53-SC-22", "SP800-53-SC-39", "SP800-53-SC-49", "SP800-53-SC-51", "SP800-53-SC-7.13", "SP800-53-SC-7.16", "SP800-53-SC-7.24", "SP800-53-SI-1", "SP800-53-SI-10.5", "SP800-53-SI-13.5", "SP800-53-SI-14", "SP800-53-SI-16", "SP800-53-SI-19.3", "SP800-53-SI-19.5", "SP800-53-SI-2", "SP800-53-SI-2.2", "SP800-53-SI-2.3", "SP800-53-SI-2.5", "SP800-53-SI-2.6", "SP800-53-SI-2.7", "SP800-53-SI-3.2", "SP800-53-SI-4", "SP800-53-SI-4.20", "SP800-53-SI-4.8", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.12", "SP800-53-SI-7.13", "SP800-53-SI-7.17", "SP800-53-SI-7.6", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-066084C6113546359CC59E75C7C5459F", "DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 31, "ref_count": 17, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_2_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_2_B", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-O_OM_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 74, "ref_count": 62, "refs": ["PCI-1.1.1", "PCI-1.1.2", "PCI-1.2.2", "PCI-1.2.3", "PCI-1.2.4", "PCI-1.2.6", "PCI-1.4.3", "PCI-1.4.4", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.3.4", "PCI-10.4.2", "PCI-11.1.1", "PCI-12.5.1", "PCI-12.5.2", "PCI-12.8.5", "PCI-2.1.1", "PCI-2.1.2", "PCI-2.2.1", "PCI-2.2.6", "PCI-3.1.1", "PCI-3.3.2", "PCI-3.4.2", "PCI-3.6.1", "PCI-4.1.1", "PCI-4.1.2", "PCI-5.1.1", "PCI-5.1.2", "PCI-5.2.1", "PCI-5.2.2", "PCI-5.2.3", "PCI-5.3.1", "PCI-5.3.4", "PCI-5.4.1", "PCI-6.1.1", "PCI-6.1.2", "PCI-6.2.4", "PCI-6.3.3", "PCI-6.5.1", "PCI-6.5.2", "PCI-6.5.4", "PCI-7.1.1", "PCI-7.1.2", "PCI-7.2.5", "PCI-7.3.1", "PCI-7.3.2", "PCI-8.1.1", "PCI-8.1.2", "PCI-8.2.1", "PCI-8.2.4", "PCI-8.3.1", "PCI-8.5.1", "PCI-8.6.1", "PCI-9.1.1", "PCI-9.1.2", "PCI-9.3.1", "PCI-9.3.2", "PCI-9.4.5", "PCI-REQ-1", "PCI-REQ-2", "PCI-REQ-7", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 10, "ref_count": 9, "refs": ["PCISSLC-2.3", "PCISSLC-3.3", "PCISSLC-5.1", "PCISSLC-5.2", "PCISSLC-6.1", "PCISSLC-6.2", "PCISSLC-8.1", "PCISSLC-8.2", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["SCAGILE-OPS-1", "SCAGILE-OPS-12", "SCAGILE-OPS-13", "SCAGILE-OPS-2", "SCAGILE-OPS-5", "SCAGILE-OPS-6"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-LOGGING", "SCFPSSD-SECURITY-CONTROLS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DELIVERY-SIGNING", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-BUILD-L1"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 18, "ref_count": 16, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PS.3", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.1.3", "SSDF-TASK-PO.3.1", "SSDF-TASK-PO.3.2", "SSDF-TASK-PO.3.3", "SSDF-TASK-PO.4.1", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.1", "SSDF-TASK-PS.3.2", "SSDF-TASK-PW.1.2", "SSDF-TASK-PW.1.3", "SSDF-TASK-PW.4.4", "SSDF-TASK-PW.5.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-001", "v1_entity_name": "Versioned Diagrams And ADR Records", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
308
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 38, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-CP-7.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "SAFECode FPSSD", "substrate_source": "safecode", "visible_refs": ["SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-THREAT-MODELING"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-16.14"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-501"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 17, "ref_count": 16, "refs": ["SP800-53-AC-4.19", "SP800-53-CP-7.5", "SP800-53-PL-2", "SP800-53-PL-8", "SP800-53-PL-8.1", "SP800-53-PM-8", "SP800-53-SA-10.6", "SP800-53-SA-12.11", "SP800-53-SA-13", "SP800-53-SA-8.10", "SP800-53-SA-8.16", "SP800-53-SA-8.18", "SP800-53-SA-8.9", "SP800-53-SA-9.3", "SP800-53-SC-17", "SP800-53-SC-7.18"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9", "DSOMM-ACTIVITY-DD5ED7C1BDBF400FB75F6D3953A1A04E"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 7, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-PLANNING", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-002", "v1_entity_name": "Trust-Boundary And DFD Modeling", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
309
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 12, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-3.1", "SP800-53-CP-10.3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-497", "CWE-654"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CWE-1230", "CWE-497", "CWE-654"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 10, "ref_count": 9, "refs": ["SP800-53-AT-3.1", "SP800-53-CP-10.3", "SP800-53-IR-9.4", "SP800-53-MP-1", "SP800-53-MP-5", "SP800-53-MP-5.1", "SP800-53-PE-16", "SP800-53-PE-3", "SP800-53-SC-7"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-003", "v1_entity_name": "Boundary Mediation Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
310
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 13, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.3", "SP800-53-CM-2.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-O_OM_3_B"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["SP800-53-AU-2.3", "SP800-53-CM-2.1", "SP800-53-CM-3", "SP800-53-CM-3.7", "SP800-53-CM-5.2", "SP800-53-PL-2.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 11, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-O_OM_3_B", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_AA_3_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-004", "v1_entity_name": "Architecture Review Gates", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
311
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 20, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-5.1", "SP800-53-CM-2.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-V_RT_2_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0008", "AML.M0033"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-309"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-18.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-CA-5.1", "SP800-53-CM-2.2", "SP800-53-CM-3.2", "SP800-53-CM-6.1", "SP800-53-MA-2.2", "SP800-53-SI-7.2", "SP800-53-SI-7.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-598897A2358E441F984CE12EC4F6110A", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-CONTINUOUS-VALIDATION", "OWASP-MCP-DATA-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C5"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 6, "ref_count": 4, "refs": ["SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_2_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-TESTING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ATB-005", "v1_entity_name": "Automated Topology Validation Jobs", "v1_entity_type": "Mechanism", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
312
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 3, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-5.3"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-SA-5.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-001", "v1_entity_name": "Architecture Baseline And Decision Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
313
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 18, "es_grounding_resolution": {"authored_more_sources_count": 18, "authored_visible_source_count": 4, "resolved_ref_count": 188, "resolved_source_count": 17, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-1.2.2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-182"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V1.5.2", "ASVS-REQ-V12.2.2", "ASVS-REQ-V12.3.3", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7", "ASVS-REQ-V15.3.4", "ASVS-REQ-V2.3.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 7, "ref_count": 7, "refs": ["CAPEC-10", "CAPEC-39", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-69", "CAPEC-94"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 26, "ref_count": 13, "refs": ["CIS-11.3", "CIS-14.8", "CIS-15", "CIS-3", "CIS-3.1", "CIS-3.13", "CIS-3.14", "CIS-3.2", "CIS-3.4", "CIS-3.5", "CIS-3.7", "CIS-3.8", "CIS-4.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 19, "ref_count": 19, "refs": ["CWE-1220", "CWE-182", "CWE-183", "CWE-201", "CWE-213", "CWE-312", "CWE-319", "CWE-348", "CWE-349", "CWE-360", "CWE-426", "CWE-454", "CWE-501", "CWE-502", "CWE-649", "CWE-654", "CWE-766", "CWE-807", "CWE-921"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 3, "refs": ["GDPR-ART-32", "GDPR-ART-35", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 94, "ref_count": 91, "refs": ["SP800-53-AC-1", "SP800-53-AC-16.7", "SP800-53-AC-17.2", "SP800-53-AC-17.6", "SP800-53-AC-24", "SP800-53-AC-24.1", "SP800-53-AC-25", "SP800-53-AC-3", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.12", "SP800-53-AC-4.14", "SP800-53-AC-4.17", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.25", "SP800-53-AC-4.26", "SP800-53-AC-4.27", "SP800-53-AC-4.28", "SP800-53-AC-4.3", "SP800-53-AC-4.30", "SP800-53-AC-4.31", "SP800-53-AC-4.32", "SP800-53-AC-4.4", "SP800-53-AC-4.6", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-AC-4.9", "SP800-53-CA-3.5", "SP800-53-CA-3.6", "SP800-53-CA-3.7", "SP800-53-CA-9", "SP800-53-CP-7.5", "SP800-53-IA-13.1", "SP800-53-IA-13.2", "SP800-53-MP-6.4", "SP800-53-PE-19.1", "SP800-53-PE-3", "SP800-53-PE-8.3", "SP800-53-PL-2", "SP800-53-PS-3.3", "SP800-53-PS-6.1", "SP800-53-PT-1", "SP800-53-RA-10", "SP800-53-RA-5", "SP800-53-SA-13", "SP800-53-SA-4.7", "SP800-53-SA-8.18", "SP800-53-SA-9.3", "SP800-53-SC-1", "SP800-53-SC-11", "SP800-53-SC-11.1", "SP800-53-SC-12.4", "SP800-53-SC-14", "SP800-53-SC-16.1", "SP800-53-SC-17", "SP800-53-SC-18", "SP800-53-SC-20", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-23.5", "SP800-53-SC-28", "SP800-53-SC-3.2", "SP800-53-SC-34.2", "SP800-53-SC-37.1", "SP800-53-SC-43", "SP800-53-SC-7", "SP800-53-SC-7.2", "SP800-53-SC-7.25", "SP800-53-SC-7.26", "SP800-53-SC-7.27", "SP800-53-SC-7.4", "SP800-53-SC-7.7", "SP800-53-SC-8", "SP800-53-SC-8.4", "SP800-53-SC-9", "SP800-53-SI-1", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-13.5", "SP800-53-SI-14.1", "SP800-53-SI-19.5", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.8", "SP800-53-SI-7.17", "SP800-53-SI-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C8"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 37, "ref_count": 32, "refs": ["PCI-1.2.2", "PCI-1.2.3", "PCI-1.2.4", "PCI-1.4.1", "PCI-1.4.2", "PCI-1.4.4", "PCI-1.5.1", "PCI-12.8.1", "PCI-12.8.2", "PCI-12.8.3", "PCI-12.8.4", "PCI-3.3.2", "PCI-3.4.2", "PCI-3.7.1", "PCI-3.7.2", "PCI-3.7.7", "PCI-4.2.1", "PCI-5.2.3", "PCI-6.3.3", "PCI-7.1.1", "PCI-7.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.5", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.3.11", "PCI-8.6.3", "PCI-9.1.1", "PCI-9.3.1", "PCI-REQ-3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.2", "PCISSLC-7.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRINCIPLE-TRUST-CODE"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PS.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-002", "v1_entity_name": "Trust Boundary Clarity And Protected Data Flows", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
314
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 3, "resolved_source_count": 1, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0048", "AML.T0048.002"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-9.4", "SP800-53-MP-5.1"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-IR-4.8", "SP800-53-IR-9.4", "SP800-53-MP-5.1"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-003", "v1_entity_name": "External Exposure Justification And Boundary Mediation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
315
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 41, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.23", "SP800-53-AC-6.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-390", "CAPEC-516"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.12", "CIS-16.8"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-653"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-390", "CAPEC-516", "CAPEC-646"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-16.8", "CIS-3.12"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-653"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 32, "ref_count": 32, "refs": ["SP800-53-AC-4.23", "SP800-53-AC-6.4", "SP800-53-CM-12.1", "SP800-53-CM-7.9", "SP800-53-CM-8.3", "SP800-53-CP-7.1", "SP800-53-PE-3", "SP800-53-RA-5.7", "SP800-53-SA-9.5", "SP800-53-SC-15.3", "SP800-53-SC-2.2", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.3", "SP800-53-SC-30", "SP800-53-SC-30.5", "SP800-53-SC-32", "SP800-53-SC-32.1", "SP800-53-SC-39", "SP800-53-SC-39.1", "SP800-53-SC-39.2", "SP800-53-SC-4.2", "SP800-53-SC-43", "SP800-53-SC-47", "SP800-53-SC-7", "SP800-53-SC-7.1", "SP800-53-SC-7.13", "SP800-53-SC-7.16", "SP800-53-SC-7.20", "SP800-53-SC-7.21", "SP800-53-SC-7.29", "SP800-53-SR-10"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-E14DE74194B3447C8B07EEA947D82E61"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-O_OM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-11.4.5"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-004", "v1_entity_name": "Technical Segmentation And Sensitive Domain Isolation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
316
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 17, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-V_AA_3_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17.8"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.5"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-17.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 12, "ref_count": 12, "refs": ["SP800-53-AU-1", "SP800-53-AU-2.3", "SP800-53-CA-1", "SP800-53-CM-1", "SP800-53-CM-2.1", "SP800-53-CM-3", "SP800-53-CM-3.7", "SP800-53-CM-5.2", "SP800-53-PL-1", "SP800-53-PM-28", "SP800-53-PM-4", "SP800-53-PM-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-O_OM_3_B", "SAMM-ACTIVITY-V_AA_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-005", "v1_entity_name": "Architecture Review And Change Trigger Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
317
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 26, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-3.2", "SP800-53-CM-6.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-80", "CAPEC-231"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0042", "AML.M0008"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V2.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-231", "CAPEC-678", "CAPEC-80"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-12.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 11, "ref_count": 11, "refs": ["SP800-53-CM-11.3", "SP800-53-CM-3.2", "SP800-53-CM-6.1", "SP800-53-CM-6.4", "SP800-53-IA-5.1", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-19.7", "SP800-53-SI-7.2", "SP800-53-SI-7.5", "SP800-53-SR-4.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-48E92BB1FDBA40E8B6C235DE0D431833"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-CONTINUOUS-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C5"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 9, "ref_count": 5, "refs": ["SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_2_B", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-006", "v1_entity_name": "Architectural Topology Validation And Pattern Conformance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
318
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 106, "resolved_source_count": 17, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PL-2", "SP800-53-PL-8"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4", "CIS-4.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-184", "CAPEC-440"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V15.1.4", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.2.4", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.4.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 9, "ref_count": 9, "refs": ["CAPEC-184", "CAPEC-440", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-670", "CAPEC-673", "CAPEC-681", "CAPEC-702"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 20, "ref_count": 10, "refs": ["CIS-10", "CIS-10.5", "CIS-12.2", "CIS-16.1", "CIS-16.11", "CIS-16.12", "CIS-16.9", "CIS-4", "CIS-4.1", "CIS-4.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["ENISA-AI-FAICP-LAYER-II"], "substrate_source_key": "enisa_multilayer_ai_cybersecurity_practices_2023"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a2"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 27, "ref_count": 26, "refs": ["SP800-53-PL-2", "SP800-53-PL-8", "SP800-53-PL-8.1", "SP800-53-PM-7", "SP800-53-RA-5.5", "SP800-53-SA-12.9", "SP800-53-SA-17", "SP800-53-SA-17.2", "SP800-53-SA-17.5", "SP800-53-SA-17.7", "SP800-53-SA-5.2", "SP800-53-SA-8", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.17", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SA-8.3", "SP800-53-SA-8.31", "SP800-53-SA-8.8", "SP800-53-SC-3.4", "SP800-53-SC-3.5", "SP800-53-SC-38"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 8, "ref_count": 8, "refs": ["DSOMM-ACTIVITY-11B3848EE9314146A35D35409ADA24EE", "DSOMM-ACTIVITY-6217FE115ED74CF49DE4555BCFA6FE87", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-F994A55D71BB45A4A8870A213D72C504"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-GOVERNANCE", "OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C1", "OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 50, "ref_count": 25, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-REQ-1", "PCI-REQ-2", "PCI-REQ-6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 3, "refs": ["PCISSLC-2.3", "PCISSLC-2.4", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-SECURITY-CONTROLS", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEVELOPMENT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 6, "ref_count": 4, "refs": ["SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.4", "SSDF-TASK-PO.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ATB-007", "v1_entity_name": "Secure Architecture Governance And Boundary Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
319
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 11, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-I_SB_3_A"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2", "SP800-53-PL-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-12.2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-12.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-CM-2", "SP800-53-PL-10", "SP800-53-PL-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-O_EM_2_A", "SAMM-ACTIVITY-O_EM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.9.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-001", "v1_entity_name": "Architecture Baseline Definition", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
320
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 33, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-12.1", "SP800-53-CM-8"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-O_EM_1_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-580", "CAPEC-581"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-8", "PCI-10.4.2"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-580", "CAPEC-581", "CAPEC-702"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-1092"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 20, "ref_count": 19, "refs": ["SP800-53-AU-12.1", "SP800-53-CM-8", "SP800-53-CM-8.4", "SP800-53-CM-8.6", "SP800-53-SA-10", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-12.14", "SP800-53-SA-15.12", "SP800-53-SA-15.13", "SP800-53-SA-15.2", "SP800-53-SA-4.2", "SP800-53-SA-8.22", "SP800-53-SC-2.2", "SP800-53-SC-22", "SP800-53-SC-7.16", "SP800-53-SI-13.1", "SP800-53-SI-2.7", "SP800-53-SI-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-10.4.2", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-LOGGING", "SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PO.3.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-002", "v1_entity_name": "Architectural Decision And Solution Traceability", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
321
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 69, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4", "SP800-53-AC-4.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V15.1.4", "ASVS-REQ-V15.2.4", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-4.1", "CIS-4.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-501"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 32, "ref_count": 32, "refs": ["SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-AC-4.9", "SP800-53-CA-4", "SP800-53-CA-9.1", "SP800-53-PM-23", "SP800-53-PM-24", "SP800-53-PM-8", "SP800-53-SA-10.6", "SP800-53-SA-13", "SP800-53-SA-8.10", "SP800-53-SA-8.16", "SP800-53-SA-8.18", "SP800-53-SA-8.28", "SP800-53-SA-8.9", "SP800-53-SA-9.3", "SP800-53-SC-17", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SI-10.2", "SP800-53-SI-10.5", "SP800-53-SI-2.1", "SP800-53-SI-3.1", "SP800-53-SI-4.24", "SP800-53-SI-7.3", "SP800-53-SI-8.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 8, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 7, "ref_count": 4, "refs": ["PCI-1.2.4", "PCI-1.4.1", "PCI-1.4.2", "PCI-1.4.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-PLANNING", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCSIC-DEVELOPMENT", "SCSIC-SOURCING-CONTRACT", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 6, "ref_count": 6, "refs": ["SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.2", "SSDF-TASK-PO.5.2", "SSDF-TASK-PW.4.2", "SSDF-TASK-PW.7.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-003", "v1_entity_name": "Trust-Boundary And Flow Review", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
322
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 9, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-9.4", "SP800-53-MP-5.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1230", "CWE-497"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a6"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0048"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CWE-1230", "CWE-497"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 6, "ref_count": 6, "refs": ["SP800-53-IR-9.4", "SP800-53-MP-5.1", "SP800-53-PE-16", "SP800-53-PE-3.7", "SP800-53-PE-6", "SP800-53-SC-7"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-004", "v1_entity_name": "External Exposure And Boundary Mediation Design", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
323
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 6, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_SM_1_A"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MA-3", "SP800-53-PL-2.2"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-MA-3", "SP800-53-PL-2.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_SM_1_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_3_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-005", "v1_entity_name": "Architecture Review And Approval Governance", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
324
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 11, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["SP800-53-AU-1", "SP800-53-AU-6", "SP800-53-CM-1", "SP800-53-CM-3", "SP800-53-CM-3.7", "SP800-53-CM-5.2", "SP800-53-PM-28", "SP800-53-PM-9", "SP800-53-SA-1", "SP800-53-SI-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_TA_3_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (architecture, governance, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-006", "v1_entity_name": "Architecture Change Trigger Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
325
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 19, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.2", "SP800-53-CM-3.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-48E92BB1FDBA40E8B6C235DE0D431833", "DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-80"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-80"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 10, "ref_count": 10, "refs": ["SP800-53-CM-11.3", "SP800-53-CM-2.2", "SP800-53-CM-3.2", "SP800-53-CM-5.7", "SP800-53-CM-6.1", "SP800-53-CM-6.4", "SP800-53-IA-5.1", "SP800-53-SC-7.17", "SP800-53-SI-10.3", "SP800-53-SI-19.7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-48E92BB1FDBA40E8B6C235DE0D431833"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C5"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 7, "ref_count": 4, "refs": ["SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-2"], "substrate_source_key": "safecode_agile_2012"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 03, Cap. 08, Cap. 13", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ATB-007", "v1_entity_name": "Automatable Topology And Pattern Validation", "v1_entity_type": "Practice", "v1_family": "ACO-ATB", "v1_slice": "ASC-03"}
326
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 90, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-7.4", "SP800-53-CP-13"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.5"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-294"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-90", "CAPEC-151"]}], "es_grounding_sources_full": [{"claim_count": 17, "ref_count": 17, "refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.5", "ASVS-REQ-V6.3.7", "ASVS-REQ-V6.3.8", "ASVS-REQ-V6.4.3", "ASVS-REQ-V6.4.4", "ASVS-REQ-V6.4.5", "ASVS-REQ-V6.5.6", "ASVS-REQ-V6.5.7", "ASVS-REQ-V6.6.4", "ASVS-REQ-V6.7.1", "ASVS-REQ-V6.7.2", "ASVS-REQ-V6.8.2", "ASVS-REQ-V7.5.1", "ASVS-REQ-V7.5.3", "ASVS-REQ-V7.6.1", "ASVS-REQ-V7.6.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 5, "ref_count": 5, "refs": ["CAPEC-151", "CAPEC-220", "CAPEC-277", "CAPEC-422", "CAPEC-90"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 5, "ref_count": 5, "refs": ["CIS-12.6", "CIS-12.7", "CIS-14.3", "CIS-3.1", "CIS-4.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 10, "ref_count": 10, "refs": ["CWE-1392", "CWE-294", "CWE-301", "CWE-303", "CWE-305", "CWE-307", "CWE-308", "CWE-309", "CWE-322", "CWE-798"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312d"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 44, "ref_count": 41, "refs": ["SP800-53-AC-7.4", "SP800-53-CP-13", "SP800-53-IA-1", "SP800-53-IA-10", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-12.4", "SP800-53-IA-13", "SP800-53-IA-2", "SP800-53-IA-2.1", "SP800-53-IA-2.2", "SP800-53-IA-2.5", "SP800-53-IA-3.1", "SP800-53-IA-4.2", "SP800-53-IA-4.4", "SP800-53-IA-5", "SP800-53-IA-5.1", "SP800-53-IA-5.16", "SP800-53-IA-5.17", "SP800-53-IA-5.2", "SP800-53-IA-5.6", "SP800-53-IA-5.7", "SP800-53-IA-5.8", "SP800-53-IA-6", "SP800-53-IA-7", "SP800-53-IA-8", "SP800-53-IA-8.1", "SP800-53-IA-8.2", "SP800-53-IA-8.4", "SP800-53-IA-8.6", "SP800-53-IA-9", "SP800-53-IA-9.1", "SP800-53-MA-4.4", "SP800-53-SC-13.1", "SP800-53-SC-16.2", "SP800-53-SC-17", "SP800-53-SC-7.17", "SP800-53-SC-7.18", "SP800-53-SC-7.23", "SP800-53-SC-8.1", "SP800-53-SC-8.4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-598E9F131AC84A01B85E8FAB93EE81DE", "DSOMM-ACTIVITY-8098E416E1ED4AE4A56183EFBE76BF57", "DSOMM-ACTIVITY-AD23BE9C56614F1F81A35A5DC7061629"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-AUTH"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP07-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C6"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A07-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-4.2.1", "PCI-8.3.11", "PCI-REQ-4"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-001", "v1_entity_name": "Authentication And Federation Protocols", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
327
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 20, "es_grounding_resolution": {"authored_more_sources_count": 20, "authored_visible_source_count": 4, "resolved_ref_count": 369, "resolved_source_count": 19, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-8"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0000", "AML.TA0012"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-7", "PCI-REQ-9"]}], "es_grounding_sources_full": [{"claim_count": 16, "ref_count": 16, "refs": ["ASVS-REQ-V1.5.2", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.3.1", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.4.2", "ASVS-REQ-V2.3.5", "ASVS-REQ-V2.4.1", "ASVS-REQ-V3.5.8", "ASVS-REQ-V8.1.1", "ASVS-REQ-V8.1.2", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.1", "ASVS-REQ-V8.2.2", "ASVS-REQ-V8.2.3", "ASVS-REQ-V8.3.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 50, "ref_count": 44, "refs": ["CAPEC-1", "CAPEC-113", "CAPEC-122", "CAPEC-126", "CAPEC-13", "CAPEC-159", "CAPEC-17", "CAPEC-180", "CAPEC-203", "CAPEC-212", "CAPEC-233", "CAPEC-234", "CAPEC-26", "CAPEC-270", "CAPEC-274", "CAPEC-279", "CAPEC-35", "CAPEC-44", "CAPEC-478", "CAPEC-51", "CAPEC-524", "CAPEC-560", "CAPEC-574", "CAPEC-575", "CAPEC-576", "CAPEC-578", "CAPEC-58", "CAPEC-581", "CAPEC-597", "CAPEC-600", "CAPEC-640", "CAPEC-644", "CAPEC-653", "CAPEC-660", "CAPEC-679", "CAPEC-69", "CAPEC-698", "CAPEC-700", "CAPEC-76", "CAPEC-8", "CAPEC-87", "CAPEC-88", "CAPEC-9", "CAPEC-96"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 25, "ref_count": 17, "refs": ["CIS-15.2", "CIS-15.4", "CIS-16.1", "CIS-16.2", "CIS-16.9", "CIS-2.2", "CIS-2.5", "CIS-2.6", "CIS-2.7", "CIS-3.3", "CIS-4.4", "CIS-4.5", "CIS-5", "CIS-5.4", "CIS-6", "CIS-6.6", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 19, "ref_count": 19, "refs": ["CWE-1220", "CWE-1230", "CWE-183", "CWE-213", "CWE-250", "CWE-267", "CWE-268", "CWE-274", "CWE-277", "CWE-278", "CWE-281", "CWE-359", "CWE-425", "CWE-497", "CWE-639", "CWE-648", "CWE-653", "CWE-654", "CWE-807"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 11, "ref_count": 8, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a3", "HIPAA-164-308a4", "HIPAA-164-308a5", "HIPAA-164-308a6", "HIPAA-164-310a1", "HIPAA-164-312a1", "HIPAA-164-316a"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-AUTH-ERROR-HANDLING"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 236, "ref_count": 198, "refs": ["SP800-53-AC-1", "SP800-53-AC-14", "SP800-53-AC-14.1", "SP800-53-AC-15", "SP800-53-AC-16", "SP800-53-AC-16.1", "SP800-53-AC-16.10", "SP800-53-AC-16.2", "SP800-53-AC-16.3", "SP800-53-AC-16.4", "SP800-53-AC-16.6", "SP800-53-AC-16.7", "SP800-53-AC-16.8", "SP800-53-AC-16.9", "SP800-53-AC-17", "SP800-53-AC-17.4", "SP800-53-AC-17.6", "SP800-53-AC-17.7", "SP800-53-AC-18", "SP800-53-AC-18.4", "SP800-53-AC-19", "SP800-53-AC-19.4", "SP800-53-AC-2", "SP800-53-AC-2.1", "SP800-53-AC-2.11", "SP800-53-AC-2.6", "SP800-53-AC-2.7", "SP800-53-AC-2.9", "SP800-53-AC-20", "SP800-53-AC-20.1", "SP800-53-AC-20.2", "SP800-53-AC-20.3", "SP800-53-AC-20.5", "SP800-53-AC-21", "SP800-53-AC-21.1", "SP800-53-AC-21.2", "SP800-53-AC-23", "SP800-53-AC-24", "SP800-53-AC-24.1", "SP800-53-AC-24.2", "SP800-53-AC-3", "SP800-53-AC-3.1", "SP800-53-AC-3.11", "SP800-53-AC-3.12", "SP800-53-AC-3.13", "SP800-53-AC-3.14", "SP800-53-AC-3.15", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.7", "SP800-53-AC-3.8", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.15", "SP800-53-AC-4.18", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.22", "SP800-53-AC-4.23", "SP800-53-AC-4.24", "SP800-53-AC-4.25", "SP800-53-AC-4.27", "SP800-53-AC-4.28", "SP800-53-AC-4.29", "SP800-53-AC-4.3", "SP800-53-AC-4.30", "SP800-53-AC-4.4", "SP800-53-AC-4.5", "SP800-53-AC-4.6", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-AC-5", "SP800-53-AC-6", "SP800-53-AC-6.1", "SP800-53-AC-6.10", "SP800-53-AC-6.2", "SP800-53-AC-6.3", "SP800-53-AC-6.4", "SP800-53-AC-6.5", "SP800-53-AC-6.6", "SP800-53-AC-6.8", "SP800-53-AC-6.9", "SP800-53-AT-3", "SP800-53-AU-2.4", "SP800-53-AU-9.5", "SP800-53-CA-1", "SP800-53-CA-3.1", "SP800-53-CA-3.3", "SP800-53-CA-3.6", "SP800-53-CA-6", "SP800-53-CA-7.5", "SP800-53-CM-5.4", "SP800-53-CM-5.5", "SP800-53-CM-5.6", "SP800-53-CM-7.4", "SP800-53-CM-7.5", "SP800-53-CM-7.6", "SP800-53-CM-7.7", "SP800-53-CM-7.8", "SP800-53-CP-9.7", "SP800-53-IR-9.4", "SP800-53-MA-3.3", "SP800-53-MA-3.4", "SP800-53-MA-5", "SP800-53-MA-5.1", "SP800-53-MA-5.2", "SP800-53-MP-1", "SP800-53-MP-2", "SP800-53-MP-2.1", "SP800-53-MP-4.2", "SP800-53-MP-5", "SP800-53-MP-6.4", "SP800-53-MP-6.7", "SP800-53-PE-1", "SP800-53-PE-19.1", "SP800-53-PE-2", "SP800-53-PE-2.1", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.7", "SP800-53-PE-4", "SP800-53-PE-5", "SP800-53-PE-5.1", "SP800-53-PE-8.3", "SP800-53-PL-4", "SP800-53-PM-1", "SP800-53-PM-10", "SP800-53-PM-18", "SP800-53-PM-19", "SP800-53-PM-20.1", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-6", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-PS-7", "SP800-53-PT-1", "SP800-53-PT-2", "SP800-53-RA-5.5", "SP800-53-SA-1", "SP800-53-SA-17", "SP800-53-SA-17.1", "SP800-53-SA-17.7", "SP800-53-SA-2", "SP800-53-SA-5.1", "SP800-53-SA-8", "SP800-53-SA-8.12", "SP800-53-SA-8.14", "SP800-53-SA-8.15", "SP800-53-SA-8.25", "SP800-53-SA-8.28", "SP800-53-SA-8.5", "SP800-53-SA-9", "SP800-53-SC-1", "SP800-53-SC-13.3", "SP800-53-SC-14", "SP800-53-SC-18", "SP800-53-SC-18.4", "SP800-53-SC-18.5", "SP800-53-SC-2.1", "SP800-53-SC-3.2", "SP800-53-SC-34", "SP800-53-SC-38", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-42.2", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SC-51", "SP800-53-SC-7.11", "SP800-53-SC-7.15", "SP800-53-SC-7.2", "SP800-53-SC-7.4", "SP800-53-SC-7.5", "SP800-53-SI-1", "SP800-53-SI-10.1", "SP800-53-SI-10.5", "SP800-53-SI-16", "SP800-53-SI-3.3", "SP800-53-SI-3.4", "SP800-53-SI-3.8", "SP800-53-SI-4.20", "SP800-53-SI-4.3", "SP800-53-SI-4.6", "SP800-53-SI-7.11", "SP800-53-SI-9", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 12, "ref_count": 12, "refs": ["DSOMM-ACTIVITY-03643CA203C2472B8E19956BF02FE9B7", "DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-65A2D7D9544146BFA4E3F76919857750", "DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-E5386ABF91544752A1A8C3A8900F732D", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP02-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C2", "OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 8, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A01-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 40, "ref_count": 34, "refs": ["PCI-1.5.1", "PCI-12.1.3", "PCI-12.2.1", "PCI-3.7.3", "PCI-3.7.5", "PCI-3.7.7", "PCI-3.7.8", "PCI-6.3.3", "PCI-7.1.1", "PCI-7.1.2", "PCI-7.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.4", "PCI-7.2.5", "PCI-7.2.6", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.2.1", "PCI-8.2.2", "PCI-8.2.3", "PCI-8.2.4", "PCI-8.3.1", "PCI-8.3.6", "PCI-8.3.7", "PCI-8.3.8", "PCI-8.6.1", "PCI-8.6.3", "PCI-9.2.4", "PCI-9.3.1", "PCI-9.3.2", "PCI-REQ-7", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCISSLC-1.2", "PCISSLC-2.2", "PCISSLC-3.3", "PCISSLC-8.1", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-REPO"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PS.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-002", "v1_entity_name": "Access Policy Enforcement", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
328
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 52, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-5.5", "CIS-6.2"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a8", "HIPAA-164-312b"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["CIS-5.5", "CIS-6.2", "CIS-6.8", "CIS-8.11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a8", "HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 46, "ref_count": 38, "refs": ["SP800-53-AC-2", "SP800-53-AC-2.4", "SP800-53-AC-4.9", "SP800-53-AC-6.7", "SP800-53-AU-1", "SP800-53-AU-10", "SP800-53-AU-10.3", "SP800-53-AU-10.4", "SP800-53-AU-10.5", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-13", "SP800-53-AU-13.2", "SP800-53-AU-14", "SP800-53-AU-14.3", "SP800-53-AU-16.1", "SP800-53-AU-16.2", "SP800-53-AU-16.3", "SP800-53-AU-2.2", "SP800-53-AU-2.3", "SP800-53-AU-6", "SP800-53-AU-6.10", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.6", "SP800-53-AU-6.7", "SP800-53-AU-8.2", "SP800-53-AU-9.3", "SP800-53-CA-1", "SP800-53-CA-3", "SP800-53-CA-7.2", "SP800-53-CM-3.7", "SP800-53-CM-7.1", "SP800-53-PE-8", "SP800-53-PM-27", "SP800-53-PT-4.3", "SP800-53-SI-1", "SP800-53-SI-4.21"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 6, "ref_count": 5, "refs": ["SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-V_AA_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-12.10.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-2.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-003", "v1_entity_name": "Periodic Review And Access Audit", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
329
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 24, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-39", "CAPEC-59"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V7.2.3", "ASVS-REQ-V7.2.4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-12", "SP800-53-AC-12.1"]}, {"source_display_name": "OWASP MCP Top 10", "substrate_source": "owasp_mcp", "visible_refs": ["MCP01-2025", "MCP10-2025"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V7.2.3", "ASVS-REQ-V7.2.4", "ASVS-REQ-V7.4.1", "ASVS-REQ-V9.1.1", "ASVS-REQ-V9.1.3", "ASVS-REQ-V9.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 9, "ref_count": 9, "refs": ["CAPEC-196", "CAPEC-226", "CAPEC-386", "CAPEC-39", "CAPEC-59", "CAPEC-593", "CAPEC-60", "CAPEC-61", "CAPEC-62"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-565"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-SESSION-HIJACKING"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 5, "ref_count": 5, "refs": ["SP800-53-AC-12", "SP800-53-AC-12.1", "SP800-53-SC-23.1", "SP800-53-SC-23.3", "SP800-53-SC-23.4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP10-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-004", "v1_entity_name": "Short-Lived Token Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
330
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 32, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.2", "ASVS-REQ-V4.1.3"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IA-2.11", "SP800-53-SA-9.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-384", "CAPEC-461"]}, {"source_display_name": "MCP Official 2025", "substrate_source": "unknown", "visible_refs": ["MCP-CONFUSED-DEPUTY"]}], "es_grounding_sources_full": [{"claim_count": 24, "ref_count": 24, "refs": ["ASVS-REQ-V10.1.2", "ASVS-REQ-V10.2.1", "ASVS-REQ-V10.2.2", "ASVS-REQ-V10.3.5", "ASVS-REQ-V10.4.10", "ASVS-REQ-V10.4.12", "ASVS-REQ-V10.4.14", "ASVS-REQ-V10.4.15", "ASVS-REQ-V10.4.16", "ASVS-REQ-V10.4.2", "ASVS-REQ-V10.4.3", "ASVS-REQ-V10.4.5", "ASVS-REQ-V10.4.7", "ASVS-REQ-V10.5.3", "ASVS-REQ-V10.7.1", "ASVS-REQ-V12.1.3", "ASVS-REQ-V12.2.2", "ASVS-REQ-V12.3.3", "ASVS-REQ-V12.3.4", "ASVS-REQ-V13.2.1", "ASVS-REQ-V15.3.4", "ASVS-REQ-V4.1.2", "ASVS-REQ-V4.1.3", "ASVS-REQ-V4.1.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-384", "CAPEC-461"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-CONFUSED-DEPUTY"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-IA-2.11", "SP800-53-SA-9.3", "SP800-53-SC-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_SA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-1.4.2"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (boundaries, gateway, identity kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-005", "v1_entity_name": "API Gateway Mutual Authentication", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
331
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 18, "es_grounding_resolution": {"authored_more_sources_count": 18, "authored_visible_source_count": 4, "resolved_ref_count": 314, "resolved_source_count": 20, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-4.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10", "PCI-1.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-3.1"]}], "es_grounding_sources_full": [{"claim_count": 16, "ref_count": 16, "refs": ["ASVS-REQ-V15.1.2", "ASVS-REQ-V15.1.5", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.2", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.2.4", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.3.1", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 20, "ref_count": 18, "refs": ["CAPEC-169", "CAPEC-224", "CAPEC-517", "CAPEC-518", "CAPEC-519", "CAPEC-521", "CAPEC-537", "CAPEC-568", "CAPEC-571", "CAPEC-634", "CAPEC-648", "CAPEC-675", "CAPEC-678", "CAPEC-682", "CAPEC-700", "CAPEC-75", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 37, "ref_count": 28, "refs": ["CIS-1", "CIS-11", "CIS-11.1", "CIS-11.2", "CIS-11.4", "CIS-13.6", "CIS-16", "CIS-16.6", "CIS-16.7", "CIS-16.8", "CIS-17.3", "CIS-3.1", "CIS-3.13", "CIS-3.14", "CIS-4.1", "CIS-4.2", "CIS-7.1", "CIS-7.3", "CIS-7.5", "CIS-7.6", "CIS-8.1", "CIS-8.12", "CIS-8.3", "CIS-8.4", "CIS-8.5", "CIS-8.6", "CIS-8.8", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["DORA-ART-12", "DORA-ART-5"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-316b1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 167, "ref_count": 131, "refs": ["SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-12.4", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-4.1", "SP800-53-AU-5.4", "SP800-53-AU-5.5", "SP800-53-AU-9.1", "SP800-53-AU-9.2", "SP800-53-AU-9.7", "SP800-53-CA-5", "SP800-53-CA-7.6", "SP800-53-CA-9", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-11", "SP800-53-CM-12.1", "SP800-53-CM-13", "SP800-53-CM-2", "SP800-53-CM-2.1", "SP800-53-CM-2.3", "SP800-53-CM-2.6", "SP800-53-CM-2.7", "SP800-53-CM-3", "SP800-53-CM-3.2", "SP800-53-CM-3.3", "SP800-53-CM-3.8", "SP800-53-CM-4", "SP800-53-CM-4.1", "SP800-53-CM-4.2", "SP800-53-CM-5", "SP800-53-CM-5.7", "SP800-53-CM-6", "SP800-53-CM-6.1", "SP800-53-CM-6.3", "SP800-53-CM-6.4", "SP800-53-CM-7.3", "SP800-53-CM-7.4", "SP800-53-CM-7.5", "SP800-53-CM-7.9", "SP800-53-CM-8", "SP800-53-CM-8.2", "SP800-53-CM-8.3", "SP800-53-CM-8.6", "SP800-53-CM-8.8", "SP800-53-CP-10.2", "SP800-53-CP-10.4", "SP800-53-CP-9.1", "SP800-53-IR-6.1", "SP800-53-MA-1", "SP800-53-MA-2", "SP800-53-MA-2.1", "SP800-53-MA-2.2", "SP800-53-MA-3", "SP800-53-MA-3.1", "SP800-53-MA-3.6", "SP800-53-MA-4", "SP800-53-MA-4.1", "SP800-53-MP-6.8", "SP800-53-MP-8", "SP800-53-MP-8.2", "SP800-53-PE-3", "SP800-53-PE-6.3", "SP800-53-PE-8.2", "SP800-53-PL-2", "SP800-53-RA-5", "SP800-53-RA-5.11", "SP800-53-SA-1", "SP800-53-SA-10", "SP800-53-SA-10.1", "SP800-53-SA-10.2", "SP800-53-SA-10.3", "SP800-53-SA-10.5", "SP800-53-SA-12.1", "SP800-53-SA-12.11", "SP800-53-SA-12.15", "SP800-53-SA-15", "SP800-53-SA-15.11", "SP800-53-SA-15.12", "SP800-53-SA-15.13", "SP800-53-SA-15.9", "SP800-53-SA-18", "SP800-53-SA-19.2", "SP800-53-SA-22.1", "SP800-53-SA-3", "SP800-53-SA-3.2", "SP800-53-SA-4", "SP800-53-SA-5.5", "SP800-53-SA-7", "SP800-53-SA-8.29", "SP800-53-SA-8.30", "SP800-53-SA-9.3", "SP800-53-SA-9.7", "SP800-53-SC-18.2", "SP800-53-SC-2.2", "SP800-53-SC-20.2", "SP800-53-SC-22", "SP800-53-SC-26", "SP800-53-SC-36.1", "SP800-53-SC-7.24", "SP800-53-SC-7.6", "SP800-53-SI-1", "SP800-53-SI-11", "SP800-53-SI-12.2", "SP800-53-SI-13.5", "SP800-53-SI-14.2", "SP800-53-SI-14.3", "SP800-53-SI-17", "SP800-53-SI-2", "SP800-53-SI-2.1", "SP800-53-SI-2.2", "SP800-53-SI-2.4", "SP800-53-SI-2.5", "SP800-53-SI-2.7", "SP800-53-SI-3.1", "SP800-53-SI-3.2", "SP800-53-SI-4", "SP800-53-SI-4.13", "SP800-53-SI-4.16", "SP800-53-SI-4.2", "SP800-53-SI-4.23", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.2", "SP800-53-SI-7.5", "SP800-53-SI-8.1", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 20, "ref_count": 20, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-3D1F4C3BF71346D9933A54A014A26C03", "DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-5C61FD6B81064C68AC28A8A42F1C67DC", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-77FFC53E9F3D41F492D302F04F9B6B0F", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-845F06EC148C4C6797557041911DCCA5", "DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46", "DSOMM-ACTIVITY-994151396B50441B89E10AA59ACCD43D", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-C72DA77986CC45B1A339190CE5093171", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-CF0D600E114D48879059D81C53805F0D", "DSOMM-ACTIVITY-E14DE74194B3447C8B07EEA947D82E61", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1", "DSOMM-ACTIVITY-F8E80F1825034E3EB3BC7F67BB28DEFE", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 61, "ref_count": 34, "refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_2_A", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_1_B", "SAMM-ACTIVITY-O_OM_2_B", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-O_OM_3_B", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 38, "ref_count": 34, "refs": ["PCI-1.1.1", "PCI-1.1.2", "PCI-1.2.2", "PCI-1.2.3", "PCI-1.2.4", "PCI-10.1.1", "PCI-10.1.2", "PCI-10.2.2", "PCI-10.3.3", "PCI-10.3.4", "PCI-10.4.2", "PCI-10.4.3", "PCI-10.5.1", "PCI-10.7.3", "PCI-11.1.1", "PCI-2.1.1", "PCI-2.1.2", "PCI-2.2.1", "PCI-2.2.4", "PCI-3.1.1", "PCI-3.3.2", "PCI-4.1.1", "PCI-5.1.1", "PCI-5.1.2", "PCI-5.2.3", "PCI-5.3.4", "PCI-6.1.1", "PCI-6.1.2", "PCI-6.2.3", "PCI-6.3.2", "PCI-6.5.2", "PCI-6.5.3", "PCI-9.4.5", "PCI-REQ-10"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["SCAGILE-EXP-11", "SCAGILE-EXP-2", "SCAGILE-OPS-10", "SCAGILE-OPS-2", "SCAGILE-OPS-5", "SCAGILE-OPS-6"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-LOGGING", "SCFPSSD-PLANNING", "SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 12, "ref_count": 12, "refs": ["SSDF-PRACTICE-PO.3", "SSDF-PRACTICE-PS.2", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.1.3", "SSDF-TASK-PO.3.2", "SSDF-TASK-PS.2.1", "SSDF-TASK-PW.1.2", "SSDF-TASK-PW.2.1", "SSDF-TASK-RV.1.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.1.3", "SSDF-TASK-RV.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 03, Cap. 12, Cap. 14", "manual_v2_anchor": "Mechanism", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IAT-006", "v1_entity_name": "Structured Logging And Effective Configuration Recording", "v1_entity_type": "Mechanism", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
332
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_resolution": {"authored_more_sources_count": 11, "authored_visible_source_count": 4, "resolved_ref_count": 97, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.3.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-4", "PCI-REQ-8"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-7", "SP800-53-AC-7.4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-290", "CWE-305"]}], "es_grounding_sources_full": [{"claim_count": 22, "ref_count": 22, "refs": ["ASVS-REQ-V11.4.2", "ASVS-REQ-V6.1.1", "ASVS-REQ-V6.3.1", "ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.4", "ASVS-REQ-V6.3.5", "ASVS-REQ-V6.3.6", "ASVS-REQ-V6.3.8", "ASVS-REQ-V6.4.1", "ASVS-REQ-V6.4.2", "ASVS-REQ-V6.4.3", "ASVS-REQ-V6.4.4", "ASVS-REQ-V6.5.1", "ASVS-REQ-V6.5.2", "ASVS-REQ-V6.5.3", "ASVS-REQ-V6.5.4", "ASVS-REQ-V6.5.5", "ASVS-REQ-V6.5.6", "ASVS-REQ-V6.5.7", "ASVS-REQ-V6.6.3", "ASVS-REQ-V6.6.4", "ASVS-REQ-V7.5.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 11, "ref_count": 11, "refs": ["CAPEC-114", "CAPEC-16", "CAPEC-2", "CAPEC-36", "CAPEC-422", "CAPEC-475", "CAPEC-49", "CAPEC-509", "CAPEC-565", "CAPEC-568", "CAPEC-652"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 6, "ref_count": 6, "refs": ["CIS-14.3", "CIS-4.1", "CIS-5.2", "CIS-6.3", "CIS-6.4", "CIS-6.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 11, "ref_count": 11, "refs": ["CWE-290", "CWE-305", "CWE-306", "CWE-307", "CWE-308", "CWE-309", "CWE-521", "CWE-640", "CWE-645", "CWE-656", "CWE-798"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a5", "HIPAA-164-312d"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 15, "ref_count": 12, "refs": ["SP800-53-AC-7", "SP800-53-AC-7.4", "SP800-53-IA-10", "SP800-53-IA-11", "SP800-53-IA-5.1", "SP800-53-IA-5.12", "SP800-53-IA-5.17", "SP800-53-IA-5.18", "SP800-53-IA-5.4", "SP800-53-IA-5.6", "SP800-53-IA-6", "SP800-53-SA-8.27"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 9, "ref_count": 9, "refs": ["DSOMM-ACTIVITY-03643CA203C2472B8E19956BF02FE9B7", "DSOMM-ACTIVITY-11B3848EE9314146A35D35409ADA24EE", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-598E9F131AC84A01B85E8FAB93EE81DE", "DSOMM-ACTIVITY-61E10F9CE1264FFAAF12FDBE0D0A831F", "DSOMM-ACTIVITY-8098E416E1ED4AE4A56183EFBE76BF57", "DSOMM-ACTIVITY-AD23BE9C56614F1F81A35A5DC7061629", "DSOMM-ACTIVITY-ECB0184C6BC945DABBBBA983797FFC93", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP07-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C1"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 6, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["TOP10-A02-2021", "TOP10-A07-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 16, "ref_count": 16, "refs": ["PCI-4.2.1", "PCI-4.2.2", "PCI-8.2.6", "PCI-8.3.10", "PCI-8.3.11", "PCI-8.3.2", "PCI-8.3.4", "PCI-8.3.6", "PCI-8.4.1", "PCI-8.4.2", "PCI-8.4.3", "PCI-8.5.1", "PCI-8.6.2", "PCI-8.6.3", "PCI-REQ-4", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-001", "v1_entity_name": "Authentication Strength And Identity Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
333
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_resolution": {"authored_more_sources_count": 15, "authored_visible_source_count": 4, "resolved_ref_count": 211, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-7", "PCI-REQ-9"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-13"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-183"]}], "es_grounding_sources_full": [{"claim_count": 9, "ref_count": 9, "refs": ["ASVS-REQ-V13.3.2", "ASVS-REQ-V15.3.1", "ASVS-REQ-V15.3.3", "ASVS-REQ-V8.1.1", "ASVS-REQ-V8.1.2", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.1", "ASVS-REQ-V8.2.2", "ASVS-REQ-V8.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 16, "ref_count": 15, "refs": ["CAPEC-1", "CAPEC-122", "CAPEC-13", "CAPEC-17", "CAPEC-35", "CAPEC-40", "CAPEC-560", "CAPEC-576", "CAPEC-58", "CAPEC-597", "CAPEC-600", "CAPEC-644", "CAPEC-653", "CAPEC-698", "CAPEC-700"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 13, "ref_count": 10, "refs": ["CIS-16.1", "CIS-16.2", "CIS-2.2", "CIS-2.5", "CIS-2.6", "CIS-2.7", "CIS-3.3", "CIS-4.7", "CIS-5.4", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 12, "ref_count": 12, "refs": ["CWE-1220", "CWE-183", "CWE-213", "CWE-250", "CWE-266", "CWE-267", "CWE-268", "CWE-277", "CWE-278", "CWE-359", "CWE-425", "CWE-551"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a3"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP-AUTH-DISCOVERY-METADATA", "MCP-AUTH-SCOPE-NEGOTIATION"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 151, "ref_count": 121, "refs": ["SP800-53-AC-1", "SP800-53-AC-14", "SP800-53-AC-15", "SP800-53-AC-16", "SP800-53-AC-16.1", "SP800-53-AC-16.10", "SP800-53-AC-16.2", "SP800-53-AC-16.3", "SP800-53-AC-16.4", "SP800-53-AC-16.6", "SP800-53-AC-17", "SP800-53-AC-17.4", "SP800-53-AC-17.7", "SP800-53-AC-17.8", "SP800-53-AC-18.4", "SP800-53-AC-19.3", "SP800-53-AC-2", "SP800-53-AC-2.11", "SP800-53-AC-2.6", "SP800-53-AC-2.7", "SP800-53-AC-2.9", "SP800-53-AC-20", "SP800-53-AC-20.2", "SP800-53-AC-20.3", "SP800-53-AC-20.5", "SP800-53-AC-21", "SP800-53-AC-21.1", "SP800-53-AC-21.2", "SP800-53-AC-24", "SP800-53-AC-24.1", "SP800-53-AC-3", "SP800-53-AC-3.1", "SP800-53-AC-3.11", "SP800-53-AC-3.13", "SP800-53-AC-3.14", "SP800-53-AC-3.15", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.6", "SP800-53-AC-3.7", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.18", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.28", "SP800-53-AC-4.3", "SP800-53-AC-4.5", "SP800-53-AC-4.6", "SP800-53-AC-5", "SP800-53-AC-6", "SP800-53-AC-6.1", "SP800-53-AC-6.10", "SP800-53-AC-6.2", "SP800-53-AC-6.3", "SP800-53-AC-6.4", "SP800-53-AC-6.5", "SP800-53-AC-6.6", "SP800-53-AC-6.8", "SP800-53-AC-6.9", "SP800-53-AT-3", "SP800-53-AU-1", "SP800-53-AU-2.4", "SP800-53-AU-6.8", "SP800-53-AU-9.4", "SP800-53-AU-9.5", "SP800-53-AU-9.6", "SP800-53-CA-1", "SP800-53-CA-6", "SP800-53-CM-11.2", "SP800-53-CM-2.5", "SP800-53-CM-3.5", "SP800-53-CM-5.4", "SP800-53-CM-5.5", "SP800-53-CM-5.6", "SP800-53-CM-7.5", "SP800-53-CM-7.6", "SP800-53-IA-1", "SP800-53-IR-9.4", "SP800-53-MA-5", "SP800-53-MP-6.4", "SP800-53-MP-6.7", "SP800-53-PE-1", "SP800-53-PE-16", "SP800-53-PE-2", "SP800-53-PE-2.1", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-5.1", "SP800-53-PL-4", "SP800-53-PM-20.1", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-6", "SP800-53-PS-6.2", "SP800-53-PT-4.1", "SP800-53-PT-7.2", "SP800-53-RA-5.5", "SP800-53-SA-1", "SP800-53-SA-17.7", "SP800-53-SA-8.14", "SP800-53-SA-8.15", "SP800-53-SC-1", "SP800-53-SC-2.1", "SP800-53-SC-42.2", "SP800-53-SC-7.15", "SP800-53-SI-1", "SP800-53-SI-10.1", "SP800-53-SI-10.5", "SP800-53-SI-2.7", "SP800-53-SI-3.3", "SP800-53-SI-3.4", "SP800-53-SI-4.20", "SP800-53-SI-4.6", "SP800-53-SI-7.11", "SP800-53-SI-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 29, "ref_count": 25, "refs": ["PCI-12.1.3", "PCI-12.2.1", "PCI-12.3.1", "PCI-12.8.3", "PCI-3.7.5", "PCI-3.7.8", "PCI-6.5.4", "PCI-7.1.2", "PCI-7.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.6", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.1.2", "PCI-8.2.4", "PCI-9.1.2", "PCI-9.3.1", "PCI-9.3.2", "PCI-9.4.1", "PCI-9.4.2", "PCI-REQ-12", "PCI-REQ-7", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-1.2", "PCISSLC-2.2", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DEV-DEFAULTS", "SCSIC-DEV-REPO"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRINCIPLE-PREFER-ATTESTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-PRACTICE-PO.4", "SSDF-TASK-PS.1.1", "SSDF-TASK-PW.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-002", "v1_entity_name": "Authorization Policy Integrity And Least Privilege", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
334
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 24, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-447", "CAPEC-675"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-6", "CIS-6.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V10.4.9"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V10.4.9"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-447", "CAPEC-675"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-6", "CIS-6.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a4"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 18, "ref_count": 16, "refs": ["SP800-53-AC-17.9", "SP800-53-AC-2", "SP800-53-AC-2.3", "SP800-53-AC-2.4", "SP800-53-AC-2.8", "SP800-53-AC-3.8", "SP800-53-AC-9.3", "SP800-53-AU-10.3", "SP800-53-AU-16.3", "SP800-53-AU-6", "SP800-53-MA-3.3", "SP800-53-PE-2", "SP800-53-PS-4", "SP800-53-PT-4.3", "SP800-53-SI-12.3", "SP800-53-SI-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-6.5.6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-6.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-003", "v1_entity_name": "Access Revocation And Privilege Lifecycle Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
335
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 46, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.4.3", "ASVS-REQ-V4.4.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-31", "CAPEC-39"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IA-13.3", "SP800-53-SC-12.5"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-488", "CWE-565"]}], "es_grounding_sources_full": [{"claim_count": 22, "ref_count": 22, "refs": ["ASVS-REQ-V10.1.1", "ASVS-REQ-V14.2.2", "ASVS-REQ-V14.3.3", "ASVS-REQ-V16.2.5", "ASVS-REQ-V4.4.3", "ASVS-REQ-V4.4.4", "ASVS-REQ-V7.1.1", "ASVS-REQ-V7.2.1", "ASVS-REQ-V7.2.2", "ASVS-REQ-V7.2.3", "ASVS-REQ-V7.2.4", "ASVS-REQ-V7.3.1", "ASVS-REQ-V7.3.2", "ASVS-REQ-V7.4.1", "ASVS-REQ-V7.4.4", "ASVS-REQ-V7.4.5", "ASVS-REQ-V7.5.2", "ASVS-REQ-V7.6.2", "ASVS-REQ-V9.1.1", "ASVS-REQ-V9.1.3", "ASVS-REQ-V9.2.1", "ASVS-REQ-V9.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["CAPEC-102", "CAPEC-196", "CAPEC-31", "CAPEC-39", "CAPEC-59", "CAPEC-593", "CAPEC-60", "CAPEC-61", "CAPEC-62", "CAPEC-74"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-4.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-488", "CWE-565", "CWE-613"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP-SESSION-HIJACKING", "MCP-TOKEN-PASSTHROUGH"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 6, "ref_count": 6, "refs": ["SP800-53-IA-13.3", "SP800-53-SC-12.5", "SP800-53-SC-23", "SP800-53-SC-23.1", "SP800-53-SC-23.3", "SP800-53-SC-23.4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP10-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-004", "v1_entity_name": "Session And Token Trust Boundaries", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
336
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 19, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.2", "ASVS-REQ-V3.5.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-8.10", "SP800-53-SA-9.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-461"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["ASVS-REQ-V12.2.2", "ASVS-REQ-V12.3.3", "ASVS-REQ-V12.3.4", "ASVS-REQ-V2.2.2", "ASVS-REQ-V3.5.1", "ASVS-REQ-V4.1.2", "ASVS-REQ-V4.1.3", "ASVS-REQ-V4.1.4", "ASVS-REQ-V4.1.5", "ASVS-REQ-V9.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-461"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 7, "refs": ["SP800-53-SA-10.4", "SP800-53-SA-10.6", "SP800-53-SA-12.3", "SP800-53-SA-13", "SP800-53-SA-8.10", "SP800-53-SA-9.3", "SP800-53-SC-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"], "substrate_source_key": "owasp_dsomm"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-005", "v1_entity_name": "API Caller Trust And Service Boundary Enforcement", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
337
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 155, "resolved_source_count": 17, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.12"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-2.3.2", "PCI-8.2.7"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-5", "CAPEC-54"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-BACF85B65BC0405DB5BAA5D971467CC1", "DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V16.3.3", "ASVS-REQ-V16.4.3", "ASVS-REQ-V2.4.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 12, "ref_count": 11, "refs": ["CAPEC-117", "CAPEC-310", "CAPEC-488", "CAPEC-5", "CAPEC-54", "CAPEC-621", "CAPEC-634", "CAPEC-646", "CAPEC-648", "CAPEC-69", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 8, "refs": ["CIS-13", "CIS-13.11", "CIS-13.6", "CIS-8", "CIS-8.1", "CIS-8.11", "CIS-8.3", "CIS-8.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 2, "refs": ["DORA-ART-10", "DORA-ART-5"], "substrate_source_key": "eu_dora"}, {"claim_count": 2, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a1", "HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 92, "ref_count": 81, "refs": ["SP800-53-AC-1", "SP800-53-AC-17.1", "SP800-53-AC-17.5", "SP800-53-AC-18.2", "SP800-53-AC-2.12", "SP800-53-AC-8", "SP800-53-AU-1", "SP800-53-AU-12.4", "SP800-53-AU-13", "SP800-53-AU-13.1", "SP800-53-AU-13.2", "SP800-53-AU-13.3", "SP800-53-AU-14.2", "SP800-53-AU-14.3", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-5", "SP800-53-AU-5.2", "SP800-53-AU-5.3", "SP800-53-AU-6", "SP800-53-AU-6.2", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.6", "SP800-53-CA-1", "SP800-53-CA-3.4", "SP800-53-CA-3.5", "SP800-53-CA-7.2", "SP800-53-CA-8", "SP800-53-CA-9", "SP800-53-MA-4.1", "SP800-53-MP-1", "SP800-53-PE-2", "SP800-53-PE-3", "SP800-53-PE-3.7", "SP800-53-PE-3.8", "SP800-53-PE-6", "SP800-53-PE-6.1", "SP800-53-PE-6.4", "SP800-53-PE-8", "SP800-53-PE-8.2", "SP800-53-PS-1", "SP800-53-PS-7", "SP800-53-RA-3", "SP800-53-RA-5", "SP800-53-RA-5.7", "SP800-53-RA-5.8", "SP800-53-RA-6", "SP800-53-RA-8", "SP800-53-SA-10", "SP800-53-SA-11.6", "SP800-53-SA-12.11", "SP800-53-SA-18", "SP800-53-SA-6", "SP800-53-SA-9", "SP800-53-SA-9.1", "SP800-53-SC-1", "SP800-53-SC-15", "SP800-53-SC-15.4", "SP800-53-SC-18", "SP800-53-SC-42", "SP800-53-SC-42.3", "SP800-53-SC-43", "SP800-53-SC-5.3", "SP800-53-SC-7.2", "SP800-53-SC-7.24", "SP800-53-SC-7.3", "SP800-53-SC-7.4", "SP800-53-SI-1", "SP800-53-SI-4", "SP800-53-SI-4.11", "SP800-53-SI-4.13", "SP800-53-SI-4.18", "SP800-53-SI-4.2", "SP800-53-SI-4.25", "SP800-53-SI-4.4", "SP800-53-SI-4.7", "SP800-53-SI-4.9", "SP800-53-SI-5.1", "SP800-53-SI-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 10, "ref_count": 10, "refs": ["DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-8746647C638C473F8E1782C068E4C311", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-BACF85B65BC0405DB5BAA5D971467CC1", "DSOMM-ACTIVITY-E808028C351C42F1BCD9FBA738D1FC55", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DATA-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 8, "ref_count": 6, "refs": ["SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_IM_3_B", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 22, "ref_count": 22, "refs": ["PCI-10.1.1", "PCI-10.2.1", "PCI-10.2.2", "PCI-10.3.1", "PCI-10.3.2", "PCI-10.3.3", "PCI-10.4.1", "PCI-10.4.2", "PCI-10.4.3", "PCI-10.7.3", "PCI-11.1.1", "PCI-11.2.1", "PCI-11.3.2", "PCI-11.5.1", "PCI-11.6.1", "PCI-12.3.4", "PCI-2.3.2", "PCI-8.2.7", "PCI-9.2.2", "PCI-9.2.3", "PCI-9.3.4", "PCI-9.4.5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-2.1", "PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-FINDINGS", "SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-006", "v1_entity_name": "Access Abuse Detection And Auditability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
338
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 53, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.17", "SP800-53-AC-17.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.8.1", "ASVS-REQ-V8.4.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-113", "CAPEC-277"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0021", "AML.T0073"]}], "es_grounding_sources_full": [{"claim_count": 11, "ref_count": 11, "refs": ["ASVS-REQ-V10.1.2", "ASVS-REQ-V10.2.2", "ASVS-REQ-V10.3.3", "ASVS-REQ-V10.4.10", "ASVS-REQ-V10.4.16", "ASVS-REQ-V10.4.2", "ASVS-REQ-V10.4.7", "ASVS-REQ-V10.5.1", "ASVS-REQ-V10.5.2", "ASVS-REQ-V6.8.1", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 7, "ref_count": 7, "refs": ["CAPEC-113", "CAPEC-277", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-575", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-289", "CWE-322", "CWE-649"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 29, "ref_count": 28, "refs": ["SP800-53-AC-17.2", "SP800-53-AC-19.5", "SP800-53-AC-4.17", "SP800-53-AU-10.1", "SP800-53-CA-3", "SP800-53-IA-12", "SP800-53-IA-12.4", "SP800-53-IA-12.6", "SP800-53-IA-13", "SP800-53-IA-13.2", "SP800-53-IA-2.11", "SP800-53-IA-3", "SP800-53-IA-4.5", "SP800-53-IA-4.6", "SP800-53-IA-4.8", "SP800-53-IA-5.15", "SP800-53-IA-5.16", "SP800-53-IA-9", "SP800-53-IA-9.1", "SP800-53-PT-3", "SP800-53-SA-12.14", "SP800-53-SA-8.1", "SP800-53-SC-12.6", "SP800-53-SC-21.1", "SP800-53-SC-3", "SP800-53-SC-7.4", "SP800-53-SC-8", "SP800-53-SI-6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C6"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-IAM"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IAT-007", "v1_entity_name": "Identity And Access Control Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
339
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_resolution": {"authored_more_sources_count": 13, "authored_visible_source_count": 4, "resolved_ref_count": 174, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-7", "SP800-53-AC-7.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.1.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-16"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-290"]}], "es_grounding_sources_full": [{"claim_count": 29, "ref_count": 29, "refs": ["ASVS-REQ-V11.3.3", "ASVS-REQ-V11.4.2", "ASVS-REQ-V11.4.4", "ASVS-REQ-V6.1.1", "ASVS-REQ-V6.1.3", "ASVS-REQ-V6.2.10", "ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.4", "ASVS-REQ-V6.3.5", "ASVS-REQ-V6.3.7", "ASVS-REQ-V6.3.8", "ASVS-REQ-V6.4.1", "ASVS-REQ-V6.4.2", "ASVS-REQ-V6.4.3", "ASVS-REQ-V6.4.4", "ASVS-REQ-V6.4.5", "ASVS-REQ-V6.5.1", "ASVS-REQ-V6.5.2", "ASVS-REQ-V6.5.3", "ASVS-REQ-V6.5.4", "ASVS-REQ-V6.5.6", "ASVS-REQ-V6.5.7", "ASVS-REQ-V6.6.3", "ASVS-REQ-V6.6.4", "ASVS-REQ-V6.7.1", "ASVS-REQ-V6.7.2", "ASVS-REQ-V6.8.3", "ASVS-REQ-V7.3.1", "ASVS-REQ-V7.5.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 33, "ref_count": 26, "refs": ["CAPEC-114", "CAPEC-115", "CAPEC-151", "CAPEC-16", "CAPEC-195", "CAPEC-2", "CAPEC-36", "CAPEC-390", "CAPEC-395", "CAPEC-402", "CAPEC-422", "CAPEC-474", "CAPEC-475", "CAPEC-485", "CAPEC-49", "CAPEC-507", "CAPEC-555", "CAPEC-560", "CAPEC-565", "CAPEC-568", "CAPEC-600", "CAPEC-644", "CAPEC-653", "CAPEC-70", "CAPEC-87", "CAPEC-94"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 8, "refs": ["CIS-14.3", "CIS-16", "CIS-4.1", "CIS-5.2", "CIS-6.3", "CIS-6.4", "CIS-6.6", "CIS-9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 16, "ref_count": 16, "refs": ["CWE-1392", "CWE-290", "CWE-303", "CWE-305", "CWE-306", "CWE-307", "CWE-308", "CWE-309", "CWE-358", "CWE-408", "CWE-521", "CWE-617", "CWE-640", "CWE-645", "CWE-798", "CWE-836"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-312c1", "HIPAA-164-312d"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 74, "ref_count": 64, "refs": ["SP800-53-AC-11", "SP800-53-AC-18.1", "SP800-53-AC-7", "SP800-53-AC-7.3", "SP800-53-AC-7.4", "SP800-53-CM-3.5", "SP800-53-CP-13", "SP800-53-IA-1", "SP800-53-IA-10", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-12.6", "SP800-53-IA-2", "SP800-53-IA-2.1", "SP800-53-IA-2.10", "SP800-53-IA-2.12", "SP800-53-IA-2.13", "SP800-53-IA-2.2", "SP800-53-IA-2.5", "SP800-53-IA-2.6", "SP800-53-IA-2.8", "SP800-53-IA-3", "SP800-53-IA-3.1", "SP800-53-IA-3.2", "SP800-53-IA-4.1", "SP800-53-IA-4.3", "SP800-53-IA-4.4", "SP800-53-IA-4.9", "SP800-53-IA-5", "SP800-53-IA-5.1", "SP800-53-IA-5.10", "SP800-53-IA-5.13", "SP800-53-IA-5.17", "SP800-53-IA-5.2", "SP800-53-IA-5.4", "SP800-53-IA-5.5", "SP800-53-IA-5.6", "SP800-53-IA-5.7", "SP800-53-IA-6", "SP800-53-IA-7", "SP800-53-IA-8", "SP800-53-IA-8.1", "SP800-53-IA-8.2", "SP800-53-IA-8.4", "SP800-53-IA-8.6", "SP800-53-IA-9.1", "SP800-53-IR-4.5", "SP800-53-PE-3", "SP800-53-PS-4.2", "SP800-53-SA-8.19", "SP800-53-SA-8.24", "SP800-53-SA-8.31", "SP800-53-SA-8.8", "SP800-53-SC-13.4", "SP800-53-SC-15.3", "SP800-53-SC-16.2", "SP800-53-SC-28.1", "SP800-53-SC-7.18", "SP800-53-SC-8.1", "SP800-53-SC-8.4", "SP800-53-SI-6", "SP800-53-SI-7.15"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-598E9F131AC84A01B85E8FAB93EE81DE", "DSOMM-ACTIVITY-61E10F9CE1264FFAAF12FDBE0D0A831F", "DSOMM-ACTIVITY-8098E416E1ED4AE4A56183EFBE76BF57"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-MINIMUM-BAR"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP07-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A07-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 16, "ref_count": 16, "refs": ["PCI-4.2.1", "PCI-8.2.1", "PCI-8.3.1", "PCI-8.3.10", "PCI-8.3.11", "PCI-8.3.2", "PCI-8.3.4", "PCI-8.3.7", "PCI-8.3.8", "PCI-8.4.1", "PCI-8.4.2", "PCI-8.4.3", "PCI-8.5.1", "PCI-8.6.3", "PCI-REQ-4", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-16"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PS.1", "SSDF-TASK-PW.9.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-001", "v1_entity_name": "Strong Authentication And Step-Up Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
340
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 146, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-183"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-13"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V13.3.2", "ASVS-REQ-V8.1.2", "ASVS-REQ-V8.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 8, "ref_count": 8, "refs": ["CAPEC-1", "CAPEC-122", "CAPEC-13", "CAPEC-524", "CAPEC-576", "CAPEC-597", "CAPEC-69", "CAPEC-700"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 12, "ref_count": 10, "refs": ["CIS-14.9", "CIS-2.2", "CIS-2.6", "CIS-2.7", "CIS-4.7", "CIS-5", "CIS-5.4", "CIS-6.1", "CIS-6.7", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 11, "ref_count": 11, "refs": ["CWE-1220", "CWE-183", "CWE-250", "CWE-266", "CWE-267", "CWE-268", "CWE-274", "CWE-277", "CWE-278", "CWE-281", "CWE-653"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a2"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 121, "ref_count": 98, "refs": ["SP800-53-AC-1", "SP800-53-AC-16", "SP800-53-AC-16.10", "SP800-53-AC-16.2", "SP800-53-AC-16.3", "SP800-53-AC-16.4", "SP800-53-AC-16.6", "SP800-53-AC-16.7", "SP800-53-AC-17.4", "SP800-53-AC-17.7", "SP800-53-AC-19.3", "SP800-53-AC-2", "SP800-53-AC-2.1", "SP800-53-AC-2.11", "SP800-53-AC-2.6", "SP800-53-AC-2.7", "SP800-53-AC-2.9", "SP800-53-AC-20", "SP800-53-AC-20.2", "SP800-53-AC-20.3", "SP800-53-AC-21.1", "SP800-53-AC-24.1", "SP800-53-AC-24.2", "SP800-53-AC-3.1", "SP800-53-AC-3.13", "SP800-53-AC-3.14", "SP800-53-AC-3.15", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.7", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.18", "SP800-53-AC-4.6", "SP800-53-AC-6", "SP800-53-AC-6.1", "SP800-53-AC-6.10", "SP800-53-AC-6.2", "SP800-53-AC-6.3", "SP800-53-AC-6.4", "SP800-53-AC-6.5", "SP800-53-AC-6.6", "SP800-53-AC-6.8", "SP800-53-AC-6.9", "SP800-53-AT-3", "SP800-53-AU-2.4", "SP800-53-AU-9.5", "SP800-53-AU-9.6", "SP800-53-CA-1", "SP800-53-CA-3.6", "SP800-53-CA-6", "SP800-53-CA-6.1", "SP800-53-CA-6.2", "SP800-53-CM-11.2", "SP800-53-CM-2.5", "SP800-53-CM-5.4", "SP800-53-CM-5.5", "SP800-53-CM-5.6", "SP800-53-CM-7.5", "SP800-53-CM-7.6", "SP800-53-CP-9.7", "SP800-53-IA-12.1", "SP800-53-IA-2.3", "SP800-53-IA-2.4", "SP800-53-IA-2.7", "SP800-53-MA-5", "SP800-53-PE-2.1", "SP800-53-PE-3.1", "SP800-53-PE-5.1", "SP800-53-PM-10", "SP800-53-PM-19", "SP800-53-PS-6", "SP800-53-PS-6.2", "SP800-53-PS-7", "SP800-53-SA-10.6", "SP800-53-SA-17.7", "SP800-53-SA-5.1", "SP800-53-SA-8.10", "SP800-53-SA-8.14", "SP800-53-SA-8.15", "SP800-53-SA-8.2", "SP800-53-SA-8.32", "SP800-53-SA-8.6", "SP800-53-SC-2.1", "SP800-53-SC-32.1", "SP800-53-SC-7.15", "SP800-53-SI-1", "SP800-53-SI-3.3", "SP800-53-SI-4.20", "SP800-53-SI-4.6", "SP800-53-SI-7.11", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP02-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-I_SD_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-6.5.4", "PCI-7.2.1", "PCI-8.2.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-1.1", "PCISSLC-1.2", "PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-REPO"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-002", "v1_entity_name": "Least-Privilege Authorization Governance", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
341
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 16, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V10.4.9", "ASVS-REQ-V12.1.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-5.5", "CIS-6.6"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a4", "HIPAA-164-312a1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V10.4.9", "ASVS-REQ-V12.1.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-5.5", "CIS-6.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-359"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 2, "refs": ["HIPAA-164-308a4", "HIPAA-164-312a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 10, "ref_count": 9, "refs": ["SP800-53-AC-1", "SP800-53-AC-17.9", "SP800-53-AC-2", "SP800-53-AC-22", "SP800-53-AC-3.8", "SP800-53-AC-4.9", "SP800-53-AC-6.7", "SP800-53-PS-6", "SP800-53-PT-4.3"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-003", "v1_entity_name": "Access Review And Timely Revocation", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
342
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 43, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.4.3", "ASVS-REQ-V4.4.4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-10", "SP800-53-AC-12"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-39"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-312", "CWE-488"]}], "es_grounding_sources_full": [{"claim_count": 14, "ref_count": 14, "refs": ["ASVS-REQ-V14.3.3", "ASVS-REQ-V4.4.3", "ASVS-REQ-V4.4.4", "ASVS-REQ-V7.1.3", "ASVS-REQ-V7.2.1", "ASVS-REQ-V7.2.2", "ASVS-REQ-V7.2.3", "ASVS-REQ-V7.2.4", "ASVS-REQ-V7.4.1", "ASVS-REQ-V7.5.2", "ASVS-REQ-V7.6.2", "ASVS-REQ-V9.1.1", "ASVS-REQ-V9.1.3", "ASVS-REQ-V9.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["CAPEC-102", "CAPEC-196", "CAPEC-21", "CAPEC-226", "CAPEC-39", "CAPEC-59", "CAPEC-593", "CAPEC-60", "CAPEC-61", "CAPEC-74"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-4.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-312", "CWE-488", "CWE-613"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP-SCOPE-MINIMIZATION", "MCP-SESSION-HIJACKING"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 11, "ref_count": 11, "refs": ["SP800-53-AC-10", "SP800-53-AC-12", "SP800-53-AC-12.1", "SP800-53-AC-12.2", "SP800-53-IA-13.3", "SP800-53-SC-23", "SP800-53-SC-23.1", "SP800-53-SC-23.2", "SP800-53-SC-23.3", "SP800-53-SC-23.4", "SP800-53-SC-23.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP10-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-004", "v1_entity_name": "Bounded Session And Token Management", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
343
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 83, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V2.2.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-8", "CAPEC-14"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.7", "SP800-53-AC-4.29"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0040", "AML.T0011.000"]}], "es_grounding_sources_full": [{"claim_count": 35, "ref_count": 35, "refs": ["ASVS-REQ-V1.3.6", "ASVS-REQ-V10.1.2", "ASVS-REQ-V10.2.1", "ASVS-REQ-V10.2.2", "ASVS-REQ-V10.3.2", "ASVS-REQ-V10.4.10", "ASVS-REQ-V10.4.12", "ASVS-REQ-V10.4.15", "ASVS-REQ-V10.4.6", "ASVS-REQ-V10.4.7", "ASVS-REQ-V10.5.3", "ASVS-REQ-V10.7.1", "ASVS-REQ-V12.2.2", "ASVS-REQ-V12.3.1", "ASVS-REQ-V12.3.3", "ASVS-REQ-V12.3.4", "ASVS-REQ-V13.2.1", "ASVS-REQ-V15.1.3", "ASVS-REQ-V15.2.2", "ASVS-REQ-V15.3.4", "ASVS-REQ-V15.3.7", "ASVS-REQ-V2.2.2", "ASVS-REQ-V3.5.1", "ASVS-REQ-V3.5.3", "ASVS-REQ-V3.5.8", "ASVS-REQ-V4.1.2", "ASVS-REQ-V4.1.3", "ASVS-REQ-V4.1.4", "ASVS-REQ-V4.1.5", "ASVS-REQ-V4.2.1", "ASVS-REQ-V4.2.5", "ASVS-REQ-V8.1.3", "ASVS-REQ-V8.3.1", "ASVS-REQ-V8.3.3", "ASVS-REQ-V9.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 17, "ref_count": 17, "refs": ["CAPEC-14", "CAPEC-202", "CAPEC-278", "CAPEC-279", "CAPEC-36", "CAPEC-383", "CAPEC-384", "CAPEC-385", "CAPEC-388", "CAPEC-389", "CAPEC-461", "CAPEC-466", "CAPEC-51", "CAPEC-510", "CAPEC-57", "CAPEC-574", "CAPEC-8"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-204", "CWE-551", "CWE-648", "CWE-939"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP-AUTH-ERROR-HANDLING", "MCP-CONFUSED-DEPUTY"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 17, "ref_count": 17, "refs": ["SP800-53-AC-4.29", "SP800-53-AC-4.7", "SP800-53-SA-12.14", "SP800-53-SA-12.3", "SP800-53-SA-5.2", "SP800-53-SA-8.1", "SP800-53-SA-9.3", "SP800-53-SC-21", "SP800-53-SC-21.1", "SP800-53-SC-46", "SP800-53-SC-7", "SP800-53-SC-7.11", "SP800-53-SC-7.25", "SP800-53-SC-7.4", "SP800-53-SC-7.5", "SP800-53-SC-7.8", "SP800-53-SI-4.22"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-29318D6018CE452680EAF5928E49F639", "DSOMM-ACTIVITY-65A2D7D9544146BFA4E3F76919857750"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY", "OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 3, "ref_count": 2, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-V_AA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-1.4.2"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-005", "v1_entity_name": "Authenticated API Boundary Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
344
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 20, "es_grounding_resolution": {"authored_more_sources_count": 20, "authored_visible_source_count": 4, "resolved_ref_count": 322, "resolved_source_count": 20, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-11", "PCI-1.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-2.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SR_1_B"]}], "es_grounding_sources_full": [{"claim_count": 9, "ref_count": 9, "refs": ["ASVS-REQ-V14.2.7", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.4.2", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 11, "ref_count": 10, "refs": ["CAPEC-268", "CAPEC-310", "CAPEC-54", "CAPEC-634", "CAPEC-646", "CAPEC-648", "CAPEC-661", "CAPEC-678", "CAPEC-69", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 44, "ref_count": 38, "refs": ["CIS-1", "CIS-13", "CIS-13.11", "CIS-13.4", "CIS-13.5", "CIS-13.6", "CIS-16.1", "CIS-16.12", "CIS-16.2", "CIS-16.3", "CIS-16.4", "CIS-16.5", "CIS-16.6", "CIS-18.1", "CIS-18.2", "CIS-18.4", "CIS-18.5", "CIS-2.3", "CIS-3", "CIS-3.1", "CIS-3.14", "CIS-3.2", "CIS-3.7", "CIS-3.8", "CIS-7.5", "CIS-7.6", "CIS-8", "CIS-8.1", "CIS-8.11", "CIS-8.12", "CIS-8.2", "CIS-8.3", "CIS-8.4", "CIS-8.5", "CIS-8.6", "CIS-8.7", "CIS-8.8", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["DORA-ART-10", "DORA-ART-5", "DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 4, "ref_count": 3, "refs": ["HIPAA-164-308a1", "HIPAA-164-308a6", "HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 168, "ref_count": 136, "refs": ["SP800-53-AC-17.1", "SP800-53-AC-17.5", "SP800-53-AC-18.2", "SP800-53-AC-2", "SP800-53-AC-2.12", "SP800-53-AC-2.4", "SP800-53-AC-25", "SP800-53-AC-4.26", "SP800-53-AT-4", "SP800-53-AU-1", "SP800-53-AU-10.2", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-12", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-12.4", "SP800-53-AU-13", "SP800-53-AU-13.1", "SP800-53-AU-13.2", "SP800-53-AU-13.3", "SP800-53-AU-14", "SP800-53-AU-14.1", "SP800-53-AU-14.2", "SP800-53-AU-14.3", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-16.2", "SP800-53-AU-16.3", "SP800-53-AU-2", "SP800-53-AU-2.1", "SP800-53-AU-2.2", "SP800-53-AU-2.3", "SP800-53-AU-3", "SP800-53-AU-3.1", "SP800-53-AU-3.2", "SP800-53-AU-3.3", "SP800-53-AU-4", "SP800-53-AU-4.1", "SP800-53-AU-5", "SP800-53-AU-5.2", "SP800-53-AU-5.3", "SP800-53-AU-5.4", "SP800-53-AU-5.5", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.10", "SP800-53-AU-6.2", "SP800-53-AU-6.3", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.6", "SP800-53-AU-6.7", "SP800-53-AU-6.9", "SP800-53-AU-7", "SP800-53-AU-7.1", "SP800-53-AU-7.2", "SP800-53-AU-8.1", "SP800-53-AU-8.2", "SP800-53-AU-9", "SP800-53-AU-9.1", "SP800-53-AU-9.2", "SP800-53-AU-9.3", "SP800-53-AU-9.7", "SP800-53-CA-1", "SP800-53-CA-4", "SP800-53-CA-7", "SP800-53-CA-7.2", "SP800-53-CA-7.3", "SP800-53-CA-7.4", "SP800-53-CA-8", "SP800-53-CA-9", "SP800-53-CM-10", "SP800-53-CM-4", "SP800-53-CM-5.1", "SP800-53-CM-7.4", "SP800-53-IR-4.12", "SP800-53-MA-2", "SP800-53-MA-3.1", "SP800-53-MA-3.2", "SP800-53-MA-3.6", "SP800-53-MA-4", "SP800-53-MA-4.1", "SP800-53-MP-6.1", "SP800-53-PE-3", "SP800-53-PE-6", "SP800-53-PE-6.1", "SP800-53-PE-6.4", "SP800-53-PE-8", "SP800-53-PE-8.1", "SP800-53-PE-8.2", "SP800-53-PM-14", "SP800-53-PM-24", "SP800-53-PM-27", "SP800-53-PM-6", "SP800-53-PT-3", "SP800-53-RA-5", "SP800-53-RA-5.11", "SP800-53-RA-5.7", "SP800-53-RA-5.8", "SP800-53-SA-10", "SP800-53-SA-11.6", "SP800-53-SA-12.11", "SP800-53-SA-15", "SP800-53-SA-15.2", "SP800-53-SA-6", "SP800-53-SA-8.21", "SP800-53-SA-8.29", "SP800-53-SA-9.1", "SP800-53-SA-9.7", "SP800-53-SC-18.2", "SP800-53-SC-5.3", "SP800-53-SI-1", "SP800-53-SI-17", "SP800-53-SI-18", "SP800-53-SI-19.5", "SP800-53-SI-2.7", "SP800-53-SI-3.10", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.13", "SP800-53-SI-4.16", "SP800-53-SI-4.18", "SP800-53-SI-4.21", "SP800-53-SI-4.24", "SP800-53-SI-4.4", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-5.1", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.2", "SP800-53-SI-7.8", "SP800-53-SR-10"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 16, "ref_count": 16, "refs": ["DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-535F301AE8E84EDAAD77A08B035C92DE", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-746025A6DBFB4087A000E46ACAB64EE1", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-8746647C638C473F8E1782C068E4C311", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-BACF85B65BC0405DB5BAA5D971467CC1", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-D03BC41074A74E9282CBD01A020CB6BF", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 43, "ref_count": 31, "refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_SM_1_B", "SAMM-ACTIVITY-G_SM_2_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_1_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_ST_1_A", "SAMM-ACTIVITY-V_ST_2_A", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 42, "ref_count": 41, "refs": ["PCI-1.1.1", "PCI-1.2.4", "PCI-10.1.1", "PCI-10.2.1", "PCI-10.2.2", "PCI-10.3.1", "PCI-10.3.2", "PCI-10.3.3", "PCI-10.3.4", "PCI-10.4.1", "PCI-10.4.2", "PCI-10.4.3", "PCI-10.5.1", "PCI-10.7.3", "PCI-11.1.1", "PCI-11.3.2", "PCI-11.4.4", "PCI-11.5.1", "PCI-11.5.2", "PCI-12.10.2", "PCI-12.2.1", "PCI-12.3.4", "PCI-12.8.3", "PCI-12.8.4", "PCI-2.1.1", "PCI-3.1.1", "PCI-3.1.2", "PCI-4.1.1", "PCI-5.1.1", "PCI-5.3.4", "PCI-6.1.1", "PCI-6.2.3", "PCI-7.1.1", "PCI-7.3.2", "PCI-8.1.1", "PCI-8.2.7", "PCI-9.1.1", "PCI-9.3.4", "PCI-9.4.5", "PCI-9.5.1", "PCI-REQ-11"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 7, "ref_count": 7, "refs": ["PCISSLC-2.1", "PCISSLC-2.4", "PCISSLC-2.5", "PCISSLC-2.6", "PCISSLC-3.2", "PCISSLC-3.4", "PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SCAGILE-EXP-9", "SCAGILE-OPS-1", "SCAGILE-OPS-10", "SCAGILE-OPS-2", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-FINDINGS", "SCFPSSD-LOGGING", "SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-TESTING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 12, "ref_count": 12, "refs": ["SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-RV.3", "SSDF-TASK-PO.3.2", "SSDF-TASK-PO.4.1", "SSDF-TASK-PS.2.1", "SSDF-TASK-PW.2.1", "SSDF-TASK-PW.7.1", "SSDF-TASK-PW.7.2", "SSDF-TASK-RV.1.1", "SSDF-TASK-RV.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IAT-006", "v1_entity_name": "Access Abuse Monitoring And Audit Trail", "v1_entity_type": "Practice", "v1_family": "ACO-IAT", "v1_slice": "ASC-02"}
345
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 135, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.2", "ASVS-REQ-V4.1.2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3.5", "SP800-53-CM-3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-14", "CAPEC-21"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0012", "AML.T0075"]}], "es_grounding_sources_full": [{"claim_count": 55, "ref_count": 55, "refs": ["ASVS-REQ-V10.1.1", "ASVS-REQ-V10.1.2", "ASVS-REQ-V10.2.1", "ASVS-REQ-V10.2.2", "ASVS-REQ-V10.3.4", "ASVS-REQ-V10.3.5", "ASVS-REQ-V10.4.10", "ASVS-REQ-V10.4.12", "ASVS-REQ-V10.4.14", "ASVS-REQ-V10.4.15", "ASVS-REQ-V10.4.16", "ASVS-REQ-V10.4.3", "ASVS-REQ-V10.4.5", "ASVS-REQ-V10.4.6", "ASVS-REQ-V10.4.7", "ASVS-REQ-V10.4.9", "ASVS-REQ-V10.5.3", "ASVS-REQ-V10.7.1", "ASVS-REQ-V12.1.3", "ASVS-REQ-V12.1.5", "ASVS-REQ-V12.2.1", "ASVS-REQ-V12.2.2", "ASVS-REQ-V12.3.1", "ASVS-REQ-V12.3.2", "ASVS-REQ-V12.3.3", "ASVS-REQ-V12.3.4", "ASVS-REQ-V12.3.5", "ASVS-REQ-V13.1.4", "ASVS-REQ-V13.2.1", "ASVS-REQ-V13.2.2", "ASVS-REQ-V2.2.2", "ASVS-REQ-V4.1.2", "ASVS-REQ-V4.1.3", "ASVS-REQ-V4.2.3", "ASVS-REQ-V6.1.3", "ASVS-REQ-V6.3.1", "ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.4", "ASVS-REQ-V6.5.1", "ASVS-REQ-V6.5.5", "ASVS-REQ-V6.5.8", "ASVS-REQ-V6.6.1", "ASVS-REQ-V6.6.2", "ASVS-REQ-V6.8.1", "ASVS-REQ-V6.8.4", "ASVS-REQ-V7.1.3", "ASVS-REQ-V7.2.1", "ASVS-REQ-V7.2.2", "ASVS-REQ-V7.5.1", "ASVS-REQ-V7.5.3", "ASVS-REQ-V7.6.1", "ASVS-REQ-V8.3.1", "ASVS-REQ-V9.1.3", "ASVS-REQ-V9.2.2", "ASVS-REQ-V9.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 16, "ref_count": 15, "refs": ["CAPEC-14", "CAPEC-196", "CAPEC-202", "CAPEC-21", "CAPEC-22", "CAPEC-36", "CAPEC-384", "CAPEC-389", "CAPEC-461", "CAPEC-509", "CAPEC-510", "CAPEC-57", "CAPEC-59", "CAPEC-681", "CAPEC-701"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-12.5", "CIS-16.11", "CIS-6.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 5, "ref_count": 5, "refs": ["CWE-1392", "CWE-289", "CWE-290", "CWE-305", "CWE-603"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["MCP-AUTH-TOKEN-VALIDATION", "MCP-CONFUSED-DEPUTY", "MCP-TOKEN-PASSTHROUGH"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 33, "ref_count": 33, "refs": ["SP800-53-CA-3.5", "SP800-53-CM-3.5", "SP800-53-IA-10", "SP800-53-IA-12.6", "SP800-53-IA-13.2", "SP800-53-IA-2.1", "SP800-53-IA-2.10", "SP800-53-IA-2.11", "SP800-53-IA-2.12", "SP800-53-IA-2.13", "SP800-53-IA-2.2", "SP800-53-IA-2.7", "SP800-53-IA-2.8", "SP800-53-IA-2.9", "SP800-53-IA-3", "SP800-53-IA-3.1", "SP800-53-IA-3.2", "SP800-53-IA-3.4", "SP800-53-IA-4.2", "SP800-53-IA-4.3", "SP800-53-IA-5.10", "SP800-53-IA-5.11", "SP800-53-IA-5.3", "SP800-53-IA-5.5", "SP800-53-IA-5.9", "SP800-53-IA-8.5", "SP800-53-IA-9", "SP800-53-PE-2", "SP800-53-SA-5.2", "SP800-53-SC-23.3", "SP800-53-SC-7.22", "SP800-53-SC-7.7", "SP800-53-SC-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-598E9F131AC84A01B85E8FAB93EE81DE", "DSOMM-ACTIVITY-65A2D7D9544146BFA4E3F76919857750", "DSOMM-ACTIVITY-67667C97C33E4306A4E5E7B1D8E10C5A", "DSOMM-ACTIVITY-8098E416E1ED4AE4A56183EFBE76BF57", "DSOMM-ACTIVITY-F57D55F2DC054B349D1FF8CE5BFB0715"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["OWASP-MCP-AUTH", "OWASP-MCP-DEPLOYMENT", "OWASP-MCP-RISK-LANDSCAPE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["OWASP-MCP-3P-AUTH-AUTHZ-REGISTRATION", "OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY", "OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP01-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 13, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A07-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-IAM"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-001", "v1_entity_name": "API Gateway With Mutual Authentication", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
346
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 17, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.3", "SP800-53-AU-10.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-3", "NIST-AI-RMF-MEASURE-4"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-AU-10.3", "SP800-53-AU-2.3", "SP800-53-RA-7", "SP800-53-SA-13", "SP800-53-SA-8.10", "SP800-53-SA-9.1", "SP800-53-SA-9.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 11, "ref_count": 7, "refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-G_SM_1_A", "SAMM-ACTIVITY-V_AA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-2.5"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-FINDINGS"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-002", "v1_entity_name": "Trust Boundary Models", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
347
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 202, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-REQ-7"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-312"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V17.2.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 5, "ref_count": 5, "refs": ["CAPEC-146", "CAPEC-200", "CAPEC-439", "CAPEC-524", "CAPEC-578"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 22, "ref_count": 15, "refs": ["CIS-12.3", "CIS-13.5", "CIS-13.9", "CIS-14.9", "CIS-15", "CIS-3", "CIS-3.1", "CIS-3.14", "CIS-3.3", "CIS-3.5", "CIS-3.8", "CIS-4.6", "CIS-6", "CIS-6.6", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 7, "ref_count": 7, "refs": ["CWE-1220", "CWE-312", "CWE-654", "CWE-695", "CWE-807", "CWE-829", "CWE-921"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 6, "ref_count": 6, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a4", "HIPAA-164-308a5", "HIPAA-164-310a1", "HIPAA-164-312a1", "HIPAA-164-312e1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 147, "ref_count": 137, "refs": ["SP800-53-AC-1", "SP800-53-AC-14.1", "SP800-53-AC-15", "SP800-53-AC-16", "SP800-53-AC-16.1", "SP800-53-AC-16.8", "SP800-53-AC-16.9", "SP800-53-AC-17", "SP800-53-AC-17.7", "SP800-53-AC-18.3", "SP800-53-AC-19.5", "SP800-53-AC-2", "SP800-53-AC-2.1", "SP800-53-AC-2.6", "SP800-53-AC-20.2", "SP800-53-AC-20.3", "SP800-53-AC-24.1", "SP800-53-AC-24.2", "SP800-53-AC-3.11", "SP800-53-AC-3.13", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.7", "SP800-53-AC-3.9", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.12", "SP800-53-AC-4.14", "SP800-53-AC-4.18", "SP800-53-AC-4.2", "SP800-53-AC-4.21", "SP800-53-AC-4.23", "SP800-53-AC-4.25", "SP800-53-AC-4.26", "SP800-53-AC-4.27", "SP800-53-AC-4.28", "SP800-53-AC-4.29", "SP800-53-AC-4.3", "SP800-53-AC-4.30", "SP800-53-AC-4.31", "SP800-53-AC-4.32", "SP800-53-AC-4.4", "SP800-53-AC-4.6", "SP800-53-AC-4.8", "SP800-53-AC-5", "SP800-53-AC-6.2", "SP800-53-AC-6.4", "SP800-53-AC-6.5", "SP800-53-AT-3.2", "SP800-53-CA-3.7", "SP800-53-CM-3", "SP800-53-CM-3.4", "SP800-53-CM-3.6", "SP800-53-CM-6", "SP800-53-CP-10.3", "SP800-53-CP-13", "SP800-53-IA-5.8", "SP800-53-MP-5", "SP800-53-MP-5.3", "SP800-53-PE-1", "SP800-53-PE-14", "SP800-53-PE-16", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.4", "SP800-53-PE-3.5", "SP800-53-PE-3.7", "SP800-53-PE-3.8", "SP800-53-PE-4", "SP800-53-PE-5", "SP800-53-PE-7", "SP800-53-PL-2", "SP800-53-PS-1", "SP800-53-PS-5", "SP800-53-PS-7", "SP800-53-RA-1", "SP800-53-RA-10", "SP800-53-RA-2", "SP800-53-SA-10.7", "SP800-53-SA-15.2", "SP800-53-SA-17.2", "SP800-53-SA-17.5", "SP800-53-SA-17.7", "SP800-53-SA-2", "SP800-53-SA-3", "SP800-53-SA-4.1", "SP800-53-SA-4.2", "SP800-53-SA-5.1", "SP800-53-SA-8.11", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.14", "SP800-53-SA-8.19", "SP800-53-SA-8.2", "SP800-53-SA-8.20", "SP800-53-SA-8.27", "SP800-53-SA-8.3", "SP800-53-SA-8.31", "SP800-53-SA-9.6", "SP800-53-SC-1", "SP800-53-SC-12.2", "SP800-53-SC-12.4", "SP800-53-SC-12.6", "SP800-53-SC-13", "SP800-53-SC-15.3", "SP800-53-SC-16", "SP800-53-SC-16.3", "SP800-53-SC-17", "SP800-53-SC-2", "SP800-53-SC-2.1", "SP800-53-SC-28.1", "SP800-53-SC-28.3", "SP800-53-SC-3", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.5", "SP800-53-SC-32.1", "SP800-53-SC-37.1", "SP800-53-SC-38", "SP800-53-SC-39", "SP800-53-SC-4.2", "SP800-53-SC-43", "SP800-53-SC-7", "SP800-53-SC-7.12", "SP800-53-SC-7.13", "SP800-53-SC-7.16", "SP800-53-SC-7.21", "SP800-53-SC-7.4", "SP800-53-SC-8.1", "SP800-53-SC-8.5", "SP800-53-SC-9", "SP800-53-SI-4.3", "SP800-53-SR-3", "SP800-53-SR-7", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 7, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 15, "ref_count": 14, "refs": ["PCI-1.4.4", "PCI-1.5.1", "PCI-5.2.3", "PCI-6.3.1", "PCI-7.2.1", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.3.1", "PCI-9.2.1", "PCI-9.2.2", "PCI-REQ-3", "PCI-REQ-7", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.3", "PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-SECURITY-CONTROLS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-PRACTICE-PW.1", "SSDF-TASK-PW.1.3", "SSDF-TASK-PW.9.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 14", "manual_v2_anchor": "Mechanism", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-003", "v1_entity_name": "Transport Security Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
348
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 180, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.12", "SP800-53-AC-8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-1.2.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.3.5", "ASVS-REQ-V4.1.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-330", "CAPEC-418"]}], "es_grounding_sources_full": [{"claim_count": 13, "ref_count": 13, "refs": ["ASVS-REQ-V11.1.3", "ASVS-REQ-V11.2.1", "ASVS-REQ-V11.3.3", "ASVS-REQ-V11.6.2", "ASVS-REQ-V13.2.4", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.4.2", "ASVS-REQ-V16.5.1", "ASVS-REQ-V17.2.7", "ASVS-REQ-V17.3.2", "ASVS-REQ-V2.3.5", "ASVS-REQ-V4.1.5", "ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 13, "ref_count": 13, "refs": ["CAPEC-330", "CAPEC-418", "CAPEC-422", "CAPEC-443", "CAPEC-475", "CAPEC-477", "CAPEC-499", "CAPEC-560", "CAPEC-584", "CAPEC-600", "CAPEC-644", "CAPEC-653", "CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 6, "ref_count": 5, "refs": ["CIS-12.1", "CIS-15.4", "CIS-2.2", "CIS-2.5", "CIS-2.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 8, "ref_count": 8, "refs": ["CWE-209", "CWE-348", "CWE-349", "CWE-353", "CWE-354", "CWE-358", "CWE-924", "CWE-940"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 108, "ref_count": 97, "refs": ["SP800-53-AC-14", "SP800-53-AC-19.4", "SP800-53-AC-22", "SP800-53-AC-3.12", "SP800-53-AC-8", "SP800-53-AU-10.1", "SP800-53-AU-10.2", "SP800-53-AU-10.5", "SP800-53-AU-5.3", "SP800-53-AU-9.5", "SP800-53-CA-3.4", "SP800-53-CA-6", "SP800-53-CA-7.5", "SP800-53-CA-9", "SP800-53-CA-9.1", "SP800-53-CM-10", "SP800-53-CM-11.3", "SP800-53-CM-7.5", "SP800-53-CM-7.8", "SP800-53-CP-2", "SP800-53-CP-9.7", "SP800-53-IA-1", "SP800-53-IA-12.5", "SP800-53-IA-5.1", "SP800-53-IA-9.2", "SP800-53-IR-1", "SP800-53-MA-3.3", "SP800-53-MA-5", "SP800-53-MA-5.5", "SP800-53-MP-1", "SP800-53-PL-4", "SP800-53-PS-3.4", "SP800-53-PS-6", "SP800-53-PT-1", "SP800-53-PT-4.3", "SP800-53-PT-6.2", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-8.22", "SP800-53-SA-9.7", "SP800-53-SC-1", "SP800-53-SC-12.1", "SP800-53-SC-13.3", "SP800-53-SC-13.4", "SP800-53-SC-15", "SP800-53-SC-15.2", "SP800-53-SC-16.1", "SP800-53-SC-18.1", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-34.2", "SP800-53-SC-42.1", "SP800-53-SC-42.2", "SP800-53-SC-7.11", "SP800-53-SC-7.17", "SP800-53-SC-7.19", "SP800-53-SC-7.23", "SP800-53-SC-7.24", "SP800-53-SC-7.4", "SP800-53-SC-7.5", "SP800-53-SC-8", "SP800-53-SI-1", "SP800-53-SI-10.1", "SP800-53-SI-10.3", "SP800-53-SI-13.5", "SP800-53-SI-18", "SP800-53-SI-18.4", "SP800-53-SI-2.1", "SP800-53-SI-2.7", "SP800-53-SI-3", "SP800-53-SI-3.1", "SP800-53-SI-3.3", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.20", "SP800-53-SI-4.22", "SP800-53-SI-4.24", "SP800-53-SI-4.4", "SP800-53-SI-4.6", "SP800-53-SI-4.8", "SP800-53-SI-5.1", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.10", "SP800-53-SI-7.12", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.4", "SP800-53-SI-7.5", "SP800-53-SI-7.6", "SP800-53-SI-7.8", "SP800-53-SI-8.1", "SP800-53-SI-8.3", "SP800-53-SI-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-GOVERNANCE", "OWASP-MCP-MINIMUM-BAR"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 25, "ref_count": 25, "refs": ["PCI-1.2.2", "PCI-1.2.3", "PCI-1.4.3", "PCI-11.2.1", "PCI-11.2.2", "PCI-12.1.2", "PCI-12.1.3", "PCI-12.2.1", "PCI-12.3.1", "PCI-12.4.2", "PCI-12.5.1", "PCI-12.5.3", "PCI-12.8.1", "PCI-12.8.2", "PCI-12.8.3", "PCI-12.8.4", "PCI-12.8.5", "PCI-3.3.2", "PCI-3.3.3", "PCI-4.2.1", "PCI-7.2.3", "PCI-8.3.8", "PCI-9.3.1", "PCI-9.3.2", "PCI-9.4.5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-6.1", "PCISSLC-6.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-16"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DELIVERY", "SCSIC-DELIVERY-SIGNING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 5, "ref_count": 5, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PS.2.1", "SSDF-TASK-PW.4.4"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-004", "v1_entity_name": "Message Integrity And Authorized Peer Policies", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
349
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 85, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-8", "CIS-8.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10", "PCI-5.3.4"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.5.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 6, "ref_count": 6, "refs": ["CAPEC-268", "CAPEC-54", "CAPEC-569", "CAPEC-571", "CAPEC-695", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 17, "ref_count": 12, "refs": ["CIS-13.6", "CIS-8", "CIS-8.1", "CIS-8.12", "CIS-8.2", "CIS-8.3", "CIS-8.4", "CIS-8.5", "CIS-8.6", "CIS-8.7", "CIS-8.8", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 39, "ref_count": 35, "refs": ["SP800-53-AU-12", "SP800-53-AU-12.1", "SP800-53-AU-12.3", "SP800-53-AU-12.4", "SP800-53-AU-13.1", "SP800-53-AU-13.3", "SP800-53-AU-14.2", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-4", "SP800-53-AU-4.1", "SP800-53-AU-5", "SP800-53-AU-5.2", "SP800-53-AU-5.4", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.3", "SP800-53-AU-6.4", "SP800-53-AU-7", "SP800-53-AU-8.1", "SP800-53-AU-9.1", "SP800-53-AU-9.2", "SP800-53-AU-9.4", "SP800-53-AU-9.7", "SP800-53-CA-2.3", "SP800-53-CA-7.6", "SP800-53-CM-3", "SP800-53-MA-4.1", "SP800-53-PE-3", "SP800-53-RA-5.8", "SP800-53-SA-15.13", "SP800-53-SC-36.1", "SP800-53-SI-4", "SP800-53-SI-4.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 7, "ref_count": 7, "refs": ["DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 7, "ref_count": 6, "refs": ["SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCI-10.2.2", "PCI-10.3.3", "PCI-10.4.2", "PCI-10.5.1", "PCI-11.3.2", "PCI-5.3.4", "PCI-9.3.4", "PCI-REQ-10"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-5"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PO.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (calls, context, logging kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-ITS-005", "v1_entity_name": "Structured External Call Logging", "v1_entity_type": "Mechanism", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
350
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 71, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-4.17"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.6.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-36"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-289"]}], "es_grounding_sources_full": [{"claim_count": 8, "ref_count": 8, "refs": ["ASVS-REQ-V12.3.5", "ASVS-REQ-V13.2.1", "ASVS-REQ-V6.3.3", "ASVS-REQ-V6.6.1", "ASVS-REQ-V7.1.3", "ASVS-REQ-V7.6.1", "ASVS-REQ-V8.3.3", "ASVS-REQ-V9.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 9, "ref_count": 8, "refs": ["CAPEC-196", "CAPEC-21", "CAPEC-226", "CAPEC-36", "CAPEC-461", "CAPEC-569", "CAPEC-633", "CAPEC-701"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 6, "ref_count": 5, "refs": ["CIS-12.5", "CIS-12.7", "CIS-16.11", "CIS-6.4", "CIS-6.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 7, "ref_count": 7, "refs": ["CWE-1392", "CWE-289", "CWE-301", "CWE-306", "CWE-322", "CWE-603", "CWE-798"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-CONFUSED-DEPUTY"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 38, "ref_count": 37, "refs": ["SP800-53-AC-17.10", "SP800-53-AC-2", "SP800-53-AC-4.17", "SP800-53-IA-1", "SP800-53-IA-10", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-13", "SP800-53-IA-2", "SP800-53-IA-2.1", "SP800-53-IA-2.10", "SP800-53-IA-2.11", "SP800-53-IA-2.12", "SP800-53-IA-2.13", "SP800-53-IA-2.2", "SP800-53-IA-2.5", "SP800-53-IA-2.7", "SP800-53-IA-2.8", "SP800-53-IA-2.9", "SP800-53-IA-3", "SP800-53-IA-3.1", "SP800-53-IA-3.2", "SP800-53-IA-3.4", "SP800-53-IA-4.2", "SP800-53-IA-5", "SP800-53-IA-5.10", "SP800-53-IA-5.11", "SP800-53-IA-5.16", "SP800-53-IA-5.3", "SP800-53-IA-5.5", "SP800-53-IA-8", "SP800-53-IA-8.2", "SP800-53-IA-8.5", "SP800-53-IA-9", "SP800-53-IA-9.1", "SP800-53-SC-7.8", "SP800-53-SI-3.9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-AUTH"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-3P-AUTH-AUTHZ-REGISTRATION", "OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP07-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C6"], "substrate_source_key": "owasp_proactive_controls_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-001", "v1_entity_name": "Authenticated Service Interaction And Machine Identity Binding", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
351
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_resolution": {"authored_more_sources_count": 8, "authored_visible_source_count": 4, "resolved_ref_count": 140, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.3", "SP800-53-AC-3.5"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-4"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-29318D6018CE452680EAF5928E49F639"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V3.4.1", "ASVS-REQ-V12.1.2"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V12.1.2", "ASVS-REQ-V12.2.1", "ASVS-REQ-V12.3.3", "ASVS-REQ-V3.4.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-157", "CAPEC-390", "CAPEC-582", "CAPEC-583"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 4, "ref_count": 4, "refs": ["CIS-12.3", "CIS-14.8", "CIS-3.1", "CIS-4.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-420", "CWE-654"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["HIPAA-164-310a1", "HIPAA-164-310c", "HIPAA-164-312e1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 105, "ref_count": 96, "refs": ["SP800-53-AC-17.8", "SP800-53-AC-18.1", "SP800-53-AC-20", "SP800-53-AC-3.3", "SP800-53-AC-3.5", "SP800-53-AC-4.1", "SP800-53-AC-4.14", "SP800-53-AC-4.31", "SP800-53-AC-4.32", "SP800-53-AC-4.4", "SP800-53-AC-4.8", "SP800-53-AC-6.2", "SP800-53-CP-11", "SP800-53-CP-13", "SP800-53-MA-4.6", "SP800-53-MA-5.5", "SP800-53-MP-5", "SP800-53-PE-3.1", "SP800-53-PE-4", "SP800-53-SA-4.7", "SP800-53-SA-5.1", "SP800-53-SA-8", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.17", "SP800-53-SA-8.19", "SP800-53-SA-8.2", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.28", "SP800-53-SA-8.31", "SP800-53-SA-8.4", "SP800-53-SA-8.8", "SP800-53-SC-1", "SP800-53-SC-12.4", "SP800-53-SC-12.5", "SP800-53-SC-13", "SP800-53-SC-14", "SP800-53-SC-15.2", "SP800-53-SC-15.3", "SP800-53-SC-16", "SP800-53-SC-16.2", "SP800-53-SC-2.1", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-28.3", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.5", "SP800-53-SC-33", "SP800-53-SC-34.3", "SP800-53-SC-37.1", "SP800-53-SC-38", "SP800-53-SC-39", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-40.1", "SP800-53-SC-42.3", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-47", "SP800-53-SC-49", "SP800-53-SC-5", "SP800-53-SC-5.1", "SP800-53-SC-50", "SP800-53-SC-6", "SP800-53-SC-7", "SP800-53-SC-7.10", "SP800-53-SC-7.11", "SP800-53-SC-7.12", "SP800-53-SC-7.13", "SP800-53-SC-7.14", "SP800-53-SC-7.18", "SP800-53-SC-7.2", "SP800-53-SC-7.20", "SP800-53-SC-7.21", "SP800-53-SC-7.24", "SP800-53-SC-7.25", "SP800-53-SC-7.26", "SP800-53-SC-7.27", "SP800-53-SC-7.28", "SP800-53-SC-7.4", "SP800-53-SC-7.5", "SP800-53-SC-7.7", "SP800-53-SC-7.9", "SP800-53-SC-8.1", "SP800-53-SC-8.3", "SP800-53-SC-8.4", "SP800-53-SC-8.5", "SP800-53-SC-9", "SP800-53-SI-4.10", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-0FF45FB87EEF46ED9B3A84C955CD7060", "DSOMM-ACTIVITY-29318D6018CE452680EAF5928E49F639", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-AD23BE9C56614F1F81A35A5DC7061629", "DSOMM-ACTIVITY-ECB0184C6BC945DABBBBA983797FFC93"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-ARCH"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C1"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A02-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 20, "ref_count": 18, "refs": ["PCI-1.2.3", "PCI-1.2.4", "PCI-1.2.5", "PCI-1.2.6", "PCI-1.3.1", "PCI-1.3.2", "PCI-1.4.4", "PCI-1.5.1", "PCI-2.2.3", "PCI-2.2.5", "PCI-2.2.6", "PCI-2.2.7", "PCI-2.3.1", "PCI-4.2.2", "PCI-6.3.3", "PCI-8.3.2", "PCI-REQ-2", "PCI-REQ-4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-ENCRYPTION"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-002", "v1_entity_name": "Secure Transport And Insecure Protocol Exclusion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
352
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 134, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.12", "SP800-53-AC-4.19"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.5.2", "ASVS-REQ-V2.3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-12", "CAPEC-22"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-179", "CWE-209"]}], "es_grounding_sources_full": [{"claim_count": 25, "ref_count": 25, "refs": ["ASVS-REQ-V1.5.2", "ASVS-REQ-V11.2.5", "ASVS-REQ-V11.3.3", "ASVS-REQ-V11.6.1", "ASVS-REQ-V11.6.2", "ASVS-REQ-V12.1.4", "ASVS-REQ-V12.1.5", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.3.4", "ASVS-REQ-V15.4.2", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.3", "ASVS-REQ-V17.2.5", "ASVS-REQ-V17.2.7", "ASVS-REQ-V17.3.2", "ASVS-REQ-V2.3.5", "ASVS-REQ-V3.5.5", "ASVS-REQ-V4.1.5", "ASVS-REQ-V6.3.8", "ASVS-REQ-V6.6.4", "ASVS-REQ-V6.7.1", "ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 19, "ref_count": 19, "refs": ["CAPEC-12", "CAPEC-145", "CAPEC-148", "CAPEC-187", "CAPEC-216", "CAPEC-218", "CAPEC-22", "CAPEC-272", "CAPEC-330", "CAPEC-385", "CAPEC-418", "CAPEC-422", "CAPEC-424", "CAPEC-474", "CAPEC-475", "CAPEC-477", "CAPEC-485", "CAPEC-499", "CAPEC-621"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-18.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 16, "ref_count": 16, "refs": ["CWE-179", "CWE-209", "CWE-212", "CWE-319", "CWE-346", "CWE-347", "CWE-348", "CWE-349", "CWE-353", "CWE-354", "CWE-358", "CWE-494", "CWE-502", "CWE-649", "CWE-924", "CWE-940"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 56, "ref_count": 53, "refs": ["SP800-53-AC-17.6", "SP800-53-AC-22", "SP800-53-AC-3.12", "SP800-53-AC-4.19", "SP800-53-AC-4.9", "SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-AU-10.5", "SP800-53-AU-5.3", "SP800-53-CA-3.4", "SP800-53-CA-9.1", "SP800-53-PS-3.4", "SP800-53-PT-2", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SC-13.1", "SP800-53-SC-16.1", "SP800-53-SC-18.1", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-34.2", "SP800-53-SC-42.1", "SP800-53-SC-7.23", "SP800-53-SI-1", "SP800-53-SI-10", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-10.4", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-11", "SP800-53-SI-18", "SP800-53-SI-19.7", "SP800-53-SI-2.7", "SP800-53-SI-3.3", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.6", "SP800-53-SI-4.8", "SP800-53-SI-5.1", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.11", "SP800-53-SI-7.12", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.5", "SP800-53-SI-8", "SP800-53-SI-8.3", "SP800-53-SI-9", "SP800-53-SR-4.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 7, "ref_count": 7, "refs": ["PCI-1.2.2", "PCI-11.2.1", "PCI-11.6.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-9.3.1", "PCI-9.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-6.1", "PCISSLC-6.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DELIVERY", "SCSIC-DEV-TESTING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRINCIPLE-TRUST-CODE"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-003", "v1_entity_name": "Message Integrity And Authorized Peer Validation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
353
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 4, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MP-5.1", "SP800-53-PE-3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-433"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-73"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-433"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-73"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-MP-5.1", "SP800-53-PE-3"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-004", "v1_entity_name": "Boundary-Mediated External Exposure And Integration Path Control", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
354
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 33, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4", "CIS-4.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3", "SP800-53-CA-4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_B"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a1", "HIPAA-164-308b1"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V15.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 16, "ref_count": 7, "refs": ["CIS-16.1", "CIS-16.2", "CIS-16.4", "CIS-16.6", "CIS-4", "CIS-4.1", "CIS-4.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-18"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-22"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 3, "refs": ["HIPAA-164-308a1", "HIPAA-164-308b1", "HIPAA-164-314a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 8, "ref_count": 6, "refs": ["SP800-53-CA-3", "SP800-53-CA-4", "SP800-53-CM-5.7", "SP800-53-PE-2", "SP800-53-PS-6", "SP800-53-SA-10"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-F57D55F2DC054B349D1FF8CE5BFB0715"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 10, "ref_count": 6, "refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-8.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-2", "SCAGILE-EXP-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-FINDINGS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING-CONTRACT"], "substrate_source_key": "safecode_sic_2010"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-005", "v1_entity_name": "Integration Security Review And Contract Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
355
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 48, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-2.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.3.3", "PCI-10.4.2"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 5, "refs": ["ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.5.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 4, "ref_count": 3, "refs": ["CIS-1", "CIS-8.1", "CIS-8.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-749"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 32, "ref_count": 29, "refs": ["SP800-53-AU-12.1", "SP800-53-AU-12.3", "SP800-53-AU-12.4", "SP800-53-AU-13.3", "SP800-53-AU-14.2", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-2.2", "SP800-53-AU-2.3", "SP800-53-AU-5", "SP800-53-AU-5.2", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.7", "SP800-53-AU-8.1", "SP800-53-AU-9.4", "SP800-53-AU-9.7", "SP800-53-CA-2.3", "SP800-53-CA-7.1", "SP800-53-MA-4.1", "SP800-53-PE-3", "SP800-53-PT-3", "SP800-53-SA-9", "SP800-53-SC-7.24", "SP800-53-SI-4", "SP800-53-SI-4.25"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-8746647C638C473F8E1782C068E4C311", "DSOMM-ACTIVITY-D03BC41074A74E9282CBD01A020CB6BF", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCI-10.3.3", "PCI-10.4.2", "PCI-11.3.2", "PCI-11.4.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-006", "v1_entity_name": "External Interaction Auditability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
356
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 17, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-6.1", "SP800-53-CA-6.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V8.4.2", "ASVS-REQ-V12.2.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-677"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-MEASURE-4"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V12.2.2", "ASVS-REQ-V12.3.4", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-677"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 12, "ref_count": 11, "refs": ["SP800-53-CA-6.1", "SP800-53-CA-6.2", "SP800-53-CA-9", "SP800-53-SA-12.12", "SP800-53-SA-12.3", "SP800-53-SA-13", "SP800-53-SA-8.10", "SP800-53-SA-8.16", "SP800-53-SA-9.3", "SP800-53-SA-9.4", "SP800-53-SI-4.17"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-12.8.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-ITS-007", "v1_entity_name": "Integration Trust And Service Interaction Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
357
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 4, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_SM_1_A"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-MEASURE-4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-13"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-SA-13"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_SM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-001", "v1_entity_name": "Trust Boundary And Integration Review", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
358
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 62, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.2", "SP800-53-AC-17.10"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.5.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-36"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0012", "AML.T0083"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["ASVS-REQ-V6.3.3", "ASVS-REQ-V6.5.3", "ASVS-REQ-V6.8.4", "ASVS-REQ-V7.1.3", "ASVS-REQ-V7.2.1", "ASVS-REQ-V7.2.3", "ASVS-REQ-V7.6.1", "ASVS-REQ-V8.3.1", "ASVS-REQ-V8.3.2", "ASVS-REQ-V9.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["CAPEC-196", "CAPEC-21", "CAPEC-226", "CAPEC-36", "CAPEC-461", "CAPEC-470", "CAPEC-509", "CAPEC-59", "CAPEC-633", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-289", "CWE-306", "CWE-308", "CWE-322"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-CONFUSED-DEPUTY"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 32, "ref_count": 32, "refs": ["SP800-53-AC-17.10", "SP800-53-AC-3.2", "SP800-53-AU-10.1", "SP800-53-IA-10", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-13", "SP800-53-IA-2.1", "SP800-53-IA-2.10", "SP800-53-IA-2.11", "SP800-53-IA-2.2", "SP800-53-IA-2.3", "SP800-53-IA-2.4", "SP800-53-IA-2.5", "SP800-53-IA-2.7", "SP800-53-IA-2.8", "SP800-53-IA-3.1", "SP800-53-IA-3.2", "SP800-53-IA-4", "SP800-53-IA-4.2", "SP800-53-IA-4.5", "SP800-53-IA-5.10", "SP800-53-IA-5.11", "SP800-53-IA-5.13", "SP800-53-IA-5.7", "SP800-53-IA-5.8", "SP800-53-IA-5.9", "SP800-53-IA-6", "SP800-53-IA-8.4", "SP800-53-IA-9", "SP800-53-SC-23.3", "SP800-53-SI-3.9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-598E9F131AC84A01B85E8FAB93EE81DE", "DSOMM-ACTIVITY-8098E416E1ED4AE4A56183EFBE76BF57"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP07-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C6"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A07-2021"], "substrate_source_key": "owasp_top_10_2021"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-002", "v1_entity_name": "Machine Identity And Mutual Authentication Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
359
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_resolution": {"authored_more_sources_count": 15, "authored_visible_source_count": 4, "resolved_ref_count": 223, "resolved_source_count": 18, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-1.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-36", "CAPEC-57"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-4"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V17.2.1", "ASVS-REQ-V3.4.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 17, "ref_count": 17, "refs": ["CAPEC-157", "CAPEC-207", "CAPEC-216", "CAPEC-220", "CAPEC-276", "CAPEC-278", "CAPEC-36", "CAPEC-517", "CAPEC-522", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-57", "CAPEC-673", "CAPEC-677", "CAPEC-678", "CAPEC-89"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 23, "ref_count": 12, "refs": ["CIS-13.9", "CIS-14.8", "CIS-16", "CIS-16.1", "CIS-16.2", "CIS-16.7", "CIS-3.1", "CIS-4", "CIS-4.1", "CIS-4.11", "CIS-4.2", "CIS-4.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-1220", "CWE-212", "CWE-213", "CWE-538"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["CRA-ART-18", "CRA-ART-19"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 3, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a6", "HIPAA-164-312e1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 124, "ref_count": 118, "refs": ["SP800-53-AC-17.8", "SP800-53-AC-19.5", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-4.1", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.15", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.23", "SP800-53-AC-4.24", "SP800-53-AC-4.25", "SP800-53-AC-4.28", "SP800-53-AC-4.29", "SP800-53-AC-4.3", "SP800-53-AC-4.30", "SP800-53-AC-4.4", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-CA-3.1", "SP800-53-CA-3.3", "SP800-53-CM-3", "SP800-53-CM-3.4", "SP800-53-CM-3.6", "SP800-53-CM-5.7", "SP800-53-CM-6", "SP800-53-IA-5.1", "SP800-53-MA-4.6", "SP800-53-MP-5", "SP800-53-PE-2", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.4", "SP800-53-PE-3.5", "SP800-53-PE-4", "SP800-53-PE-8.3", "SP800-53-PL-2", "SP800-53-PL-8", "SP800-53-PM-8", "SP800-53-PS-1", "SP800-53-PS-6.1", "SP800-53-PS-7", "SP800-53-PT-1", "SP800-53-SA-10.6", "SP800-53-SA-10.7", "SP800-53-SA-17", "SP800-53-SA-17.3", "SP800-53-SA-4.7", "SP800-53-SA-8", "SP800-53-SA-8.1", "SP800-53-SA-8.12", "SP800-53-SA-8.16", "SP800-53-SA-8.19", "SP800-53-SA-8.23", "SP800-53-SA-8.25", "SP800-53-SA-8.28", "SP800-53-SA-8.3", "SP800-53-SA-8.31", "SP800-53-SA-8.8", "SP800-53-SA-8.9", "SP800-53-SC-1", "SP800-53-SC-11", "SP800-53-SC-12.3", "SP800-53-SC-12.4", "SP800-53-SC-12.5", "SP800-53-SC-12.6", "SP800-53-SC-14", "SP800-53-SC-15.3", "SP800-53-SC-16", "SP800-53-SC-17", "SP800-53-SC-18", "SP800-53-SC-23.5", "SP800-53-SC-28.1", "SP800-53-SC-28.3", "SP800-53-SC-3", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.4", "SP800-53-SC-3.5", "SP800-53-SC-30.2", "SP800-53-SC-30.5", "SP800-53-SC-32.1", "SP800-53-SC-38", "SP800-53-SC-39", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-40.1", "SP800-53-SC-40.2", "SP800-53-SC-42.3", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SC-7", "SP800-53-SC-7.10", "SP800-53-SC-7.13", "SP800-53-SC-7.14", "SP800-53-SC-7.17", "SP800-53-SC-7.18", "SP800-53-SC-7.2", "SP800-53-SC-7.21", "SP800-53-SC-7.25", "SP800-53-SC-7.26", "SP800-53-SC-7.27", "SP800-53-SC-7.28", "SP800-53-SC-7.4", "SP800-53-SC-7.7", "SP800-53-SC-7.9", "SP800-53-SC-8.1", "SP800-53-SC-8.4", "SP800-53-SC-8.5", "SP800-53-SC-9", "SP800-53-SI-4.3", "SP800-53-SI-7.4", "SP800-53-SR-7", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 10, "ref_count": 10, "refs": ["DSOMM-ACTIVITY-03643CA203C2472B8E19956BF02FE9B7", "DSOMM-ACTIVITY-0FF45FB87EEF46ED9B3A84C955CD7060", "DSOMM-ACTIVITY-11B3848EE9314146A35D35409ADA24EE", "DSOMM-ACTIVITY-48E92BB1FDBA40E8B6C235DE0D431833", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-AD23BE9C56614F1F81A35A5DC7061629", "DSOMM-ACTIVITY-ECB0184C6BC945DABBBBA983797FFC93", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DEPLOYMENT"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 25, "ref_count": 11, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 28, "ref_count": 25, "refs": ["PCI-1.1.1", "PCI-1.2.5", "PCI-1.3.2", "PCI-1.5.1", "PCI-12.3.3", "PCI-2.1.1", "PCI-2.2.3", "PCI-2.2.4", "PCI-2.2.6", "PCI-2.3.1", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.7", "PCI-4.2.1", "PCI-4.2.2", "PCI-6.3.3", "PCI-7.1.1", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.1.1", "PCI-8.3.11", "PCI-8.3.2", "PCI-9.1.1", "PCI-REQ-2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 7, "ref_count": 6, "refs": ["PCISSLC-2.3", "PCISSLC-5.1", "PCISSLC-8.1", "PCISSLC-8.2", "PCISSLC-8.3", "PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-EXP-11", "SCAGILE-EXP-12", "SCAGILE-EXP-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-ENCRYPTION"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-DEFAULTS"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 5, "ref_count": 5, "refs": ["SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.9", "SSDF-TASK-PO.5.2", "SSDF-TASK-PW.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-003", "v1_entity_name": "Transport And Protocol Hardening", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
360
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 126, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-AC-22"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.2", "ASVS-REQ-V2.3.3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-209", "CWE-294"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.2", "PCI-1.2.4"]}], "es_grounding_sources_full": [{"claim_count": 29, "ref_count": 29, "refs": ["ASVS-REQ-V11.2.5", "ASVS-REQ-V11.3.2", "ASVS-REQ-V11.3.3", "ASVS-REQ-V11.6.1", "ASVS-REQ-V11.6.2", "ASVS-REQ-V13.2.2", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.2.2", "ASVS-REQ-V17.2.5", "ASVS-REQ-V17.2.7", "ASVS-REQ-V17.3.2", "ASVS-REQ-V2.2.2", "ASVS-REQ-V2.3.3", "ASVS-REQ-V2.3.5", "ASVS-REQ-V3.5.5", "ASVS-REQ-V4.1.5", "ASVS-REQ-V5.4.3", "ASVS-REQ-V6.3.5", "ASVS-REQ-V6.3.8", "ASVS-REQ-V6.5.6", "ASVS-REQ-V6.6.1", "ASVS-REQ-V6.6.2", "ASVS-REQ-V6.7.1", "ASVS-REQ-V8.1.3", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.4", "ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-330", "CAPEC-475", "CAPEC-69"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-12.1", "CIS-18.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 10, "ref_count": 10, "refs": ["CWE-209", "CWE-294", "CWE-346", "CWE-347", "CWE-348", "CWE-353", "CWE-354", "CWE-494", "CWE-924", "CWE-940"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 64, "ref_count": 62, "refs": ["SP800-53-AC-22", "SP800-53-AC-4.19", "SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-AU-10.5", "SP800-53-AU-5.3", "SP800-53-CA-3.4", "SP800-53-CA-3.6", "SP800-53-CA-9.1", "SP800-53-CM-10", "SP800-53-CP-9.1", "SP800-53-IA-1", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-12.5", "SP800-53-IA-5.16", "SP800-53-MP-6.1", "SP800-53-PL-4", "SP800-53-PS-3.4", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-12.10", "SP800-53-SA-19", "SP800-53-SC-16.1", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-34.2", "SP800-53-SC-42.1", "SP800-53-SC-7.23", "SP800-53-SC-7.4", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-13.5", "SP800-53-SI-14.3", "SP800-53-SI-17", "SP800-53-SI-18", "SP800-53-SI-18.4", "SP800-53-SI-19.7", "SP800-53-SI-2.1", "SP800-53-SI-2.7", "SP800-53-SI-3.1", "SP800-53-SI-3.3", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.22", "SP800-53-SI-4.4", "SP800-53-SI-5.1", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.12", "SP800-53-SI-7.15", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.5", "SP800-53-SI-7.9", "SP800-53-SI-8.1", "SP800-53-SI-8.3", "SP800-53-SR-4.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 7, "ref_count": 4, "refs": ["SAMM-ACTIVITY-I_SD_3_A", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCI-1.1.2", "PCI-1.2.4", "PCI-11.2.1", "PCI-2.1.2", "PCI-3.3.3", "PCI-7.2.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-6.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCSIC-DELIVERY-SIGNING", "SCSIC-DEV-TESTING", "SCSIC-DEVELOPMENT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PS.2.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-004", "v1_entity_name": "Message Integrity And Authorized Peer Validation", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
361
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 8, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3", "SP800-53-CM-1"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308b1", "HIPAA-164-314a1"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308b1", "HIPAA-164-314a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 5, "ref_count": 5, "refs": ["SP800-53-CA-3", "SP800-53-CM-1", "SP800-53-SA-10", "SP800-53-SA-12.12", "SP800-53-SR-8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (integration, interface, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-005", "v1_entity_name": "Integration Contract And Change Assurance", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
362
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 180, "resolved_source_count": 17, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.4", "SP800-53-AC-3.10"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10", "PCI-5.3.4"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-8"]}], "es_grounding_sources_full": [{"claim_count": 16, "ref_count": 16, "refs": ["ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.2", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.2.4", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.3.1", "ASVS-REQ-V16.3.2", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.3", "ASVS-REQ-V16.5.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 9, "ref_count": 9, "refs": ["CAPEC-268", "CAPEC-54", "CAPEC-569", "CAPEC-571", "CAPEC-634", "CAPEC-648", "CAPEC-678", "CAPEC-702", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 22, "ref_count": 16, "refs": ["CIS-13.1", "CIS-13.6", "CIS-17.3", "CIS-3.1", "CIS-8", "CIS-8.1", "CIS-8.11", "CIS-8.12", "CIS-8.2", "CIS-8.3", "CIS-8.4", "CIS-8.5", "CIS-8.6", "CIS-8.7", "CIS-8.8", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-749", "CWE-778", "CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-5"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 105, "ref_count": 87, "refs": ["SP800-53-AC-17.1", "SP800-53-AC-2.4", "SP800-53-AC-25", "SP800-53-AC-3.10", "SP800-53-AC-4.26", "SP800-53-AU-1", "SP800-53-AU-10", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-12", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-12.4", "SP800-53-AU-13", "SP800-53-AU-13.1", "SP800-53-AU-13.3", "SP800-53-AU-14", "SP800-53-AU-14.1", "SP800-53-AU-14.2", "SP800-53-AU-14.3", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-16.2", "SP800-53-AU-16.3", "SP800-53-AU-2", "SP800-53-AU-2.1", "SP800-53-AU-2.2", "SP800-53-AU-2.3", "SP800-53-AU-3", "SP800-53-AU-3.2", "SP800-53-AU-4", "SP800-53-AU-4.1", "SP800-53-AU-5", "SP800-53-AU-5.2", "SP800-53-AU-5.4", "SP800-53-AU-5.5", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.10", "SP800-53-AU-6.2", "SP800-53-AU-6.3", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.6", "SP800-53-AU-6.7", "SP800-53-AU-6.9", "SP800-53-AU-7", "SP800-53-AU-7.1", "SP800-53-AU-7.2", "SP800-53-AU-8", "SP800-53-AU-8.1", "SP800-53-AU-8.2", "SP800-53-AU-9", "SP800-53-AU-9.1", "SP800-53-AU-9.2", "SP800-53-AU-9.4", "SP800-53-AU-9.6", "SP800-53-AU-9.7", "SP800-53-CA-1", "SP800-53-CA-2.3", "SP800-53-CA-3.5", "SP800-53-CA-7.6", "SP800-53-CA-9", "SP800-53-CM-5.1", "SP800-53-IR-4.1", "SP800-53-IR-6.1", "SP800-53-IR-7.2", "SP800-53-MA-3.1", "SP800-53-MA-4.1", "SP800-53-PE-3", "SP800-53-PE-6", "SP800-53-RA-5.8", "SP800-53-SA-10", "SP800-53-SA-11.6", "SP800-53-SA-11.9", "SP800-53-SA-12.15", "SP800-53-SA-15.13", "SP800-53-SA-9", "SP800-53-SC-7.24", "SP800-53-SI-2.7", "SP800-53-SI-4", "SP800-53-SI-4.16", "SP800-53-SI-4.2", "SP800-53-SI-4.9", "SP800-53-SI-7.17", "SP800-53-SI-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 9, "ref_count": 9, "refs": ["DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-8746647C638C473F8E1782C068E4C311", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-D03BC41074A74E9282CBD01A020CB6BF", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 13, "ref_count": 12, "refs": ["SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_1_B", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_ST_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 18, "ref_count": 17, "refs": ["PCI-10.2.1", "PCI-10.2.2", "PCI-10.3.1", "PCI-10.3.2", "PCI-10.3.3", "PCI-10.3.4", "PCI-10.4.1", "PCI-10.4.2", "PCI-10.4.3", "PCI-10.5.1", "PCI-11.3.2", "PCI-11.5.2", "PCI-5.3.4", "PCI-8.2.7", "PCI-9.3.4", "PCI-9.4.5", "PCI-REQ-10"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-5"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-LOGGING", "SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-TASK-PW.2.1", "SSDF-TASK-RV.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (calls, context, logging kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-ITS-006", "v1_entity_name": "External Interaction Audit Logging", "v1_entity_type": "Practice", "v1_family": "ACO-ITS", "v1_slice": "ASC-08"}
363
363
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 (DM, AA, SR); DSOMM architecture activities", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
364
364
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de Arquitetura Segura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
365
365
  {"authority_class": "editorial", "coverage_status": "manual_only", "es_grounding_direct": "Glossário e terminologia", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/07-termos-e-glossario-arquitetura.md", "manual_v2_anchor": "DocumentUnit", "rastreabilidade_role": "manual_only_coverage"}
@@ -393,26 +393,26 @@
393
393
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "05-dependencias-sbom-sca:validacao-automatica-de-compatibilidade-de-licencas", "manual_v2_entity_label": "Validação Automática de Compatibilidade de Licenças", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
394
394
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "05-dependencias-sbom-sca:validacao-de-release-go-no-go", "manual_v2_entity_label": "Validação de release (*go/no-go*)", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
395
395
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "None", "manual_v2_entity_label": "hybrid", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
396
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_3_B"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1", "PCISSLC-5.2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-C7D99B18C3E14D22B2E39AA9146C0B17", "DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-001", "v1_entity_name": "Versioned Pipelines", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
397
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.4", "SP800-53-AC-4.28"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.4", "CIS-3.13"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-002", "v1_entity_name": "Automated Security Scanners", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
398
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3.5"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.7.2", "PCI-3.7.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-36"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-I_DM_1_A"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-003", "v1_entity_name": "Release Promotion Gates", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
399
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-9.1", "SP800-53-AU-9.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-206", "CAPEC-459"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-004", "v1_entity_name": "Artifact Signing And Attestation", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
400
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-1.1"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0060", "AML.M0023"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8", "SP800-53-SR-4.4"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-005", "v1_entity_name": "Build And Image Inventory Generation", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
401
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.3", "SP800-53-AC-3.11"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-7", "PCI-1.3.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-51", "CAPEC-203"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.5"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (enforcement, proxy, registries kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-006", "v1_entity_name": "Registry Allowlisting And Approved Source Enforcement", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
402
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8", "SP800-53-CM-8.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-1.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-O_EM_1_A"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-001", "v1_entity_name": "Dependency Inventory And SBOM Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
403
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-7.4", "SP800-53-PM-9"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.3", "NIST-AI-RMF-GOVERN-1.5"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-15.2"]}, {"source_display_name": "EU NIS2", "substrate_source": "eu_nis2", "visible_refs": ["NIS2-ART-21"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-002", "v1_entity_name": "Dependency Risk Evaluation And Policy Gating", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
404
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.3", "SP800-53-AC-3.9"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-1230"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.5", "CIS-2.6"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-4.2.1"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-003", "v1_entity_name": "Controlled Dependency And Image Sources", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
405
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-443", "CAPEC-523"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-004", "v1_entity_name": "Build Definition And Execution Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
406
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AC-13"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-205", "CWE-250"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.7.8", "PCI-7.2.3"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.M0029"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-005", "v1_entity_name": "Release Promotion And Human Approval Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
407
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-9.1", "SP800-53-IA-12"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0009", "AML.T0002"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477", "DSOMM-ACTIVITY-A854B48D83BD4F8D8621A0BDD470837F"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-006", "v1_entity_name": "Artifact Attestation And Provenance Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
408
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-34869EAFF2E14926B0BD28C43402F057"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-12.3", "SP800-53-SI-7.4"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0010.004", "AML.M0032"]}, {"source_display_name": "EU CRA", "substrate_source": "eu_cra", "visible_refs": ["CRA-ART-19"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-007", "v1_entity_name": "Container Image Supply Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
409
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-I_SB_1_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-PRODUCER-CHOOSE-BUILD-PLATFORM", "SLSA-PRODUCER-CONSISTENT-BUILD"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V15.1.2"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-001", "v1_entity_name": "Build-Linked SBOM Generation", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
410
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-35", "CAPEC-187"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-7.4", "SP800-53-CM-5.7"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-002", "v1_entity_name": "Automated Dependency And Image Risk Gating", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
411
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.11", "SP800-53-AC-4.19"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.6"]}, {"source_display_name": "SAFECode SIC", "substrate_source": "safecode", "visible_refs": ["SCSIC-SOURCING", "SCSIC-SOURCING-OSS"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-003", "v1_entity_name": "Approved Source And Registry Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
412
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM03-2025"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-004", "v1_entity_name": "Pipeline Definition As Reviewed Code", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
413
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-12", "PCI-1.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-13"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a1", "HIPAA-164-308a2"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (approval, enforce, gates kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-005", "v1_entity_name": "Governed Promotion And Release Approval", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
414
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-10.5", "SP800-53-AU-12.1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.1.2", "ASVS-REQ-V4.1.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665", "DSOMM-ACTIVITY-830570280B774D2E813540969768AE88"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.2", "PCI-2.1.2"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-006", "v1_entity_name": "Artifact Signature And Provenance Validation", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
415
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-19.5", "SP800-53-MP-5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-16E39C8F5336400188EDA552D2447531", "DSOMM-ACTIVITY-485A33837F2E4DBABB84479377070904"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0010.004", "AML.T0105"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-426", "CWE-829"]}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (build, container, policy kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-007", "v1_entity_name": "Trusted Container Image Supply", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
396
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 34, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_3_B"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1", "PCISSLC-5.2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-C7D99B18C3E14D22B2E39AA9146C0B17", "DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46"]}], "es_grounding_sources_full": [{"claim_count": 21, "ref_count": 16, "refs": ["SP800-53-AU-1", "SP800-53-AU-2.3", "SP800-53-CA-1", "SP800-53-CM-1", "SP800-53-CM-2.1", "SP800-53-CM-2.3", "SP800-53-CM-3.2", "SP800-53-CM-5.2", "SP800-53-MA-1", "SP800-53-PL-1", "SP800-53-PL-2", "SP800-53-PM-28", "SP800-53-PM-5.1", "SP800-53-RA-1", "SP800-53-RA-5.1", "SP800-53-SA-1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46", "DSOMM-ACTIVITY-C7D99B18C3E14D22B2E39AA9146C0B17"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 14, "ref_count": 9, "refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_B", "SAMM-ACTIVITY-O_OM_3_B", "SAMM-ACTIVITY-V_AA_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["PCI-1.2.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-10.1", "PCISSLC-5.1", "PCISSLC-5.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-6"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-LIFECYCLE-FEEDBACK", "SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-001", "v1_entity_name": "Versioned Pipelines", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
397
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_resolution": {"authored_more_sources_count": 15, "authored_visible_source_count": 4, "resolved_ref_count": 321, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.4", "SP800-53-AC-4.28"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.4", "CIS-3.13"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["ASVS-REQ-V11.4.2", "ASVS-REQ-V13.3.3", "ASVS-REQ-V15.2.3", "ASVS-REQ-V15.2.5", "ASVS-REQ-V16.4.3", "ASVS-REQ-V2.4.1", "ASVS-REQ-V5.4.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 37, "ref_count": 31, "refs": ["CAPEC-169", "CAPEC-187", "CAPEC-188", "CAPEC-190", "CAPEC-310", "CAPEC-35", "CAPEC-44", "CAPEC-441", "CAPEC-442", "CAPEC-445", "CAPEC-446", "CAPEC-511", "CAPEC-523", "CAPEC-524", "CAPEC-529", "CAPEC-532", "CAPEC-533", "CAPEC-537", "CAPEC-549", "CAPEC-578", "CAPEC-581", "CAPEC-642", "CAPEC-643", "CAPEC-648", "CAPEC-657", "CAPEC-669", "CAPEC-670", "CAPEC-672", "CAPEC-673", "CAPEC-678", "CAPEC-680"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 54, "ref_count": 41, "refs": ["CIS-10", "CIS-10.1", "CIS-10.2", "CIS-10.4", "CIS-10.6", "CIS-11.2", "CIS-12.2", "CIS-12.3", "CIS-13", "CIS-13.1", "CIS-13.2", "CIS-13.3", "CIS-13.5", "CIS-13.7", "CIS-13.8", "CIS-14.7", "CIS-16", "CIS-16.1", "CIS-16.11", "CIS-16.12", "CIS-16.13", "CIS-16.3", "CIS-16.5", "CIS-16.6", "CIS-16.8", "CIS-18.2", "CIS-18.4", "CIS-18.5", "CIS-2.4", "CIS-3.13", "CIS-4.1", "CIS-4.2", "CIS-4.4", "CIS-7", "CIS-7.1", "CIS-7.3", "CIS-7.4", "CIS-7.5", "CIS-7.6", "CIS-7.7", "CIS-9.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 73, "ref_count": 69, "refs": ["SP800-53-AC-15", "SP800-53-AC-17.1", "SP800-53-AC-2.4", "SP800-53-AC-4.28", "SP800-53-AU-13.1", "SP800-53-AU-6.2", "SP800-53-AU-7.1", "SP800-53-CA-5.1", "SP800-53-CA-7.6", "SP800-53-CM-12.1", "SP800-53-CM-2.2", "SP800-53-CM-3.5", "SP800-53-CM-4.2", "SP800-53-CM-5.1", "SP800-53-CM-5.7", "SP800-53-CM-6", "SP800-53-CM-6.3", "SP800-53-CM-8.2", "SP800-53-CM-8.3", "SP800-53-IR-4.5", "SP800-53-MA-2.2", "SP800-53-MA-3.2", "SP800-53-MA-3.6", "SP800-53-MA-4", "SP800-53-MP-2.1", "SP800-53-MP-8", "SP800-53-PE-15.1", "SP800-53-PE-6", "SP800-53-PE-6.1", "SP800-53-PE-6.2", "SP800-53-PL-2", "SP800-53-PM-14", "SP800-53-PM-16.1", "SP800-53-PS-4.2", "SP800-53-RA-3.4", "SP800-53-RA-5", "SP800-53-RA-5.10", "SP800-53-RA-5.2", "SP800-53-RA-5.5", "SP800-53-RA-5.6", "SP800-53-RA-5.7", "SP800-53-SA-11.2", "SP800-53-SA-11.6", "SP800-53-SA-11.9", "SP800-53-SA-15.12", "SP800-53-SA-15.2", "SP800-53-SA-15.4", "SP800-53-SA-15.5", "SP800-53-SA-15.7", "SP800-53-SA-15.8", "SP800-53-SA-8.17", "SP800-53-SA-8.30", "SP800-53-SI-18.1", "SP800-53-SI-2.2", "SP800-53-SI-2.4", "SP800-53-SI-2.5", "SP800-53-SI-3", "SP800-53-SI-3.10", "SP800-53-SI-4", "SP800-53-SI-4.1", "SP800-53-SI-4.12", "SP800-53-SI-4.3", "SP800-53-SI-4.7", "SP800-53-SI-5.1", "SP800-53-SI-6", "SP800-53-SI-6.2", "SP800-53-SI-8.2", "SP800-53-SR-11.3", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 43, "ref_count": 43, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-07FE8C4FAE334409B1B2CF64CFCCEA86", "DSOMM-ACTIVITY-08F27C262C6A47FE94585E88F188085D", "DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E", "DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-26E1C6D556324EC780D2E564B98732AD", "DSOMM-ACTIVITY-297BE0018D9441EEAB29207020D423C0", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-46D6A2A8F9DC4C159FC81723CFECBDDC", "DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-535F301AE8E84EDAAD77A08B035C92DE", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-598897A2358E441F984CE12EC4F6110A", "DSOMM-ACTIVITY-5B5A1EB2113F41FBA3D606AF4FDC9CEA", "DSOMM-ACTIVITY-67667C97C33E4306A4E5E7B1D8E10C5A", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4", "DSOMM-ACTIVITY-7A82020C94D1471CBBD35F7FE7DF4876", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-837F8F90ADC24E6B9EBB60C2EE29494D", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-9E3A7C2F1B4D4E8AA5C67F2B9D1E3A8C", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-B2F776063E6C41E9B72D7C0B1D3D581D", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-CB6321AA0FBF49969E0805AB26EF4C1E", "DSOMM-ACTIVITY-CE970C9BDA9441CFBD788C15357B7E8E", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-EB2C7F9DD0BD4253A2BACFF2ACE4A075", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F2F0F274C1A0450192FE7FC4452BC8AD", "DSOMM-ACTIVITY-F57D55F2DC054B349D1FF8CE5BFB0715"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-CONTINUOUS-VALIDATION", "OWASP-MCP-RISK-LANDSCAPE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-GOVERNANCE-REGISTRY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C2", "OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 78, "ref_count": 53, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-D_TA_2_B", "SAMM-ACTIVITY-D_TA_3_B", "SAMM-ACTIVITY-G_EG_1_A", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_1_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-O_EM_2_A", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_1_B", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_3_A", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_1_A", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_2_A", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_A", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 35, "ref_count": 25, "refs": ["PCI-1.2.3", "PCI-1.2.4", "PCI-10.7.2", "PCI-11.3.2", "PCI-11.4.4", "PCI-11.5.2", "PCI-11.6.1", "PCI-2.2.3", "PCI-5.1.1", "PCI-5.2.1", "PCI-5.2.2", "PCI-5.3.1", "PCI-5.3.2", "PCI-5.3.3", "PCI-5.3.4", "PCI-5.4.1", "PCI-6.1.1", "PCI-6.3.1", "PCI-6.5.5", "PCI-REQ-1", "PCI-REQ-10", "PCI-REQ-11", "PCI-REQ-2", "PCI-REQ-5", "PCI-REQ-6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCISSLC-2.6", "PCISSLC-3.2", "PCISSLC-3.4", "PCISSLC-4.1", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 13, "ref_count": 13, "refs": ["SCAGILE-EXP-1", "SCAGILE-EXP-12", "SCAGILE-EXP-3", "SCAGILE-EXP-5", "SCAGILE-EXP-8", "SCAGILE-EXP-9", "SCAGILE-OPS-1", "SCAGILE-OPS-10", "SCAGILE-OPS-11", "SCAGILE-OPS-14", "SCAGILE-OPS-16", "SCAGILE-OPS-2", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-FIX-VULN", "SCFPSSD-TESTING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 27, "ref_count": 25, "refs": ["SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.5", "SSDF-PRACTICE-PW.6", "SSDF-PRACTICE-PW.7", "SSDF-PRACTICE-PW.8", "SSDF-PRACTICE-PW.9", "SSDF-PRACTICE-RV.1", "SSDF-PRACTICE-RV.2", "SSDF-PRACTICE-RV.3", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.3.2", "SSDF-TASK-PO.4.1", "SSDF-TASK-PW.1.1", "SSDF-TASK-PW.1.3", "SSDF-TASK-PW.2.1", "SSDF-TASK-PW.4.1", "SSDF-TASK-PW.6.1", "SSDF-TASK-PW.7.2", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-002", "v1_entity_name": "Automated Security Scanners", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
398
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_resolution": {"authored_more_sources_count": 8, "authored_visible_source_count": 4, "resolved_ref_count": 93, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3.5"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.7.2", "PCI-3.7.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-36"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-I_DM_1_A"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V2.3.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 5, "ref_count": 5, "refs": ["CAPEC-2", "CAPEC-36", "CAPEC-426", "CAPEC-439", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 2, "refs": ["CIS-17.9", "CIS-6.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-408"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 74, "ref_count": 66, "refs": ["SP800-53-AC-1", "SP800-53-AC-13", "SP800-53-AC-14", "SP800-53-AC-16", "SP800-53-AC-17.6", "SP800-53-AC-20.3", "SP800-53-AC-3.5", "SP800-53-AC-3.9", "SP800-53-AC-4.13", "SP800-53-AC-4.7", "SP800-53-AC-8", "SP800-53-AU-10.3", "SP800-53-CA-3.1", "SP800-53-CA-3.2", "SP800-53-CA-3.3", "SP800-53-CP-10.3", "SP800-53-CP-13", "SP800-53-CP-2", "SP800-53-CP-7.5", "SP800-53-CP-9.4", "SP800-53-IA-1", "SP800-53-IA-13.1", "SP800-53-IA-13.3", "SP800-53-IA-9.2", "SP800-53-PE-4", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-9", "SP800-53-PS-1", "SP800-53-PS-6", "SP800-53-PS-6.1", "SP800-53-PS-8", "SP800-53-RA-10", "SP800-53-RA-5.11", "SP800-53-SA-1", "SP800-53-SA-12.9", "SP800-53-SA-4.6", "SP800-53-SA-5.1", "SP800-53-SA-8.10", "SP800-53-SA-8.12", "SP800-53-SA-8.16", "SP800-53-SA-8.25", "SP800-53-SA-8.28", "SP800-53-SA-8.5", "SP800-53-SC-1", "SP800-53-SC-13.3", "SP800-53-SC-14", "SP800-53-SC-28.1", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-38", "SP800-53-SC-4.1", "SP800-53-SC-49", "SP800-53-SC-5.1", "SP800-53-SC-50", "SP800-53-SC-7.14", "SP800-53-SC-7.25", "SP800-53-SC-7.26", "SP800-53-SC-7.27", "SP800-53-SC-7.4", "SP800-53-SC-8.4", "SP800-53-SI-19.3", "SP800-53-SI-8", "SP800-53-SR-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-1B9281B948E24C019AC69DB9931C4885"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 4, "ref_count": 4, "refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_OM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 7, "ref_count": 7, "refs": ["PCI-12.6.1", "PCI-12.6.3", "PCI-3.7.2", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.7", "PCI-9.2.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-2.2", "PCISSLC-2.5", "PCISSLC-5.1", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-003", "v1_entity_name": "Release Promotion Gates", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
399
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 98, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-9.1", "SP800-53-AU-9.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-206", "CAPEC-459"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477"]}], "es_grounding_sources_full": [{"claim_count": 8, "ref_count": 8, "refs": ["ASVS-REQ-V11.1.2", "ASVS-REQ-V11.1.3", "ASVS-REQ-V11.1.4", "ASVS-REQ-V16.1.1", "ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1", "ASVS-REQ-V6.8.2", "ASVS-REQ-V9.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["CAPEC-206", "CAPEC-459", "CAPEC-473", "CAPEC-475", "CAPEC-476", "CAPEC-477", "CAPEC-485", "CAPEC-523", "CAPEC-524", "CAPEC-532"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-347", "CWE-353", "CWE-354", "CWE-494"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 50, "ref_count": 49, "refs": ["SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-AU-10.5", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-14.2", "SP800-53-AU-9.1", "SP800-53-AU-9.3", "SP800-53-CM-14", "SP800-53-CP-9.1", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-13.2", "SP800-53-IA-3.4", "SP800-53-IA-4.3", "SP800-53-IA-4.9", "SP800-53-IR-4.12", "SP800-53-MP-8.2", "SP800-53-PM-24", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-12.10", "SP800-53-SA-12.14", "SP800-53-SA-12.3", "SP800-53-SA-18.2", "SP800-53-SA-19", "SP800-53-SA-8.32", "SP800-53-SA-9.3", "SP800-53-SC-16.1", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SI-1", "SP800-53-SI-13.5", "SP800-53-SI-18.3", "SP800-53-SI-2", "SP800-53-SI-2.3", "SP800-53-SI-2.7", "SP800-53-SI-3.7", "SP800-53-SI-4", "SP800-53-SI-4.24", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.12", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.4", "SP800-53-SI-7.8", "SP800-53-SI-7.9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 8, "ref_count": 8, "refs": ["DSOMM-ACTIVITY-0CB2C39A3CEC4353B3AB8D70DAF4C9D2", "DSOMM-ACTIVITY-27337442E4B14E878DC9CE86FBB79A39", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-A854B48D83BD4F8D8621A0BDD470837F", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SD_3_A", "SAMM-ACTIVITY-V_RT_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCI-1.1.2", "PCI-2.1.2", "PCI-3.3.2", "PCI-3.3.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-6.1", "PCISSLC-7.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DELIVERY-SIGNING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 4, "ref_count": 4, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-L3", "SLSA-VERIFY-BUILD-LEVEL"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-004", "v1_entity_name": "Artifact Signing And Attestation", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
400
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 14, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-1.1"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0060", "AML.M0023"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8", "SP800-53-SR-4.4"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V15.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 14, "ref_count": 4, "refs": ["CIS-1", "CIS-1.1", "CIS-16.4", "CIS-2.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-CM-8", "SP800-53-SR-4.4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-13E9757E58E24277BC0FEADC674891E6", "DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F", "DSOMM-ACTIVITY-34869EAFF2E14926B0BD28C43402F057", "DSOMM-ACTIVITY-830570280B774D2E813540969768AE88"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-12.5.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRODUCER-CONSISTENT-BUILD"], "substrate_source_key": "slsa_spec_v1_0_build_track"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-005", "v1_entity_name": "Build And Image Inventory Generation", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
401
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 67, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.3", "SP800-53-AC-3.11"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-7", "PCI-1.3.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-51", "CAPEC-203"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.5"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-203", "CAPEC-51", "CAPEC-571", "CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 5, "ref_count": 4, "refs": ["CIS-15.2", "CIS-2.2", "CIS-2.5", "CIS-2.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-1220", "CWE-1230", "CWE-183", "CWE-829"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-19"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-AUTH-DISCOVERY-METADATA"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 45, "ref_count": 34, "refs": ["SP800-53-AC-25", "SP800-53-AC-3.11", "SP800-53-AC-3.3", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.14", "SP800-53-AC-4.19", "SP800-53-AC-4.27", "SP800-53-AC-4.29", "SP800-53-AC-4.6", "SP800-53-CA-1", "SP800-53-CM-10", "SP800-53-CM-10.1", "SP800-53-CM-11", "SP800-53-CM-5.4", "SP800-53-CM-5.6", "SP800-53-CM-7.5", "SP800-53-CM-8.7", "SP800-53-MA-3.4", "SP800-53-MP-1", "SP800-53-MP-5.1", "SP800-53-MP-6.1", "SP800-53-MP-6.4", "SP800-53-MP-6.7", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-SA-6", "SP800-53-SA-9", "SP800-53-SC-7.11", "SP800-53-SC-7.15", "SP800-53-SC-7.17", "SP800-53-SC-7.4", "SP800-53-SC-7.5", "SP800-53-SI-10.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A", "DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-994151396B50441B89E10AA59ACCD43D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 2, "refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 12, "ref_count": 10, "refs": ["PCI-1.3.2", "PCI-1.4.2", "PCI-3.4.2", "PCI-7.2.6", "PCI-7.3.1", "PCI-7.3.3", "PCI-9.2.1", "PCI-9.4.2", "PCI-9.4.4", "PCI-REQ-7"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-8.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DEV-REPO", "SCSIC-SOURCING-OSS"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (enforcement, proxy, registries kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SCBI-006", "v1_entity_name": "Registry Allowlisting And Approved Source Enforcement", "v1_entity_type": "Mechanism", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
402
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_resolution": {"authored_more_sources_count": 8, "authored_visible_source_count": 4, "resolved_ref_count": 48, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8", "SP800-53-CM-8.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-1.1"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-O_EM_1_A"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V15.1.2", "ASVS-REQ-V16.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-446", "CAPEC-516"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 18, "ref_count": 8, "refs": ["CIS-1", "CIS-1.1", "CIS-15.1", "CIS-16.4", "CIS-2", "CIS-2.1", "CIS-2.2", "CIS-2.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-1103", "CWE-1104"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 21, "ref_count": 19, "refs": ["SP800-53-CM-8", "SP800-53-CM-8.1", "SP800-53-CM-8.2", "SP800-53-CM-8.4", "SP800-53-CM-8.5", "SP800-53-CM-8.6", "SP800-53-CM-8.7", "SP800-53-PM-30.1", "SP800-53-PM-5", "SP800-53-SA-17.2", "SP800-53-SA-19.3", "SP800-53-SA-4.4", "SP800-53-SA-8.22", "SP800-53-SA-8.4", "SP800-53-SI-13.1", "SP800-53-SR-12", "SP800-53-SR-3.1", "SP800-53-SR-4.1", "SP800-53-SR-6.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-13E9757E58E24277BC0FEADC674891E6", "DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP04-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_EM_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-12.5.1", "PCI-6.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-OPS-5", "SCAGILE-OPS-6"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-MANIFEST"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-TASK-PO.1.3", "SSDF-TASK-PO.3.1", "SSDF-TASK-PW.4.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-001", "v1_entity_name": "Dependency Inventory And SBOM Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
403
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 11, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-7.4", "SP800-53-PM-9"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.3", "NIST-AI-RMF-GOVERN-1.5"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-15.2"]}, {"source_display_name": "EU NIS2", "substrate_source": "eu_nis2", "visible_refs": ["NIS2-ART-21"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-15.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 19, "ref_count": 7, "refs": ["SP800-53-CA-7.4", "SP800-53-PM-28", "SP800-53-PM-29", "SP800-53-PM-9", "SP800-53-RA-1", "SP800-53-RA-10", "SP800-53-RA-5.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_TA_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-12.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-002", "v1_entity_name": "Dependency Risk Evaluation And Policy Gating", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
404
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 27, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.3", "SP800-53-AC-3.9"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1220", "CWE-1230"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.5", "CIS-2.6"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-4.2.1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CIS-2.5", "CIS-2.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-1220", "CWE-1230", "CWE-434", "CWE-829"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 25, "ref_count": 19, "refs": ["SP800-53-AC-14.1", "SP800-53-AC-20", "SP800-53-AC-20.3", "SP800-53-AC-22", "SP800-53-AC-24", "SP800-53-AC-25", "SP800-53-AC-3.11", "SP800-53-AC-3.3", "SP800-53-AC-3.9", "SP800-53-CM-10.1", "SP800-53-MP-1", "SP800-53-MP-4.2", "SP800-53-MP-5", "SP800-53-MP-5.1", "SP800-53-MP-6.4", "SP800-53-MP-8.3", "SP800-53-PE-2.3", "SP800-53-SC-37.1", "SP800-53-SI-10.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-066084C6113546359CC59E75C7C5459F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-003", "v1_entity_name": "Controlled Dependency And Image Sources", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
405
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 81, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-443", "CAPEC-523"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V15.2.3", "ASVS-REQ-V15.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 8, "ref_count": 7, "refs": ["CAPEC-443", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-670", "CAPEC-673", "CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 2, "refs": ["CIS-16.1", "CIS-16.12"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-1127", "CWE-733"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-CM-7.7", "SP800-53-SA-10.4", "SP800-53-SA-15", "SP800-53-SA-17.3", "SP800-53-SC-11", "SP800-53-SI-7.1", "SP800-53-SI-7.13"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 13, "ref_count": 13, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-74938A3F126949B99D0FC43A79A1985A", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B", "DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 52, "ref_count": 17, "refs": ["SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_2_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-6.5.3", "PCI-6.5.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCISSLC-2.3", "PCISSLC-2.6", "PCISSLC-6.1", "PCISSLC-6.2", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SCAGILE-EXP-11", "SCAGILE-EXP-2", "SCAGILE-OPS-2", "SCAGILE-OPS-8", "SCAGILE-OPS-9"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DEV-BUILD", "SCSIC-DEVELOPMENT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 3, "ref_count": 3, "refs": ["SLSA-BUILD-L3", "SLSA-BUILD-PLATFORM-ISOLATION", "SLSA-PRINCIPLE-TRUST-CODE"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 13, "ref_count": 13, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.5", "SSDF-PRACTICE-PW.6", "SSDF-PRACTICE-PW.8", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.3.3", "SSDF-TASK-PO.5.2", "SSDF-TASK-PW.2.1", "SSDF-TASK-PW.5.1", "SSDF-TASK-PW.6.1", "SSDF-TASK-PW.6.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-004", "v1_entity_name": "Build Definition And Execution Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
406
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 41, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AC-13"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-205", "CWE-250"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.7.8", "PCI-7.2.3"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.M0029"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V2.3.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 5, "ref_count": 5, "refs": ["CWE-205", "CWE-250", "CWE-268", "CWE-497", "CWE-841"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 29, "ref_count": 27, "refs": ["SP800-53-AC-13", "SP800-53-AC-14", "SP800-53-AC-24.2", "SP800-53-AC-4.9", "SP800-53-AU-1", "SP800-53-AU-10", "SP800-53-AU-10.3", "SP800-53-AU-16.3", "SP800-53-AU-2.3", "SP800-53-AU-2.4", "SP800-53-AU-6.7", "SP800-53-CA-6", "SP800-53-CA-7.5", "SP800-53-CP-9.4", "SP800-53-CP-9.7", "SP800-53-MA-3", "SP800-53-MA-3.3", "SP800-53-PE-3", "SP800-53-PL-4", "SP800-53-PM-1", "SP800-53-PT-1", "SP800-53-PT-2", "SP800-53-SC-13.3", "SP800-53-SI-1", "SP800-53-SI-2.7", "SP800-53-SI-7.11", "SP800-53-SI-7.16"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-3.7.8", "PCI-7.2.3", "PCI-9.2.2"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-005", "v1_entity_name": "Release Promotion And Human Approval Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
407
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 33, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-9.1", "SP800-53-IA-12"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0009", "AML.T0002"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477", "DSOMM-ACTIVITY-A854B48D83BD4F8D8621A0BDD470837F"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V11.1.2", "ASVS-REQ-V6.7.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-523", "CAPEC-524", "CAPEC-530", "CAPEC-532"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-353", "CWE-354"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 8, "ref_count": 8, "refs": ["SP800-53-CP-9.1", "SP800-53-IA-12", "SP800-53-SA-10.3", "SP800-53-SA-12.10", "SP800-53-SA-19", "SP800-53-SC-21.1", "SP800-53-SI-2", "SP800-53-SI-7.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-A854B48D83BD4F8D8621A0BDD470837F", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SB_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-7.1", "PCISSLC-7.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING-CONTRACT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 5, "ref_count": 5, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS", "SLSA-PRODUCER-DISTRIBUTE-PROVENANCE", "SLSA-VERIFY-BUILD-LEVEL"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-006", "v1_entity_name": "Artifact Attestation And Provenance Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
408
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 16, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-34869EAFF2E14926B0BD28C43402F057"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-12.3", "SP800-53-SI-7.4"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0010.004", "AML.M0032"]}, {"source_display_name": "EU CRA", "substrate_source": "eu_cra", "visible_refs": ["CRA-ART-19"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-19"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 6, "ref_count": 5, "refs": ["SP800-53-SA-12.3", "SP800-53-SI-7.4", "SP800-53-SR-11", "SP800-53-SR-11.3", "SP800-53-SR-4.4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 9, "ref_count": 9, "refs": ["DSOMM-ACTIVITY-16E39C8F5336400188EDA552D2447531", "DSOMM-ACTIVITY-34869EAFF2E14926B0BD28C43402F057", "DSOMM-ACTIVITY-485A33837F2E4DBABB84479377070904", "DSOMM-ACTIVITY-58825D221CE64748AF810EC9956E4129", "DSOMM-ACTIVITY-6B96E5A0CE344EA4A88F469D3B84546E", "DSOMM-ACTIVITY-A86C1FBC28FD461089A3A7F73ACFE45F", "DSOMM-ACTIVITY-CB6321AA0FBF49969E0805AB26EF4C1E", "DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-DDFE7C3CB7A44CBA9041B044D4A34E5B"], "substrate_source_key": "owasp_dsomm"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SCBI-007", "v1_entity_name": "Container Image Supply Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
409
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 10, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-I_SB_1_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-PRODUCER-CHOOSE-BUILD-PLATFORM", "SLSA-PRODUCER-CONSISTENT-BUILD"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V15.1.2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V15.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-2858AC12017940D99ACF1B839C030473", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRODUCER-CHOOSE-BUILD-PLATFORM", "SLSA-PRODUCER-CONSISTENT-BUILD"], "substrate_source_key": "slsa_spec_v1_0_build_track"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-001", "v1_entity_name": "Build-Linked SBOM Generation", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
410
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 136, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-35", "CAPEC-187"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-7.4", "SP800-53-CM-5.7"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V1.3.4", "ASVS-REQ-V15.1.1", "ASVS-REQ-V15.2.3", "ASVS-REQ-V15.2.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 17, "ref_count": 17, "refs": ["CAPEC-187", "CAPEC-212", "CAPEC-35", "CAPEC-442", "CAPEC-445", "CAPEC-446", "CAPEC-511", "CAPEC-516", "CAPEC-533", "CAPEC-534", "CAPEC-537", "CAPEC-648", "CAPEC-657", "CAPEC-662", "CAPEC-670", "CAPEC-673", "CAPEC-693"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 14, "ref_count": 12, "refs": ["CIS-10", "CIS-10.2", "CIS-16.12", "CIS-16.3", "CIS-16.5", "CIS-16.6", "CIS-7.1", "CIS-7.2", "CIS-7.3", "CIS-7.4", "CIS-7.5", "CIS-7.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-209", "CWE-676"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-24"], "substrate_source_key": "eu_dora"}, {"claim_count": 25, "ref_count": 17, "refs": ["SP800-53-CA-7.4", "SP800-53-CM-5.7", "SP800-53-MA-3.2", "SP800-53-PM-28", "SP800-53-RA-10", "SP800-53-RA-3", "SP800-53-RA-3.2", "SP800-53-RA-5", "SP800-53-RA-5.1", "SP800-53-RA-5.10", "SP800-53-RA-5.2", "SP800-53-RA-5.6", "SP800-53-RA-5.7", "SP800-53-SA-11.2", "SP800-53-SA-15.7", "SP800-53-SI-2.2", "SP800-53-SI-3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 24, "ref_count": 24, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-07FE8C4FAE334409B1B2CF64CFCCEA86", "DSOMM-ACTIVITY-08F27C262C6A47FE94585E88F188085D", "DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-0DE465A655A74343AF79948BB5FF10BA", "DSOMM-ACTIVITY-11B3848EE9314146A35D35409ADA24EE", "DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-26E1C6D556324EC780D2E564B98732AD", "DSOMM-ACTIVITY-2B7CC923BDAF43E38FB4A995B7783969", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-598897A2358E441F984CE12EC4F6110A", "DSOMM-ACTIVITY-7A82020C94D1471CBBD35F7FE7DF4876", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-837F8F90ADC24E6B9EBB60C2EE29494D", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-B2F776063E6C41E9B72D7C0B1D3D581D", "DSOMM-ACTIVITY-CF0D600E114D48879059D81C53805F0D", "DSOMM-ACTIVITY-D17DBFF01F10492AB4C717BB59A0A711", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-F2F0F274C1A0450192FE7FC4452BC8AD"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-RISK-LANDSCAPE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP04-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 28, "ref_count": 20, "refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-D_TA_3_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_2_B", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_1_A", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_2_A", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 15, "ref_count": 14, "refs": ["PCI-11.4.4", "PCI-11.5.2", "PCI-11.6.1", "PCI-12.3.2", "PCI-5.2.1", "PCI-5.2.3", "PCI-5.3.1", "PCI-5.3.4", "PCI-5.4.1", "PCI-6.4.1", "PCI-6.5.2", "PCI-6.5.3", "PCI-6.5.5", "PCI-REQ-5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.2", "PCISSLC-4.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCAGILE-EXP-3", "SCAGILE-OPS-10", "SCAGILE-OPS-11", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-THIRD-PARTY", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 16, "ref_count": 15, "refs": ["SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.5", "SSDF-PRACTICE-PW.6", "SSDF-PRACTICE-PW.7", "SSDF-PRACTICE-PW.8", "SSDF-PRACTICE-RV.1", "SSDF-PRACTICE-RV.2", "SSDF-PRACTICE-RV.3", "SSDF-TASK-PW.1.1", "SSDF-TASK-PW.2.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.2.1", "SSDF-TASK-RV.3.1", "SSDF-TASK-RV.3.2", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-002", "v1_entity_name": "Automated Dependency And Image Risk Gating", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
411
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 53, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.11", "SP800-53-AC-4.19"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.6"]}, {"source_display_name": "SAFECode SIC", "substrate_source": "safecode", "visible_refs": ["SCSIC-SOURCING", "SCSIC-SOURCING-OSS"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-647", "CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 7, "refs": ["CIS-15.2", "CIS-16.1", "CIS-16.2", "CIS-2.2", "CIS-2.6", "CIS-4.1", "CIS-4.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 30, "ref_count": 27, "refs": ["SP800-53-AC-3.11", "SP800-53-AC-4.19", "SP800-53-AT-1", "SP800-53-AU-13.1", "SP800-53-AU-13.2", "SP800-53-AU-6.3", "SP800-53-AU-6.9", "SP800-53-CA-1", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-10.1", "SP800-53-CM-11", "SP800-53-CM-7.3", "SP800-53-CM-8.7", "SP800-53-IA-5.14", "SP800-53-MA-1", "SP800-53-MP-1", "SP800-53-PE-1", "SP800-53-PL-1", "SP800-53-PM-23", "SP800-53-SA-1", "SP800-53-SA-22.1", "SP800-53-SA-6", "SP800-53-SC-17", "SP800-53-SC-20", "SP800-53-SI-1", "SP800-53-SI-10.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-994151396B50441B89E10AA59ACCD43D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 9, "ref_count": 4, "refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-3.4.2", "PCI-7.2.6", "PCI-9.4.7"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SCSIC-DELIVERY", "SCSIC-DEV-REPO", "SCSIC-DEVELOPMENT", "SCSIC-SOURCING", "SCSIC-SOURCING-OSS"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRINCIPLE-TRUST-CODE", "SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.4.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-003", "v1_entity_name": "Approved Source And Registry Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
412
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 1, "resolved_ref_count": 0, "resolved_source_count": 0, "status": "entity_absent_in_substrate_index", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM03-2025"]}], "es_grounding_sources_full": [], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-004", "v1_entity_name": "Pipeline Definition As Reviewed Code", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
413
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 195, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-12", "PCI-1.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-13"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a1", "HIPAA-164-308a2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V2.3.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 8, "ref_count": 8, "refs": ["CAPEC-122", "CAPEC-13", "CAPEC-2", "CAPEC-233", "CAPEC-36", "CAPEC-422", "CAPEC-426", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 11, "ref_count": 4, "refs": ["CIS-13.11", "CIS-17.9", "CIS-6.6", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 6, "ref_count": 6, "refs": ["CWE-268", "CWE-408", "CWE-412", "CWE-497", "CWE-654", "CWE-807"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 2, "ref_count": 2, "refs": ["GDPR-ART-32", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 10, "ref_count": 8, "refs": ["HIPAA-164-308a1", "HIPAA-164-308a2", "HIPAA-164-308a4", "HIPAA-164-308a5", "HIPAA-164-308a6", "HIPAA-164-308a8", "HIPAA-164-312a1", "HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 153, "ref_count": 122, "refs": ["SP800-53-AC-1", "SP800-53-AC-13", "SP800-53-AC-14", "SP800-53-AC-16", "SP800-53-AC-17.6", "SP800-53-AC-19.4", "SP800-53-AC-2", "SP800-53-AC-2.4", "SP800-53-AC-20.1", "SP800-53-AC-20.3", "SP800-53-AC-24", "SP800-53-AC-24.1", "SP800-53-AC-24.2", "SP800-53-AC-3", "SP800-53-AC-3.10", "SP800-53-AC-3.15", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.7", "SP800-53-AC-3.8", "SP800-53-AC-3.9", "SP800-53-AC-4", "SP800-53-AC-4.13", "SP800-53-AC-4.26", "SP800-53-AC-4.3", "SP800-53-AC-4.4", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-AC-6.3", "SP800-53-AC-6.6", "SP800-53-AC-8", "SP800-53-AU-1", "SP800-53-AU-10.3", "SP800-53-AU-6.2", "SP800-53-AU-6.7", "SP800-53-AU-9.5", "SP800-53-CA-1", "SP800-53-CA-3.1", "SP800-53-CA-3.2", "SP800-53-CA-3.3", "SP800-53-CA-4", "SP800-53-CA-6", "SP800-53-CM-11", "SP800-53-CM-5.4", "SP800-53-CP-10.3", "SP800-53-CP-13", "SP800-53-CP-2", "SP800-53-CP-7.5", "SP800-53-CP-9.4", "SP800-53-IA-1", "SP800-53-IA-13.1", "SP800-53-IA-13.3", "SP800-53-IA-9.2", "SP800-53-IR-9.4", "SP800-53-MA-3", "SP800-53-MA-5.2", "SP800-53-PE-2", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-4", "SP800-53-PE-5", "SP800-53-PL-2", "SP800-53-PL-3", "SP800-53-PL-4", "SP800-53-PL-6", "SP800-53-PM-1", "SP800-53-PM-10", "SP800-53-PM-9", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-4.2", "SP800-53-PS-6", "SP800-53-PS-6.1", "SP800-53-PS-7", "SP800-53-PS-8", "SP800-53-PT-1", "SP800-53-PT-2", "SP800-53-RA-10", "SP800-53-RA-5.11", "SP800-53-SA-12.9", "SP800-53-SA-4.6", "SP800-53-SA-5.1", "SP800-53-SA-8.12", "SP800-53-SA-8.18", "SP800-53-SA-8.19", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.28", "SP800-53-SA-8.5", "SP800-53-SA-9.1", "SP800-53-SC-1", "SP800-53-SC-13.3", "SP800-53-SC-14", "SP800-53-SC-18", "SP800-53-SC-23", "SP800-53-SC-28.1", "SP800-53-SC-3", "SP800-53-SC-3.2", "SP800-53-SC-37.1", "SP800-53-SC-38", "SP800-53-SC-4.1", "SP800-53-SC-42.2", "SP800-53-SC-46", "SP800-53-SC-47", "SP800-53-SC-49", "SP800-53-SC-5.1", "SP800-53-SC-50", "SP800-53-SC-7.11", "SP800-53-SC-7.18", "SP800-53-SC-7.2", "SP800-53-SC-7.25", "SP800-53-SC-7.26", "SP800-53-SC-7.27", "SP800-53-SC-8.4", "SP800-53-SI-4.22", "SP800-53-SI-5", "SP800-53-SI-7.11", "SP800-53-SI-7.6", "SP800-53-SI-8", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-1B9281B948E24C019AC69DB9931C4885", "DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 8, "ref_count": 6, "refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_RT_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 23, "ref_count": 23, "refs": ["PCI-1.1.1", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.4.3", "PCI-11.1.1", "PCI-11.2.1", "PCI-12.6.1", "PCI-12.6.3", "PCI-12.8.4", "PCI-2.1.1", "PCI-3.7.7", "PCI-7.1.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.1.1", "PCI-8.2.4", "PCI-8.3.8", "PCI-9.1.1", "PCI-9.2.4", "PCI-REQ-12"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCISSLC-2.1", "PCISSLC-2.2", "PCISSLC-2.3", "PCISSLC-2.4", "PCISSLC-2.5", "PCISSLC-3.3", "PCISSLC-8.2", "PCISSLC-9.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-FINDINGS", "SCFPSSD-SECURITY-CONTROLS"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (approval, enforce, gates kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-005", "v1_entity_name": "Governed Promotion And Release Approval", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
414
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_resolution": {"authored_more_sources_count": 13, "authored_visible_source_count": 4, "resolved_ref_count": 63, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-10.5", "SP800-53-AU-12.1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.1.2", "ASVS-REQ-V4.1.5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665", "DSOMM-ACTIVITY-830570280B774D2E813540969768AE88"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.2", "PCI-2.1.2"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["ASVS-REQ-V11.1.2", "ASVS-REQ-V11.1.3", "ASVS-REQ-V11.4.3", "ASVS-REQ-V16.1.1", "ASVS-REQ-V2.1.2", "ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1", "ASVS-REQ-V6.8.2", "ASVS-REQ-V8.1.4", "ASVS-REQ-V9.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-476"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-347", "CWE-353", "CWE-354"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 31, "ref_count": 31, "refs": ["SP800-53-AU-10.5", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-14.2", "SP800-53-CP-9.1", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-13.2", "SP800-53-IA-4.3", "SP800-53-MP-3", "SP800-53-PM-24", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-12.10", "SP800-53-SA-12.14", "SP800-53-SA-18.2", "SP800-53-SA-19", "SP800-53-SA-9.3", "SP800-53-SC-16.1", "SP800-53-SC-20.2", "SP800-53-SI-19.7", "SP800-53-SI-2", "SP800-53-SI-2.3", "SP800-53-SI-4", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.12", "SP800-53-SI-7.2", "SP800-53-SI-7.5", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-830570280B774D2E813540969768AE88", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665", "DSOMM-ACTIVITY-A854B48D83BD4F8D8621A0BDD470837F", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SD_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCI-1.1.2", "PCI-2.1.2", "PCI-3.3.2", "PCI-3.3.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DELIVERY-SIGNING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 3, "ref_count": 3, "refs": ["SLSA-BUILD-L1", "SLSA-PRODUCER-DISTRIBUTE-PROVENANCE", "SLSA-VERIFY-BUILD-LEVEL"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-006", "v1_entity_name": "Artifact Signature And Provenance Validation", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
415
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 22, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-19.5", "SP800-53-MP-5"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-16E39C8F5336400188EDA552D2447531", "DSOMM-ACTIVITY-485A33837F2E4DBABB84479377070904"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0010.004", "AML.T0105"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-426", "CWE-829"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-677"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-426", "CWE-829"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 12, "ref_count": 11, "refs": ["SP800-53-AC-19.5", "SP800-53-MP-5", "SP800-53-MP-5.1", "SP800-53-MP-6.1", "SP800-53-MP-6.7", "SP800-53-SA-12", "SP800-53-SA-12.3", "SP800-53-SA-8.9", "SP800-53-SI-7.4", "SP800-53-SR-11", "SP800-53-SR-11.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-16E39C8F5336400188EDA552D2447531", "DSOMM-ACTIVITY-29318D6018CE452680EAF5928E49F639", "DSOMM-ACTIVITY-485A33837F2E4DBABB84479377070904", "DSOMM-ACTIVITY-58825D221CE64748AF810EC9956E4129", "DSOMM-ACTIVITY-6B96E5A0CE344EA4A88F469D3B84546E", "DSOMM-ACTIVITY-A86C1FBC28FD461089A3A7F73ACFE45F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-1.4.4", "PCI-9.4.1"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (build, container, policy kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SCBI-007", "v1_entity_name": "Trusted Container Image Supply", "v1_entity_type": "Practice", "v1_family": "ACO-SCBI", "v1_slice": "ASC-01"}
416
416
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 SCA maturity; DSOMM dependency activities", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
417
417
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de SBOM e Gestão de Dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
418
418
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "KPIs operacionais SBOM/SCA", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/10-kpis-metricas.md", "manual_v2_anchor": "ExternalFramework", "rastreabilidade_role": "manual_only_coverage"}
@@ -443,43 +443,43 @@
443
443
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "06-desenvolvimento-seguro:validacao-de-padroes-perigosos-e-anti-patterns", "manual_v2_entity_label": "Validação de Padrões Perigosos e Anti-patterns", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
444
444
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "06-desenvolvimento-seguro:validacoes-locais-obrigatorias-pre-commit", "manual_v2_entity_label": "Validações Locais Obrigatórias (Pre-commit)", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
445
445
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "None", "manual_v2_entity_label": "hybrid", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
446
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AC-13"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.5", "ASVS-REQ-V1.2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-14", "CAPEC-24"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_3_A"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-001", "v1_entity_name": "Code Review For Input And Error Discipline", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
447
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0010.001", "AML.T0020"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-15", "CAPEC-35"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-183", "CWE-184"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.1", "SP800-53-AC-4.6"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-002", "v1_entity_name": "Static Rulepacks And Security Linters", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
448
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.1.1", "ASVS-REQ-V2.1.2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-9.3", "SP800-53-SA-10.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-95", "CAPEC-146"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-112", "CWE-353"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-003", "v1_entity_name": "Schema And Contract Validators", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
449
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-1.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2", "CIS-4.9"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-994151396B50441B89E10AA59ACCD43D", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "⚠️ future-work (P8 §10)", "manual_v2_anchor": "Mechanism", "methodology_label": "Gap", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-004", "v1_entity_name": "Centralized Error Translation And Redaction", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
450
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-18", "CAPEC-19"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.1.2", "ASVS-REQ-V1.2.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1021", "CWE-838"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0077"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (html, json, output kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-005", "v1_entity_name": "Context-Aware Encoder Selection And Application", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
451
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-20", "SP800-53-AC-20.1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.1.1", "ASVS-REQ-V2.2.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1284", "CWE-1286"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM02-2025", "LLM10-2025"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-001", "v1_entity_name": "External Input Contract Validation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
452
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.11", "SP800-53-AC-4.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-13", "CAPEC-80"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1056", "CWE-1070"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.5", "CIS-2.6"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-002", "v1_entity_name": "Schema, Type And Allowlist Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
453
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-3", "CAPEC-6"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-115", "CWE-186"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.2.7"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0051", "AML.T0051.000"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-003", "v1_entity_name": "Injection-Resistant Input Handling And Dangerous Pattern Exclusion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
454
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-CA-3.6"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-18.4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-346", "CWE-349"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-004", "v1_entity_name": "Validation Before Internal Use And Trust Crossing", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
455
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 17, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-8"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1058", "CWE-1073"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-1.2.3"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-005", "v1_entity_name": "Controlled Failure And Non-Revealing Client Error Surface", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
456
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.24", "SP800-53-AU-1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.14", "CIS-4.9"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_EG_2_B"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-006", "v1_entity_name": "Centralized Error Handling And Sensitive Error Logging Hygiene", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
457
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PE-5", "SP800-53-SC-7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-16.1", "CIS-16.8"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-522", "CAPEC-624"]}, {"source_display_name": "OWASP ML Top 10", "substrate_source": "owasp_ml_top_10", "visible_refs": ["ML02-2023", "ML09-2023"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-007", "v1_entity_name": "Input Validation And Safe Failure Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
458
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-18", "CAPEC-19"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.1", "ASVS-REQ-V1.2.2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1021", "CWE-79"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0077"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-008", "v1_entity_name": "Context-Aware Output Encoding And Rendering Safety", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
459
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1173", "CWE-1284"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.1.1", "ASVS-REQ-V2.2.2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SI-10", "SP800-53-SI-10.2"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM02-2025", "LLM10-2025"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-001", "v1_entity_name": "Boundary Input Validation", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
460
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3", "SP800-53-AC-3.8"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.6", "ASVS-REQ-V1.5.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-8", "PCI-REQ-9"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-13", "CAPEC-58"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (accepted, allowlist, enforcement kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-002", "v1_entity_name": "Schema And Allowlist Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
461
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-6", "CAPEC-7"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-115", "CWE-184"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-2.3.3", "NIST-AI-100-2-E2025-3.2.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.8", "ASVS-REQ-V1.2.9"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-003", "v1_entity_name": "Dangerous Pattern Exclusion", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
462
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3.6", "SP800-53-CA-7.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1.1", "CIS-3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.3", "ASVS-REQ-V2.3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_3_A"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-004", "v1_entity_name": "Pre-Use Data Validation Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
463
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 18, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-1.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-12", "CAPEC-22"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1073", "CWE-1084"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-005", "v1_entity_name": "Non-Revealing Error Surface Control", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
464
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-8.1", "CIS-8.3"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 00, Cap. 07, Cap. 10, Cap. 12, Cap. 13, Cap. 14", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-006", "v1_entity_name": "Centralized Error Governance", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
465
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.1.2", "ASVS-REQ-V1.2.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-19", "CAPEC-32"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0077"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-838"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (encoding, escaping, html kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-007", "v1_entity_name": "Context-Aware Output Encoding At Rendering Boundaries", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
466
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 19, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-24", "CAPEC-39"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.2", "ASVS-REQ-V6.5.2"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-001", "v1_entity_name": "Secret Management Systems", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
467
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.12", "SP800-53-AC-14"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.8.4", "ASVS-REQ-V7.5.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-151"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-8.2.1", "PCI-8.2.2"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-002", "v1_entity_name": "OIDC-Based Operational Identity", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
468
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.2.10"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-5", "CIS-6.8"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0013", "AML.T0098"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.4", "SP800-53-AC-2.8"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-003", "v1_entity_name": "Short-Lived Credential Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
469
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.7"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-13", "CAPEC-35"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0109", "AML.T0002.002"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1", "NIST-AI-RMF-GOVERN-1.6"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-004", "v1_entity_name": "Secret Scope And Binding Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
470
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-215", "CWE-348"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.31", "SP800-53-PE-19"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-65", "CAPEC-242"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0057", "AML.T0068"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-001", "v1_entity_name": "Secret Leak Prevention And Hardcoded-Secret Exclusion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
471
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.6", "SP800-53-AC-3.9"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-256", "CWE-257"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-37", "CAPEC-204"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-002", "v1_entity_name": "Protected Secret Storage And Controlled Retrieval", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
472
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.2.10", "ASVS-REQ-V6.4.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-262", "CWE-263"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-003", "v1_entity_name": "Secret Rotation And Expiry Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
473
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-IA-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-59"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.4", "ASVS-REQ-V6.8.4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-289"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-004", "v1_entity_name": "Operational Identity Binding And Short-Lived Credentials", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
474
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0008.000", "AML.T0024"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SC-7.20", "SP800-53-SC-39"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.12", "CIS-16.8"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-005", "v1_entity_name": "Secret Usage Isolation Across Pipeline, Workload And Deploy Surfaces", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
475
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.7", "SP800-53-AC-3.10"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.3.2", "PCI-11.5.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V11.1.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-678"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-006", "v1_entity_name": "Secret Change Auditability And Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
476
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.5", "CIS-4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-007", "v1_entity_name": "Secret Handling And Operational Identity Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
477
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-38", "CAPEC-44"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PS.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-001", "v1_entity_name": "Secret Leak Prevention In Source And Pipeline", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
478
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.13", "SP800-53-AC-4.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-REQ-4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-256", "CWE-257"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-002", "v1_entity_name": "Vault-Backed Secret Storage", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
479
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IA-5.13", "SP800-53-PS-1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.4.5", "ASVS-REQ-V13.3.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-14.1"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a6"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-003", "v1_entity_name": "Secret Rotation And Renewal Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
480
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-4.12"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.8.1", "ASVS-REQ-V6.8.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.1", "PCI-4.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-196"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-004", "v1_entity_name": "Operational Identity Binding And OIDC Use", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
481
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-17.6", "SP800-53-AC-20"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-22", "CAPEC-36"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0013", "AML.TA0010"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1104", "CWE-1220"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 07, Cap. 08, Cap. 11", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-005", "v1_entity_name": "Secret Isolation Across Technical Surfaces", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
482
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-4.20"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1", "NIST-AI-RMF-GOVERN-1.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-2.2.1"]}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 00, Cap. 05, Cap. 07, Cap. 13, Cap. 14", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-006", "v1_entity_name": "Secret Configuration Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
446
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_resolution": {"authored_more_sources_count": 15, "authored_visible_source_count": 4, "resolved_ref_count": 127, "resolved_source_count": 17, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AC-13"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.5", "ASVS-REQ-V1.2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-14", "CAPEC-24"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_3_A"]}], "es_grounding_sources_full": [{"claim_count": 16, "ref_count": 16, "refs": ["ASVS-REQ-V1.1.1", "ASVS-REQ-V1.2.5", "ASVS-REQ-V1.2.6", "ASVS-REQ-V1.3.11", "ASVS-REQ-V1.3.6", "ASVS-REQ-V1.4.1", "ASVS-REQ-V1.4.3", "ASVS-REQ-V15.2.3", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.4.3", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.5.3", "ASVS-REQ-V2.4.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 17, "ref_count": 16, "refs": ["CAPEC-100", "CAPEC-135", "CAPEC-14", "CAPEC-153", "CAPEC-215", "CAPEC-24", "CAPEC-242", "CAPEC-54", "CAPEC-586", "CAPEC-66", "CAPEC-680", "CAPEC-700", "CAPEC-76", "CAPEC-77", "CAPEC-80", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 12, "ref_count": 12, "refs": ["CIS-16.1", "CIS-16.12", "CIS-16.2", "CIS-16.6", "CIS-16.9", "CIS-3.1", "CIS-3.2", "CIS-3.7", "CIS-3.8", "CIS-6.6", "CIS-7.1", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-1085", "CWE-115", "CWE-391", "CWE-94"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 42, "ref_count": 35, "refs": ["SP800-53-AC-13", "SP800-53-AC-4.9", "SP800-53-AU-2.3", "SP800-53-CM-3", "SP800-53-CM-3.7", "SP800-53-CM-5.2", "SP800-53-CM-7.1", "SP800-53-PM-14", "SP800-53-PM-28", "SP800-53-RA-3", "SP800-53-RA-5", "SP800-53-RA-5.2", "SP800-53-RA-5.8", "SP800-53-SA-11.4", "SP800-53-SA-11.6", "SP800-53-SA-11.8", "SP800-53-SA-11.9", "SP800-53-SC-18.1", "SP800-53-SC-7.24", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-10.4", "SP800-53-SI-10.6", "SP800-53-SI-2", "SP800-53-SI-2.7", "SP800-53-SI-3.10", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.8", "SP800-53-SI-6.1", "SP800-53-SI-6.3", "SP800-53-SI-7.13", "SP800-53-SI-9", "SP800-53-SR-6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-CONTINUOUS-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C10", "OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 17, "ref_count": 14, "refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_AA_3_B", "SAMM-ACTIVITY-V_RT_1_B", "SAMM-ACTIVITY-V_RT_2_B", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-10.4.1", "PCI-6.2.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-OPS-2", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-DATA-HANDLING", "SCFPSSD-TESTING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-TESTING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 10, "ref_count": 10, "refs": ["SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PW.5", "SSDF-PRACTICE-PW.7", "SSDF-PRACTICE-RV.3", "SSDF-TASK-PW.5.1", "SSDF-TASK-PW.7.1", "SSDF-TASK-PW.7.2", "SSDF-TASK-PW.8.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-001", "v1_entity_name": "Code Review For Input And Error Discipline", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
447
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 67, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0010.001", "AML.T0020"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-15", "CAPEC-35"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-183", "CWE-184"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.1", "SP800-53-AC-4.6"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V1.3.12", "ASVS-REQ-V1.3.5", "ASVS-REQ-V1.3.7", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.1.4", "ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 16, "ref_count": 16, "refs": ["CAPEC-139", "CAPEC-15", "CAPEC-191", "CAPEC-197", "CAPEC-199", "CAPEC-229", "CAPEC-243", "CAPEC-35", "CAPEC-38", "CAPEC-491", "CAPEC-492", "CAPEC-51", "CAPEC-671", "CAPEC-673", "CAPEC-691", "CAPEC-71"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-10", "CIS-2.6", "CIS-3.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 10, "ref_count": 10, "refs": ["CWE-183", "CWE-184", "CWE-186", "CWE-434", "CWE-547", "CWE-624", "CWE-625", "CWE-829", "CWE-91", "CWE-917"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 10, "ref_count": 10, "refs": ["SP800-53-AC-4.1", "SP800-53-AC-4.14", "SP800-53-AC-4.28", "SP800-53-AC-4.6", "SP800-53-CM-8.3", "SP800-53-IA-5.1", "SP800-53-PE-6.2", "SP800-53-RA-5.7", "SP800-53-SC-34", "SP800-53-SI-4.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-EE68331F9B1D4F61844BB2EA04753A84", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F4FF841D3B2A45D9853E5EC7ECBCB054"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 12, "ref_count": 7, "refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCI-2.2.6", "PCI-6.3.3", "PCI-7.3.3", "PCI-8.3.2", "PCI-8.5.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-8.1", "PCISSLC-8.2", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PO.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-002", "v1_entity_name": "Static Rulepacks And Security Linters", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
448
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 32, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.1.1", "ASVS-REQ-V2.1.2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-9.3", "SP800-53-SA-10.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-95", "CAPEC-146"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-112", "CWE-353"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["ASVS-REQ-V2.1.1", "ASVS-REQ-V2.1.2", "ASVS-REQ-V2.1.3", "ASVS-REQ-V2.2.3", "ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.2", "ASVS-REQ-V2.3.3", "ASVS-REQ-V2.3.5", "ASVS-REQ-V2.4.2", "ASVS-REQ-V8.1.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 6, "ref_count": 6, "refs": ["CAPEC-146", "CAPEC-218", "CAPEC-231", "CAPEC-271", "CAPEC-277", "CAPEC-95"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-3.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-112", "CWE-353", "CWE-354", "CWE-501"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-SA-10.1", "SP800-53-SA-12.10", "SP800-53-SA-19", "SP800-53-SA-9.3", "SP800-53-SI-18.2", "SP800-53-SR-4", "SP800-53-SR-4.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-017D9E2642B549A4B9459F59B308FB99"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C5"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.2"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-003", "v1_entity_name": "Schema And Contract Validators", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
449
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_resolution": {"authored_more_sources_count": 11, "authored_visible_source_count": 4, "resolved_ref_count": 157, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-1.1.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2", "CIS-4.9"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-994151396B50441B89E10AA59ACCD43D", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}], "es_grounding_sources_full": [{"claim_count": 11, "ref_count": 10, "refs": ["CAPEC-12", "CAPEC-187", "CAPEC-384", "CAPEC-385", "CAPEC-439", "CAPEC-571", "CAPEC-61", "CAPEC-669", "CAPEC-678", "CAPEC-695"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 22, "ref_count": 19, "refs": ["CIS-11.4", "CIS-12", "CIS-12.3", "CIS-12.5", "CIS-13.1", "CIS-13.5", "CIS-2", "CIS-4.9", "CIS-6.7", "CIS-7", "CIS-7.1", "CIS-7.2", "CIS-7.3", "CIS-7.4", "CIS-8.1", "CIS-8.4", "CIS-8.9", "CIS-9.1", "CIS-9.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 85, "ref_count": 69, "refs": ["SP800-53-AC-1", "SP800-53-AC-2.4", "SP800-53-AC-4.24", "SP800-53-AU-1", "SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-15", "SP800-53-AU-3.2", "SP800-53-AU-5.5", "SP800-53-AU-6.3", "SP800-53-CA-1", "SP800-53-CA-5", "SP800-53-CA-7.5", "SP800-53-CA-9", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-10.1", "SP800-53-CM-11", "SP800-53-CM-13", "SP800-53-CM-2", "SP800-53-CM-2.3", "SP800-53-CM-2.5", "SP800-53-CM-3", "SP800-53-CM-3.1", "SP800-53-CM-3.2", "SP800-53-CM-3.3", "SP800-53-CM-3.8", "SP800-53-CM-4", "SP800-53-CM-5.4", "SP800-53-CM-6", "SP800-53-CM-6.4", "SP800-53-CM-7", "SP800-53-CM-7.5", "SP800-53-CM-8", "SP800-53-CM-8.2", "SP800-53-CM-8.7", "SP800-53-IA-5.14", "SP800-53-MA-1", "SP800-53-MA-2", "SP800-53-MA-3.4", "SP800-53-MA-3.6", "SP800-53-MA-4", "SP800-53-MA-4.3", "SP800-53-MA-4.4", "SP800-53-PL-9", "SP800-53-PM-25", "SP800-53-PM-30.1", "SP800-53-PM-4", "SP800-53-PM-5.1", "SP800-53-PT-1", "SP800-53-SA-10", "SP800-53-SA-10.5", "SP800-53-SA-10.6", "SP800-53-SC-1", "SP800-53-SC-2.2", "SP800-53-SC-22", "SP800-53-SC-3.4", "SP800-53-SC-36", "SP800-53-SI-1", "SP800-53-SI-13.1", "SP800-53-SI-13.3", "SP800-53-SI-13.5", "SP800-53-SI-2.1", "SP800-53-SI-2.4", "SP800-53-SI-3.1", "SP800-53-SI-4", "SP800-53-SI-8", "SP800-53-SI-8.1", "SP800-53-SR-11.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 12, "ref_count": 12, "refs": ["DSOMM-ACTIVITY-066084C6113546359CC59E75C7C5459F", "DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514", "DSOMM-ACTIVITY-994151396B50441B89E10AA59ACCD43D", "DSOMM-ACTIVITY-CF0D600E114D48879059D81C53805F0D", "DSOMM-ACTIVITY-E5386ABF91544752A1A8C3A8900F732D", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1", "DSOMM-ACTIVITY-F2594F8F1CD645F9AF29EAF3315698EB", "DSOMM-ACTIVITY-F8E80F1825034E3EB3BC7F67BB28DEFE", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 16, "ref_count": 12, "refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_2_A", "SAMM-ACTIVITY-O_EM_2_B", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_B", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 20, "ref_count": 20, "refs": ["PCI-1.1.1", "PCI-1.1.2", "PCI-1.2.2", "PCI-1.2.4", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.4.2", "PCI-11.5.2", "PCI-11.6.1", "PCI-2.2.3", "PCI-2.2.5", "PCI-5.1.2", "PCI-5.3.1", "PCI-6.5.1", "PCI-7.1.1", "PCI-7.1.2", "PCI-7.2.6", "PCI-9.1.1", "PCI-9.1.2", "PCI-REQ-1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-OPS-1", "SCAGILE-OPS-5", "SCAGILE-OPS-6"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-MITIGATIONS", "SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 5, "ref_count": 5, "refs": ["SSDF-PRACTICE-PS.3", "SSDF-TASK-PO.1.3", "SSDF-TASK-PO.3.2", "SSDF-TASK-PW.1.3", "SSDF-TASK-RV.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "⚠️ future-work (P8 §10)", "manual_v2_anchor": "Mechanism", "methodology_label": "Gap", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-004", "v1_entity_name": "Centralized Error Translation And Redaction", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
450
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 0, "resolved_source_count": 0, "status": "entity_absent_in_substrate_index", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-18", "CAPEC-19"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.1.2", "ASVS-REQ-V1.2.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1021", "CWE-838"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0077"]}], "es_grounding_sources_full": [], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (html, json, output kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-IVF-005", "v1_entity_name": "Context-Aware Encoder Selection And Application", "v1_entity_type": "Mechanism", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
451
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 16, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-20", "SP800-53-AC-20.1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.1.1", "ASVS-REQ-V2.2.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1284", "CWE-1286"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM02-2025", "LLM10-2025"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V12.2.2", "ASVS-REQ-V2.1.1", "ASVS-REQ-V2.2.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-15.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-1284"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 9, "ref_count": 8, "refs": ["SP800-53-AC-20", "SP800-53-AC-20.1", "SP800-53-CA-3.5", "SP800-53-IA-5.16", "SP800-53-IA-8.2", "SP800-53-PS-7", "SP800-53-SA-9", "SP800-53-SC-35"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C5"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-11.4.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING-CONTRACT"], "substrate_source_key": "safecode_sic_2010"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-001", "v1_entity_name": "External Input Contract Validation", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
452
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 29, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.11", "SP800-53-AC-4.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-13", "CAPEC-80"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1056", "CWE-1070"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.5", "CIS-2.6"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 7, "ref_count": 7, "refs": ["CAPEC-146", "CAPEC-197", "CAPEC-231", "CAPEC-271", "CAPEC-698", "CAPEC-80", "CAPEC-95"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-2.5", "CIS-2.6", "CIS-3.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-1056", "CWE-1070", "CWE-1117", "CWE-915"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 11, "ref_count": 11, "refs": ["SP800-53-AC-16.10", "SP800-53-AC-16.5", "SP800-53-AC-24.1", "SP800-53-AC-3.11", "SP800-53-AC-4.1", "SP800-53-AC-4.14", "SP800-53-AC-4.5", "SP800-53-AC-4.6", "SP800-53-CM-7", "SP800-53-IA-5.1", "SP800-53-SI-12.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-PROMPT-INJECTION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_SA_2_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-002", "v1_entity_name": "Schema, Type And Allowlist Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
453
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 67, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-3", "CAPEC-6"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-115", "CWE-186"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.2.7"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0051", "AML.T0051.000"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.2.7", "ASVS-REQ-V1.2.8", "ASVS-REQ-V1.3.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 51, "ref_count": 50, "refs": ["CAPEC-101", "CAPEC-104", "CAPEC-109", "CAPEC-110", "CAPEC-120", "CAPEC-126", "CAPEC-134", "CAPEC-135", "CAPEC-136", "CAPEC-137", "CAPEC-138", "CAPEC-139", "CAPEC-140", "CAPEC-165", "CAPEC-174", "CAPEC-175", "CAPEC-182", "CAPEC-183", "CAPEC-199", "CAPEC-200", "CAPEC-23", "CAPEC-230", "CAPEC-231", "CAPEC-237", "CAPEC-243", "CAPEC-245", "CAPEC-247", "CAPEC-248", "CAPEC-250", "CAPEC-274", "CAPEC-3", "CAPEC-32", "CAPEC-40", "CAPEC-460", "CAPEC-554", "CAPEC-591", "CAPEC-597", "CAPEC-6", "CAPEC-64", "CAPEC-66", "CAPEC-676", "CAPEC-7", "CAPEC-71", "CAPEC-73", "CAPEC-76", "CAPEC-78", "CAPEC-79", "CAPEC-83", "CAPEC-84", "CAPEC-88"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 8, "refs": ["CWE-186", "CWE-470", "CWE-624", "CWE-749", "CWE-89", "CWE-91", "CWE-917", "CWE-94"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-SC-41"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-00E91A8A397246928679674AB8547486"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP06-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C4"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A03-2021"], "substrate_source_key": "owasp_top_10_2021"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-003", "v1_entity_name": "Injection-Resistant Input Handling And Dangerous Pattern Exclusion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
454
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 13, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.19", "SP800-53-CA-3.6"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-18.4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-346", "CWE-349"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.3", "ASVS-REQ-V2.3.5", "ASVS-REQ-V2.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-3.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-346", "CWE-349"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SP800-53-AC-4.19", "SP800-53-CA-3.6", "SP800-53-CA-3.7", "SP800-53-SA-13", "SP800-53-SR-5.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-1.4.2"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-004", "v1_entity_name": "Validation Before Internal Use And Trust Crossing", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
455
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 17, "es_grounding_resolution": {"authored_more_sources_count": 17, "authored_visible_source_count": 4, "resolved_ref_count": 153, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-8"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1058", "CWE-1073"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-1.2.3"]}], "es_grounding_sources_full": [{"claim_count": 11, "ref_count": 11, "refs": ["ASVS-REQ-V11.2.5", "ASVS-REQ-V13.1.3", "ASVS-REQ-V14.2.2", "ASVS-REQ-V15.1.3", "ASVS-REQ-V15.2.2", "ASVS-REQ-V15.4.4", "ASVS-REQ-V16.5.2", "ASVS-REQ-V17.3.2", "ASVS-REQ-V3.1.1", "ASVS-REQ-V4.2.5", "ASVS-REQ-V6.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 34, "ref_count": 34, "refs": ["CAPEC-122", "CAPEC-124", "CAPEC-131", "CAPEC-147", "CAPEC-166", "CAPEC-180", "CAPEC-187", "CAPEC-2", "CAPEC-202", "CAPEC-207", "CAPEC-22", "CAPEC-220", "CAPEC-227", "CAPEC-25", "CAPEC-263", "CAPEC-278", "CAPEC-329", "CAPEC-330", "CAPEC-384", "CAPEC-389", "CAPEC-44", "CAPEC-482", "CAPEC-528", "CAPEC-533", "CAPEC-548", "CAPEC-57", "CAPEC-61", "CAPEC-657", "CAPEC-662", "CAPEC-663", "CAPEC-679", "CAPEC-701", "CAPEC-74", "CAPEC-80"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-16", "CIS-9.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 24, "ref_count": 24, "refs": ["CWE-1058", "CWE-1073", "CWE-1118", "CWE-1127", "CWE-1341", "CWE-209", "CWE-250", "CWE-274", "CWE-280", "CWE-294", "CWE-305", "CWE-307", "CWE-366", "CWE-390", "CWE-391", "CWE-455", "CWE-488", "CWE-497", "CWE-603", "CWE-617", "CWE-763", "CWE-841", "CWE-924", "CWE-940"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-AUTH-ERROR-HANDLING"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 37, "ref_count": 36, "refs": ["SP800-53-AC-17.2", "SP800-53-AC-17.6", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.9", "SP800-53-AC-4.3", "SP800-53-AC-4.31", "SP800-53-AC-4.4", "SP800-53-AC-7", "SP800-53-CM-4.2", "SP800-53-IA-6", "SP800-53-MA-4.6", "SP800-53-SA-12.15", "SP800-53-SA-8.16", "SP800-53-SA-8.24", "SP800-53-SA-8.26", "SP800-53-SC-12.1", "SP800-53-SC-15", "SP800-53-SC-18.3", "SP800-53-SC-23", "SP800-53-SC-24", "SP800-53-SC-30.4", "SP800-53-SC-36.1", "SP800-53-SC-4", "SP800-53-SC-5.2", "SP800-53-SC-7.18", "SP800-53-SC-7.23", "SP800-53-SC-7.24", "SP800-53-SC-7.6", "SP800-53-SI-13", "SP800-53-SI-13.5", "SP800-53-SI-16", "SP800-53-SI-17", "SP800-53-SI-4", "SP800-53-SI-6.1", "SP800-53-SI-7.16"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 9, "ref_count": 9, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-07FE8C4FAE334409B1B2CF64CFCCEA86", "DSOMM-ACTIVITY-27337442E4B14E878DC9CE86FBB79A39", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-760F1056B0EE4F22A35BF65446F944CA", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-E5386ABF91544752A1A8C3A8900F732D", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["OWASP-MCP-3P-AUTH-AUTHZ-REGISTRATION", "OWASP-MCP-3P-TOOL-POISONING", "OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["MCP02-2025", "MCP07-2025", "MCP10-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 7, "ref_count": 4, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["TOP10-A01-2021", "TOP10-A07-2021", "TOP10-A10-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 13, "ref_count": 13, "refs": ["PCI-1.2.2", "PCI-1.2.3", "PCI-10.7.2", "PCI-10.7.3", "PCI-11.6.1", "PCI-2.2.5", "PCI-5.2.3", "PCI-6.4.1", "PCI-6.4.2", "PCI-7.2.2", "PCI-7.3.1", "PCI-7.3.2", "PCI-8.3.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCISSLC-2.6", "PCISSLC-3.2", "PCISSLC-3.3", "PCISSLC-3.4", "PCISSLC-4.2", "PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-OPS-12", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-005", "v1_entity_name": "Controlled Failure And Non-Revealing Client Error Surface", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
456
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 114, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.24", "SP800-53-AU-1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.14", "CIS-4.9"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_EG_2_B"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 10, "refs": ["ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.2", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.2.4", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.3.1", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.4.2", "ASVS-REQ-V16.4.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-268", "CAPEC-571", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 16, "ref_count": 12, "refs": ["CIS-12.3", "CIS-12.5", "CIS-13.1", "CIS-17.1", "CIS-3.14", "CIS-4.9", "CIS-7", "CIS-8", "CIS-8.1", "CIS-8.3", "CIS-8.4", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-779"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 66, "ref_count": 53, "refs": ["SP800-53-AC-4.24", "SP800-53-AU-1", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-3.2", "SP800-53-AU-4", "SP800-53-AU-4.1", "SP800-53-AU-5", "SP800-53-AU-5.3", "SP800-53-AU-5.4", "SP800-53-AU-5.5", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.3", "SP800-53-AU-6.4", "SP800-53-AU-9.2", "SP800-53-AU-9.4", "SP800-53-CM-11", "SP800-53-CM-11.3", "SP800-53-CM-2.2", "SP800-53-CM-5.1", "SP800-53-CM-5.4", "SP800-53-CM-6", "SP800-53-CM-8", "SP800-53-CM-8.2", "SP800-53-CM-8.7", "SP800-53-MA-4", "SP800-53-MA-4.1", "SP800-53-MA-4.3", "SP800-53-SA-10", "SP800-53-SA-10.5", "SP800-53-SA-15.13", "SP800-53-SA-8.22", "SP800-53-SC-22", "SP800-53-SI-1", "SP800-53-SI-11", "SP800-53-SI-2", "SP800-53-SI-2.1", "SP800-53-SI-3.1", "SP800-53-SI-4", "SP800-53-SI-4.16", "SP800-53-SI-4.20", "SP800-53-SI-5", "SP800-53-SI-5.1", "SP800-53-SI-6.2", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.5", "SP800-53-SI-8.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 8, "ref_count": 8, "refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-9E3A7C2F1B4D4E8AA5C67F2B9D1E3A8C", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-CE970C9BDA9441CFBD788C15357B7E8E", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 12, "ref_count": 10, "refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCI-1.2.4", "PCI-10.3.4", "PCI-10.4.1", "PCI-10.4.2", "PCI-10.5.1", "PCI-2.2.3", "PCI-5.3.4", "PCI-9.3.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-1"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-IAM", "SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-006", "v1_entity_name": "Centralized Error Handling And Sensitive Error Logging Hygiene", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
457
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 61, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PE-5", "SP800-53-SC-7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-16.1", "CIS-16.8"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-522", "CAPEC-624"]}, {"source_display_name": "OWASP ML Top 10", "substrate_source": "owasp_ml_top_10", "visible_refs": ["ML02-2023", "ML09-2023"]}], "es_grounding_sources_full": [{"claim_count": 12, "ref_count": 12, "refs": ["ASVS-REQ-V1.1.1", "ASVS-REQ-V1.2.6", "ASVS-REQ-V1.3.11", "ASVS-REQ-V1.3.7", "ASVS-REQ-V1.4.2", "ASVS-REQ-V1.5.1", "ASVS-REQ-V1.5.2", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.3.5", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["CAPEC-267", "CAPEC-443", "CAPEC-522", "CAPEC-539", "CAPEC-558", "CAPEC-624", "CAPEC-625", "CAPEC-671", "CAPEC-673", "CAPEC-674"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 12, "ref_count": 6, "refs": ["CIS-16.1", "CIS-16.2", "CIS-16.5", "CIS-16.6", "CIS-16.8", "CIS-16.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["CWE-1173", "CWE-1289", "CWE-649", "CWE-829"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 10, "ref_count": 10, "refs": ["SP800-53-AC-4.2", "SP800-53-PE-3.4", "SP800-53-SA-10.3", "SP800-53-SI-10.2", "SP800-53-SI-10.6", "SP800-53-SI-19.7", "SP800-53-SI-7.12", "SP800-53-SI-7.13", "SP800-53-SI-7.4", "SP800-53-SI-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-2B7CC923BDAF43E38FB4A995B7783969", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP03-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 9, "ref_count": 6, "refs": ["SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_B", "SAMM-ACTIVITY-V_ST_1_A", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-2"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 4, "ref_count": 3, "refs": ["SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.7"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-007", "v1_entity_name": "Input Validation And Safe Failure Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
458
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 0, "resolved_source_count": 0, "status": "entity_absent_in_substrate_index", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-18", "CAPEC-19"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.1", "ASVS-REQ-V1.2.2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1021", "CWE-79"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0077"]}], "es_grounding_sources_full": [], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-IVF-008", "v1_entity_name": "Context-Aware Output Encoding And Rendering Safety", "v1_entity_type": "ControlObjective", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
459
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 13, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1173", "CWE-1284"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.1.1", "ASVS-REQ-V2.2.2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SI-10", "SP800-53-SI-10.2"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM02-2025", "LLM10-2025"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V1.1.1", "ASVS-REQ-V2.2.2", "ASVS-REQ-V4.2.3", "ASVS-REQ-V4.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 6, "ref_count": 6, "refs": ["CWE-1173", "CWE-1284", "CWE-1285", "CWE-1286", "CWE-1287", "CWE-1288"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-SI-10", "SP800-53-SI-10.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C5"], "substrate_source_key": "owasp_proactive_controls_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-001", "v1_entity_name": "Boundary Input Validation", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
460
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 122, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3", "SP800-53-AC-3.8"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.6", "ASVS-REQ-V1.5.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-8", "PCI-REQ-9"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-13", "CAPEC-58"]}], "es_grounding_sources_full": [{"claim_count": 23, "ref_count": 23, "refs": ["ASVS-REQ-V1.2.6", "ASVS-REQ-V1.5.1", "ASVS-REQ-V1.5.2", "ASVS-REQ-V1.5.3", "ASVS-REQ-V11.2.1", "ASVS-REQ-V13.2.4", "ASVS-REQ-V14.1.1", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.3.1", "ASVS-REQ-V15.3.5", "ASVS-REQ-V15.4.2", "ASVS-REQ-V2.3.2", "ASVS-REQ-V4.1.5", "ASVS-REQ-V4.3.1", "ASVS-REQ-V6.1.2", "ASVS-REQ-V8.1.1", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.1", "ASVS-REQ-V8.2.2", "ASVS-REQ-V8.2.3", "ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 12, "ref_count": 12, "refs": ["CAPEC-13", "CAPEC-146", "CAPEC-231", "CAPEC-271", "CAPEC-277", "CAPEC-279", "CAPEC-477", "CAPEC-491", "CAPEC-58", "CAPEC-698", "CAPEC-80", "CAPEC-95"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-2.5", "CIS-2.6", "CIS-2.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 8, "ref_count": 8, "refs": ["CWE-1070", "CWE-112", "CWE-1230", "CWE-201", "CWE-353", "CWE-358", "CWE-501", "CWE-502"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 35, "ref_count": 34, "refs": ["SP800-53-AC-16", "SP800-53-AC-16.10", "SP800-53-AC-16.3", "SP800-53-AC-16.4", "SP800-53-AC-16.9", "SP800-53-AC-22", "SP800-53-AC-3", "SP800-53-AC-3.11", "SP800-53-AC-3.8", "SP800-53-AC-4.1", "SP800-53-AC-4.14", "SP800-53-AC-4.19", "SP800-53-AC-4.28", "SP800-53-AC-4.29", "SP800-53-AC-4.5", "SP800-53-AC-4.6", "SP800-53-AU-3.3", "SP800-53-CM-10", "SP800-53-IA-1", "SP800-53-IA-5.1", "SP800-53-IA-8.2", "SP800-53-PE-8.3", "SP800-53-PS-6.2", "SP800-53-SA-8.15", "SP800-53-SA-8.20", "SP800-53-SC-16.1", "SP800-53-SC-7.11", "SP800-53-SC-7.17", "SP800-53-SI-10.1", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-12.1", "SP800-53-SI-19.4", "SP800-53-SI-4.6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-6DF508EF86FC4C22BD9F646C3127CE7D", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-PROMPT-INJECTION", "OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 16, "ref_count": 10, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 20, "ref_count": 19, "refs": ["PCI-1.2.5", "PCI-1.4.1", "PCI-12.5.1", "PCI-3.7.3", "PCI-3.7.4", "PCI-4.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.6", "PCI-7.3.1", "PCI-7.3.3", "PCI-8.2.4", "PCI-8.3.2", "PCI-8.5.1", "PCI-9.3.1", "PCI-9.3.2", "PCI-9.4.4", "PCI-REQ-8", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-6.1", "PCISSLC-6.2", "PCISSLC-8.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-BUILD-L1"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PW.7"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (accepted, allowlist, enforcement kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-002", "v1_entity_name": "Schema And Allowlist Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
461
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 63, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-6", "CAPEC-7"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-115", "CWE-184"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-2.3.3", "NIST-AI-100-2-E2025-3.2.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.8", "ASVS-REQ-V1.2.9"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["ASVS-REQ-V1.2.8", "ASVS-REQ-V1.2.9", "ASVS-REQ-V1.3.12", "ASVS-REQ-V1.3.2", "ASVS-REQ-V1.3.5", "ASVS-REQ-V1.3.7", "ASVS-REQ-V15.3.6"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 39, "ref_count": 39, "refs": ["CAPEC-101", "CAPEC-104", "CAPEC-135", "CAPEC-139", "CAPEC-140", "CAPEC-170", "CAPEC-198", "CAPEC-199", "CAPEC-200", "CAPEC-230", "CAPEC-231", "CAPEC-237", "CAPEC-242", "CAPEC-243", "CAPEC-245", "CAPEC-247", "CAPEC-248", "CAPEC-250", "CAPEC-274", "CAPEC-28", "CAPEC-32", "CAPEC-390", "CAPEC-43", "CAPEC-46", "CAPEC-468", "CAPEC-472", "CAPEC-492", "CAPEC-554", "CAPEC-586", "CAPEC-591", "CAPEC-6", "CAPEC-640", "CAPEC-66", "CAPEC-7", "CAPEC-73", "CAPEC-76", "CAPEC-85", "CAPEC-86", "CAPEC-88"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 9, "ref_count": 9, "refs": ["CWE-115", "CWE-184", "CWE-186", "CWE-242", "CWE-470", "CWE-624", "CWE-676", "CWE-749", "CWE-94"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-D17DBFF01F10492AB4C717BB59A0A711", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-E1F37ABBD8484A3AB3DF65E91A89DCB7"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP06-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C4"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_TA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A03-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-003", "v1_entity_name": "Dangerous Pattern Exclusion", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
462
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 70, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-3.6", "SP800-53-CA-7.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1.1", "CIS-3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.3", "ASVS-REQ-V2.3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_3_A"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["ASVS-REQ-V11.7.2", "ASVS-REQ-V14.2.7", "ASVS-REQ-V2.2.3", "ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.3", "ASVS-REQ-V2.3.5", "ASVS-REQ-V2.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 31, "ref_count": 18, "refs": ["CIS-1.1", "CIS-11", "CIS-11.1", "CIS-11.2", "CIS-12.1", "CIS-14.4", "CIS-15", "CIS-15.2", "CIS-16.5", "CIS-3", "CIS-3.1", "CIS-3.12", "CIS-3.13", "CIS-3.2", "CIS-3.4", "CIS-3.5", "CIS-3.7", "CIS-3.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-348", "CWE-454"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 4, "ref_count": 3, "refs": ["GDPR-ART-32", "GDPR-ART-35", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 28, "ref_count": 27, "refs": ["SP800-53-CA-3.6", "SP800-53-CA-7.4", "SP800-53-CP-7.4", "SP800-53-IA-12.4", "SP800-53-PM-25", "SP800-53-RA-3", "SP800-53-SA-12.10", "SP800-53-SA-12.7", "SP800-53-SA-13", "SP800-53-SA-15.9", "SP800-53-SA-21.1", "SP800-53-SA-3.2", "SP800-53-SA-4.12", "SP800-53-SA-9.1", "SP800-53-SA-9.3", "SP800-53-SI-12", "SP800-53-SI-12.2", "SP800-53-SI-18", "SP800-53-SI-18.2", "SP800-53-SI-19", "SP800-53-SI-4.19", "SP800-53-SR-4", "SP800-53-SR-4.3", "SP800-53-SR-4.4", "SP800-53-SR-5", "SP800-53-SR-5.2", "SP800-53-SR-9.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DATA-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 8, "ref_count": 7, "refs": ["SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A02-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-6.5.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-RV.1", "SSDF-PRACTICE-RV.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-004", "v1_entity_name": "Pre-Use Data Validation Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
463
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 18, "es_grounding_resolution": {"authored_more_sources_count": 18, "authored_visible_source_count": 4, "resolved_ref_count": 227, "resolved_source_count": 19, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-1.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-12", "CAPEC-22"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1073", "CWE-1084"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V15.3.4", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.2", "ASVS-REQ-V6.1.1", "ASVS-REQ-V8.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 20, "ref_count": 20, "refs": ["CAPEC-12", "CAPEC-131", "CAPEC-180", "CAPEC-187", "CAPEC-207", "CAPEC-212", "CAPEC-22", "CAPEC-330", "CAPEC-36", "CAPEC-384", "CAPEC-524", "CAPEC-537", "CAPEC-54", "CAPEC-575", "CAPEC-680", "CAPEC-681", "CAPEC-682", "CAPEC-702", "CAPEC-74", "CAPEC-80"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 6, "refs": ["CIS-13.5", "CIS-13.9", "CIS-16", "CIS-17.9", "CIS-4.11", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 20, "ref_count": 20, "refs": ["CWE-1073", "CWE-1084", "CWE-1118", "CWE-1220", "CWE-193", "CWE-209", "CWE-213", "CWE-223", "CWE-250", "CWE-274", "CWE-294", "CWE-312", "CWE-360", "CWE-390", "CWE-455", "CWE-488", "CWE-497", "CWE-656", "CWE-695", "CWE-924"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 6, "ref_count": 5, "refs": ["HIPAA-164-308a6", "HIPAA-164-310a1", "HIPAA-164-310b", "HIPAA-164-312a1", "HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 136, "ref_count": 123, "refs": ["SP800-53-AC-1", "SP800-53-AC-14.1", "SP800-53-AC-17.1", "SP800-53-AC-17.2", "SP800-53-AC-17.6", "SP800-53-AC-17.7", "SP800-53-AC-18.3", "SP800-53-AC-2", "SP800-53-AC-20", "SP800-53-AC-24.2", "SP800-53-AC-25", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.9", "SP800-53-AC-4.15", "SP800-53-AC-4.3", "SP800-53-AC-4.31", "SP800-53-AC-4.4", "SP800-53-AC-4.7", "SP800-53-AC-8", "SP800-53-AU-5.3", "SP800-53-AU-9", "SP800-53-AU-9.1", "SP800-53-CA-9", "SP800-53-CM-3.6", "SP800-53-CM-4.2", "SP800-53-CP-10.3", "SP800-53-CP-7.5", "SP800-53-CP-9.4", "SP800-53-IA-6", "SP800-53-IR-4.5", "SP800-53-IR-9.4", "SP800-53-MA-4", "SP800-53-MA-4.4", "SP800-53-MA-4.6", "SP800-53-MA-5.1", "SP800-53-MP-5.1", "SP800-53-MP-6.4", "SP800-53-MP-6.8", "SP800-53-MP-8.3", "SP800-53-PE-16", "SP800-53-PE-19", "SP800-53-PE-5", "SP800-53-PL-2", "SP800-53-PL-8.1", "SP800-53-PM-1", "SP800-53-RA-10", "SP800-53-RA-5", "SP800-53-RA-5.11", "SP800-53-SA-10", "SP800-53-SA-11.6", "SP800-53-SA-15.5", "SP800-53-SA-17.4", "SP800-53-SA-18", "SP800-53-SA-4.2", "SP800-53-SA-5.1", "SP800-53-SA-8.11", "SP800-53-SA-8.12", "SP800-53-SA-8.16", "SP800-53-SA-8.24", "SP800-53-SA-8.26", "SP800-53-SA-8.29", "SP800-53-SA-8.30", "SP800-53-SC-1", "SP800-53-SC-12.1", "SP800-53-SC-12.6", "SP800-53-SC-14", "SP800-53-SC-15", "SP800-53-SC-15.3", "SP800-53-SC-2.1", "SP800-53-SC-2.2", "SP800-53-SC-23", "SP800-53-SC-23.2", "SP800-53-SC-24", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.5", "SP800-53-SC-30.4", "SP800-53-SC-31.1", "SP800-53-SC-34.3", "SP800-53-SC-36.1", "SP800-53-SC-38", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-47", "SP800-53-SC-49", "SP800-53-SC-5", "SP800-53-SC-5.1", "SP800-53-SC-5.2", "SP800-53-SC-51", "SP800-53-SC-7", "SP800-53-SC-7.13", "SP800-53-SC-7.14", "SP800-53-SC-7.16", "SP800-53-SC-7.18", "SP800-53-SC-7.19", "SP800-53-SC-7.21", "SP800-53-SC-7.23", "SP800-53-SC-7.24", "SP800-53-SC-7.4", "SP800-53-SC-7.6", "SP800-53-SC-7.7", "SP800-53-SC-8.3", "SP800-53-SC-8.4", "SP800-53-SI-1", "SP800-53-SI-10.4", "SP800-53-SI-11", "SP800-53-SI-13.5", "SP800-53-SI-16", "SP800-53-SI-17", "SP800-53-SI-2.2", "SP800-53-SI-3.9", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.23", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-5", "SP800-53-SI-5.1", "SP800-53-SI-7.17", "SP800-53-SI-7.6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-E5386ABF91544752A1A8C3A8900F732D", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP02-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 6, "ref_count": 4, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-V_RT_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A01-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 21, "ref_count": 21, "refs": ["PCI-1.1.1", "PCI-1.2.2", "PCI-1.2.3", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.7.2", "PCI-10.7.3", "PCI-11.1.1", "PCI-11.5.2", "PCI-11.6.1", "PCI-12.10.5", "PCI-5.1.1", "PCI-5.2.3", "PCI-6.2.3", "PCI-6.5.1", "PCI-7.3.2", "PCI-8.1.1", "PCI-9.1.1", "PCI-9.2.2", "PCI-9.2.4", "PCI-REQ-1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCISSLC-2.6", "PCISSLC-3.2", "PCISSLC-3.3", "PCISSLC-3.4", "PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-SECURITY-CONTROLS", "SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEVELOPMENT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-TASK-PO.5.2", "SSDF-TASK-PW.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-005", "v1_entity_name": "Non-Revealing Error Surface Control", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
464
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 51, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-8.1", "CIS-8.3"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 4, "refs": ["CIS-13.1", "CIS-8.1", "CIS-8.3", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 30, "ref_count": 28, "refs": ["SP800-53-AU-1", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-12.3", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-2.3", "SP800-53-AU-3.2", "SP800-53-AU-4", "SP800-53-AU-5", "SP800-53-AU-5.4", "SP800-53-AU-5.5", "SP800-53-AU-6.1", "SP800-53-AU-6.4", "SP800-53-CM-1", "SP800-53-CM-2.2", "SP800-53-CM-8.2", "SP800-53-MA-4.1", "SP800-53-PL-9", "SP800-53-PM-23", "SP800-53-RA-5", "SP800-53-SA-15.13", "SP800-53-SI-2.1", "SP800-53-SI-3.1", "SP800-53-SI-4", "SP800-53-SI-7.2", "SP800-53-SI-8.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-CE970C9BDA9441CFBD788C15357B7E8E", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 14, "ref_count": 10, "refs": ["SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-10.4.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 00, Cap. 07, Cap. 10, Cap. 12, Cap. 13, Cap. 14", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-006", "v1_entity_name": "Centralized Error Governance", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
465
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 0, "resolved_source_count": 0, "status": "entity_absent_in_substrate_index", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.1.2", "ASVS-REQ-V1.2.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-19", "CAPEC-32"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0077"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-838"]}], "es_grounding_sources_full": [], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (encoding, escaping, html kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-IVF-007", "v1_entity_name": "Context-Aware Output Encoding At Rendering Boundaries", "v1_entity_type": "Practice", "v1_family": "ACO-IVF", "v1_slice": "ASC-07"}
466
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 19, "es_grounding_resolution": {"authored_more_sources_count": 19, "authored_visible_source_count": 4, "resolved_ref_count": 304, "resolved_source_count": 19, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AC-3.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-24", "CAPEC-39"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.2", "ASVS-REQ-V6.5.2"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4"]}], "es_grounding_sources_full": [{"claim_count": 19, "ref_count": 18, "refs": ["ASVS-REQ-V11.1.1", "ASVS-REQ-V11.1.2", "ASVS-REQ-V11.1.4", "ASVS-REQ-V11.4.2", "ASVS-REQ-V11.6.1", "ASVS-REQ-V11.7.1", "ASVS-REQ-V13.3.1", "ASVS-REQ-V13.3.3", "ASVS-REQ-V13.3.4", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.7", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.4.3", "ASVS-REQ-V6.1.2", "ASVS-REQ-V6.5.2", "ASVS-REQ-V6.5.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 28, "ref_count": 27, "refs": ["CAPEC-150", "CAPEC-169", "CAPEC-187", "CAPEC-224", "CAPEC-24", "CAPEC-271", "CAPEC-39", "CAPEC-390", "CAPEC-391", "CAPEC-395", "CAPEC-426", "CAPEC-474", "CAPEC-518", "CAPEC-519", "CAPEC-529", "CAPEC-530", "CAPEC-544", "CAPEC-548", "CAPEC-552", "CAPEC-571", "CAPEC-578", "CAPEC-636", "CAPEC-639", "CAPEC-643", "CAPEC-678", "CAPEC-692", "CAPEC-97"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 12, "ref_count": 8, "refs": ["CIS-10.6", "CIS-12.3", "CIS-12.6", "CIS-16.9", "CIS-3", "CIS-3.1", "CIS-3.3", "CIS-3.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 9, "ref_count": 9, "refs": ["CWE-1230", "CWE-309", "CWE-312", "CWE-385", "CWE-497", "CWE-515", "CWE-538", "CWE-656", "CWE-921"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 2, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 5, "ref_count": 5, "refs": ["HIPAA-164-308a4", "HIPAA-164-308a5", "HIPAA-164-310a1", "HIPAA-164-312b", "HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 179, "ref_count": 170, "refs": ["SP800-53-AC-11", "SP800-53-AC-17.2", "SP800-53-AC-18.1", "SP800-53-AC-19.5", "SP800-53-AC-20", "SP800-53-AC-20.3", "SP800-53-AC-22", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-4.15", "SP800-53-AC-4.25", "SP800-53-AC-4.4", "SP800-53-AT-2", "SP800-53-AU-9", "SP800-53-AU-9.3", "SP800-53-CM-10", "SP800-53-CM-2.4", "SP800-53-CM-3.6", "SP800-53-CM-5.7", "SP800-53-CM-7.4", "SP800-53-CM-7.7", "SP800-53-CP-9.8", "SP800-53-IA-13.1", "SP800-53-IA-5.1", "SP800-53-IA-5.14", "SP800-53-IA-5.18", "SP800-53-IA-5.6", "SP800-53-IA-7", "SP800-53-MA-3.3", "SP800-53-MA-4.6", "SP800-53-MA-5.1", "SP800-53-MA-5.2", "SP800-53-MP-2.2", "SP800-53-MP-4.1", "SP800-53-MP-5", "SP800-53-MP-5.4", "SP800-53-MP-6", "SP800-53-MP-6.4", "SP800-53-MP-8.3", "SP800-53-MP-8.4", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.2", "SP800-53-PE-3.4", "SP800-53-PE-3.5", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-14", "SP800-53-PM-15", "SP800-53-PM-16", "SP800-53-PM-16.1", "SP800-53-PM-20", "SP800-53-PM-3", "SP800-53-PM-9", "SP800-53-PS-3.1", "SP800-53-PS-3.3", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-RA-2", "SP800-53-RA-5", "SP800-53-SA-10.4", "SP800-53-SA-10.6", "SP800-53-SA-15.11", "SP800-53-SA-17", "SP800-53-SA-17.5", "SP800-53-SA-18", "SP800-53-SA-2", "SP800-53-SA-3", "SP800-53-SA-8", "SP800-53-SA-8.10", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.18", "SP800-53-SA-8.19", "SP800-53-SA-8.20", "SP800-53-SA-8.22", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SA-8.31", "SP800-53-SA-8.5", "SP800-53-SA-8.6", "SP800-53-SA-8.8", "SP800-53-SA-8.9", "SP800-53-SA-9.6", "SP800-53-SA-9.7", "SP800-53-SC-11", "SP800-53-SC-12", "SP800-53-SC-12.1", "SP800-53-SC-12.2", "SP800-53-SC-12.3", "SP800-53-SC-12.6", "SP800-53-SC-13", "SP800-53-SC-13.1", "SP800-53-SC-13.4", "SP800-53-SC-14", "SP800-53-SC-15.3", "SP800-53-SC-16.1", "SP800-53-SC-16.2", "SP800-53-SC-2", "SP800-53-SC-2.1", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-26", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-28.3", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.3", "SP800-53-SC-3.5", "SP800-53-SC-30", "SP800-53-SC-30.2", "SP800-53-SC-30.4", "SP800-53-SC-30.5", "SP800-53-SC-31", "SP800-53-SC-34.2", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-40.1", "SP800-53-SC-43", "SP800-53-SC-5.1", "SP800-53-SC-51", "SP800-53-SC-7", "SP800-53-SC-7.13", "SP800-53-SC-7.16", "SP800-53-SC-7.18", "SP800-53-SC-7.21", "SP800-53-SC-7.26", "SP800-53-SC-8", "SP800-53-SC-8.1", "SP800-53-SC-8.3", "SP800-53-SC-8.4", "SP800-53-SI-1", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-12", "SP800-53-SI-12.2", "SP800-53-SI-12.3", "SP800-53-SI-14.2", "SP800-53-SI-16", "SP800-53-SI-19.5", "SP800-53-SI-2", "SP800-53-SI-2.1", "SP800-53-SI-3", "SP800-53-SI-3.1", "SP800-53-SI-3.3", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.24", "SP800-53-SI-4.6", "SP800-53-SI-4.8", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.11", "SP800-53-SI-7.13", "SP800-53-SI-7.15", "SP800-53-SI-7.3", "SP800-53-SI-7.6", "SP800-53-SI-8", "SP800-53-SI-8.1", "SP800-53-SI-8.2", "SP800-53-SI-9", "SP800-53-SR-10", "SP800-53-SR-11", "SP800-53-SR-11.1", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 10, "ref_count": 10, "refs": ["DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-1B9281B948E24C019AC69DB9931C4885", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-C6E3C81256E241B0AE01B7AFC41A004C", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F", "DSOMM-ACTIVITY-F88D1B173D7D4C3D8139AD44FC4942D4"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DEPLOYMENT"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["OPC-C1", "OPC-C3", "OPC-C8"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 12, "ref_count": 10, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-G_EG_2_B", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SD_1_B", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-O_OM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 14, "ref_count": 13, "refs": ["PCI-1.2.3", "PCI-1.2.4", "PCI-1.4.4", "PCI-1.4.5", "PCI-3.7.6", "PCI-4.2.1", "PCI-5.2.1", "PCI-5.3.1", "PCI-7.3.1", "PCI-8.3.6", "PCI-8.6.3", "PCI-REQ-5", "PCI-REQ-6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-2.3", "PCISSLC-6.1", "PCISSLC-6.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-1", "SCAGILE-EXP-12"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-ENCRYPTION"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-REPO"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 20, "ref_count": 17, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PS.3", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.5", "SSDF-PRACTICE-PW.7", "SSDF-PRACTICE-PW.9", "SSDF-TASK-PO.1.2", "SSDF-TASK-PS.1.1", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.1", "SSDF-TASK-PW.7.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-001", "v1_entity_name": "Secret Management Systems", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
467
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 75, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.12", "SP800-53-AC-14"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.8.4", "ASVS-REQ-V7.5.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-151"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-8.2.1", "PCI-8.2.2"]}], "es_grounding_sources_full": [{"claim_count": 18, "ref_count": 18, "refs": ["ASVS-REQ-V10.1.2", "ASVS-REQ-V10.2.2", "ASVS-REQ-V10.3.3", "ASVS-REQ-V10.4.10", "ASVS-REQ-V10.4.15", "ASVS-REQ-V10.4.6", "ASVS-REQ-V10.4.7", "ASVS-REQ-V10.5.1", "ASVS-REQ-V10.5.2", "ASVS-REQ-V10.5.3", "ASVS-REQ-V10.5.4", "ASVS-REQ-V10.5.5", "ASVS-REQ-V10.7.1", "ASVS-REQ-V12.3.5", "ASVS-REQ-V6.8.1", "ASVS-REQ-V6.8.4", "ASVS-REQ-V7.5.3", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-151", "CAPEC-21", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-322"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 48, "ref_count": 45, "refs": ["SP800-53-AC-14", "SP800-53-AC-16.1", "SP800-53-AC-16.2", "SP800-53-AC-16.4", "SP800-53-AC-24.2", "SP800-53-AC-4.12", "SP800-53-AU-10.1", "SP800-53-CA-6.2", "SP800-53-IA-1", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-12.6", "SP800-53-IA-13", "SP800-53-IA-13.2", "SP800-53-IA-2", "SP800-53-IA-2.10", "SP800-53-IA-2.2", "SP800-53-IA-2.5", "SP800-53-IA-2.7", "SP800-53-IA-3", "SP800-53-IA-3.2", "SP800-53-IA-3.4", "SP800-53-IA-4", "SP800-53-IA-4.4", "SP800-53-IA-4.5", "SP800-53-IA-4.6", "SP800-53-IA-4.8", "SP800-53-IA-5.1", "SP800-53-IA-5.11", "SP800-53-IA-5.16", "SP800-53-IA-5.3", "SP800-53-IA-8", "SP800-53-IA-8.2", "SP800-53-IA-8.4", "SP800-53-IA-8.5", "SP800-53-IA-8.6", "SP800-53-IA-9", "SP800-53-IA-9.1", "SP800-53-PT-3", "SP800-53-SA-12.14", "SP800-53-SA-15.12", "SP800-53-SC-23.3", "SP800-53-SR-4.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-65A2D7D9544146BFA4E3F76919857750"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-AUTH"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C6"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-8.2.1", "PCI-8.2.2", "PCI-8.3.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-IAM"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-002", "v1_entity_name": "OIDC-Based Operational Identity", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
468
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 7, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.2.10"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-5", "CIS-6.8"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0013", "AML.T0098"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.4", "SP800-53-AC-2.8"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V6.1.1", "ASVS-REQ-V6.2.10"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-226"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-5", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-AC-2.4", "SP800-53-AC-2.8"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-003", "v1_entity_name": "Short-Lived Credential Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
469
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_resolution": {"authored_more_sources_count": 13, "authored_visible_source_count": 4, "resolved_ref_count": 93, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.7"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-13", "CAPEC-35"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0109", "AML.T0002.002"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1", "NIST-AI-RMF-GOVERN-1.6"]}], "es_grounding_sources_full": [{"claim_count": 9, "ref_count": 9, "refs": ["CAPEC-122", "CAPEC-13", "CAPEC-176", "CAPEC-203", "CAPEC-35", "CAPEC-38", "CAPEC-678", "CAPEC-700", "CAPEC-77"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-2.2", "CIS-2.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-1220", "CWE-268", "CWE-829"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-SCOPE-MINIMIZATION"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 66, "ref_count": 56, "refs": ["SP800-53-AC-1", "SP800-53-AC-17", "SP800-53-AC-17.4", "SP800-53-AC-2.7", "SP800-53-AC-24", "SP800-53-AC-3.1", "SP800-53-AC-3.15", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.7", "SP800-53-AC-4.11", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.18", "SP800-53-AC-4.2", "SP800-53-AC-4.23", "SP800-53-AC-4.28", "SP800-53-AC-4.29", "SP800-53-AC-4.30", "SP800-53-AC-4.6", "SP800-53-AC-5", "SP800-53-AC-6.3", "SP800-53-AC-6.4", "SP800-53-AC-6.5", "SP800-53-AT-1", "SP800-53-AU-1", "SP800-53-AU-2.4", "SP800-53-AU-9.5", "SP800-53-CA-1", "SP800-53-CM-1", "SP800-53-CM-11", "SP800-53-CM-13", "SP800-53-CM-3", "SP800-53-CM-3.4", "SP800-53-CM-3.5", "SP800-53-CM-4", "SP800-53-CM-5.3", "SP800-53-CM-5.4", "SP800-53-CM-5.5", "SP800-53-CM-6", "SP800-53-CM-6.1", "SP800-53-CM-6.4", "SP800-53-CP-10.3", "SP800-53-CP-13", "SP800-53-CP-2", "SP800-53-PE-1", "SP800-53-PM-8", "SP800-53-PS-1", "SP800-53-RA-1", "SP800-53-SA-1", "SP800-53-SA-10.7", "SP800-53-SC-1", "SP800-53-SC-46", "SP800-53-SI-1", "SP800-53-SR-1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-E5386ABF91544752A1A8C3A8900F732D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP02-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 12, "ref_count": 6, "refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCI-5.2.3", "PCI-6.5.3", "PCI-6.5.4", "PCI-7.2.2", "PCI-7.3.3", "PCI-9.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-5.1", "PCISSLC-8.1", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PO.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SPC-004", "v1_entity_name": "Secret Scope And Binding Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
470
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 14, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-215", "CWE-348"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.31", "SP800-53-PE-19"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-65", "CAPEC-242"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0057", "AML.T0068"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-242", "CAPEC-65"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-215", "CWE-348", "CWE-434"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-AC-4.31", "SP800-53-PE-19", "SP800-53-SR-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-D17DBFF01F10492AB4C717BB59A0A711"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_DM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-REPO"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PW.5"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-001", "v1_entity_name": "Secret Leak Prevention And Hardcoded-Secret Exclusion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
471
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 68, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.6", "SP800-53-AC-3.9"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-256", "CWE-257"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-37", "CAPEC-204"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-204", "CAPEC-37", "CAPEC-636"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 22, "ref_count": 10, "refs": ["CIS-11.3", "CIS-3", "CIS-3.1", "CIS-3.11", "CIS-3.2", "CIS-3.3", "CIS-3.6", "CIS-3.7", "CIS-3.8", "CIS-3.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 10, "ref_count": 10, "refs": ["CWE-256", "CWE-257", "CWE-260", "CWE-278", "CWE-312", "CWE-412", "CWE-502", "CWE-515", "CWE-832", "CWE-921"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 39, "ref_count": 38, "refs": ["SP800-53-AC-11.1", "SP800-53-AC-18.1", "SP800-53-AC-19.1", "SP800-53-AC-19.2", "SP800-53-AC-19.3", "SP800-53-AC-19.5", "SP800-53-AC-20", "SP800-53-AC-20.2", "SP800-53-AC-20.3", "SP800-53-AC-20.5", "SP800-53-AC-21.2", "SP800-53-AC-23", "SP800-53-AC-3.6", "SP800-53-AC-3.9", "SP800-53-CM-10", "SP800-53-CP-10.6", "SP800-53-CP-9.3", "SP800-53-CP-9.8", "SP800-53-IA-5.1", "SP800-53-MP-2.2", "SP800-53-MP-4", "SP800-53-MP-4.1", "SP800-53-MP-4.2", "SP800-53-MP-5.4", "SP800-53-MP-6.3", "SP800-53-MP-6.4", "SP800-53-MP-8.3", "SP800-53-SC-12.6", "SP800-53-SC-14", "SP800-53-SC-28", "SP800-53-SC-28.2", "SP800-53-SC-28.3", "SP800-53-SC-34.1", "SP800-53-SC-34.2", "SP800-53-SC-7.15", "SP800-53-SC-8.5", "SP800-53-SI-19.2", "SP800-53-SI-3.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C3"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-O_OM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-3.3.2", "PCI-9.4.6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-7.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-002", "v1_entity_name": "Protected Secret Storage And Controlled Retrieval", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
472
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 2, "resolved_ref_count": 7, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.2.10", "ASVS-REQ-V6.4.1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-262", "CWE-263"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V13.1.4", "ASVS-REQ-V13.3.4", "ASVS-REQ-V6.2.10", "ASVS-REQ-V6.4.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-262", "CWE-263", "CWE-324"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-003", "v1_entity_name": "Secret Rotation And Expiry Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
473
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 48, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-IA-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-59"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.4", "ASVS-REQ-V6.8.4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1392", "CWE-289"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 5, "refs": ["ASVS-REQ-V13.2.1", "ASVS-REQ-V6.3.4", "ASVS-REQ-V6.8.4", "ASVS-REQ-V7.1.3", "ASVS-REQ-V7.6.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 6, "ref_count": 6, "refs": ["CAPEC-196", "CAPEC-21", "CAPEC-226", "CAPEC-568", "CAPEC-59", "CAPEC-654"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 5, "ref_count": 5, "refs": ["CWE-1392", "CWE-289", "CWE-306", "CWE-322", "CWE-408"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 25, "ref_count": 23, "refs": ["SP800-53-AC-2", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-12.6", "SP800-53-IA-13", "SP800-53-IA-13.2", "SP800-53-IA-2", "SP800-53-IA-2.1", "SP800-53-IA-2.10", "SP800-53-IA-2.2", "SP800-53-IA-2.3", "SP800-53-IA-2.5", "SP800-53-IA-2.7", "SP800-53-IA-2.8", "SP800-53-IA-2.9", "SP800-53-IA-4.5", "SP800-53-IA-5.10", "SP800-53-IA-5.5", "SP800-53-IA-5.7", "SP800-53-IA-5.9", "SP800-53-IA-8", "SP800-53-IA-8.4", "SP800-53-IA-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-65A2D7D9544146BFA4E3F76919857750"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-AUTH"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP07-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A07-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-IAM"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-004", "v1_entity_name": "Operational Identity Binding And Short-Lived Credentials", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
474
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 14, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0008.000", "AML.T0024"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SC-7.20", "SP800-53-SC-39"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.12", "CIS-16.8"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-574"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CIS-16.8", "CIS-4.12"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-214"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-SC-39", "SP800-53-SC-39.1", "SP800-53-SC-7.20"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-3A94D55EFD8249969EB320D23FF2A873", "DSOMM-ACTIVITY-4CE24ABD8BA6494C828D4D193E28E4A1", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415", "DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B", "DSOMM-ACTIVITY-E14DE74194B3447C8B07EEA947D82E61"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-BUILD-PLATFORM-ISOLATION"], "substrate_source_key": "slsa_spec_v1_0_build_track"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-005", "v1_entity_name": "Secret Usage Isolation Across Pipeline, Workload And Deploy Surfaces", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
475
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 52, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2.7", "SP800-53-AC-3.10"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.3.2", "PCI-11.5.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V11.1.4"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-678"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V11.1.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 1, "refs": ["CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312b"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 51, "ref_count": 44, "refs": ["SP800-53-AC-16", "SP800-53-AC-2.7", "SP800-53-AC-3.10", "SP800-53-AC-4.23", "SP800-53-AC-4.26", "SP800-53-AU-1", "SP800-53-AU-10.3", "SP800-53-AU-10.4", "SP800-53-AU-10.5", "SP800-53-AU-11", "SP800-53-AU-12.1", "SP800-53-AU-12.3", "SP800-53-AU-13", "SP800-53-AU-13.3", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-16.1", "SP800-53-AU-16.2", "SP800-53-AU-16.3", "SP800-53-AU-2.2", "SP800-53-AU-2.3", "SP800-53-AU-3", "SP800-53-AU-3.2", "SP800-53-AU-4", "SP800-53-AU-5.5", "SP800-53-AU-6", "SP800-53-AU-6.10", "SP800-53-AU-6.3", "SP800-53-AU-6.9", "SP800-53-AU-9.1", "SP800-53-AU-9.4", "SP800-53-AU-9.6", "SP800-53-AU-9.7", "SP800-53-CM-1", "SP800-53-CM-3", "SP800-53-CM-3.7", "SP800-53-CM-4", "SP800-53-CM-4.2", "SP800-53-CM-6", "SP800-53-CM-6.3", "SP800-53-SA-10", "SP800-53-SI-1", "SP800-53-SI-4", "SP800-53-SI-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-10.3.2", "PCI-11.5.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-006", "v1_entity_name": "Secret Change Auditability And Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
476
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 16, "es_grounding_resolution": {"authored_more_sources_count": 16, "authored_visible_source_count": 4, "resolved_ref_count": 167, "resolved_source_count": 18, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.5", "CIS-4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V13.3.3", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.4.2", "ASVS-REQ-V15.4.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 7, "ref_count": 7, "refs": ["CAPEC-212", "CAPEC-511", "CAPEC-518", "CAPEC-519", "CAPEC-673", "CAPEC-680", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 15, "ref_count": 11, "refs": ["CIS-12.3", "CIS-14.9", "CIS-15.7", "CIS-16.1", "CIS-16.12", "CIS-3.5", "CIS-4", "CIS-4.1", "CIS-4.11", "CIS-4.2", "CIS-4.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-358", "CWE-649"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 2, "refs": ["GDPR-ART-32", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 4, "ref_count": 4, "refs": ["HIPAA-164-308a1", "HIPAA-164-308a2", "HIPAA-164-308a5", "HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 94, "ref_count": 85, "refs": ["SP800-53-AC-1", "SP800-53-AC-3", "SP800-53-AC-3.5", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.12", "SP800-53-AC-4.13", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.3", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-AT-3.5", "SP800-53-CA-9.1", "SP800-53-CM-5.7", "SP800-53-CP-13", "SP800-53-CP-7.5", "SP800-53-IA-1", "SP800-53-IA-4.1", "SP800-53-MA-5.1", "SP800-53-MA-5.2", "SP800-53-PL-8", "SP800-53-PL-8.1", "SP800-53-PM-1", "SP800-53-PM-18", "SP800-53-PM-21", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-6", "SP800-53-PS-7", "SP800-53-PS-9", "SP800-53-PT-1", "SP800-53-PT-2", "SP800-53-PT-3", "SP800-53-PT-7", "SP800-53-SA-12.9", "SP800-53-SA-17", "SP800-53-SA-3", "SP800-53-SA-8", "SP800-53-SA-8.1", "SP800-53-SA-8.15", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.26", "SP800-53-SA-8.28", "SP800-53-SA-8.3", "SP800-53-SA-8.30", "SP800-53-SA-8.9", "SP800-53-SA-9.7", "SP800-53-SC-1", "SP800-53-SC-12", "SP800-53-SC-16", "SP800-53-SC-16.1", "SP800-53-SC-20.2", "SP800-53-SC-23", "SP800-53-SC-26", "SP800-53-SC-3.2", "SP800-53-SC-3.4", "SP800-53-SC-3.5", "SP800-53-SC-30.4", "SP800-53-SC-38", "SP800-53-SC-4.2", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SC-7.24", "SP800-53-SI-1", "SP800-53-SI-12.1", "SP800-53-SI-12.3", "SP800-53-SI-19.4", "SP800-53-SI-2.7", "SP800-53-SI-22", "SP800-53-SI-3.3", "SP800-53-SI-4", "SP800-53-SI-4.3", "SP800-53-SI-6", "SP800-53-SI-6.3", "SP800-53-SI-7.1", "SP800-53-SI-7.11", "SP800-53-SI-7.13", "SP800-53-SI-7.15", "SP800-53-SI-7.6", "SP800-53-SI-9", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 15, "ref_count": 9, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_2_B", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 16, "ref_count": 16, "refs": ["PCI-1.2.6", "PCI-1.5.1", "PCI-2.1.1", "PCI-2.2.3", "PCI-3.1.1", "PCI-3.6.1", "PCI-3.7.3", "PCI-3.7.7", "PCI-5.2.3", "PCI-6.1.2", "PCI-6.5.4", "PCI-7.2.5", "PCI-8.3.11", "PCI-9.1.1", "PCI-REQ-2", "PCI-REQ-7"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCISSLC-1.2", "PCISSLC-2.3", "PCISSLC-2.4", "PCISSLC-8.1", "PCISSLC-8.2", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SCAGILE-EXP-12", "SCAGILE-EXP-8", "SCAGILE-OPS-12", "SCAGILE-OPS-14", "SCAGILE-OPS-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-SECURITY-CONTROLS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCSIC-DELIVERY-SIGNING", "SCSIC-SOURCING", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PO.5", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PW.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SPC-007", "v1_entity_name": "Secret Handling And Operational Identity Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
477
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 122, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-38", "CAPEC-44"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PS.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V15.1.1", "ASVS-REQ-V15.1.4", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.2.4", "ASVS-REQ-V15.2.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 18, "ref_count": 18, "refs": ["CAPEC-131", "CAPEC-150", "CAPEC-159", "CAPEC-187", "CAPEC-188", "CAPEC-191", "CAPEC-271", "CAPEC-38", "CAPEC-44", "CAPEC-519", "CAPEC-643", "CAPEC-669", "CAPEC-678", "CAPEC-690", "CAPEC-691", "CAPEC-692", "CAPEC-693", "CAPEC-695"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 19, "ref_count": 9, "refs": ["CIS-16.1", "CIS-16.12", "CIS-16.2", "CIS-16.4", "CIS-16.5", "CIS-16.6", "CIS-16.9", "CIS-3.13", "CIS-3.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-494"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 10, "ref_count": 10, "refs": ["SP800-53-AC-4.28", "SP800-53-RA-5.11", "SP800-53-SA-10", "SP800-53-SI-10.5", "SP800-53-SI-2", "SP800-53-SI-2.4", "SP800-53-SI-3", "SP800-53-SI-3.2", "SP800-53-SI-3.4", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 24, "ref_count": 24, "refs": ["DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-13AF12273DD14D4FA9E953DEB793C18F", "DSOMM-ACTIVITY-26E1C6D556324EC780D2E564B98732AD", "DSOMM-ACTIVITY-363A3EEABAF9401088CABB8186A2989D", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-6532C1FE9D2342288722558DDABCA7D4", "DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-C6E3C81256E241B0AE01B7AFC41A004C", "DSOMM-ACTIVITY-C7D99B18C3E14D22B2E39AA9146C0B17", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-D17DBFF01F10492AB4C717BB59A0A711", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 32, "ref_count": 12, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 8, "ref_count": 5, "refs": ["PCI-1.2.4", "PCI-5.2.1", "PCI-5.2.3", "PCI-6.2.3", "PCI-7.2.6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-4.1", "PCISSLC-4.2", "PCISSLC-6.1", "PCISSLC-6.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCAGILE-EXP-1", "SCAGILE-OPS-14", "SCAGILE-OPS-2", "SCAGILE-OPS-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-LIFECYCLE-FEEDBACK"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCSIC-DELIVERY", "SCSIC-DEV-REPO", "SCSIC-SOURCING-OSS"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 5, "ref_count": 5, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-L3", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS", "SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 19, "ref_count": 18, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.5", "SSDF-PRACTICE-PW.6", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.3.2", "SSDF-TASK-PO.3.3", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.2", "SSDF-TASK-PW.1.2", "SSDF-TASK-PW.2.1", "SSDF-TASK-PW.4.1", "SSDF-TASK-PW.5.1", "SSDF-TASK-RV.1.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-001", "v1_entity_name": "Secret Leak Prevention In Source And Pipeline", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
478
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 161, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.13", "SP800-53-AC-4.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-REQ-4"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-256", "CWE-257"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}], "es_grounding_sources_full": [{"claim_count": 12, "ref_count": 12, "refs": ["ASVS-REQ-V11.1.2", "ASVS-REQ-V11.2.2", "ASVS-REQ-V11.7.1", "ASVS-REQ-V11.7.2", "ASVS-REQ-V13.3.1", "ASVS-REQ-V13.3.3", "ASVS-REQ-V14.2.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7", "ASVS-REQ-V6.5.2", "ASVS-REQ-V6.5.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["CAPEC-204", "CAPEC-24", "CAPEC-37", "CAPEC-391", "CAPEC-546", "CAPEC-568", "CAPEC-608", "CAPEC-620", "CAPEC-636", "CAPEC-675"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 22, "ref_count": 13, "refs": ["CIS-11.3", "CIS-11.4", "CIS-3", "CIS-3.1", "CIS-3.11", "CIS-3.14", "CIS-3.2", "CIS-3.3", "CIS-3.5", "CIS-3.6", "CIS-3.7", "CIS-3.8", "CIS-3.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 14, "ref_count": 14, "refs": ["CWE-256", "CWE-257", "CWE-278", "CWE-308", "CWE-309", "CWE-312", "CWE-324", "CWE-502", "CWE-515", "CWE-549", "CWE-640", "CWE-798", "CWE-836", "CWE-921"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 2, "refs": ["GDPR-ART-32", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-312d"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 84, "ref_count": 81, "refs": ["SP800-53-AC-11", "SP800-53-AC-16", "SP800-53-AC-17.2", "SP800-53-AC-18.1", "SP800-53-AC-19.1", "SP800-53-AC-19.2", "SP800-53-AC-19.3", "SP800-53-AC-19.5", "SP800-53-AC-20.2", "SP800-53-AC-20.4", "SP800-53-AC-20.5", "SP800-53-AC-3.13", "SP800-53-AC-4.25", "SP800-53-AC-4.4", "SP800-53-AU-9.2", "SP800-53-AU-9.3", "SP800-53-CM-10", "SP800-53-CP-9", "SP800-53-CP-9.3", "SP800-53-CP-9.7", "SP800-53-CP-9.8", "SP800-53-IA-13.1", "SP800-53-IA-4.9", "SP800-53-IA-5.1", "SP800-53-IA-5.14", "SP800-53-IA-5.18", "SP800-53-IA-5.7", "SP800-53-MA-4.6", "SP800-53-MP-2.2", "SP800-53-MP-4", "SP800-53-MP-4.1", "SP800-53-MP-4.2", "SP800-53-MP-5.4", "SP800-53-MP-6", "SP800-53-MP-6.4", "SP800-53-MP-6.7", "SP800-53-MP-6.8", "SP800-53-MP-8.4", "SP800-53-PE-3", "SP800-53-PE-3.4", "SP800-53-SA-15.11", "SP800-53-SA-8.20", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.8", "SP800-53-SA-9.6", "SP800-53-SA-9.7", "SP800-53-SC-12", "SP800-53-SC-12.1", "SP800-53-SC-12.2", "SP800-53-SC-12.3", "SP800-53-SC-12.6", "SP800-53-SC-13", "SP800-53-SC-13.1", "SP800-53-SC-13.2", "SP800-53-SC-13.4", "SP800-53-SC-14", "SP800-53-SC-16.1", "SP800-53-SC-16.3", "SP800-53-SC-21.1", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-28.2", "SP800-53-SC-28.3", "SP800-53-SC-34.1", "SP800-53-SC-34.2", "SP800-53-SC-36", "SP800-53-SC-51", "SP800-53-SC-7.18", "SP800-53-SC-8", "SP800-53-SC-8.1", "SP800-53-SC-8.3", "SP800-53-SI-14", "SP800-53-SI-14.2", "SP800-53-SI-16", "SP800-53-SI-19.2", "SP800-53-SI-19.4", "SP800-53-SI-3.5", "SP800-53-SI-7.10", "SP800-53-SI-7.15", "SP800-53-SI-7.6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-0FF45FB87EEF46ED9B3A84C955CD7060"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DEPLOYMENT"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C3"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-O_OM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 17, "ref_count": 17, "refs": ["PCI-1.4.4", "PCI-3.3.2", "PCI-3.6.1", "PCI-3.7.1", "PCI-3.7.2", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.6", "PCI-3.7.7", "PCI-4.2.1", "PCI-8.6.2", "PCI-8.6.3", "PCI-9.4.1", "PCI-9.4.2", "PCI-REQ-3", "PCI-REQ-4", "PCI-REQ-6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-7.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-ENCRYPTION"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-002", "v1_entity_name": "Vault-Backed Secret Storage", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
479
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 9, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IA-5.13", "SP800-53-PS-1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.4.5", "ASVS-REQ-V13.3.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-14.1"]}, {"source_display_name": "HIPAA", "substrate_source": "hipaa", "visible_refs": ["HIPAA-164-308a6"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V13.3.4", "ASVS-REQ-V6.4.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-14.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-IA-5.13", "SP800-53-PS-1", "SP800-53-PS-6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-G_SM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-003", "v1_entity_name": "Secret Rotation And Renewal Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
480
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_resolution": {"authored_more_sources_count": 8, "authored_visible_source_count": 4, "resolved_ref_count": 79, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-4.12"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.8.1", "ASVS-REQ-V6.8.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.1.1", "PCI-4.1.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-196"]}], "es_grounding_sources_full": [{"claim_count": 20, "ref_count": 20, "refs": ["ASVS-REQ-V10.1.2", "ASVS-REQ-V10.3.3", "ASVS-REQ-V10.4.10", "ASVS-REQ-V10.4.16", "ASVS-REQ-V10.4.7", "ASVS-REQ-V10.5.1", "ASVS-REQ-V10.5.2", "ASVS-REQ-V10.5.3", "ASVS-REQ-V10.5.4", "ASVS-REQ-V10.5.5", "ASVS-REQ-V10.6.1", "ASVS-REQ-V10.7.1", "ASVS-REQ-V6.8.1", "ASVS-REQ-V6.8.2", "ASVS-REQ-V6.8.4", "ASVS-REQ-V7.1.3", "ASVS-REQ-V7.6.1", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.2", "ASVS-REQ-V8.2.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-196", "CAPEC-21"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-289", "CWE-322"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 46, "ref_count": 44, "refs": ["SP800-53-AC-16.4", "SP800-53-AC-2", "SP800-53-AC-24.2", "SP800-53-AC-4.12", "SP800-53-AC-4.18", "SP800-53-AU-10.1", "SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-CA-6.1", "SP800-53-CA-6.2", "SP800-53-IA-1", "SP800-53-IA-11", "SP800-53-IA-12", "SP800-53-IA-12.2", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-12.6", "SP800-53-IA-13", "SP800-53-IA-13.2", "SP800-53-IA-2", "SP800-53-IA-2.10", "SP800-53-IA-2.5", "SP800-53-IA-3", "SP800-53-IA-4", "SP800-53-IA-4.3", "SP800-53-IA-4.4", "SP800-53-IA-4.5", "SP800-53-IA-4.6", "SP800-53-IA-4.8", "SP800-53-IA-5.10", "SP800-53-IA-5.16", "SP800-53-IA-5.3", "SP800-53-IA-5.5", "SP800-53-IA-5.9", "SP800-53-IA-8", "SP800-53-IA-8.2", "SP800-53-IA-8.4", "SP800-53-IA-8.5", "SP800-53-IA-9", "SP800-53-IA-9.1", "SP800-53-PT-2", "SP800-53-SA-12.14", "SP800-53-SR-4.1", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-65A2D7D9544146BFA4E3F76919857750"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-AUTH"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-TOOLS-UTILITIES"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C6"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCI-1.1.1", "PCI-11.1.1", "PCI-4.1.1", "PCI-8.1.1", "PCI-8.2.1", "PCI-8.3.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-IAM"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-004", "v1_entity_name": "Operational Identity Binding And OIDC Use", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
481
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 117, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-17.6", "SP800-53-AC-20"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-22", "CAPEC-36"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0013", "AML.TA0010"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1104", "CWE-1220"]}], "es_grounding_sources_full": [{"claim_count": 24, "ref_count": 24, "refs": ["CAPEC-113", "CAPEC-121", "CAPEC-122", "CAPEC-124", "CAPEC-157", "CAPEC-161", "CAPEC-216", "CAPEC-22", "CAPEC-237", "CAPEC-270", "CAPEC-312", "CAPEC-36", "CAPEC-384", "CAPEC-401", "CAPEC-416", "CAPEC-438", "CAPEC-439", "CAPEC-480", "CAPEC-521", "CAPEC-539", "CAPEC-564", "CAPEC-623", "CAPEC-663", "CAPEC-682"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 5, "ref_count": 5, "refs": ["CIS-1", "CIS-14.8", "CIS-16", "CIS-16.8", "CIS-4.12"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 16, "ref_count": 16, "refs": ["CWE-1104", "CWE-1220", "CWE-213", "CWE-214", "CWE-224", "CWE-250", "CWE-290", "CWE-385", "CWE-412", "CWE-497", "CWE-645", "CWE-653", "CWE-654", "CWE-656", "CWE-807", "CWE-829"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-310c"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 54, "ref_count": 53, "refs": ["SP800-53-AC-17.6", "SP800-53-AC-20", "SP800-53-CM-4.1", "SP800-53-CP-7.1", "SP800-53-IA-6", "SP800-53-IR-9.4", "SP800-53-PE-19", "SP800-53-PE-4", "SP800-53-PL-8.1", "SP800-53-PM-9", "SP800-53-PT-3", "SP800-53-RA-10", "SP800-53-RA-5", "SP800-53-SA-17", "SP800-53-SA-5.2", "SP800-53-SA-8.1", "SP800-53-SA-8.16", "SP800-53-SA-8.2", "SP800-53-SA-8.22", "SP800-53-SA-8.26", "SP800-53-SA-8.27", "SP800-53-SA-8.30", "SP800-53-SA-8.5", "SP800-53-SA-8.6", "SP800-53-SC-15.3", "SP800-53-SC-18.5", "SP800-53-SC-2", "SP800-53-SC-26", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.4", "SP800-53-SC-3.5", "SP800-53-SC-30.4", "SP800-53-SC-30.5", "SP800-53-SC-39", "SP800-53-SC-39.1", "SP800-53-SC-4.1", "SP800-53-SC-4.2", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SC-7", "SP800-53-SC-7.13", "SP800-53-SC-7.14", "SP800-53-SC-7.20", "SP800-53-SC-7.21", "SP800-53-SC-7.7", "SP800-53-SI-19.5", "SP800-53-SI-4", "SP800-53-SI-4.18", "SP800-53-SI-7.11"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 10, "ref_count": 10, "refs": ["DSOMM-ACTIVITY-11B3848EE9314146A35D35409ADA24EE", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-3A94D55EFD8249969EB320D23FF2A873", "DSOMM-ACTIVITY-4CE24ABD8BA6494C828D4D193E28E4A1", "DSOMM-ACTIVITY-746025A6DBFB4087A000E46ACAB64EE1", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-AD23BE9C56614F1F81A35A5DC7061629", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415", "DSOMM-ACTIVITY-E14DE74194B3447C8B07EEA947D82E61", "DSOMM-ACTIVITY-ECB0184C6BC945DABBBBA983797FFC93"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP01-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-O_OM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-8.2.7"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-BUILD-PLATFORM-ISOLATION", "SLSA-PRINCIPLE-TRUST-CODE"], "substrate_source_key": "slsa_spec_v1_0_build_track"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 07, Cap. 08, Cap. 11", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-005", "v1_entity_name": "Secret Isolation Across Technical Surfaces", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
482
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 54, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-4.20"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1", "NIST-AI-RMF-GOVERN-1.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-2.2.1"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V13.3.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 1, "refs": ["CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-20"], "substrate_source_key": "eu_nis2"}, {"claim_count": 48, "ref_count": 34, "refs": ["SP800-53-AC-1", "SP800-53-AC-13", "SP800-53-AC-4.20", "SP800-53-AU-1", "SP800-53-CM-1", "SP800-53-CM-11", "SP800-53-CM-2", "SP800-53-CM-2.5", "SP800-53-CM-3", "SP800-53-CM-3.4", "SP800-53-CM-3.6", "SP800-53-CM-3.8", "SP800-53-CM-4.2", "SP800-53-CM-5", "SP800-53-CM-5.3", "SP800-53-CM-6", "SP800-53-CM-6.1", "SP800-53-CM-6.2", "SP800-53-CM-6.3", "SP800-53-CM-6.4", "SP800-53-CM-7.3", "SP800-53-CM-7.9", "SP800-53-CM-8", "SP800-53-CM-8.4", "SP800-53-CM-8.5", "SP800-53-CM-9", "SP800-53-CM-9.1", "SP800-53-CP-10.3", "SP800-53-PL-2", "SP800-53-SA-10", "SP800-53-SA-10.2", "SP800-53-SA-10.7", "SP800-53-SI-2", "SP800-53-SR-11.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 16, "ref_count": 8, "refs": ["SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_SM_1_A", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-V_AA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-2.2.1", "PCI-6.5.4", "PCI-REQ-2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-2.1", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-PLANNING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-DEFAULTS"], "substrate_source_key": "safecode_sic_2010"}], "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "cross-chapter → Cap. 00, Cap. 05, Cap. 07, Cap. 13, Cap. 14", "manual_v2_anchor": "Practice", "methodology_label": "Parcial", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SPC-006", "v1_entity_name": "Secret Configuration Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SPC", "v1_slice": "ASC-06"}
483
483
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 SSDF practices maturity; DSOMM secure dev activities", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
484
484
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de Desenvolvimento Seguro", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
485
485
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Guidelines operacionais de equipa", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/07-guidelines-equipa.md", "manual_v2_anchor": "OverlayPlaybook", "rastreabilidade_role": "manual_only_coverage"}
@@ -716,25 +716,25 @@
716
716
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "10-testes-seguranca:validacao-empirica-de-exploitabilidade-de-findings", "manual_v2_entity_label": "Validação Empírica de Exploitabilidade de Findings", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
717
717
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "10-testes-seguranca:validacao-humana-da-interpretacao-final-dos-resultados", "manual_v2_entity_label": "Validação humana da interpretação final dos resultados", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
718
718
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "None", "manual_v2_entity_label": "hybrid", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
719
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 17, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-6.2", "SP800-53-CA-3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-5"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-001", "v1_entity_name": "Integrated Security Scanners", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
720
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-8.2", "SP800-53-CM-2.6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_2_A"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0005", "AML.T0011"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-002", "v1_entity_name": "Test Execution Surfaces", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
721
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.9", "SP800-53-AU-10.3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-1.3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.M0001"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-003", "v1_entity_name": "CI/CD Gate And Release Promotion", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
722
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AU-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17", "CIS-17.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-2.1.2", "PCI-6.5.2"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-004", "v1_entity_name": "Findings Workflow And Exception Governance", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
723
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-71699DAFB2A4466BA0B289F7DBB18506", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2", "SP800-53-CM-8"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-MEASURE-4.3", "NIST-AI-RMF-MANAGE-4.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-O_EM_3_A"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-005", "v1_entity_name": "Static Analysis Profile Management", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
724
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-8.5", "SP800-53-PL-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-420"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-16.14"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-001", "v1_entity_name": "Risk-Proportional Security Testing Strategy", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
725
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B", "DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-11.1"]}, {"source_display_name": "SAFECode Agile", "substrate_source": "safecode", "visible_refs": ["SCAGILE-OPS-4"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-002", "v1_entity_name": "Static Analysis Signal Quality And Baseline Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
726
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AU-6"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.3.2", "PCI-3.3.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-54", "CAPEC-144"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-003", "v1_entity_name": "Security Finding Triage And Correction Closure", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
727
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.4.1", "ASVS-REQ-V1.4.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-004", "v1_entity_name": "Reproducible Security Test Evidence And Build Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
728
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0073"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-3", "SP800-53-CM-3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-443", "CAPEC-671"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-005", "v1_entity_name": "Staged Dynamic Validation And Release Gate Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
729
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-2.1", "NIST-AI-100-2-E2025-2.1.3"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0001", "AML.T0016.000"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-5E0FF85BEC894EF096B15695FA0025DC"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-28", "CAPEC-100"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-006", "v1_entity_name": "Specialized Empirical Testing Depth And Regression Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
730
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-6.2", "SP800-53-CA-4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-1.3", "PCISSLC-2.3"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-007", "v1_entity_name": "Security Testing And Empirical Assurance Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
731
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-2", "SP800-53-CA-7.4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SR_1_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-7", "CIS-7.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-6", "PCI-5.2.3"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-001", "v1_entity_name": "Risk-Based Security Test Planning", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
732
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B"]}, {"source_display_name": "SAFECode Agile", "substrate_source": "safecode", "visible_refs": ["SCAGILE-OPS-4", "SCAGILE-OPS-9"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-190", "CAPEC-191"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-11.1", "SP800-53-SA-11.8"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-002", "v1_entity_name": "Governed Static Analysis Execution", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
733
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-CA-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-15.5"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-003", "v1_entity_name": "Findings Triage, SLA And Retest Closure", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
734
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.1", "SP800-53-AU-3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.2.2", "PCI-10.3.3"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-004", "v1_entity_name": "Reproducible Test Evidence Management", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
735
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.12", "SP800-53-CM-3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-121", "CAPEC-443"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0001", "AML.T0011.000"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-005", "v1_entity_name": "Staged Dynamic Testing And Gate Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
736
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PW.8", "SSDF-PRACTICE-RV.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-28", "CAPEC-215"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-3.3.1", "NIST-AI-100-2-E2025-3.6"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0001", "AML.M0008"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-006", "v1_entity_name": "Specialized Empirical Testing", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
737
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AU-6.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-5.4.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-I_SD_2_A"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-2.6", "PCISSLC-6.2"]}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (final, release, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-007", "v1_entity_name": "Human Review Of Security Test Signals", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
719
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 17, "es_grounding_resolution": {"authored_more_sources_count": 17, "authored_visible_source_count": 4, "resolved_ref_count": 204, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-6.2", "SP800-53-CA-3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-5"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V16.4.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 12, "ref_count": 12, "refs": ["CAPEC-300", "CAPEC-305", "CAPEC-310", "CAPEC-442", "CAPEC-445", "CAPEC-511", "CAPEC-529", "CAPEC-54", "CAPEC-578", "CAPEC-639", "CAPEC-678", "CAPEC-691"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 32, "ref_count": 23, "refs": ["CIS-10.1", "CIS-10.2", "CIS-10.5", "CIS-13.11", "CIS-13.2", "CIS-13.3", "CIS-13.7", "CIS-13.8", "CIS-14", "CIS-14.1", "CIS-14.7", "CIS-14.9", "CIS-16", "CIS-16.11", "CIS-16.12", "CIS-16.14", "CIS-16.5", "CIS-16.9", "CIS-7", "CIS-7.1", "CIS-7.4", "CIS-7.5", "CIS-7.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["ENISA-AI-FAICP-SURVEY"], "substrate_source_key": "enisa_multilayer_ai_cybersecurity_practices_2023"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 48, "ref_count": 42, "refs": ["SP800-53-AU-6.2", "SP800-53-CA-3.1", "SP800-53-CA-3.2", "SP800-53-CA-3.3", "SP800-53-CA-4", "SP800-53-CM-3", "SP800-53-CM-3.5", "SP800-53-CM-5.7", "SP800-53-MA-4", "SP800-53-MA-5.2", "SP800-53-PE-6", "SP800-53-PE-6.1", "SP800-53-PE-6.2", "SP800-53-PL-3", "SP800-53-RA-10", "SP800-53-RA-3.4", "SP800-53-RA-5", "SP800-53-RA-5.10", "SP800-53-RA-5.2", "SP800-53-RA-5.3", "SP800-53-RA-5.5", "SP800-53-RA-5.6", "SP800-53-RA-5.8", "SP800-53-SA-11.2", "SP800-53-SA-11.6", "SP800-53-SA-15.4", "SP800-53-SA-15.5", "SP800-53-SA-15.7", "SP800-53-SA-15.8", "SP800-53-SA-21", "SP800-53-SA-21.1", "SP800-53-SA-8.21", "SP800-53-SC-3", "SP800-53-SC-3.3", "SP800-53-SI-3", "SP800-53-SI-4.1", "SP800-53-SI-4.18", "SP800-53-SI-4.3", "SP800-53-SI-4.9", "SP800-53-SI-5", "SP800-53-SI-5.1", "SP800-53-SI-6"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 30, "ref_count": 30, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0", "DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-297BE0018D9441EEAB29207020D423C0", "DSOMM-ACTIVITY-2EBFC4218C76415CA3B0FA518915BD10", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-35446784761040D9AF9ED43F3173BF8C", "DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-5B5A1EB2113F41FBA3D606AF4FDC9CEA", "DSOMM-ACTIVITY-6217FE115ED74CF49DE4555BCFA6FE87", "DSOMM-ACTIVITY-79EF8103E1ED40558DF8FD2B2015BEBE", "DSOMM-ACTIVITY-7A82020C94D1471CBBD35F7FE7DF4876", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20B", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BMEDIUM", "DSOMM-ACTIVITY-F2F0F274C1A0450192FE7FC4452BC8AD", "DSOMM-ACTIVITY-F7B215DC73A44C619E49B3A3AF1C9AC3", "DSOMM-ACTIVITY-F88D1B173D7D4C3D8139AD44FC4942D4", "DSOMM-ACTIVITY-F994A55D71BB45A4A8870A213D72C504"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-TOOL-DESIGN"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-GOVERNANCE-REGISTRY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C2", "OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 49, "ref_count": 35, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-D_TA_3_B", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_2_B", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_DM_1_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_2_A", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_A", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 36, "ref_count": 30, "refs": ["PCI-1.1.1", "PCI-1.2.6", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.4.1", "PCI-10.4.2", "PCI-10.7.2", "PCI-10.7.3", "PCI-11.1.1", "PCI-11.3.1", "PCI-11.3.2", "PCI-11.5.1", "PCI-12.10.2", "PCI-2.1.1", "PCI-2.2.6", "PCI-4.1.1", "PCI-5.1.1", "PCI-5.2.1", "PCI-5.3.1", "PCI-5.3.4", "PCI-6.1.1", "PCI-6.3.1", "PCI-6.3.3", "PCI-7.1.1", "PCI-8.1.1", "PCI-8.3.8", "PCI-9.1.1", "PCI-REQ-2", "PCI-REQ-5", "PCI-REQ-6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-1.2", "PCISSLC-1.3", "PCISSLC-2.3", "PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SCAGILE-EXP-3", "SCAGILE-EXP-8", "SCAGILE-EXP-9", "SCAGILE-OPS-1", "SCAGILE-OPS-2"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCFPSSD-CODING-STANDARDS", "SCFPSSD-FINDINGS", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 14, "ref_count": 13, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.7", "SSDF-PRACTICE-PW.9", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.3.2", "SSDF-TASK-PO.3.3", "SSDF-TASK-PO.4.1", "SSDF-TASK-PW.1.1", "SSDF-TASK-RV.2.1", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-001", "v1_entity_name": "Integrated Security Scanners", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
720
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 29, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-8.2", "SP800-53-CM-2.6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_2_A"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0005", "AML.T0011"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-121"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 9, "ref_count": 9, "refs": ["SP800-53-CA-8.2", "SP800-53-CM-2.6", "SP800-53-CM-4.1", "SP800-53-CP-4.3", "SP800-53-MP-6.2", "SP800-53-SA-11", "SP800-53-SA-17.6", "SP800-53-SI-6.2", "SP800-53-SR-6.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 13, "ref_count": 13, "refs": ["DSOMM-ACTIVITY-0CB2C39A3CEC4353B3AB8D70DAF4C9D2", "DSOMM-ACTIVITY-46D6A2A8F9DC4C159FC81723CFECBDDC", "DSOMM-ACTIVITY-58825D221CE64748AF810EC9956E4129", "DSOMM-ACTIVITY-598897A2358E441F984CE12EC4F6110A", "DSOMM-ACTIVITY-61E10F9CE1264FFAAF12FDBE0D0A831F", "DSOMM-ACTIVITY-6532C1FE9D2342288722558DDABCA7D4", "DSOMM-ACTIVITY-7BB7076493924462935DE55B2E148199", "DSOMM-ACTIVITY-8FC3DE677B8D420B8D24F35928CFED6E", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-AB5725AA4D5347B996DFC14B3FA93BCD", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415", "DSOMM-ACTIVITY-C6E3C81256E241B0AE01B7AFC41A004C", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-REQ-10"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-7"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-BUILD-L3"], "substrate_source_key": "slsa_spec_v1_0_build_track"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-002", "v1_entity_name": "Test Execution Surfaces", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
721
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 27, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.9", "SP800-53-AU-10.3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-1.3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.M0001"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-5"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a8"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 12, "ref_count": 12, "refs": ["SP800-53-AC-3.9", "SP800-53-AU-10.3", "SP800-53-CM-10", "SP800-53-CM-7.5", "SP800-53-MP-8.3", "SP800-53-PE-3", "SP800-53-PM-25", "SP800-53-SA-10.6", "SP800-53-SA-8.19", "SP800-53-SC-18.2", "SP800-53-SC-50", "SP800-53-SI-8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-77FFC53E9F3D41F492D302F04F9B6B0F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCI-1.2.2", "PCI-1.3.1", "PCI-1.3.2", "PCI-11.4.5", "PCI-9.2.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LIFECYCLE-FEEDBACK"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DELIVERY"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRINCIPLE-PREFER-ATTESTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PS.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-003", "v1_entity_name": "CI/CD Gate And Release Promotion", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
722
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 95, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AU-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17", "CIS-17.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-2.1.2", "PCI-6.5.2"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 22, "ref_count": 9, "refs": ["CIS-17", "CIS-17.1", "CIS-17.2", "CIS-17.3", "CIS-17.4", "CIS-17.5", "CIS-17.6", "CIS-17.8", "CIS-17.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-1118"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-316b1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 63, "ref_count": 48, "refs": ["SP800-53-AC-4.9", "SP800-53-AU-1", "SP800-53-AU-10.4", "SP800-53-AU-2.3", "SP800-53-AU-5", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.3", "SP800-53-AU-6.4", "SP800-53-AU-7", "SP800-53-CA-1", "SP800-53-CA-5", "SP800-53-CA-7.5", "SP800-53-CM-3.1", "SP800-53-CM-3.7", "SP800-53-CP-1", "SP800-53-CP-2", "SP800-53-IR-1", "SP800-53-IR-3.2", "SP800-53-IR-3.3", "SP800-53-IR-4.1", "SP800-53-IR-5.1", "SP800-53-IR-6.1", "SP800-53-IR-8.1", "SP800-53-MA-1", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-24", "SP800-53-PM-4", "SP800-53-PT-1", "SP800-53-RA-1", "SP800-53-SA-1", "SP800-53-SA-10", "SP800-53-SA-12.7", "SP800-53-SA-15.10", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-11", "SP800-53-SI-17", "SP800-53-SI-2", "SP800-53-SI-2.3", "SP800-53-SI-2.4", "SP800-53-SI-2.7", "SP800-53-SI-4.24", "SP800-53-SI-7.2", "SP800-53-SI-7.5", "SP800-53-SI-7.7", "SP800-53-SI-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1", "DSOMM-ACTIVITY-EA6F69F754A54922AC15A77FF0C16162"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 30, "ref_count": 16, "refs": ["SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_2_B", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_IM_3_B", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCI-10.4.3", "PCI-11.1.2", "PCI-12.10.5", "PCI-12.10.7", "PCI-12.5.2", "PCI-2.1.2", "PCI-6.5.2", "PCI-9.3.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-10.1", "PCISSLC-4.2", "PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-PRACTICE-PO.3", "SSDF-TASK-PO.4.2", "SSDF-TASK-PW.7.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-004", "v1_entity_name": "Findings Workflow And Exception Governance", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
723
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 12, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-71699DAFB2A4466BA0B289F7DBB18506", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2", "SP800-53-CM-8"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-MEASURE-4.3", "NIST-AI-RMF-MANAGE-4.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-O_EM_3_A"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-CM-2", "SP800-53-CM-8", "SP800-53-SA-11.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4", "DSOMM-ACTIVITY-71699DAFB2A4466BA0B289F7DBB18506", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B", "DSOMM-ACTIVITY-EE68331F9B1D4F61844BB2EA04753A84", "DSOMM-ACTIVITY-F4FF841D3B2A45D9853E5EC7ECBCB054"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-O_EM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-10", "SCAGILE-OPS-4"], "substrate_source_key": "safecode_agile_2012"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-TSV-005", "v1_entity_name": "Static Analysis Profile Management", "v1_entity_type": "Mechanism", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
724
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 28, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-8.5", "SP800-53-PL-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-420"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-16.14"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-420"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-16.14"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 20, "ref_count": 14, "refs": ["SP800-53-CP-8.5", "SP800-53-PL-2", "SP800-53-PM-28", "SP800-53-PM-30", "SP800-53-PM-4", "SP800-53-PM-9", "SP800-53-PS-2", "SP800-53-RA-10", "SP800-53-RA-3", "SP800-53-RA-3.1", "SP800-53-RA-5.9", "SP800-53-SA-8.13", "SP800-53-SC-30.2", "SP800-53-SR-6.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 7, "ref_count": 7, "refs": ["SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B", "SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_SM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-12.3.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-5"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-001", "v1_entity_name": "Risk-Proportional Security Testing Strategy", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
725
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 8, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B", "DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-11.1"]}, {"source_display_name": "SAFECode Agile", "substrate_source": "safecode", "visible_refs": ["SCAGILE-OPS-4"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-SA-11.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B", "DSOMM-ACTIVITY-EE68331F9B1D4F61844BB2EA04753A84", "DSOMM-ACTIVITY-F4FF841D3B2A45D9853E5EC7ECBCB054"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-4"], "substrate_source_key": "safecode_agile_2012"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-002", "v1_entity_name": "Static Analysis Signal Quality And Baseline Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
726
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 66, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.5", "SP800-53-AU-6"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.3.2", "PCI-3.3.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-54", "CAPEC-144"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 5, "refs": ["ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7", "ASVS-REQ-V15.4.2", "ASVS-REQ-V15.4.3", "ASVS-REQ-V16.5.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-144", "CAPEC-54"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-17.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-358", "CWE-414"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 27, "ref_count": 26, "refs": ["SP800-53-AC-3.5", "SP800-53-AU-6", "SP800-53-CP-13", "SP800-53-CP-2", "SP800-53-IR-8.1", "SP800-53-MA-4", "SP800-53-MA-4.6", "SP800-53-PE-13.4", "SP800-53-PM-1", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-RA-5.4", "SP800-53-SA-10", "SP800-53-SC-7.24", "SP800-53-SI-1", "SP800-53-SI-13.5", "SP800-53-SI-17", "SP800-53-SI-2", "SP800-53-SI-2.3", "SP800-53-SI-3.2", "SP800-53-SI-4", "SP800-53-SI-7.2", "SP800-53-SI-7.5", "SP800-53-SI-7.7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 4, "ref_count": 2, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-O_IM_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 21, "ref_count": 21, "refs": ["PCI-10.4.3", "PCI-11.5.2", "PCI-12.10.5", "PCI-12.10.7", "PCI-12.4.1", "PCI-12.4.2", "PCI-12.5.3", "PCI-12.8.1", "PCI-12.8.3", "PCI-12.8.4", "PCI-12.8.5", "PCI-3.3.2", "PCI-3.3.3", "PCI-3.6.1", "PCI-5.1.2", "PCI-5.2.3", "PCI-5.4.1", "PCI-6.4.3", "PCI-6.5.2", "PCI-7.2.5", "PCI-8.2.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.4", "PCISSLC-4.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-003", "v1_entity_name": "Security Finding Triage And Correction Closure", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
727
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 47, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.4.1", "ASVS-REQ-V1.4.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57"]}], "es_grounding_sources_full": [{"claim_count": 9, "ref_count": 9, "refs": ["ASVS-REQ-V1.4.1", "ASVS-REQ-V1.4.3", "ASVS-REQ-V15.1.1", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.1.4", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.2.2", "ASVS-REQ-V16.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-190", "CAPEC-690"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-16.11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-215", "CWE-494"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SP800-53-AU-12.1", "SP800-53-PM-6", "SP800-53-SA-10.4", "SP800-53-SI-7.13"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-C6E3C81256E241B0AE01B7AFC41A004C"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 17, "ref_count": 7, "refs": ["SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 6, "ref_count": 5, "refs": ["PCI-10.3.2", "PCI-10.3.3", "PCI-5.2.1", "PCI-5.3.4", "PCI-6.2.3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-9"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 6, "ref_count": 6, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-L3", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION", "SLSA-PRINCIPLE-TRUST-CODE", "SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-TASK-PW.6.1", "SSDF-TASK-PW.8.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-004", "v1_entity_name": "Reproducible Security Test Evidence And Build Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
728
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 15, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054", "AML.T0073"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-3", "SP800-53-CM-3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-443", "CAPEC-671"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-443", "CAPEC-671", "CAPEC-672", "CAPEC-681"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-179", "CWE-408"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SP800-53-CM-3", "SP800-53-CM-3.5", "SP800-53-CM-8.3", "SP800-53-RA-5.7", "SP800-53-SR-7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-6.5.5"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-005", "v1_entity_name": "Staged Dynamic Validation And Release Gate Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
729
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 19, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-2.1", "NIST-AI-100-2-E2025-2.1.3"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0001", "AML.T0016.000"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-5E0FF85BEC894EF096B15695FA0025DC"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-28", "CAPEC-100"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-100", "CAPEC-28", "CAPEC-670"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-IR-4.13", "SP800-53-RA-5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 6, "refs": ["DSOMM-ACTIVITY-2EBFC4218C76415CA3B0FA518915BD10", "DSOMM-ACTIVITY-5E0FF85BEC894EF096B15695FA0025DC", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F2F0F274C1A0450192FE7FC4452BC8AD"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-RISK-LANDSCAPE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-V_RT_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-11.4.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-3"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-PRACTICE-RV.3", "SSDF-TASK-RV.3.1", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-006", "v1_entity_name": "Specialized Empirical Testing Depth And Regression Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
730
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 13, "es_grounding_resolution": {"authored_more_sources_count": 13, "authored_visible_source_count": 4, "resolved_ref_count": 59, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-6.2", "SP800-53-CA-4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-1.3", "PCISSLC-2.3"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V11.6.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-184", "CAPEC-330", "CAPEC-440"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 4, "ref_count": 2, "refs": ["CIS-14.1", "CIS-18.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a5"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 17, "ref_count": 17, "refs": ["SP800-53-AU-6.2", "SP800-53-CA-4", "SP800-53-CP-9.1", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-11.7", "SP800-53-SA-4.6", "SP800-53-SA-8.8", "SP800-53-SA-9.1", "SP800-53-SC-16.1", "SP800-53-SC-16.2", "SP800-53-SI-2", "SP800-53-SI-4", "SP800-53-SI-4.9", "SP800-53-SI-6.1", "SP800-53-SI-7", "SP800-53-SI-7.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 8, "ref_count": 8, "refs": ["DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0", "DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-31833D5635AF4EF39300F23D27646CE7", "DSOMM-ACTIVITY-35446784761040D9AF9ED43F3173BF8C", "DSOMM-ACTIVITY-58C46807FEE9448BB6DD8050C464AB52", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-BFDB576EA4164EC696FEA078D58B2FF8", "DSOMM-ACTIVITY-F88D1B173D7D4C3D8139AD44FC4942D4"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 17, "ref_count": 12, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-1.2.6", "PCI-12.6.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["PCISSLC-1.3", "PCISSLC-2.3", "PCISSLC-2.4", "PCISSLC-2.5", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-15"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-PLANNING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEVELOPMENT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PO.1.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-TSV-007", "v1_entity_name": "Security Testing And Empirical Assurance Integrity", "v1_entity_type": "ControlObjective", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
731
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 77, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CA-2", "SP800-53-CA-7.4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SR_1_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-7", "CIS-7.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-6", "PCI-5.2.3"]}], "es_grounding_sources_full": [{"claim_count": 12, "ref_count": 8, "refs": ["CIS-14.1", "CIS-14.9", "CIS-16.14", "CIS-18.1", "CIS-7", "CIS-7.1", "CIS-7.5", "CIS-7.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 5, "ref_count": 3, "refs": ["NIS2-ART-20", "NIS2-ART-21", "NIS2-ART-22"], "substrate_source_key": "eu_nis2"}, {"claim_count": 48, "ref_count": 32, "refs": ["SP800-53-CA-2", "SP800-53-CA-7.4", "SP800-53-CA-8", "SP800-53-CP-10.1", "SP800-53-CP-10.3", "SP800-53-CP-12", "SP800-53-CP-4", "SP800-53-CP-4.1", "SP800-53-CP-4.3", "SP800-53-CP-7.5", "SP800-53-PE-3.6", "SP800-53-PL-2", "SP800-53-PL-3", "SP800-53-PL-6", "SP800-53-PM-1", "SP800-53-PM-14", "SP800-53-PM-28", "SP800-53-PM-29", "SP800-53-PM-8", "SP800-53-PM-9", "SP800-53-PS-2", "SP800-53-RA-1", "SP800-53-RA-10", "SP800-53-RA-3", "SP800-53-RA-5", "SP800-53-RA-5.3", "SP800-53-RA-5.6", "SP800-53-RA-5.9", "SP800-53-SA-11.2", "SP800-53-SA-15.4", "SP800-53-SA-8.25", "SP800-53-SR-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-0EC92899A5CB4649984B2FB1D6C784AD", "DSOMM-ACTIVITY-6217FE115ED74CF49DE4555BCFA6FE87", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D", "DSOMM-ACTIVITY-DD5ED7C1BDBF400FB75F6D3953A1A04E"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C1"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 20, "ref_count": 15, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_PC_2_A", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_RT_3_A", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCI-11.4.1", "PCI-12.3.2", "PCI-5.2.3", "PCI-5.3.1", "PCI-6.3.1", "PCI-REQ-6"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-PLANNING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 6, "ref_count": 5, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PW.1", "SSDF-TASK-PW.1.1", "SSDF-TASK-RV.2.1", "SSDF-TASK-RV.2.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-001", "v1_entity_name": "Risk-Based Security Test Planning", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
732
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 16, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B"]}, {"source_display_name": "SAFECode Agile", "substrate_source": "safecode", "visible_refs": ["SCAGILE-OPS-4", "SCAGILE-OPS-9"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-190", "CAPEC-191"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-SA-11.1", "SP800-53-SA-11.8"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-190", "CAPEC-191"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-16.12"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["SP800-53-SA-11.1", "SP800-53-SA-11.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 7, "ref_count": 7, "refs": ["DSOMM-ACTIVITY-297BE0018D9441EEAB29207020D423C0", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-6C05C8378C9946E2828B7C903E27DBA4", "DSOMM-ACTIVITY-D17DBFF01F10492AB4C717BB59A0A711", "DSOMM-ACTIVITY-E237176BBEC5447DA926E37D6DD60E4B", "DSOMM-ACTIVITY-EE68331F9B1D4F61844BB2EA04753A84", "DSOMM-ACTIVITY-F4FF841D3B2A45D9853E5EC7ECBCB054"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-V_AA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-EXP-10", "SCAGILE-OPS-4", "SCAGILE-OPS-9"], "substrate_source_key": "safecode_agile_2012"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-002", "v1_entity_name": "Governed Static Analysis Execution", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
733
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 22, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-CA-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-15.5"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-15.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 12, "ref_count": 11, "refs": ["SP800-53-AU-1", "SP800-53-CA-1", "SP800-53-CA-7.2", "SP800-53-CA-7.5", "SP800-53-CP-1", "SP800-53-IR-1", "SP800-53-MA-1", "SP800-53-SA-1", "SP800-53-SA-12.7", "SP800-53-SI-1", "SP800-53-SI-17"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 15, "ref_count": 7, "refs": ["SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-O_EM_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PO.4.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-003", "v1_entity_name": "Findings Triage, SLA And Retest Closure", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
734
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 6, "es_grounding_resolution": {"authored_more_sources_count": 6, "authored_visible_source_count": 4, "resolved_ref_count": 37, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2.1", "SP800-53-AU-3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.2.2", "PCI-10.3.3"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}], "es_grounding_sources_full": [{"claim_count": 10, "ref_count": 6, "refs": ["CIS-11.1", "CIS-11.5", "CIS-3.1", "CIS-8", "CIS-8.1", "CIS-8.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 23, "ref_count": 22, "refs": ["SP800-53-AU-10", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-12.1", "SP800-53-AU-12.2", "SP800-53-AU-14.2", "SP800-53-AU-2.1", "SP800-53-AU-3", "SP800-53-AU-3.2", "SP800-53-AU-4", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.3", "SP800-53-AU-6.5", "SP800-53-AU-7", "SP800-53-AU-7.2", "SP800-53-AU-9.3", "SP800-53-CP-9.1", "SP800-53-IA-12", "SP800-53-PM-25", "SP800-53-SI-12.2", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_DM_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCI-10.2.2", "PCI-10.3.3", "PCI-10.5.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-004", "v1_entity_name": "Reproducible Test Evidence Management", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
735
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 44, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.12", "SP800-53-CM-3.5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-121", "CAPEC-443"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.TA0001", "AML.T0011.000"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V13.3.3", "ASVS-REQ-V15.2.3", "ASVS-REQ-V2.4.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 12, "ref_count": 12, "refs": ["CAPEC-121", "CAPEC-443", "CAPEC-445", "CAPEC-516", "CAPEC-537", "CAPEC-671", "CAPEC-672", "CAPEC-673", "CAPEC-674", "CAPEC-680", "CAPEC-681", "CAPEC-702"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 15, "ref_count": 15, "refs": ["SP800-53-AC-3.12", "SP800-53-CM-3.5", "SP800-53-CM-5.1", "SP800-53-CM-7.7", "SP800-53-CM-8.3", "SP800-53-IA-3.4", "SP800-53-MP-8.2", "SP800-53-PE-3", "SP800-53-SA-10.4", "SP800-53-SA-11.9", "SP800-53-SA-8.26", "SP800-53-SA-8.30", "SP800-53-SC-31.1", "SP800-53-SI-6.2", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-7BB7076493924462935DE55B2E148199", "DSOMM-ACTIVITY-CB6321AA0FBF49969E0805AB26EF4C1E", "DSOMM-ACTIVITY-DCCF1949B9A84CE8B9926A4A7F3A623A"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 10, "ref_count": 6, "refs": ["SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-11.4.4", "PCI-6.5.5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-4", "SCAGILE-OPS-15"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LIFECYCLE-FEEDBACK"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-005", "v1_entity_name": "Staged Dynamic Testing And Gate Enforcement", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
736
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 15, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PW.8", "SSDF-PRACTICE-RV.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-28", "CAPEC-215"]}, {"source_display_name": "NIST AI 100-2 e2025", "substrate_source": "nist_ai_100_2", "visible_refs": ["NIST-AI-100-2-E2025-3.3.1", "NIST-AI-100-2-E2025-3.6"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0001", "AML.M0008"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-215", "CAPEC-261", "CAPEC-28", "CAPEC-492"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-IR-4.13"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-87B54313FAFD4860930F5EF132B3E4AD", "DSOMM-ACTIVITY-D03BC41074A74E9282CBD01A020CB6BF"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-V_RT_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-TESTING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 6, "ref_count": 6, "refs": ["SSDF-PRACTICE-PW.8", "SSDF-PRACTICE-RV.1", "SSDF-PRACTICE-RV.3", "SSDF-TASK-PW.8.1", "SSDF-TASK-RV.3.1", "SSDF-TASK-RV.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-006", "v1_entity_name": "Specialized Empirical Testing", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
737
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_resolution": {"authored_more_sources_count": 11, "authored_visible_source_count": 4, "resolved_ref_count": 67, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.9", "SP800-53-AU-6.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.2", "PCI-5.4.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-I_SD_2_A"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-2.6", "PCISSLC-6.2"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CIS-14.7", "CIS-17.6"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-358"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 2, "ref_count": 2, "refs": ["HIPAA-164-308a6", "HIPAA-164-308a8"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 36, "ref_count": 32, "refs": ["SP800-53-AC-4.9", "SP800-53-AU-6.2", "SP800-53-CA-3.1", "SP800-53-CA-3.2", "SP800-53-CA-3.3", "SP800-53-CA-4", "SP800-53-CM-3.7", "SP800-53-IA-9.2", "SP800-53-IR-10", "SP800-53-PE-6", "SP800-53-PS-1", "SP800-53-PS-4.2", "SP800-53-PS-6", "SP800-53-RA-5.11", "SP800-53-RA-5.2", "SP800-53-SA-10", "SP800-53-SA-11.6", "SP800-53-SA-21.1", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-2.2", "SP800-53-SI-4", "SP800-53-SI-4.24", "SP800-53-SI-4.5", "SP800-53-SI-4.7", "SP800-53-SI-5.1", "SP800-53-SI-6.1", "SP800-53-SI-6.3", "SP800-53-SI-7.7", "SP800-53-SR-10"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 5, "ref_count": 5, "refs": ["SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_3_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCI-1.2.2", "PCI-10.4.1", "PCI-10.7.3", "PCI-11.3.1", "PCI-12.10.5", "PCI-12.8.3", "PCI-12.8.4", "PCI-5.4.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-2.6", "PCISSLC-6.2", "PCISSLC-8.3", "PCISSLC-9.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-EXP-2", "SCAGILE-OPS-16", "SCAGILE-OPS-2"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-TESTING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PW.7", "SSDF-TASK-PW.7.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (final, release, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-TSV-007", "v1_entity_name": "Human Review Of Security Test Signals", "v1_entity_type": "Practice", "v1_family": "ACO-TSV", "v1_slice": "ASC-04"}
738
738
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 ST maturity; DSOMM testing activities", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
739
739
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de Testes de Segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
740
740
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "Catálogo requisitos com componentes meta-testing", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "ExternalFramework", "rastreabilidade_role": "manual_only_coverage"}
@@ -770,33 +770,33 @@
770
770
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "11-deploy-seguro:validacoes-tecnicas-pre-deploy-com-gates-condicionais", "manual_v2_entity_label": "Validações técnicas pré-deploy com *gates* condicionais", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
771
771
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "deterministic", "manual_v2_entity_id": "11-deploy-seguro:versionamento-semantico-e-changelog-tecnico", "manual_v2_entity_label": "Versionamento semântico e *changelog* técnico", "manual_v2_entity_type": "Practice", "manual_v2_source_mode": "explicit", "rastreabilidade_role": "manual_v2_entity"}
772
772
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "normative", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "None", "manual_v2_entity_label": "hybrid", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
773
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.9", "SP800-53-AC-22"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-677"]}, {"source_display_name": "SAFECode SIC", "substrate_source": "safecode", "visible_refs": ["SCSIC-SOURCING"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-001", "v1_entity_name": "Release Promotion Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
774
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MA-2", "SP800-53-MA-3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-184", "CWE-807"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.6", "NIST-AI-RMF-GOVERN-1.7"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0029"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (gate, gates, promotion kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-002", "v1_entity_name": "Approval Gates And Separation Of Signal From Promotion Decision", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
775
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-10.5", "SP800-53-CM-14"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-459", "CAPEC-475"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (identity, promotion, provenance kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-003", "v1_entity_name": "Provenance And Signature Verification At Promotion", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
776
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CM-3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-I_DM_1_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A511799B045E4B9698437D63D8C1E2AD", "DSOMM-ACTIVITY-C72DA77986CC45B1A339190CE5093171"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-004", "v1_entity_name": "Rollback And Containment Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
777
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-6.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-I_SB_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-8.1"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (audit, deploy, deployment kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-005", "v1_entity_name": "Deployment Pipeline Traceability And Audit Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
778
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-1", "SP800-53-CM-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-I_SB_1_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-523", "CAPEC-524"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.1", "CIS-4.2"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-008", "v1_entity_name": "Baseline Configuration Template Or Policy Bundle", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
779
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.11"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-13"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.1", "ASVS-REQ-V2.2.2"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-009", "v1_entity_name": "Gate Or Policy Check For Prohibited Or Unsafe Overrides", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
780
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-3.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-6.2.3", "PCI-6.5.1"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (baseline, change, record kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-010", "v1_entity_name": "Change Review Control For Security-Relevant Baseline Deviations", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
781
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-14"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.5"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-212", "CWE-283"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1", "PCISSLC-7.1"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-001", "v1_entity_name": "Release Authorization And Irreversible Change Accountability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
782
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MP-3", "SP800-53-SA-3.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-523", "CAPEC-524"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-002", "v1_entity_name": "Verified Artifact Promotion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
783
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-003", "v1_entity_name": "Pre-Promotion Security Gates And Staging Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
784
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-5", "SP800-53-MA-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_3_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.4", "ASVS-REQ-V13.4.5"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-004", "v1_entity_name": "End-to-End Deployment Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
785
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CP-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-7.7", "CIS-11.5"]}, {"source_display_name": "EU DORA", "substrate_source": "eu_dora", "visible_refs": ["DORA-ART-12"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-005", "v1_entity_name": "Tested Rollback Readiness And Reversibility", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
786
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PE-3.6"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-006", "v1_entity_name": "Controlled Rollout And Blast-Radius Containment", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
787
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.9", "SP800-53-MP-8.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-439"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.11"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1341"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-007", "v1_entity_name": "Release Promotion And Reversible Rollout Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
788
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1188"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-2.2.2"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-008", "v1_entity_name": "Secure Defaults And Hardened Baseline Selection", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
789
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 21, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-12", "CAPEC-13"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.6", "CIS-3"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-009", "v1_entity_name": "Security-Relevant Configuration Integrity And Override Control", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
790
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.3.4", "PCI-10.4.1"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-TASK-PO.4.1", "SSDF-TASK-PW.7.2"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-010", "v1_entity_name": "Baseline Review, Exception Visibility And Change Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
791
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-1", "SP800-53-AU-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17.3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-283"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-001", "v1_entity_name": "Accountable Release Approval", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
792
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-10.5", "SP800-53-IA-4.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-476", "CAPEC-523"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (artifact, identity, promotion kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-002", "v1_entity_name": "Verified Artifact Promotion", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
793
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.4"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0020"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-12"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (gate, gates, policy kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-003", "v1_entity_name": "Pre-Promotion Gates And Staging Validation", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
794
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8.2", "SP800-53-CM-8.7"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_2_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.4", "ASVS-REQ-V13.4.5"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-004", "v1_entity_name": "End-to-End Deploy Traceability", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
795
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-11", "CIS-11.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CP-4.4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_OM_3_A"]}, {"source_display_name": "SAFECode FPSSD", "substrate_source": "safecode", "visible_refs": ["SCFPSSD-TESTING"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (production, rollback, rollout kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-005", "v1_entity_name": "Tested Rollback Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
796
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "EU DORA", "substrate_source": "eu_dora", "visible_refs": ["DORA-ART-5"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (change, progressive, rollout kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-006", "v1_entity_name": "Progressive Rollout And Containment", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
797
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-16", "SP800-53-AC-16.7"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-8"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (baseline, components, define kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-008", "v1_entity_name": "Define Hardened Baseline Profiles For Security-Relevant Components", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
798
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-12", "PCI-1.2.7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.1", "CIS-4.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-69", "CAPEC-122"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (change, deployment, promotion kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-009", "v1_entity_name": "Review Security-Relevant Overrides Before Promotion Or Deployment", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
799
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.12"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-3.8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-6.5.2", "PCI-9.3.1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V7.5.1", "ASVS-REQ-V14.2.7"]}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (baseline, record, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-010", "v1_entity_name": "Record And Periodically Review Exceptions Against The Intended Baseline", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
773
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 17, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.9", "SP800-53-AC-22"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-677"]}, {"source_display_name": "SAFECode SIC", "substrate_source": "safecode", "visible_refs": ["SCSIC-SOURCING"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-677"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 16, "ref_count": 15, "refs": ["SP800-53-AC-22", "SP800-53-AC-3.9", "SP800-53-AT-3.1", "SP800-53-IR-9.4", "SP800-53-MP-1", "SP800-53-MP-5.1", "SP800-53-MP-6.4", "SP800-53-MP-8.3", "SP800-53-SA-12", "SP800-53-SI-8", "SP800-53-SR-1", "SP800-53-SR-11", "SP800-53-SR-2", "SP800-53-SR-3", "SP800-53-SR-3.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-SOURCING"], "substrate_source_key": "safecode_sic_2010"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-001", "v1_entity_name": "Release Promotion Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
774
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 8, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MA-2", "SP800-53-MA-3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-184", "CWE-807"]}, {"source_display_name": "NIST AI RMF 1.0", "substrate_source": "nist_ai_rmf", "visible_refs": ["NIST-AI-RMF-GOVERN-1.6", "NIST-AI-RMF-GOVERN-1.7"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0029"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CWE-184", "CWE-807", "CWE-841"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SP800-53-MA-2", "SP800-53-MA-3", "SP800-53-PM-1", "SP800-53-PT-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PO.4.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (gate, gates, promotion kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-002", "v1_entity_name": "Approval Gates And Separation Of Signal From Promotion Decision", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
775
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 53, "resolved_source_count": 11, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-10.5", "SP800-53-CM-14"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-459", "CAPEC-475"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["ASVS-REQ-V11.1.2", "ASVS-REQ-V11.1.3", "ASVS-REQ-V15.1.2", "ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1", "ASVS-REQ-V6.8.2", "ASVS-REQ-V9.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 7, "ref_count": 7, "refs": ["CAPEC-459", "CAPEC-475", "CAPEC-476", "CAPEC-485", "CAPEC-523", "CAPEC-524", "CAPEC-532"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 2, "ref_count": 1, "refs": ["CIS-2.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 6, "ref_count": 6, "refs": ["CWE-283", "CWE-347", "CWE-348", "CWE-353", "CWE-354", "CWE-494"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 14, "ref_count": 14, "refs": ["SP800-53-AU-10.5", "SP800-53-CM-14", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-13.2", "SP800-53-IA-5.14", "SP800-53-SA-12.10", "SP800-53-SA-12.3", "SP800-53-SA-13", "SP800-53-SA-19", "SP800-53-SC-16.1", "SP800-53-SI-19.7", "SP800-53-SI-7.4", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-5786959D0C6F46A68E1CA32FF1A50222", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SB_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-6.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DELIVERY-SIGNING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 8, "ref_count": 8, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS", "SLSA-PRINCIPLE-TRUST-PLATFORMS", "SLSA-PRODUCER-DISTRIBUTE-PROVENANCE", "SLSA-VERIFY-BUILD-LEVEL", "SLSA-VERIFY-EXPECTATIONS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.2", "SSDF-TASK-PW.4.4"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (identity, promotion, provenance kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-003", "v1_entity_name": "Provenance And Signature Verification At Promotion", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
776
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 66, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CM-3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3", "CIS-3.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-I_DM_1_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-A511799B045E4B9698437D63D8C1E2AD", "DSOMM-ACTIVITY-C72DA77986CC45B1A339190CE5093171"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-517", "CAPEC-518", "CAPEC-675"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 14, "ref_count": 13, "refs": ["CIS-11", "CIS-11.1", "CIS-11.2", "CIS-11.4", "CIS-17", "CIS-3", "CIS-3.1", "CIS-3.4", "CIS-4.11", "CIS-7.2", "CIS-7.3", "CIS-7.4", "CIS-7.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["DORA-ART-12", "DORA-ART-5", "DORA-ART-9"], "substrate_source_key": "eu_dora"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 31, "ref_count": 29, "refs": ["SP800-53-CM-2.3", "SP800-53-CM-3", "SP800-53-CM-8.2", "SP800-53-CP-10.2", "SP800-53-CP-10.4", "SP800-53-CP-10.6", "SP800-53-CP-2", "SP800-53-CP-2.5", "SP800-53-CP-2.6", "SP800-53-CP-7.4", "SP800-53-CP-9.2", "SP800-53-IR-4", "SP800-53-IR-4.2", "SP800-53-IR-4.3", "SP800-53-IR-9.3", "SP800-53-MA-1", "SP800-53-MA-2", "SP800-53-MP-8.2", "SP800-53-PL-2", "SP800-53-SA-3.1", "SP800-53-SA-3.2", "SP800-53-SA-8.29", "SP800-53-SI-12.3", "SP800-53-SI-13.1", "SP800-53-SI-13.5", "SP800-53-SI-2", "SP800-53-SI-2.4", "SP800-53-SR-12", "SP800-53-SR-9.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-066084C6113546359CC59E75C7C5459F", "DSOMM-ACTIVITY-A511799B045E4B9698437D63D8C1E2AD", "DSOMM-ACTIVITY-C72DA77986CC45B1A339190CE5093171", "DSOMM-ACTIVITY-F8E80F1825034E3EB3BC7F67BB28DEFE"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 13, "ref_count": 10, "refs": ["SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_B", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_B", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-O_OM_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-OPS-5"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PS.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-004", "v1_entity_name": "Rollback And Containment Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
777
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 81, "resolved_source_count": 12, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-6.3"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-I_SB_1_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-8.1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 11, "ref_count": 10, "refs": ["CIS-1", "CIS-13.6", "CIS-8.1", "CIS-8.12", "CIS-8.2", "CIS-8.3", "CIS-8.5", "CIS-8.7", "CIS-8.8", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 19, "ref_count": 19, "refs": ["SP800-53-AU-12", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-6.3", "SP800-53-AU-9.2", "SP800-53-AU-9.7", "SP800-53-CM-8.6", "SP800-53-MA-3", "SP800-53-MA-3.1", "SP800-53-MA-4.1", "SP800-53-PE-3", "SP800-53-RA-5", "SP800-53-SA-10.5", "SP800-53-SA-15", "SP800-53-SA-15.13", "SP800-53-SA-15.2", "SP800-53-SA-18.2", "SP800-53-SA-8.22", "SP800-53-SI-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 27, "ref_count": 27, "refs": ["DSOMM-ACTIVITY-08F27C262C6A47FE94585E88F188085D", "DSOMM-ACTIVITY-0CB2626BFB0D4A0F968857F787310D97", "DSOMM-ACTIVITY-0CB2C39A3CEC4353B3AB8D70DAF4C9D2", "DSOMM-ACTIVITY-0EC92899A5CB4649984B2FB1D6C784AD", "DSOMM-ACTIVITY-13E9757E58E24277BC0FEADC674891E6", "DSOMM-ACTIVITY-26E1C6D556324EC780D2E564B98732AD", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F", "DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-621FB6A55C0A4408826A068868BB031B", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-74938A3F126949B99D0FC43A79A1985A", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-830570280B774D2E813540969768AE88", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-A854B48D83BD4F8D8621A0BDD470837F", "DSOMM-ACTIVITY-CE970C9BDA9441CFBD788C15357B7E8E", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-DCCF1949B9A84CE8B9926A4A7F3A623A", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477", "DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-CONTINUOUS-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 19, "ref_count": 13, "refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCI-10.2.2", "PCI-10.3.3", "PCI-11.1.2", "PCI-5.1.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-2.4"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PO.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (audit, deploy, deployment kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-005", "v1_entity_name": "Deployment Pipeline Traceability And Audit Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
778
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 24, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-1", "SP800-53-CM-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-I_SB_1_A"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-523", "CAPEC-524"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.1", "CIS-4.2"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CAPEC-523", "CAPEC-524", "CAPEC-532"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-16.7", "CIS-4.1", "CIS-4.2"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 11, "ref_count": 10, "refs": ["SP800-53-CM-1", "SP800-53-CM-2", "SP800-53-CM-2.6", "SP800-53-CM-3", "SP800-53-CM-3.3", "SP800-53-CM-6", "SP800-53-CM-6.1", "SP800-53-SA-17.3", "SP800-53-SA-17.4", "SP800-53-SA-4.5"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 5, "ref_count": 4, "refs": ["SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SD_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.9.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-008", "v1_entity_name": "Baseline Configuration Template Or Policy Bundle", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
779
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 15, "es_grounding_resolution": {"authored_more_sources_count": 15, "authored_visible_source_count": 4, "resolved_ref_count": 228, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2.11"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-5"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-2", "CAPEC-13"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.2.1", "ASVS-REQ-V2.2.2"]}], "es_grounding_sources_full": [{"claim_count": 20, "ref_count": 20, "refs": ["ASVS-REQ-V11.4.2", "ASVS-REQ-V13.3.3", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.3.5", "ASVS-REQ-V15.4.2", "ASVS-REQ-V15.4.3", "ASVS-REQ-V16.3.3", "ASVS-REQ-V2.2.1", "ASVS-REQ-V2.2.2", "ASVS-REQ-V2.3.2", "ASVS-REQ-V2.4.1", "ASVS-REQ-V3.1.1", "ASVS-REQ-V6.1.1", "ASVS-REQ-V6.3.1", "ASVS-REQ-V6.3.5", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.4.2", "ASVS-REQ-V9.1.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 27, "ref_count": 22, "refs": ["CAPEC-122", "CAPEC-13", "CAPEC-180", "CAPEC-2", "CAPEC-212", "CAPEC-270", "CAPEC-35", "CAPEC-445", "CAPEC-522", "CAPEC-529", "CAPEC-537", "CAPEC-560", "CAPEC-578", "CAPEC-583", "CAPEC-600", "CAPEC-644", "CAPEC-653", "CAPEC-674", "CAPEC-678", "CAPEC-679", "CAPEC-681", "CAPEC-702"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 11, "ref_count": 11, "refs": ["CIS-10.2", "CIS-10.5", "CIS-13.4", "CIS-13.8", "CIS-13.9", "CIS-15.2", "CIS-16.1", "CIS-16.3", "CIS-18.4", "CIS-3.3", "CIS-4.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-267", "CWE-391", "CWE-654"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 3, "refs": ["HIPAA-164-308a5", "HIPAA-164-308a6", "HIPAA-164-316a"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 103, "ref_count": 84, "refs": ["SP800-53-AC-1", "SP800-53-AC-17.7", "SP800-53-AC-18.3", "SP800-53-AC-19.4", "SP800-53-AC-2.11", "SP800-53-AC-20", "SP800-53-AC-3", "SP800-53-AC-3.12", "SP800-53-AC-3.15", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.7", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.20", "SP800-53-AC-4.8", "SP800-53-AC-6.1", "SP800-53-AC-6.3", "SP800-53-AC-6.8", "SP800-53-CA-1", "SP800-53-CA-9.1", "SP800-53-CM-11", "SP800-53-CM-11.1", "SP800-53-CM-11.3", "SP800-53-CM-3.6", "SP800-53-CM-3.8", "SP800-53-CM-5.7", "SP800-53-CM-7.4", "SP800-53-CM-7.5", "SP800-53-CM-7.8", "SP800-53-CM-7.9", "SP800-53-CM-8.3", "SP800-53-CP-12", "SP800-53-IA-4.1", "SP800-53-IR-4.5", "SP800-53-MA-5.5", "SP800-53-MA-7", "SP800-53-PE-1", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.2", "SP800-53-PE-3.5", "SP800-53-PE-6.1", "SP800-53-PL-2", "SP800-53-PM-20.1", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-6.2", "SP800-53-RA-1", "SP800-53-RA-5.7", "SP800-53-SA-8.16", "SP800-53-SA-8.28", "SP800-53-SC-1", "SP800-53-SC-16.2", "SP800-53-SC-18", "SP800-53-SC-18.1", "SP800-53-SC-3.2", "SP800-53-SC-38", "SP800-53-SC-4.1", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-5.1", "SP800-53-SC-50", "SP800-53-SC-7.11", "SP800-53-SC-7.18", "SP800-53-SC-7.4", "SP800-53-SI-1", "SP800-53-SI-10.1", "SP800-53-SI-16", "SP800-53-SI-2.5", "SP800-53-SI-3", "SP800-53-SI-4.4", "SP800-53-SI-5", "SP800-53-SI-5.1", "SP800-53-SI-6", "SP800-53-SI-7.1", "SP800-53-SI-7.10"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 9, "ref_count": 9, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20B", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BMEDIUM", "DSOMM-ACTIVITY-F88D1B173D7D4C3D8139AD44FC4942D4"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-MINIMUM-BAR"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C7"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 29, "ref_count": 20, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-G_EG_1_A", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 45, "ref_count": 45, "refs": ["PCI-1.2.1", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.7.1", "PCI-11.1.1", "PCI-11.2.1", "PCI-11.5.1", "PCI-12.1.1", "PCI-12.1.2", "PCI-12.1.3", "PCI-12.2.1", "PCI-12.3.1", "PCI-12.3.4", "PCI-12.4.1", "PCI-12.4.2", "PCI-12.5.3", "PCI-12.8.1", "PCI-12.8.3", "PCI-12.8.5", "PCI-12.9.1", "PCI-12.9.2", "PCI-2.2.3", "PCI-2.2.7", "PCI-3.1.1", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.5", "PCI-3.7.7", "PCI-6.3.1", "PCI-6.3.3", "PCI-6.4.3", "PCI-6.5.5", "PCI-7.1.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.3.3", "PCI-8.1.1", "PCI-8.3.10", "PCI-8.3.6", "PCI-8.3.8", "PCI-8.6.3", "PCI-9.1.1", "PCI-REQ-1", "PCI-REQ-12", "PCI-REQ-5"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.2", "PCISSLC-3.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-EXP-2", "SCAGILE-OPS-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PW.1", "SSDF-TASK-PW.1.2", "SSDF-TASK-PW.8.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-009", "v1_entity_name": "Gate Or Policy Check For Prohibited Or Unsafe Overrides", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
780
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 7, "es_grounding_resolution": {"authored_more_sources_count": 7, "authored_visible_source_count": 4, "resolved_ref_count": 94, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-3.2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-6.2.3", "PCI-6.5.1"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V14.2.7", "ASVS-REQ-V7.5.1", "ASVS-REQ-V8.3.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-447"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 13, "ref_count": 10, "refs": ["CIS-16.4", "CIS-16.6", "CIS-17.9", "CIS-3.1", "CIS-3.2", "CIS-3.7", "CIS-3.8", "CIS-6.6", "CIS-6.8", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 60, "ref_count": 56, "refs": ["SP800-53-AC-1", "SP800-53-AC-16", "SP800-53-AC-16.9", "SP800-53-AC-2", "SP800-53-AC-2.12", "SP800-53-AC-2.4", "SP800-53-AC-2.7", "SP800-53-AC-4.23", "SP800-53-AC-4.26", "SP800-53-AC-4.9", "SP800-53-AC-9.3", "SP800-53-AU-1", "SP800-53-AU-10.4", "SP800-53-AU-11", "SP800-53-AU-12.3", "SP800-53-AU-13.2", "SP800-53-AU-2", "SP800-53-AU-2.3", "SP800-53-AU-3", "SP800-53-AU-6", "SP800-53-AU-6.10", "SP800-53-AU-6.2", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.6", "SP800-53-AU-7", "SP800-53-AU-9.5", "SP800-53-AU-9.6", "SP800-53-CA-1", "SP800-53-CA-3", "SP800-53-CA-7", "SP800-53-CA-7.3", "SP800-53-CM-3", "SP800-53-CM-3.7", "SP800-53-CM-5.2", "SP800-53-IA-1", "SP800-53-IA-6", "SP800-53-PM-24", "SP800-53-PM-31", "SP800-53-PM-9", "SP800-53-PS-2", "SP800-53-PS-6", "SP800-53-PT-3", "SP800-53-PT-6.1", "SP800-53-RA-1", "SP800-53-RA-5", "SP800-53-RA-5.8", "SP800-53-SA-10", "SP800-53-SA-4.8", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-18", "SP800-53-SI-2.3", "SP800-53-SI-2.7", "SP800-53-SI-4", "SP800-53-SI-4.21"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-0C10A7F7F78F49F2943D19FDEF248FED", "DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-9E3A7C2F1B4D4E8AA5C67F2B9D1E3A8C"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 11, "ref_count": 10, "refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-V_AA_3_B", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_A", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCI-10.4.1", "PCI-11.5.2", "PCI-11.6.1", "PCI-12.10.2", "PCI-6.2.3", "PCI-6.5.1", "PCI-6.5.2", "PCI-8.2.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (baseline, change, record kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-RPR-010", "v1_entity_name": "Change Review Control For Security-Relevant Baseline Deviations", "v1_entity_type": "Mechanism", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
781
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 49, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-14"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.2", "CIS-2.5"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-212", "CWE-283"]}, {"source_display_name": "PCI SSLC v1.1", "substrate_source": "pci_secure_slc", "visible_refs": ["PCISSLC-5.1", "PCISSLC-7.1"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V8.3.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 4, "ref_count": 4, "refs": ["CIS-2.2", "CIS-2.5", "CIS-6.2", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-212", "CWE-283"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a4"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 47, "ref_count": 38, "refs": ["SP800-53-AC-1", "SP800-53-AC-14", "SP800-53-AC-16", "SP800-53-AC-16.2", "SP800-53-AC-16.4", "SP800-53-AC-22", "SP800-53-AU-1", "SP800-53-AU-10", "SP800-53-AU-10.1", "SP800-53-AU-10.3", "SP800-53-AU-12.3", "SP800-53-AU-13.3", "SP800-53-AU-14.2", "SP800-53-AU-16.1", "SP800-53-AU-16.3", "SP800-53-AU-2.4", "SP800-53-AU-6", "SP800-53-AU-6.7", "SP800-53-AU-7", "SP800-53-AU-9.5", "SP800-53-CA-1", "SP800-53-CA-6", "SP800-53-CM-8.4", "SP800-53-CP-2", "SP800-53-CP-9.7", "SP800-53-MA-3", "SP800-53-PE-2", "SP800-53-PE-5.1", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-21", "SP800-53-PS-5", "SP800-53-PT-1", "SP800-53-PT-2", "SP800-53-PT-4.3", "SP800-53-SA-10", "SP800-53-SI-19.5", "SP800-53-SR-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-D_TA_2_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-5.1", "PCISSLC-7.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-001", "v1_entity_name": "Release Authorization And Irreversible Change Accountability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
782
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 30, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-MP-3", "SP800-53-SA-3.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-523", "CAPEC-524"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V15.1.2", "ASVS-REQ-V6.7.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 4, "ref_count": 4, "refs": ["CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-695"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-353"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 5, "ref_count": 5, "refs": ["SP800-53-MP-3", "SP800-53-SA-12.10", "SP800-53-SA-19", "SP800-53-SA-3.2", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 3, "ref_count": 3, "refs": ["DSOMM-ACTIVITY-5786959D0C6F46A68E1CA32FF1A50222", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SB_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DELIVERY-SIGNING", "SCSIC-SOURCING-OSS"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 8, "ref_count": 8, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS", "SLSA-PRINCIPLE-TRUST-PLATFORMS", "SLSA-PRODUCER-CHOOSE-BUILD-PLATFORM", "SLSA-PRODUCER-DISTRIBUTE-PROVENANCE", "SLSA-VERIFY-BUILD-LEVEL"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.2", "SSDF-TASK-PW.4.4"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-002", "v1_entity_name": "Verified Artifact Promotion", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
783
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 1, "resolved_ref_count": 0, "resolved_source_count": 0, "status": "entity_absent_in_substrate_index", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.T0054"]}], "es_grounding_sources_full": [], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-003", "v1_entity_name": "Pre-Promotion Security Gates And Staging Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
784
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 8, "es_grounding_resolution": {"authored_more_sources_count": 8, "authored_visible_source_count": 4, "resolved_ref_count": 37, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-IR-5", "SP800-53-MA-2"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_3_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.4", "ASVS-REQ-V13.4.5"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V13.4.4", "ASVS-REQ-V13.4.5", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-144"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-1", "CIS-13.6", "CIS-8.5"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 10, "ref_count": 9, "refs": ["SP800-53-IR-5", "SP800-53-MA-2", "SP800-53-MA-3", "SP800-53-MA-3.1", "SP800-53-MA-3.6", "SP800-53-SA-12.11", "SP800-53-SA-12.14", "SP800-53-SA-8.22", "SP800-53-SI-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 10, "ref_count": 10, "refs": ["DSOMM-ACTIVITY-0CB2C39A3CEC4353B3AB8D70DAF4C9D2", "DSOMM-ACTIVITY-0EC92899A5CB4649984B2FB1D6C784AD", "DSOMM-ACTIVITY-13E9757E58E24277BC0FEADC674891E6", "DSOMM-ACTIVITY-26E1C6D556324EC780D2E564B98732AD", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-830570280B774D2E813540969768AE88", "DSOMM-ACTIVITY-BC548CBACB824F76BD4B325D9D256279", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-GOVERNANCE-REGISTRY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 10, "ref_count": 7, "refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_OM_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-004", "v1_entity_name": "End-to-End Deployment Traceability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
785
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 11, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CP-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-7.7", "CIS-11.5"]}, {"source_display_name": "EU DORA", "substrate_source": "eu_dora", "visible_refs": ["DORA-ART-12"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["CIS-11.5", "CIS-18.3", "CIS-7.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-12"], "substrate_source_key": "eu_dora"}, {"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-CM-2.3", "SP800-53-CP-2", "SP800-53-CP-4.4", "SP800-53-CP-9.1", "SP800-53-CP-9.2", "SP800-53-RA-5", "SP800-53-SI-2"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-005", "v1_entity_name": "Tested Rollback Readiness And Reversibility", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
786
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 1, "resolved_ref_count": 1, "resolved_source_count": 1, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-PE-3.6"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-PE-3.6"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-006", "v1_entity_name": "Controlled Rollout And Blast-Radius Containment", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
787
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 10, "resolved_source_count": 7, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3.9", "SP800-53-MP-8.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-439"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.11"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1341"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-439"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CIS-4.11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-1341"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 4, "ref_count": 4, "refs": ["SP800-53-AC-3.9", "SP800-53-MP-8.3", "SP800-53-SI-19.3", "SP800-53-SR-12"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-O_OM_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PS.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-007", "v1_entity_name": "Release Promotion And Reversible Rollout Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
788
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 5, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1188"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-2.2.2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CWE-1188"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SB_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-2.2.2"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.9.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-008", "v1_entity_name": "Secure Defaults And Hardened Baseline Selection", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
789
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 21, "es_grounding_resolution": {"authored_more_sources_count": 21, "authored_visible_source_count": 4, "resolved_ref_count": 626, "resolved_source_count": 22, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-12", "CAPEC-13"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-2"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-2.6", "CIS-3"]}], "es_grounding_sources_full": [{"claim_count": 29, "ref_count": 28, "refs": ["ASVS-REQ-V1.2.6", "ASVS-REQ-V13.1.4", "ASVS-REQ-V13.2.2", "ASVS-REQ-V13.3.1", "ASVS-REQ-V13.3.2", "ASVS-REQ-V13.3.3", "ASVS-REQ-V13.4.2", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.2", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.1.1", "ASVS-REQ-V15.1.3", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.2.2", "ASVS-REQ-V15.2.3", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.3.4", "ASVS-REQ-V15.3.5", "ASVS-REQ-V15.3.7", "ASVS-REQ-V2.4.1", "ASVS-REQ-V3.1.1", "ASVS-REQ-V6.1.1", "ASVS-REQ-V6.3.1", "ASVS-REQ-V8.1.3", "ASVS-REQ-V8.2.4", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 106, "ref_count": 95, "refs": ["CAPEC-100", "CAPEC-104", "CAPEC-110", "CAPEC-113", "CAPEC-12", "CAPEC-122", "CAPEC-13", "CAPEC-14", "CAPEC-146", "CAPEC-159", "CAPEC-165", "CAPEC-166", "CAPEC-17", "CAPEC-176", "CAPEC-180", "CAPEC-187", "CAPEC-203", "CAPEC-207", "CAPEC-212", "CAPEC-22", "CAPEC-23", "CAPEC-242", "CAPEC-263", "CAPEC-270", "CAPEC-271", "CAPEC-278", "CAPEC-35", "CAPEC-36", "CAPEC-38", "CAPEC-384", "CAPEC-389", "CAPEC-390", "CAPEC-438", "CAPEC-44", "CAPEC-440", "CAPEC-441", "CAPEC-442", "CAPEC-443", "CAPEC-445", "CAPEC-446", "CAPEC-447", "CAPEC-46", "CAPEC-478", "CAPEC-51", "CAPEC-511", "CAPEC-516", "CAPEC-517", "CAPEC-518", "CAPEC-519", "CAPEC-521", "CAPEC-522", "CAPEC-523", "CAPEC-524", "CAPEC-529", "CAPEC-532", "CAPEC-533", "CAPEC-534", "CAPEC-536", "CAPEC-537", "CAPEC-539", "CAPEC-551", "CAPEC-552", "CAPEC-558", "CAPEC-562", "CAPEC-564", "CAPEC-578", "CAPEC-58", "CAPEC-582", "CAPEC-583", "CAPEC-61", "CAPEC-624", "CAPEC-638", "CAPEC-640", "CAPEC-647", "CAPEC-65", "CAPEC-655", "CAPEC-662", "CAPEC-665", "CAPEC-669", "CAPEC-670", "CAPEC-671", "CAPEC-673", "CAPEC-674", "CAPEC-677", "CAPEC-678", "CAPEC-679", "CAPEC-68", "CAPEC-680", "CAPEC-681", "CAPEC-69", "CAPEC-702", "CAPEC-74", "CAPEC-75", "CAPEC-77", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 68, "ref_count": 35, "refs": ["CIS-10", "CIS-10.1", "CIS-10.2", "CIS-10.5", "CIS-12.2", "CIS-13.5", "CIS-13.9", "CIS-15.4", "CIS-16", "CIS-16.1", "CIS-16.11", "CIS-16.2", "CIS-16.4", "CIS-16.5", "CIS-16.6", "CIS-16.7", "CIS-16.8", "CIS-16.9", "CIS-18.4", "CIS-2.6", "CIS-3", "CIS-3.1", "CIS-3.14", "CIS-3.2", "CIS-3.3", "CIS-3.7", "CIS-4", "CIS-4.1", "CIS-4.2", "CIS-4.6", "CIS-4.8", "CIS-4.9", "CIS-6.3", "CIS-6.6", "CIS-9.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 20, "ref_count": 20, "refs": ["CWE-1037", "CWE-1220", "CWE-15", "CWE-183", "CWE-213", "CWE-215", "CWE-250", "CWE-267", "CWE-268", "CWE-277", "CWE-290", "CWE-391", "CWE-455", "CWE-487", "CWE-497", "CWE-547", "CWE-649", "CWE-653", "CWE-654", "CWE-733"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 3, "ref_count": 3, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a5", "HIPAA-164-310a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 294, "ref_count": 253, "refs": ["SP800-53-AC-14.1", "SP800-53-AC-16", "SP800-53-AC-16.10", "SP800-53-AC-16.3", "SP800-53-AC-16.6", "SP800-53-AC-16.7", "SP800-53-AC-17.2", "SP800-53-AC-17.4", "SP800-53-AC-17.6", "SP800-53-AC-17.7", "SP800-53-AC-18.3", "SP800-53-AC-18.4", "SP800-53-AC-2", "SP800-53-AC-2.6", "SP800-53-AC-3.12", "SP800-53-AC-3.13", "SP800-53-AC-3.2", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.18", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.22", "SP800-53-AC-4.23", "SP800-53-AC-4.24", "SP800-53-AC-4.25", "SP800-53-AC-4.4", "SP800-53-AC-6.1", "SP800-53-AC-6.2", "SP800-53-AC-6.3", "SP800-53-AC-6.8", "SP800-53-AT-3.2", "SP800-53-CA-9.1", "SP800-53-CM-1", "SP800-53-CM-10", "SP800-53-CM-10.1", "SP800-53-CM-11", "SP800-53-CM-11.1", "SP800-53-CM-11.3", "SP800-53-CM-12.1", "SP800-53-CM-2", "SP800-53-CM-2.1", "SP800-53-CM-2.4", "SP800-53-CM-2.5", "SP800-53-CM-2.7", "SP800-53-CM-3", "SP800-53-CM-3.2", "SP800-53-CM-3.4", "SP800-53-CM-3.5", "SP800-53-CM-3.6", "SP800-53-CM-3.8", "SP800-53-CM-4", "SP800-53-CM-4.1", "SP800-53-CM-4.2", "SP800-53-CM-5", "SP800-53-CM-5.1", "SP800-53-CM-5.3", "SP800-53-CM-5.4", "SP800-53-CM-5.5", "SP800-53-CM-5.6", "SP800-53-CM-5.7", "SP800-53-CM-6", "SP800-53-CM-6.1", "SP800-53-CM-6.2", "SP800-53-CM-6.3", "SP800-53-CM-6.4", "SP800-53-CM-7.2", "SP800-53-CM-7.3", "SP800-53-CM-7.4", "SP800-53-CM-7.5", "SP800-53-CM-7.6", "SP800-53-CM-7.7", "SP800-53-CM-7.8", "SP800-53-CM-7.9", "SP800-53-CM-8", "SP800-53-CM-8.1", "SP800-53-CM-8.3", "SP800-53-CM-8.5", "SP800-53-CM-9", "SP800-53-CM-9.1", "SP800-53-CP-10.3", "SP800-53-CP-13", "SP800-53-CP-7.5", "SP800-53-CP-9.8", "SP800-53-IA-3.4", "SP800-53-IA-4.9", "SP800-53-IA-5.5", "SP800-53-IR-4.5", "SP800-53-MA-4", "SP800-53-MA-4.3", "SP800-53-MA-4.4", "SP800-53-MA-4.6", "SP800-53-MA-5.1", "SP800-53-MA-7", "SP800-53-MP-5.1", "SP800-53-MP-6.7", "SP800-53-PE-16", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.4", "SP800-53-PE-3.5", "SP800-53-PE-4", "SP800-53-PE-6.1", "SP800-53-PL-2", "SP800-53-PL-3", "SP800-53-PL-8", "SP800-53-PL-8.1", "SP800-53-PM-1", "SP800-53-PM-8", "SP800-53-PS-1", "SP800-53-PS-3.3", "SP800-53-PS-6.1", "SP800-53-PS-7", "SP800-53-RA-5", "SP800-53-RA-5.5", "SP800-53-SA-10", "SP800-53-SA-10.2", "SP800-53-SA-10.4", "SP800-53-SA-10.5", "SP800-53-SA-10.7", "SP800-53-SA-12.9", "SP800-53-SA-15", "SP800-53-SA-15.12", "SP800-53-SA-15.4", "SP800-53-SA-15.5", "SP800-53-SA-15.8", "SP800-53-SA-17", "SP800-53-SA-17.2", "SP800-53-SA-17.3", "SP800-53-SA-17.4", "SP800-53-SA-17.5", "SP800-53-SA-17.7", "SP800-53-SA-19.2", "SP800-53-SA-3", "SP800-53-SA-4.5", "SP800-53-SA-5.1", "SP800-53-SA-5.2", "SP800-53-SA-8", "SP800-53-SA-8.1", "SP800-53-SA-8.10", "SP800-53-SA-8.11", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.14", "SP800-53-SA-8.15", "SP800-53-SA-8.16", "SP800-53-SA-8.17", "SP800-53-SA-8.18", "SP800-53-SA-8.19", "SP800-53-SA-8.20", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SA-8.3", "SP800-53-SA-8.30", "SP800-53-SA-8.31", "SP800-53-SA-8.32", "SP800-53-SA-8.6", "SP800-53-SA-8.7", "SP800-53-SA-8.8", "SP800-53-SA-8.9", "SP800-53-SC-1", "SP800-53-SC-11", "SP800-53-SC-12.1", "SP800-53-SC-12.6", "SP800-53-SC-14", "SP800-53-SC-15.3", "SP800-53-SC-16", "SP800-53-SC-16.1", "SP800-53-SC-16.2", "SP800-53-SC-18", "SP800-53-SC-18.4", "SP800-53-SC-18.5", "SP800-53-SC-2.1", "SP800-53-SC-21.1", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.4", "SP800-53-SC-3.5", "SP800-53-SC-30.4", "SP800-53-SC-30.5", "SP800-53-SC-32.1", "SP800-53-SC-34", "SP800-53-SC-37.1", "SP800-53-SC-38", "SP800-53-SC-39", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-43", "SP800-53-SC-46", "SP800-53-SC-49", "SP800-53-SC-5.1", "SP800-53-SC-50", "SP800-53-SC-51", "SP800-53-SC-7", "SP800-53-SC-7.12", "SP800-53-SC-7.13", "SP800-53-SC-7.14", "SP800-53-SC-7.15", "SP800-53-SC-7.16", "SP800-53-SC-7.17", "SP800-53-SC-7.18", "SP800-53-SC-7.4", "SP800-53-SC-7.5", "SP800-53-SC-8", "SP800-53-SC-8.3", "SP800-53-SC-8.4", "SP800-53-SI-1", "SP800-53-SI-10.1", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-12.1", "SP800-53-SI-13.5", "SP800-53-SI-14.1", "SP800-53-SI-16", "SP800-53-SI-2", "SP800-53-SI-2.5", "SP800-53-SI-3", "SP800-53-SI-3.3", "SP800-53-SI-3.4", "SP800-53-SI-3.9", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.23", "SP800-53-SI-4.3", "SP800-53-SI-4.6", "SP800-53-SI-5", "SP800-53-SI-6", "SP800-53-SI-7.10", "SP800-53-SI-7.11", "SP800-53-SI-7.13", "SP800-53-SI-7.17", "SP800-53-SI-7.6", "SP800-53-SI-8.2", "SP800-53-SI-9", "SP800-53-SR-11.2", "SP800-53-SR-7", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 25, "ref_count": 25, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-12C90CC63D584D9B82FFD469D2A0C298", "DSOMM-ACTIVITY-13367D8FE37F4197A6109FFCA4FDE261", "DSOMM-ACTIVITY-29318D6018CE452680EAF5928E49F639", "DSOMM-ACTIVITY-3A94D55EFD8249969EB320D23FF2A873", "DSOMM-ACTIVITY-46D6A2A8F9DC4C159FC81723CFECBDDC", "DSOMM-ACTIVITY-67667C97C33E4306A4E5E7B1D8E10C5A", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-7BB7076493924462935DE55B2E148199", "DSOMM-ACTIVITY-7DE0AE33653845CD8222A1475647BA58", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-94A96F798BD6490497C0994FF88F176A", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-A511799B045E4B9698437D63D8C1E2AD", "DSOMM-ACTIVITY-AC8730A2CCC0465C9550D91EDAE9D5EE", "DSOMM-ACTIVITY-AE22DAFDBCD641EEBA018B7FE6FC1AD9", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-BFDACB521E3F431DAE72D844A5E86415", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B", "DSOMM-ACTIVITY-EB2C7F9DD0BD4253A2BACFF2ACE4A075", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BMEDIUM", "DSOMM-ACTIVITY-F57D55F2DC054B349D1FF8CE5BFB0715"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 3, "ref_count": 3, "refs": ["OWASP-MCP-DEPLOYMENT", "OWASP-MCP-GOVERNANCE", "OWASP-MCP-RISK-LANDSCAPE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-3P-AUTH-AUTHZ-REGISTRATION", "OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["MCP01-2025", "MCP02-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C1", "OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 56, "ref_count": 29, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_SR_2_B", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-D_SR_3_B", "SAMM-ACTIVITY-D_TA_3_B", "SAMM-ACTIVITY-G_EG_1_A", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_1_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_3_A", "SAMM-ACTIVITY-V_RT_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["TOP10-A05-2021", "TOP10-A06-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 94, "ref_count": 82, "refs": ["PCI-1.1.1", "PCI-1.2.1", "PCI-1.2.3", "PCI-1.2.6", "PCI-1.2.7", "PCI-1.3.2", "PCI-1.4.1", "PCI-1.4.4", "PCI-1.4.5", "PCI-1.5.1", "PCI-10.1.1", "PCI-10.7.1", "PCI-11.4.4", "PCI-12.2.1", "PCI-12.3.1", "PCI-12.4.2", "PCI-12.5.3", "PCI-2.1.1", "PCI-2.2.1", "PCI-2.2.3", "PCI-2.2.4", "PCI-2.2.5", "PCI-2.2.6", "PCI-2.2.7", "PCI-2.3.1", "PCI-3.7.2", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.7", "PCI-3.7.9", "PCI-4.1.1", "PCI-4.2.2", "PCI-5.1.1", "PCI-5.1.2", "PCI-5.2.1", "PCI-5.2.2", "PCI-5.2.3", "PCI-5.3.1", "PCI-5.3.2", "PCI-5.3.4", "PCI-5.3.5", "PCI-5.4.1", "PCI-6.1.1", "PCI-6.1.2", "PCI-6.3.1", "PCI-6.3.3", "PCI-6.4.1", "PCI-6.4.2", "PCI-6.4.3", "PCI-6.5.1", "PCI-6.5.3", "PCI-6.5.4", "PCI-6.5.5", "PCI-7.1.1", "PCI-7.2.2", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.1.1", "PCI-8.3.1", "PCI-8.3.10", "PCI-8.3.11", "PCI-8.3.2", "PCI-8.3.3", "PCI-8.3.4", "PCI-8.3.6", "PCI-8.3.7", "PCI-8.4.1", "PCI-8.4.2", "PCI-8.4.3", "PCI-8.6.2", "PCI-8.6.3", "PCI-9.1.1", "PCI-9.2.2", "PCI-9.2.4", "PCI-REQ-1", "PCI-REQ-12", "PCI-REQ-2", "PCI-REQ-5", "PCI-REQ-6", "PCI-REQ-7", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 10, "ref_count": 9, "refs": ["PCISSLC-1.2", "PCISSLC-1.3", "PCISSLC-2.2", "PCISSLC-2.3", "PCISSLC-3.3", "PCISSLC-6.1", "PCISSLC-8.1", "PCISSLC-8.2", "PCISSLC-9.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 9, "ref_count": 9, "refs": ["SCAGILE-EXP-11", "SCAGILE-EXP-12", "SCAGILE-EXP-8", "SCAGILE-EXP-9", "SCAGILE-OPS-12", "SCAGILE-OPS-13", "SCAGILE-OPS-14", "SCAGILE-OPS-16", "SCAGILE-OPS-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 6, "ref_count": 6, "refs": ["SCFPSSD-COMPILER", "SCFPSSD-DESIGN-PRINCIPLES", "SCFPSSD-PLANNING", "SCFPSSD-SECURITY-CONTROLS", "SCFPSSD-THIRD-PARTY", "SCFPSSD-THREAT-MODELING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DEV-REPO", "SCSIC-DEVELOPMENT"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 19, "ref_count": 16, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.6", "SSDF-PRACTICE-PW.9", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.3.2", "SSDF-TASK-PO.5.1", "SSDF-TASK-PW.1.2", "SSDF-TASK-PW.1.3", "SSDF-TASK-PW.4.2", "SSDF-TASK-PW.5.1", "SSDF-TASK-PW.6.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-009", "v1_entity_name": "Security-Relevant Configuration Integrity And Override Control", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
790
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_resolution": {"authored_more_sources_count": 11, "authored_visible_source_count": 4, "resolved_ref_count": 82, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-6"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.3.4", "PCI-10.4.1"]}, {"source_display_name": "SSDF v1.1", "substrate_source": "nist_ssdf", "visible_refs": ["SSDF-TASK-PO.4.1", "SSDF-TASK-PW.7.2"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 3, "refs": ["ASVS-REQ-V16.2.2", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 7, "ref_count": 5, "refs": ["CIS-16.4", "CIS-16.6", "CIS-17.9", "CIS-8.1", "CIS-8.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-13"], "substrate_source_key": "eu_cra"}, {"claim_count": 1, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-308a1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 28, "ref_count": 25, "refs": ["SP800-53-AU-2", "SP800-53-AU-6", "SP800-53-AU-6.4", "SP800-53-CA-1", "SP800-53-CA-4", "SP800-53-CA-5", "SP800-53-CA-7", "SP800-53-CA-7.4", "SP800-53-CA-7.5", "SP800-53-CM-3.7", "SP800-53-MA-1", "SP800-53-PE-13.4", "SP800-53-PE-6", "SP800-53-PM-14", "SP800-53-PM-25", "SP800-53-PM-28", "SP800-53-PM-29", "SP800-53-PM-4", "SP800-53-PM-9", "SP800-53-PS-2", "SP800-53-RA-1", "SP800-53-RA-5.8", "SP800-53-SI-2.3", "SP800-53-SI-4", "SP800-53-SI-6.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-13AF12273DD14D4FA9E953DEB793C18F", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-D17DBFF01F10492AB4C717BB59A0A711"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 25, "ref_count": 18, "refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_1_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-V_AA_3_B", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 9, "ref_count": 9, "refs": ["PCI-10.3.4", "PCI-10.4.1", "PCI-10.4.3", "PCI-10.5.1", "PCI-11.3.2", "PCI-12.10.5", "PCI-12.3.2", "PCI-12.8.3", "PCI-12.8.4"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-2.1", "PCISSLC-2.6", "PCISSLC-5.1", "PCISSLC-9.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-OPS-4", "SCAGILE-OPS-7", "SCAGILE-OPS-9"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 6, "ref_count": 6, "refs": ["SSDF-TASK-PO.4.1", "SSDF-TASK-PW.7.2", "SSDF-TASK-PW.8.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.2", "SSDF-TASK-RV.3.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-RPR-010", "v1_entity_name": "Baseline Review, Exception Visibility And Change Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
791
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 2, "es_grounding_resolution": {"authored_more_sources_count": 2, "authored_visible_source_count": 4, "resolved_ref_count": 19, "resolved_source_count": 5, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-1", "SP800-53-AU-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-17.3"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-283"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CIS-17.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-283"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 13, "ref_count": 11, "refs": ["SP800-53-AT-1", "SP800-53-AU-1", "SP800-53-AU-2.4", "SP800-53-AU-6.9", "SP800-53-CA-2.3", "SP800-53-CM-8.4", "SP800-53-IR-1", "SP800-53-PE-6", "SP800-53-PM-1", "SP800-53-SR-1", "SP800-53-SR-2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 6, "ref_count": 5, "refs": ["SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_A", "SAMM-ACTIVITY-G_SM_1_A", "SAMM-ACTIVITY-O_IM_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-7.1"], "substrate_source_key": "pci_sslc_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-001", "v1_entity_name": "Accountable Release Approval", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
792
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 44, "resolved_source_count": 9, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-10.5", "SP800-53-IA-4.3"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1"]}, {"source_display_name": "SLSA v1.0", "substrate_source": "slsa", "visible_refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-476", "CAPEC-523"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["ASVS-REQ-V11.1.2", "ASVS-REQ-V11.1.3", "ASVS-REQ-V15.1.2", "ASVS-REQ-V4.1.5", "ASVS-REQ-V6.7.1", "ASVS-REQ-V6.8.2", "ASVS-REQ-V9.1.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 5, "ref_count": 5, "refs": ["CAPEC-476", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-695"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-348"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 16, "ref_count": 15, "refs": ["SP800-53-AU-10.5", "SP800-53-IA-12", "SP800-53-IA-12.3", "SP800-53-IA-12.4", "SP800-53-IA-12.6", "SP800-53-IA-13.2", "SP800-53-IA-4.3", "SP800-53-MP-3", "SP800-53-SA-12.10", "SP800-53-SA-12.3", "SP800-53-SA-19", "SP800-53-SA-19.1", "SP800-53-SC-16.1", "SP800-53-SI-19.7", "SP800-53-SR-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-9F10792761E9457485AD3F2B4BCA8665"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SB_1_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DELIVERY-SIGNING", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 7, "ref_count": 7, "refs": ["SLSA-BUILD-L1", "SLSA-BUILD-L2", "SLSA-BUILD-PLATFORM-PROVENANCE-GENERATION", "SLSA-PRINCIPLE-PREFER-ATTESTATIONS", "SLSA-PRINCIPLE-TRUST-PLATFORMS", "SLSA-PRODUCER-DISTRIBUTE-PROVENANCE", "SLSA-VERIFY-BUILD-LEVEL"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 4, "ref_count": 4, "refs": ["SSDF-PRACTICE-PS.2", "SSDF-TASK-PS.2.1", "SSDF-TASK-PS.3.2", "SSDF-TASK-PW.4.4"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (artifact, identity, promotion kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-002", "v1_entity_name": "Verified Artifact Promotion", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
793
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 5, "resolved_source_count": 2, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.4"]}, {"source_display_name": "MITRE ATLAS", "substrate_source": "mitre_atlas", "visible_refs": ["AML.M0020"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CP-12"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 4, "refs": ["ASVS-REQ-V2.3.1", "ASVS-REQ-V2.3.4", "ASVS-REQ-V2.3.5", "ASVS-REQ-V2.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["SP800-53-CP-12"], "substrate_source_key": "nist_sp800_53_rev5"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (gate, gates, policy kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-003", "v1_entity_name": "Pre-Promotion Gates And Staging Validation", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
794
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 10, "es_grounding_resolution": {"authored_more_sources_count": 10, "authored_visible_source_count": 4, "resolved_ref_count": 67, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8.2", "SP800-53-CM-8.7"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_2_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V13.4.4", "ASVS-REQ-V13.4.5"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 5, "refs": ["ASVS-REQ-V13.4.4", "ASVS-REQ-V13.4.5", "ASVS-REQ-V13.4.6", "ASVS-REQ-V15.2.2", "ASVS-REQ-V15.2.3"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 5, "ref_count": 5, "refs": ["CIS-1", "CIS-12.1", "CIS-12.4", "CIS-16.8", "CIS-7.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 14, "ref_count": 14, "refs": ["SP800-53-CM-8.2", "SP800-53-CM-8.7", "SP800-53-MA-3", "SP800-53-MA-3.6", "SP800-53-RA-5", "SP800-53-SA-10.5", "SP800-53-SA-12.14", "SP800-53-SA-12.15", "SP800-53-SA-15.13", "SP800-53-SA-8.22", "SP800-53-SC-2.2", "SP800-53-SI-2.4", "SP800-53-SI-4", "SP800-53-SI-7.13"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 24, "ref_count": 24, "refs": ["DSOMM-ACTIVITY-08F27C262C6A47FE94585E88F188085D", "DSOMM-ACTIVITY-0CB2626BFB0D4A0F968857F787310D97", "DSOMM-ACTIVITY-0EC92899A5CB4649984B2FB1D6C784AD", "DSOMM-ACTIVITY-13E9757E58E24277BC0FEADC674891E6", "DSOMM-ACTIVITY-26E1C6D556324EC780D2E564B98732AD", "DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F", "DSOMM-ACTIVITY-517B095749814AC0B4C70D8D1934C474", "DSOMM-ACTIVITY-5C61FD6B81064C68AC28A8A42F1C67DC", "DSOMM-ACTIVITY-67E1A9AA9FBF4EC5A2DE400F01960C51", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-77FFC53E9F3D41F492D302F04F9B6B0F", "DSOMM-ACTIVITY-830570280B774D2E813540969768AE88", "DSOMM-ACTIVITY-86D490B9D7984A5BA011AB9688014C46", "DSOMM-ACTIVITY-8AE0B92C10E04602BA227524D6AED488", "DSOMM-ACTIVITY-8B994601575E4EA5B228ACCB18C8E514", "DSOMM-ACTIVITY-A340F46B63604CB8847BA0D3483D09D3", "DSOMM-ACTIVITY-CE970C9BDA9441CFBD788C15357B7E8E", "DSOMM-ACTIVITY-D5E6303CD5C64D59B258A3B9DE38A07F", "DSOMM-ACTIVITY-D918CD44A97243E9A974EFF3F4A5DCFE", "DSOMM-ACTIVITY-DA4FF665DCB94E939D2048CDEDC50FC2", "DSOMM-ACTIVITY-DF428C9DEFA042269F47A15BB53F822B", "DSOMM-ACTIVITY-E14DE74194B3447C8B07EEA947D82E61", "DSOMM-ACTIVITY-F3C4971E9F4D4E598ED0F0BDB6262477", "DSOMM-ACTIVITY-F6F7737F25A943178DE209BF59F29B5B"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DEPLOYMENT"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP04-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 21, "ref_count": 13, "refs": ["SAMM-ACTIVITY-I_SB_1_B", "SAMM-ACTIVITY-I_SB_2_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_EM_1_A", "SAMM-ACTIVITY-O_EM_1_B", "SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_EM_3_B", "SAMM-ACTIVITY-O_OM_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCAGILE-OPS-1", "SCAGILE-OPS-6"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-BUILD"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PO.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-004", "v1_entity_name": "End-to-End Deploy Traceability", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
795
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 15, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-11", "CIS-11.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-2.3", "SP800-53-CP-4.4"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_OM_3_A"]}, {"source_display_name": "SAFECode FPSSD", "substrate_source": "safecode", "visible_refs": ["SCFPSSD-TESTING"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 6, "refs": ["CIS-11", "CIS-11.1", "CIS-11.2", "CIS-11.5", "CIS-17.7", "CIS-18.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 4, "ref_count": 4, "refs": ["SP800-53-CM-2.3", "SP800-53-CP-4.4", "SP800-53-CP-9.2", "SP800-53-MP-8.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-O_OM_3_B", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-TESTING"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (production, rollback, rollout kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-005", "v1_entity_name": "Tested Rollback Discipline", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
796
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 1, "resolved_ref_count": 1, "resolved_source_count": 1, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "EU DORA", "substrate_source": "eu_dora", "visible_refs": ["DORA-ART-5"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["DORA-ART-5"], "substrate_source_key": "eu_dora"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (change, progressive, rollout kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-006", "v1_entity_name": "Progressive Rollout And Containment", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
797
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 64, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-16", "SP800-53-AC-16.7"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-2", "PCI-REQ-8"]}], "es_grounding_sources_full": [{"claim_count": 5, "ref_count": 5, "refs": ["CAPEC-166", "CAPEC-523", "CAPEC-524", "CAPEC-532", "CAPEC-671"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 3, "ref_count": 3, "refs": ["CIS-12.2", "CIS-16.1", "CIS-16.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-547"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 16, "ref_count": 15, "refs": ["SP800-53-AC-16", "SP800-53-AC-16.7", "SP800-53-CM-2", "SP800-53-CM-2.6", "SP800-53-CM-3.3", "SP800-53-CM-6", "SP800-53-CM-7.7", "SP800-53-SA-15.5", "SP800-53-SA-17.2", "SP800-53-SA-17.3", "SP800-53-SA-17.4", "SP800-53-SA-17.5", "SP800-53-SA-17.7", "SP800-53-SA-8.1", "SP800-53-SI-12.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 12, "ref_count": 12, "refs": ["DSOMM-ACTIVITY-03643CA203C2472B8E19956BF02FE9B7", "DSOMM-ACTIVITY-11B3848EE9314146A35D35409ADA24EE", "DSOMM-ACTIVITY-3A94D55EFD8249969EB320D23FF2A873", "DSOMM-ACTIVITY-47419324E263415B815DE7161B6B905E", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-5992C38C8597403589DBD15820D81C3A", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-DCF9601BB4F24E259143E39AF75F7C33", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20B", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BMEDIUM", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C1", "OPC-C2"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 21, "ref_count": 13, "refs": ["SAMM-ACTIVITY-D_SR_2_A", "SAMM-ACTIVITY-D_SR_3_A", "SAMM-ACTIVITY-D_TA_1_A", "SAMM-ACTIVITY-D_TA_1_B", "SAMM-ACTIVITY-D_TA_2_B", "SAMM-ACTIVITY-G_SM_1_B", "SAMM-ACTIVITY-I_SB_1_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-O_EM_2_A", "SAMM-ACTIVITY-V_RT_3_A", "SAMM-ACTIVITY-V_RT_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 6, "ref_count": 6, "refs": ["PCI-1.2.1", "PCI-12.5.1", "PCI-2.2.1", "PCI-8.5.1", "PCI-REQ-2", "PCI-REQ-8"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-DESIGN-PRINCIPLES"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 6, "ref_count": 6, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.5", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.4", "SSDF-TASK-PW.9.1", "SSDF-TASK-PW.9.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (baseline, components, define kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-008", "v1_entity_name": "Define Hardened Baseline Profiles For Security-Relevant Components", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
798
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 14, "es_grounding_resolution": {"authored_more_sources_count": 14, "authored_visible_source_count": 4, "resolved_ref_count": 202, "resolved_source_count": 16, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-3"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-12", "PCI-1.2.7"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.1", "CIS-4.2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-69", "CAPEC-122"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 18, "ref_count": 17, "refs": ["CAPEC-122", "CAPEC-180", "CAPEC-207", "CAPEC-212", "CAPEC-417", "CAPEC-421", "CAPEC-422", "CAPEC-424", "CAPEC-427", "CAPEC-444", "CAPEC-445", "CAPEC-447", "CAPEC-478", "CAPEC-522", "CAPEC-551", "CAPEC-678", "CAPEC-69"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 28, "ref_count": 19, "refs": ["CIS-13.2", "CIS-13.5", "CIS-13.7", "CIS-13.8", "CIS-14", "CIS-14.1", "CIS-15.1", "CIS-15.2", "CIS-16", "CIS-16.1", "CIS-16.2", "CIS-16.6", "CIS-16.9", "CIS-4.1", "CIS-4.2", "CIS-4.8", "CIS-6.6", "CIS-7.1", "CIS-9.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["CWE-213"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["ENISA-AI-FAICP-CONCLUSIONS", "ENISA-AI-FAICP-SURVEY"], "substrate_source_key": "enisa_multilayer_ai_cybersecurity_practices_2023"}, {"claim_count": 5, "ref_count": 2, "refs": ["NIS2-ART-20", "NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 3, "ref_count": 3, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a5", "HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 118, "ref_count": 95, "refs": ["SP800-53-AC-1", "SP800-53-AC-16", "SP800-53-AC-16.9", "SP800-53-AC-24", "SP800-53-AC-3", "SP800-53-AC-3.10", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.8", "SP800-53-AC-4.10", "SP800-53-AC-4.13", "SP800-53-AC-4.20", "SP800-53-AC-4.23", "SP800-53-AC-6.1", "SP800-53-AC-6.7", "SP800-53-AT-3.2", "SP800-53-AT-5", "SP800-53-CA-3.1", "SP800-53-CA-3.2", "SP800-53-CA-3.3", "SP800-53-CM-1", "SP800-53-CM-11", "SP800-53-CM-11.1", "SP800-53-CM-2.1", "SP800-53-CM-2.4", "SP800-53-CM-3", "SP800-53-CM-3.4", "SP800-53-CM-3.6", "SP800-53-CM-4", "SP800-53-CM-4.2", "SP800-53-CM-5.2", "SP800-53-CM-6", "SP800-53-CM-6.2", "SP800-53-CM-6.3", "SP800-53-CM-7.4", "SP800-53-CM-7.5", "SP800-53-CP-10.3", "SP800-53-CP-13", "SP800-53-CP-7.5", "SP800-53-IR-4.14", "SP800-53-IR-4.5", "SP800-53-IR-9.4", "SP800-53-MA-1", "SP800-53-MA-3.3", "SP800-53-MA-5.1", "SP800-53-MA-5.5", "SP800-53-MP-1", "SP800-53-PE-1", "SP800-53-PE-3.5", "SP800-53-PE-6.1", "SP800-53-PL-2", "SP800-53-PL-3", "SP800-53-PL-6", "SP800-53-PM-1", "SP800-53-PM-4", "SP800-53-PS-1", "SP800-53-PS-4.2", "SP800-53-PS-5", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-PS-7", "SP800-53-RA-10", "SP800-53-RA-2", "SP800-53-RA-5", "SP800-53-RA-5.7", "SP800-53-RA-6", "SP800-53-RA-7", "SP800-53-SA-10.7", "SP800-53-SA-11.6", "SP800-53-SA-12.9", "SP800-53-SA-3", "SP800-53-SA-5.1", "SP800-53-SA-8.10", "SP800-53-SA-8.16", "SP800-53-SA-8.18", "SP800-53-SA-8.25", "SP800-53-SA-8.27", "SP800-53-SA-8.28", "SP800-53-SA-8.31", "SP800-53-SA-9.1", "SP800-53-SC-1", "SP800-53-SC-16.2", "SP800-53-SC-28.1", "SP800-53-SC-3.2", "SP800-53-SC-30.4", "SP800-53-SC-38", "SP800-53-SC-46", "SP800-53-SI-1", "SP800-53-SI-3", "SP800-53-SI-5", "SP800-53-SI-5.1", "SP800-53-SI-7.6", "SP800-53-SR-11.2", "SP800-53-SR-7", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 13, "ref_count": 13, "refs": ["DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E", "DSOMM-ACTIVITY-0B28367B75A04BAEA9263725C1BF9BB0", "DSOMM-ACTIVITY-1B9281B948E24C019AC69DB9931C4885", "DSOMM-ACTIVITY-35446784761040D9AF9ED43F3173BF8C", "DSOMM-ACTIVITY-3F63BDBCC75F4780A941E6AD42E894E1", "DSOMM-ACTIVITY-58C46807FEE9448BB6DD8050C464AB52", "DSOMM-ACTIVITY-7121B0C76ACE4D6B95D094535DBCCB57", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-BFDB576EA4164EC696FEA078D58B2FF8", "DSOMM-ACTIVITY-DD5ED7C1BDBF400FB75F6D3953A1A04E", "DSOMM-ACTIVITY-F7B215DC73A44C619E49B3A3AF1C9AC3", "DSOMM-ACTIVITY-F88D1B173D7D4C3D8139AD44FC4942D4", "DSOMM-ACTIVITY-F994A55D71BB45A4A8870A213D72C504"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-GOVERNANCE", "OWASP-MCP-MINIMUM-BAR"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 22, "ref_count": 16, "refs": ["SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-G_EG_2_A", "SAMM-ACTIVITY-G_EG_3_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-I_SB_2_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_2_B", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_3_A", "SAMM-ACTIVITY-V_AA_1_B", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_ST_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 23, "ref_count": 23, "refs": ["PCI-1.2.7", "PCI-1.5.1", "PCI-12.1.2", "PCI-12.1.3", "PCI-12.1.4", "PCI-12.10.4", "PCI-12.2.1", "PCI-12.3.4", "PCI-12.4.2", "PCI-12.6.1", "PCI-12.6.2", "PCI-12.6.3", "PCI-12.8.1", "PCI-12.9.1", "PCI-12.9.2", "PCI-5.2.2", "PCI-5.3.4", "PCI-6.4.1", "PCI-7.1.1", "PCI-8.1.1", "PCI-8.3.7", "PCI-9.1.1", "PCI-REQ-12"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-3.3", "PCISSLC-9.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["SCAGILE-EXP-9", "SCAGILE-OPS-16", "SCAGILE-OPS-2"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-FINDINGS", "SCFPSSD-VULN-RESPONSE"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-RV.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (change, deployment, promotion kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-009", "v1_entity_name": "Review Security-Relevant Overrides Before Promotion Or Deployment", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
799
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 11, "es_grounding_resolution": {"authored_more_sources_count": 11, "authored_visible_source_count": 4, "resolved_ref_count": 136, "resolved_source_count": 13, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-2.12"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-3.8"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-6.5.2", "PCI-9.3.1"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V7.5.1", "ASVS-REQ-V14.2.7"]}], "es_grounding_sources_full": [{"claim_count": 9, "ref_count": 9, "refs": ["ASVS-REQ-V14.2.7", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.2", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.3.1", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.3", "ASVS-REQ-V7.5.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 18, "ref_count": 13, "refs": ["CIS-16.1", "CIS-16.2", "CIS-16.4", "CIS-17.2", "CIS-17.3", "CIS-17.4", "CIS-17.6", "CIS-17.8", "CIS-17.9", "CIS-3.1", "CIS-3.8", "CIS-8.1", "CIS-8.4"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-307", "CWE-358"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["GDPR-ART-32", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 1, "ref_count": 1, "refs": ["HIPAA-164-316b1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 93, "ref_count": 77, "refs": ["SP800-53-AC-2", "SP800-53-AC-2.12", "SP800-53-AC-25", "SP800-53-AU-1", "SP800-53-AU-10.4", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-12.1", "SP800-53-AU-12.3", "SP800-53-AU-12.4", "SP800-53-AU-13", "SP800-53-AU-13.2", "SP800-53-AU-14.2", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-2", "SP800-53-AU-3", "SP800-53-AU-3.2", "SP800-53-AU-4", "SP800-53-AU-4.1", "SP800-53-AU-5", "SP800-53-AU-5.5", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.10", "SP800-53-AU-6.4", "SP800-53-AU-6.5", "SP800-53-AU-6.6", "SP800-53-AU-7", "SP800-53-AU-7.1", "SP800-53-AU-8.1", "SP800-53-AU-8.2", "SP800-53-AU-9.2", "SP800-53-CA-1", "SP800-53-CA-3", "SP800-53-CA-7.5", "SP800-53-IA-1", "SP800-53-IR-1", "SP800-53-IR-5", "SP800-53-IR-6.1", "SP800-53-MA-4.1", "SP800-53-PE-3", "SP800-53-PE-6", "SP800-53-PE-8", "SP800-53-PE-8.1", "SP800-53-PE-8.2", "SP800-53-PM-24", "SP800-53-PM-25", "SP800-53-PM-4", "SP800-53-PT-3", "SP800-53-PT-6.1", "SP800-53-PT-6.2", "SP800-53-RA-1", "SP800-53-RA-5.8", "SP800-53-SA-8.29", "SP800-53-SI-1", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-17", "SP800-53-SI-18", "SP800-53-SI-18.5", "SP800-53-SI-19.5", "SP800-53-SI-2", "SP800-53-SI-2.3", "SP800-53-SI-2.7", "SP800-53-SI-3.6", "SP800-53-SI-4", "SP800-53-SI-4.19", "SP800-53-SI-4.21", "SP800-53-SI-4.7", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-6.1", "SP800-53-SI-6.3", "SP800-53-SI-7.5", "SP800-53-SI-7.7", "SP800-53-SI-7.8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 12, "ref_count": 9, "refs": ["SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_PC_2_B", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-V_ST_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 12, "ref_count": 12, "refs": ["PCI-10.2.2", "PCI-10.4.1", "PCI-10.4.3", "PCI-10.5.1", "PCI-12.10.2", "PCI-12.10.5", "PCI-12.10.7", "PCI-12.5.2", "PCI-12.8.2", "PCI-12.8.4", "PCI-6.5.2", "PCI-9.3.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-2.6"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 3, "ref_count": 3, "refs": ["SSDF-TASK-PO.4.1", "SSDF-TASK-RV.1.2", "SSDF-TASK-RV.3.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (baseline, record, review kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-RPR-010", "v1_entity_name": "Record And Periodically Review Exceptions Against The Intended Baseline", "v1_entity_type": "Practice", "v1_family": "ACO-RPR", "v1_slice": "ASC-09"}
800
800
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 OE maturity; DSOMM deploy activities", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
801
801
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de Deploy Seguro", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
802
802
  {"content_type": "IR playbooks examples", "coverage_status": "out_of_appsec", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/04-incident-response-playbook.md", "manual_v2_anchor": "DocumentUnit", "rastreabilidade_role": "out_of_appsec_coverage"}
@@ -868,24 +868,24 @@
868
868
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:signal:falhas-de-login", "manual_v2_entity_label": "Falhas de login", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
869
869
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:signal:logs", "manual_v2_entity_label": "Logs", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
870
870
  {"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_v2_authority_class": "semantic", "manual_v2_confidence_model": "bounded", "manual_v2_entity_id": "sem:signal:metricas-mttd-mttr", "manual_v2_entity_label": "Métricas MTTD/MTTR", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
871
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-637"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-001", "v1_entity_name": "Machine-Readable Structured Logging", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
872
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-1.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8.7", "SP800-53-SA-19.3"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM03-2025"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (central, forwarding, ingestion kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-002", "v1_entity_name": "Central Log Ingestion And Normalization", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
873
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 21, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-21"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.5.2"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-003", "v1_entity_name": "Log Integrity And Access Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
874
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-5.4", "SP800-53-MA-1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1118", "CWE-391"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-O_IM_3_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.4"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-004", "v1_entity_name": "Logging Failure Visibility Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
875
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_3_A"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-11", "PCI-1.1.1"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (audit, coverage, define kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-005", "v1_entity_name": "Security Event Catalog And Coverage Verification", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
876
- {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-5.1", "SP800-53-CM-1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-5.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-546"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-7F36B9BABC054FD69A2A73344C249722"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (lifecycle, logs, management kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-006", "v1_entity_name": "Log Retention Lifecycle Management Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
877
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AU-5.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-11", "PCI-5.2.3"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426", "DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SR_1_B"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-001", "v1_entity_name": "Critical Security Event Coverage And Catalog Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
878
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.1", "SP800-53-AC-16"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V15.3.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.4"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-002", "v1_entity_name": "Structured Audit Fields And Machine-Readable Log Shape", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
879
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3", "SP800-53-AC-3.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-4.2.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-3.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.8", "ASVS-REQ-V11.3.3"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-003", "v1_entity_name": "Log Integrity Protection And Access Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
880
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-7", "SP800-53-AU-10.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-6.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.2.1", "PCI-10.5.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-675"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-004", "v1_entity_name": "Audit Record Retention And Lifecycle Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
881
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-8"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-150", "CAPEC-384"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-005", "v1_entity_name": "Centralized Log Ingestion And Source Accountability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
882
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-117", "CWE-391"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-006", "v1_entity_name": "Logging Pipeline Health And Silent-Failure Visibility", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
883
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-4", "SP800-53-AU-5"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.3", "ASVS-REQ-V6.3.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.1", "CIS-4.2"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-007", "v1_entity_name": "Security Logging And Audit Trail Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
884
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-2.2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-778"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.7.2"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-001", "v1_entity_name": "Critical Event Catalog Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
885
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1.1", "CIS-1.4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-12.1", "SP800-53-AU-2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_A"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-002", "v1_entity_name": "Structured And Centralized Security Logging", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
886
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 22, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-REQ-4"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-22"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-003", "v1_entity_name": "Log Integrity And Protected Access", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
887
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-4", "SP800-53-AU-5.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_3_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-8.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.2.1", "PCI-10.5.1"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-004", "v1_entity_name": "Log Retention And Lifecycle Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
888
- {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-5.4", "SP800-53-MA-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_3_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V16.5.4"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM03-2025"]}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (detect, logging, pipeline kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-005", "v1_entity_name": "Logging Pipeline Health Visibility", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
871
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 5, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-637"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-10"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-637"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-REQ-10"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-001", "v1_entity_name": "Machine-Readable Structured Logging", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
872
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 8, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-1.1"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-CM-8.7", "SP800-53-SA-19.3"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM03-2025"]}], "es_grounding_sources_full": [{"claim_count": 4, "ref_count": 3, "refs": ["CIS-1", "CIS-1.1", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-CM-8.7", "SP800-53-SA-19.3", "SP800-53-SC-36"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-2A44B708734F4463B0CB86DC46344B2F"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (central, forwarding, ingestion kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-002", "v1_entity_name": "Central Log Ingestion And Normalization", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
873
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 21, "es_grounding_resolution": {"authored_more_sources_count": 21, "authored_visible_source_count": 4, "resolved_ref_count": 616, "resolved_source_count": 21, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-1", "PCI-REQ-3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-1", "CAPEC-21"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.5.2"]}], "es_grounding_sources_full": [{"claim_count": 29, "ref_count": 29, "refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.5.2", "ASVS-REQ-V11.2.1", "ASVS-REQ-V11.2.3", "ASVS-REQ-V11.3.3", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.8", "ASVS-REQ-V15.2.5", "ASVS-REQ-V15.3.1", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.3.4", "ASVS-REQ-V15.4.1", "ASVS-REQ-V15.4.2", "ASVS-REQ-V15.4.3", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.4.2", "ASVS-REQ-V16.4.3", "ASVS-REQ-V6.1.1", "ASVS-REQ-V6.3.3", "ASVS-REQ-V6.5.6", "ASVS-REQ-V7.5.1", "ASVS-REQ-V7.5.3", "ASVS-REQ-V8.2.2", "ASVS-REQ-V8.2.4", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 54, "ref_count": 51, "refs": ["CAPEC-1", "CAPEC-114", "CAPEC-122", "CAPEC-123", "CAPEC-157", "CAPEC-180", "CAPEC-184", "CAPEC-207", "CAPEC-21", "CAPEC-212", "CAPEC-224", "CAPEC-268", "CAPEC-270", "CAPEC-271", "CAPEC-274", "CAPEC-31", "CAPEC-36", "CAPEC-37", "CAPEC-385", "CAPEC-39", "CAPEC-390", "CAPEC-440", "CAPEC-445", "CAPEC-507", "CAPEC-517", "CAPEC-518", "CAPEC-519", "CAPEC-521", "CAPEC-522", "CAPEC-524", "CAPEC-54", "CAPEC-548", "CAPEC-568", "CAPEC-569", "CAPEC-57", "CAPEC-578", "CAPEC-624", "CAPEC-648", "CAPEC-655", "CAPEC-669", "CAPEC-670", "CAPEC-671", "CAPEC-678", "CAPEC-679", "CAPEC-680", "CAPEC-681", "CAPEC-69", "CAPEC-74", "CAPEC-75", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 45, "ref_count": 26, "refs": ["CIS-11.3", "CIS-15.4", "CIS-16", "CIS-16.1", "CIS-16.11", "CIS-16.5", "CIS-16.9", "CIS-2.5", "CIS-2.6", "CIS-3", "CIS-3.1", "CIS-3.13", "CIS-3.14", "CIS-3.2", "CIS-3.3", "CIS-3.5", "CIS-3.7", "CIS-3.8", "CIS-4.11", "CIS-4.2", "CIS-4.6", "CIS-6", "CIS-6.3", "CIS-6.6", "CIS-6.8", "CIS-8.3"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 26, "ref_count": 26, "refs": ["CWE-1220", "CWE-1230", "CWE-183", "CWE-209", "CWE-213", "CWE-215", "CWE-224", "CWE-268", "CWE-278", "CWE-294", "CWE-312", "CWE-348", "CWE-349", "CWE-353", "CWE-354", "CWE-358", "CWE-497", "CWE-501", "CWE-649", "CWE-654", "CWE-656", "CWE-779", "CWE-798", "CWE-807", "CWE-921", "CWE-924"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 4, "ref_count": 2, "refs": ["GDPR-ART-32", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 10, "ref_count": 10, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a4", "HIPAA-164-308a6", "HIPAA-164-310a1", "HIPAA-164-310b", "HIPAA-164-310c", "HIPAA-164-312a1", "HIPAA-164-312b", "HIPAA-164-312c1", "HIPAA-164-312d"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-SCOPE-MINIMIZATION"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 396, "ref_count": 342, "refs": ["SP800-53-AC-1", "SP800-53-AC-11", "SP800-53-AC-13", "SP800-53-AC-14", "SP800-53-AC-14.1", "SP800-53-AC-16", "SP800-53-AC-16.1", "SP800-53-AC-16.10", "SP800-53-AC-16.2", "SP800-53-AC-16.3", "SP800-53-AC-16.4", "SP800-53-AC-16.5", "SP800-53-AC-16.6", "SP800-53-AC-16.7", "SP800-53-AC-16.8", "SP800-53-AC-16.9", "SP800-53-AC-17", "SP800-53-AC-17.2", "SP800-53-AC-17.4", "SP800-53-AC-17.6", "SP800-53-AC-17.7", "SP800-53-AC-18.1", "SP800-53-AC-19", "SP800-53-AC-19.1", "SP800-53-AC-19.4", "SP800-53-AC-19.5", "SP800-53-AC-2", "SP800-53-AC-2.11", "SP800-53-AC-2.13", "SP800-53-AC-2.4", "SP800-53-AC-2.6", "SP800-53-AC-2.7", "SP800-53-AC-20", "SP800-53-AC-20.1", "SP800-53-AC-20.2", "SP800-53-AC-20.3", "SP800-53-AC-21", "SP800-53-AC-21.2", "SP800-53-AC-22", "SP800-53-AC-24", "SP800-53-AC-24.1", "SP800-53-AC-24.2", "SP800-53-AC-25", "SP800-53-AC-3", "SP800-53-AC-3.10", "SP800-53-AC-3.13", "SP800-53-AC-3.14", "SP800-53-AC-3.15", "SP800-53-AC-3.3", "SP800-53-AC-3.4", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.7", "SP800-53-AC-3.8", "SP800-53-AC-3.9", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.10", "SP800-53-AC-4.11", "SP800-53-AC-4.12", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.15", "SP800-53-AC-4.17", "SP800-53-AC-4.18", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.20", "SP800-53-AC-4.21", "SP800-53-AC-4.22", "SP800-53-AC-4.23", "SP800-53-AC-4.25", "SP800-53-AC-4.26", "SP800-53-AC-4.27", "SP800-53-AC-4.28", "SP800-53-AC-4.3", "SP800-53-AC-4.30", "SP800-53-AC-4.31", "SP800-53-AC-4.32", "SP800-53-AC-4.4", "SP800-53-AC-4.5", "SP800-53-AC-4.6", "SP800-53-AC-4.7", "SP800-53-AC-4.8", "SP800-53-AC-5", "SP800-53-AC-6.1", "SP800-53-AC-6.2", "SP800-53-AC-6.3", "SP800-53-AC-6.5", "SP800-53-AC-6.6", "SP800-53-AC-6.8", "SP800-53-AC-6.9", "SP800-53-AC-7.4", "SP800-53-AU-1", "SP800-53-AU-10", "SP800-53-AU-10.3", "SP800-53-AU-10.5", "SP800-53-AU-12.3", "SP800-53-AU-13.3", "SP800-53-AU-14.2", "SP800-53-AU-15", "SP800-53-AU-16", "SP800-53-AU-16.2", "SP800-53-AU-16.3", "SP800-53-AU-2.4", "SP800-53-AU-3.3", "SP800-53-AU-5.3", "SP800-53-AU-6", "SP800-53-AU-6.10", "SP800-53-AU-6.7", "SP800-53-AU-7", "SP800-53-AU-9", "SP800-53-AU-9.1", "SP800-53-AU-9.2", "SP800-53-AU-9.3", "SP800-53-AU-9.4", "SP800-53-AU-9.5", "SP800-53-AU-9.6", "SP800-53-CA-3.6", "SP800-53-CA-9", "SP800-53-CA-9.1", "SP800-53-CM-3.4", "SP800-53-CM-3.6", "SP800-53-CM-5.1", "SP800-53-CM-5.4", "SP800-53-CM-5.7", "SP800-53-CM-6", "SP800-53-CP-7.5", "SP800-53-CP-9.4", "SP800-53-CP-9.7", "SP800-53-CP-9.8", "SP800-53-IA-1", "SP800-53-IA-10", "SP800-53-IA-12", "SP800-53-IA-13.1", "SP800-53-IA-13.2", "SP800-53-IA-13.3", "SP800-53-IA-2.1", "SP800-53-IA-2.6", "SP800-53-IA-2.8", "SP800-53-IA-2.9", "SP800-53-IA-4.1", "SP800-53-IA-4.9", "SP800-53-IA-5", "SP800-53-IA-5.1", "SP800-53-IA-5.6", "SP800-53-IA-5.8", "SP800-53-IR-9.4", "SP800-53-MA-3.3", "SP800-53-MA-4.6", "SP800-53-MA-5.2", "SP800-53-MP-4.2", "SP800-53-MP-5", "SP800-53-MP-6.1", "SP800-53-MP-6.4", "SP800-53-MP-6.7", "SP800-53-MP-6.8", "SP800-53-PE-19.1", "SP800-53-PE-2", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.4", "SP800-53-PE-3.5", "SP800-53-PE-4", "SP800-53-PE-5", "SP800-53-PE-8", "SP800-53-PE-8.2", "SP800-53-PE-8.3", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-21", "SP800-53-PM-24", "SP800-53-PM-27", "SP800-53-PS-3.1", "SP800-53-PS-3.3", "SP800-53-PS-3.4", "SP800-53-PS-6", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-PS-7", "SP800-53-PT-1", "SP800-53-PT-2", "SP800-53-PT-2.1", "SP800-53-PT-2.2", "SP800-53-PT-3", "SP800-53-PT-4.1", "SP800-53-PT-4.3", "SP800-53-PT-6.2", "SP800-53-RA-5", "SP800-53-RA-5.5", "SP800-53-SA-10", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-10.5", "SP800-53-SA-10.7", "SP800-53-SA-12.14", "SP800-53-SA-12.9", "SP800-53-SA-17", "SP800-53-SA-17.2", "SP800-53-SA-17.7", "SP800-53-SA-18", "SP800-53-SA-3", "SP800-53-SA-4.11", "SP800-53-SA-5.1", "SP800-53-SA-8", "SP800-53-SA-8.1", "SP800-53-SA-8.10", "SP800-53-SA-8.11", "SP800-53-SA-8.12", "SP800-53-SA-8.13", "SP800-53-SA-8.14", "SP800-53-SA-8.15", "SP800-53-SA-8.18", "SP800-53-SA-8.19", "SP800-53-SA-8.20", "SP800-53-SA-8.22", "SP800-53-SA-8.23", "SP800-53-SA-8.24", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.28", "SP800-53-SA-8.29", "SP800-53-SA-8.3", "SP800-53-SA-8.31", "SP800-53-SA-8.32", "SP800-53-SA-8.5", "SP800-53-SA-8.8", "SP800-53-SA-8.9", "SP800-53-SA-9", "SP800-53-SA-9.6", "SP800-53-SA-9.7", "SP800-53-SC-1", "SP800-53-SC-11", "SP800-53-SC-12.1", "SP800-53-SC-12.6", "SP800-53-SC-13.3", "SP800-53-SC-14", "SP800-53-SC-16", "SP800-53-SC-16.1", "SP800-53-SC-16.3", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-23.5", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-28.3", "SP800-53-SC-3", "SP800-53-SC-3.1", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-3.5", "SP800-53-SC-30.4", "SP800-53-SC-34.2", "SP800-53-SC-37.1", "SP800-53-SC-38", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-4.2", "SP800-53-SC-42", "SP800-53-SC-42.1", "SP800-53-SC-42.2", "SP800-53-SC-43", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SC-51", "SP800-53-SC-7.13", "SP800-53-SC-7.14", "SP800-53-SC-7.15", "SP800-53-SC-7.2", "SP800-53-SC-7.24", "SP800-53-SC-7.4", "SP800-53-SC-8", "SP800-53-SC-8.1", "SP800-53-SC-8.3", "SP800-53-SC-8.4", "SP800-53-SI-1", "SP800-53-SI-10.1", "SP800-53-SI-10.2", "SP800-53-SI-10.3", "SP800-53-SI-10.4", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-12.1", "SP800-53-SI-13.5", "SP800-53-SI-14.1", "SP800-53-SI-14.2", "SP800-53-SI-15", "SP800-53-SI-16", "SP800-53-SI-18", "SP800-53-SI-18.2", "SP800-53-SI-18.3", "SP800-53-SI-18.4", "SP800-53-SI-19.3", "SP800-53-SI-19.4", "SP800-53-SI-19.5", "SP800-53-SI-2", "SP800-53-SI-2.1", "SP800-53-SI-2.2", "SP800-53-SI-2.3", "SP800-53-SI-2.7", "SP800-53-SI-20", "SP800-53-SI-22", "SP800-53-SI-3", "SP800-53-SI-3.1", "SP800-53-SI-3.2", "SP800-53-SI-3.3", "SP800-53-SI-3.5", "SP800-53-SI-3.7", "SP800-53-SI-3.9", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.16", "SP800-53-SI-4.19", "SP800-53-SI-4.20", "SP800-53-SI-4.21", "SP800-53-SI-4.24", "SP800-53-SI-4.6", "SP800-53-SI-4.8", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.10", "SP800-53-SI-7.11", "SP800-53-SI-7.12", "SP800-53-SI-7.13", "SP800-53-SI-7.14", "SP800-53-SI-7.15", "SP800-53-SI-7.17", "SP800-53-SI-7.3", "SP800-53-SI-7.4", "SP800-53-SI-7.5", "SP800-53-SI-7.6", "SP800-53-SI-7.7", "SP800-53-SI-8", "SP800-53-SI-8.1", "SP800-53-SI-8.2", "SP800-53-SI-9", "SP800-53-SR-4.4", "SP800-53-SR-7", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 5, "ref_count": 5, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-613A73DC4F6049DBA6CE4FB7BF8519F9", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-746025A6DBFB4087A000E46ACAB64EE1", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-GOVERNANCE"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP01-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 4, "ref_count": 4, "refs": ["OPC-C1", "OPC-C3", "OPC-C7", "OPC-C8"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 17, "ref_count": 10, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_2_B", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-G_PC_1_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["TOP10-A01-2021", "TOP10-A02-2021", "TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 84, "ref_count": 77, "refs": ["PCI-1.2.3", "PCI-1.2.4", "PCI-1.4.4", "PCI-1.5.1", "PCI-10.3.1", "PCI-10.3.2", "PCI-12.3.4", "PCI-12.8.5", "PCI-2.2.3", "PCI-2.2.7", "PCI-3.1.2", "PCI-3.3.2", "PCI-3.4.2", "PCI-3.6.1", "PCI-3.7.1", "PCI-3.7.2", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.5", "PCI-3.7.6", "PCI-3.7.7", "PCI-4.1.2", "PCI-4.2.1", "PCI-4.2.2", "PCI-5.1.2", "PCI-6.1.2", "PCI-6.3.3", "PCI-7.1.1", "PCI-7.1.2", "PCI-7.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.4", "PCI-7.2.5", "PCI-7.2.6", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.1.2", "PCI-8.2.1", "PCI-8.2.2", "PCI-8.2.4", "PCI-8.2.5", "PCI-8.2.7", "PCI-8.3.1", "PCI-8.3.11", "PCI-8.3.2", "PCI-8.3.3", "PCI-8.3.4", "PCI-8.3.6", "PCI-8.3.7", "PCI-8.4.1", "PCI-8.4.2", "PCI-8.4.3", "PCI-8.5.1", "PCI-8.6.1", "PCI-8.6.2", "PCI-8.6.3", "PCI-9.1.2", "PCI-9.2.2", "PCI-9.2.3", "PCI-9.2.4", "PCI-9.3.1", "PCI-9.3.2", "PCI-9.3.4", "PCI-9.4.1", "PCI-9.4.2", "PCI-9.4.3", "PCI-9.4.5", "PCI-9.5.1", "PCI-REQ-1", "PCI-REQ-3", "PCI-REQ-4", "PCI-REQ-5", "PCI-REQ-7", "PCI-REQ-8", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 8, "ref_count": 8, "refs": ["PCISSLC-1.2", "PCISSLC-3.2", "PCISSLC-3.3", "PCISSLC-4.2", "PCISSLC-6.1", "PCISSLC-6.2", "PCISSLC-7.1", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-IAM", "SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 6, "ref_count": 6, "refs": ["SCSIC-DELIVERY", "SCSIC-DEV-REPO", "SCSIC-DEVELOPMENT", "SCSIC-SOURCING", "SCSIC-SOURCING-CONTRACT", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 10, "ref_count": 9, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PO.1.1", "SSDF-TASK-PS.2.1", "SSDF-TASK-PW.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-003", "v1_entity_name": "Log Integrity And Access Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
874
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 23, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-5.4", "SP800-53-MA-1"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-1118", "CWE-391"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-O_IM_3_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.4"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-1118", "CWE-391", "CWE-455"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 14, "ref_count": 11, "refs": ["SP800-53-AU-5.4", "SP800-53-MA-1", "SP800-53-MA-2", "SP800-53-MA-3", "SP800-53-MA-3.1", "SP800-53-MA-4", "SP800-53-MA-4.1", "SP800-53-SA-12.15", "SP800-53-SC-7.6", "SP800-53-SI-13", "SP800-53-SI-13.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP08-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["TOP10-A09-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-3.4"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-MITIGATIONS"], "substrate_source_key": "safecode_fpssd_2018"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md (mechanism)", "manual_v2_anchor": "Mechanism", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-004", "v1_entity_name": "Logging Failure Visibility Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
875
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 132, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_3_A"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-1", "SP800-53-AU-2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-11", "PCI-1.1.1"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["ASVS-REQ-V11.1.3", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.1", "ASVS-REQ-V16.2.2", "ASVS-REQ-V16.3.3", "ASVS-REQ-V6.3.5"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-95"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 12, "ref_count": 12, "refs": ["CIS-13.1", "CIS-13.11", "CIS-14.7", "CIS-16.3", "CIS-17.3", "CIS-18.1", "CIS-18.2", "CIS-18.4", "CIS-8.1", "CIS-8.11", "CIS-8.5", "CIS-8.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 35, "ref_count": 27, "refs": ["SP800-53-AU-1", "SP800-53-AU-12", "SP800-53-AU-14.1", "SP800-53-AU-2", "SP800-53-AU-2.2", "SP800-53-AU-3", "SP800-53-AU-5.2", "SP800-53-AU-6.1", "SP800-53-AU-6.2", "SP800-53-AU-6.3", "SP800-53-AU-7.1", "SP800-53-CA-1", "SP800-53-IA-1", "SP800-53-PE-13.4", "SP800-53-PE-6.2", "SP800-53-PM-14", "SP800-53-RA-5", "SP800-53-RA-5.7", "SP800-53-SA-11.9", "SP800-53-SA-9.1", "SP800-53-SI-3.6", "SP800-53-SI-4.13", "SP800-53-SI-4.7", "SP800-53-SI-4.9", "SP800-53-SI-5", "SP800-53-SI-6.1", "SP800-53-SI-6.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 21, "ref_count": 21, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-27337442E4B14E878DC9CE86FBB79A39", "DSOMM-ACTIVITY-598897A2358E441F984CE12EC4F6110A", "DSOMM-ACTIVITY-6532C1FE9D2342288722558DDABCA7D4", "DSOMM-ACTIVITY-67667C97C33E4306A4E5E7B1D8E10C5A", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-845F06EC148C4C6797557041911DCCA5", "DSOMM-ACTIVITY-85BA562384BE42198892808837BE582D", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-9768F154357A4C06AF6FD66570677C9B", "DSOMM-ACTIVITY-AAFFA73F59F64267B0AB732F3D13E90D", "DSOMM-ACTIVITY-B217C8BB5D614B41A6751083993F83B1", "DSOMM-ACTIVITY-C1ACC8AF312E4503A817A26220C993A0", "DSOMM-ACTIVITY-CCF4561D253F4762ADCBBC4622FD6FC5", "DSOMM-ACTIVITY-CCFDD0A8991E4269AD77C0A54CA655CB", "DSOMM-ACTIVITY-D03BC41074A74E9282CBD01A020CB6BF", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D", "DSOMM-ACTIVITY-EB2C7F9DD0BD4253A2BACFF2ACE4A075", "DSOMM-ACTIVITY-F0E018143B884BD0A3A9F91DB001D20BADVANCED", "DSOMM-ACTIVITY-F57D55F2DC054B349D1FF8CE5BFB0715"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-CONTINUOUS-VALIDATION"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["OWASP-MCP-3P-CLIENT-SECURITY-DISCOVERY", "OWASP-MCP-3P-GOVERNANCE-REGISTRY"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 45, "ref_count": 33, "refs": ["SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_3_A", "SAMM-ACTIVITY-G_EG_1_A", "SAMM-ACTIVITY-G_PC_2_A", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_SM_1_B", "SAMM-ACTIVITY-G_SM_2_A", "SAMM-ACTIVITY-G_SM_2_B", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-G_SM_3_B", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_DM_1_B", "SAMM-ACTIVITY-I_DM_2_A", "SAMM-ACTIVITY-I_DM_3_A", "SAMM-ACTIVITY-I_DM_3_B", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_A", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-V_AA_2_B", "SAMM-ACTIVITY-V_RT_1_A", "SAMM-ACTIVITY-V_RT_2_A", "SAMM-ACTIVITY-V_RT_3_A", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_1_A", "SAMM-ACTIVITY-V_ST_1_B", "SAMM-ACTIVITY-V_ST_2_A", "SAMM-ACTIVITY-V_ST_2_B", "SAMM-ACTIVITY-V_ST_3_A", "SAMM-ACTIVITY-V_ST_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 16, "ref_count": 16, "refs": ["PCI-1.1.1", "PCI-10.1.1", "PCI-10.4.1", "PCI-10.5.1", "PCI-11.1.1", "PCI-11.4.4", "PCI-11.5.1", "PCI-12.10.2", "PCI-12.10.5", "PCI-12.10.7", "PCI-12.3.2", "PCI-12.8.3", "PCI-12.8.4", "PCI-2.1.1", "PCI-6.1.1", "PCI-REQ-11"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCISSLC-2.5", "PCISSLC-4.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCAGILE-EXP-2", "SCAGILE-OPS-1", "SCAGILE-OPS-2", "SCAGILE-OPS-9"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-FINDINGS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCSIC-DEV-TESTING"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 5, "ref_count": 5, "refs": ["SSDF-PRACTICE-PW.8", "SSDF-TASK-PW.2.1", "SSDF-TASK-PW.8.1", "SSDF-TASK-RV.1.1", "SSDF-TASK-RV.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (audit, coverage, define kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-005", "v1_entity_name": "Security Event Catalog And Coverage Verification", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
876
+ {"authority_class": "semantic", "coverage_status": "substantive", "es_grounding_more_sources_count": 5, "es_grounding_resolution": {"authored_more_sources_count": 5, "authored_visible_source_count": 4, "resolved_ref_count": 18, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-5.1", "SP800-53-CM-1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-5.3"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-546"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-7F36B9BABC054FD69A2A73344C249722"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-546"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 6, "ref_count": 5, "refs": ["CIS-11.2", "CIS-3.4", "CIS-5.3", "CIS-5.5", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 7, "ref_count": 7, "refs": ["SP800-53-AU-5.1", "SP800-53-CM-1", "SP800-53-CM-2.3", "SP800-53-CM-3", "SP800-53-CP-9.3", "SP800-53-SI-12", "SP800-53-SI-12.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["DSOMM-ACTIVITY-7F36B9BABC054FD69A2A73344C249722"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DEPLOYMENT"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SD_3_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-3.2.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.3.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (lifecycle, logs, management kws verified)", "manual_v2_anchor": "Mechanism", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "scored", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACM-SLG-006", "v1_entity_name": "Log Retention Lifecycle Management Controls", "v1_entity_type": "Mechanism", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
877
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 105, "resolved_source_count": 15, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AU-5.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-11", "PCI-5.2.3"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426", "DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SR_1_B"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-639"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 8, "ref_count": 6, "refs": ["CIS-13.11", "CIS-16", "CIS-17.2", "CIS-17.3", "CIS-17.6", "CIS-17.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 3, "ref_count": 3, "refs": ["CWE-360", "CWE-766", "CWE-778"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["ENISA-AI-FAICP-SURVEY"], "substrate_source_key": "enisa_multilayer_ai_cybersecurity_practices_2023"}, {"claim_count": 1, "ref_count": 1, "refs": ["CRA-ART-14"], "substrate_source_key": "eu_cra"}, {"claim_count": 3, "ref_count": 3, "refs": ["DORA-ART-10", "DORA-ART-19", "DORA-ART-5"], "substrate_source_key": "eu_dora"}, {"claim_count": 4, "ref_count": 3, "refs": ["NIS2-ART-21", "NIS2-ART-22", "NIS2-ART-23"], "substrate_source_key": "eu_nis2"}, {"claim_count": 4, "ref_count": 2, "refs": ["HIPAA-164-308a2", "HIPAA-164-308a6"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 39, "ref_count": 37, "refs": ["SP800-53-AC-1", "SP800-53-AU-5.2", "SP800-53-CP-7.5", "SP800-53-CP-9.3", "SP800-53-IR-10", "SP800-53-IR-4.14", "SP800-53-IR-5", "SP800-53-IR-6.1", "SP800-53-IR-6.2", "SP800-53-IR-8.1", "SP800-53-MP-1", "SP800-53-PE-13.4", "SP800-53-PE-6.2", "SP800-53-PL-6", "SP800-53-PM-1", "SP800-53-PM-4", "SP800-53-PM-8", "SP800-53-PS-1", "SP800-53-PS-4.2", "SP800-53-RA-1", "SP800-53-RA-2", "SP800-53-RA-5", "SP800-53-RA-5.3", "SP800-53-RA-5.7", "SP800-53-RA-6", "SP800-53-RA-9", "SP800-53-SA-11.6", "SP800-53-SA-14", "SP800-53-SA-8.25", "SP800-53-SC-1", "SP800-53-SI-4", "SP800-53-SI-4.12", "SP800-53-SI-4.13", "SP800-53-SI-4.2", "SP800-53-SI-4.5", "SP800-53-SI-4.7", "SP800-53-SI-6.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 15, "ref_count": 15, "refs": ["DSOMM-ACTIVITY-0779681137F9467C9FF248F346E77FF3", "DSOMM-ACTIVITY-0A929C3EAB9A42068761ADF84B74622E", "DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-35446784761040D9AF9ED43F3173BF8C", "DSOMM-ACTIVITY-44F2C8A94AAA4C72942D63F78B89F385", "DSOMM-ACTIVITY-48F97F31931C46EB9B3EE2FEC0CD0426", "DSOMM-ACTIVITY-51F3FCE5B5C846838C41E785FE4F3B5F", "DSOMM-ACTIVITY-55F4C9163A34474DAD969A9F7A4F6A83", "DSOMM-ACTIVITY-6217FE115ED74CF49DE4555BCFA6FE87", "DSOMM-ACTIVITY-7A82020C94D1471CBBD35F7FE7DF4876", "DSOMM-ACTIVITY-8A442D8E0EB14793A513571AEF982EDD", "DSOMM-ACTIVITY-BC548CBACB824F76BD4B325D9D256279", "DSOMM-ACTIVITY-CCF4561D253F4762ADCBBC4622FD6FC5", "DSOMM-ACTIVITY-D0D681E7D6DE4829AC64A9EB2546AA0D", "DSOMM-ACTIVITY-F88D1B173D7D4C3D8139AD44FC4942D4"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 14, "ref_count": 12, "refs": ["SAMM-ACTIVITY-D_SA_1_A", "SAMM-ACTIVITY-D_SR_1_B", "SAMM-ACTIVITY-D_TA_2_A", "SAMM-ACTIVITY-D_TA_3_B", "SAMM-ACTIVITY-G_EG_1_B", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_IM_2_A", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_IM_3_A", "SAMM-ACTIVITY-O_IM_3_B", "SAMM-ACTIVITY-V_RT_3_B", "SAMM-ACTIVITY-V_ST_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 16, "ref_count": 16, "refs": ["PCI-10.7.1", "PCI-10.7.2", "PCI-10.7.3", "PCI-12.1.3", "PCI-12.10.2", "PCI-12.10.3", "PCI-12.10.5", "PCI-12.10.6", "PCI-12.10.7", "PCI-12.3.2", "PCI-12.6.1", "PCI-12.6.2", "PCI-12.6.3", "PCI-5.2.3", "PCI-6.3.1", "PCI-REQ-11"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 3, "ref_count": 3, "refs": ["PCISSLC-3.2", "PCISSLC-3.4", "PCISSLC-5.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCFPSSD-FINDINGS"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PW.2.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-001", "v1_entity_name": "Critical Security Event Coverage And Catalog Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
878
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 12, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-4.1", "SP800-53-AC-16"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V15.3.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-1.2.4"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V15.3.1"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 10, "ref_count": 10, "refs": ["SP800-53-AC-16", "SP800-53-AC-16.1", "SP800-53-AC-16.10", "SP800-53-AC-16.3", "SP800-53-AC-16.7", "SP800-53-AC-4.1", "SP800-53-IA-5.1", "SP800-53-SA-8.32", "SP800-53-SC-16", "SP800-53-SI-1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-1.2.4"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-002", "v1_entity_name": "Structured Audit Fields And Machine-Readable Log Shape", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
879
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 9, "es_grounding_resolution": {"authored_more_sources_count": 9, "authored_visible_source_count": 4, "resolved_ref_count": 80, "resolved_source_count": 10, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-3", "SP800-53-AC-3.4"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-4.2.1"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.1", "CIS-3.2"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.3.8", "ASVS-REQ-V11.3.3"]}], "es_grounding_sources_full": [{"claim_count": 7, "ref_count": 7, "refs": ["ASVS-REQ-V11.3.3", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.4", "ASVS-REQ-V15.4.3", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.4.2", "ASVS-REQ-V6.3.8"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 8, "ref_count": 6, "refs": ["CAPEC-268", "CAPEC-36", "CAPEC-578", "CAPEC-69", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 14, "ref_count": 8, "refs": ["CIS-3.1", "CIS-3.14", "CIS-3.2", "CIS-3.7", "CIS-3.8", "CIS-8", "CIS-8.1", "CIS-8.11"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 2, "refs": ["CWE-654", "CWE-656"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["HIPAA-164-310c", "HIPAA-164-312a1", "HIPAA-164-312b", "HIPAA-164-312c1"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 37, "ref_count": 36, "refs": ["SP800-53-AC-17.2", "SP800-53-AC-17.6", "SP800-53-AC-17.7", "SP800-53-AC-3", "SP800-53-AC-3.10", "SP800-53-AC-3.4", "SP800-53-AC-3.6", "SP800-53-AC-3.8", "SP800-53-AU-3.3", "SP800-53-AU-5.3", "SP800-53-AU-5.5", "SP800-53-AU-6.7", "SP800-53-AU-9", "SP800-53-AU-9.3", "SP800-53-AU-9.4", "SP800-53-AU-9.5", "SP800-53-AU-9.6", "SP800-53-IA-4.1", "SP800-53-IA-5.6", "SP800-53-MP-4.2", "SP800-53-PE-3.5", "SP800-53-PE-8.3", "SP800-53-PS-6.2", "SP800-53-PT-6.2", "SP800-53-SC-14", "SP800-53-SC-21.1", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-34.2", "SP800-53-SC-51", "SP800-53-SC-7.4", "SP800-53-SC-8", "SP800-53-SC-8.3", "SP800-53-SI-10.5", "SP800-53-SI-4.6", "SP800-53-SI-8"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C8"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 14, "ref_count": 14, "refs": ["PCI-10.3.1", "PCI-10.3.2", "PCI-4.2.1", "PCI-6.3.3", "PCI-7.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.4", "PCI-7.3.3", "PCI-8.3.2", "PCI-8.3.3", "PCI-8.3.4", "PCI-9.2.2", "PCI-REQ-3"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCISSLC-6.1"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-PRACTICE-PS.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-003", "v1_entity_name": "Log Integrity Protection And Access Discipline", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
880
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 17, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-7", "SP800-53-AU-10.3"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-6.2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.2.1", "PCI-10.5.1"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-675"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CAPEC-675"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 4, "ref_count": 3, "refs": ["CIS-3.4", "CIS-6.2", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 10, "ref_count": 9, "refs": ["SP800-53-AU-10.3", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-16.3", "SP800-53-AU-7", "SP800-53-CP-9.7", "SP800-53-PM-21", "SP800-53-SI-12", "SP800-53-SI-12.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-10.5.1", "PCI-3.2.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SSDF-TASK-PS.3.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-004", "v1_entity_name": "Audit Record Retention And Lifecycle Governance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
881
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 3, "es_grounding_resolution": {"authored_more_sources_count": 3, "authored_visible_source_count": 4, "resolved_ref_count": 31, "resolved_source_count": 6, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-2", "SP800-53-AC-8"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1", "CIS-2"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-150", "CAPEC-384"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6"]}], "es_grounding_sources_full": [{"claim_count": 6, "ref_count": 6, "refs": ["CAPEC-150", "CAPEC-384", "CAPEC-445", "CAPEC-529", "CAPEC-571", "CAPEC-678"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 7, "ref_count": 7, "refs": ["CIS-1", "CIS-12.5", "CIS-13.5", "CIS-13.6", "CIS-2", "CIS-6.7", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP-SCOPE-MINIMIZATION"], "substrate_source_key": "mcp_official_security_foundations_2025"}, {"claim_count": 13, "ref_count": 12, "refs": ["SP800-53-AC-2", "SP800-53-AC-8", "SP800-53-AU-6.4", "SP800-53-CA-9", "SP800-53-CM-8", "SP800-53-CM-8.7", "SP800-53-PE-5.1", "SP800-53-SA-8.6", "SP800-53-SI-2.1", "SP800-53-SI-3.1", "SP800-53-SI-4", "SP800-53-SI-8.1"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6", "DSOMM-ACTIVITY-95CAEF9636ED458CA0875C35D4F9DEC2", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["SAMM-ACTIVITY-I_SD_3_B"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-005", "v1_entity_name": "Centralized Log Ingestion And Source Accountability", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
882
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 1, "resolved_ref_count": 2, "resolved_source_count": 1, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-117", "CWE-391"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CWE-117", "CWE-391"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-006", "v1_entity_name": "Logging Pipeline Health And Silent-Failure Visibility", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
883
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 12, "es_grounding_resolution": {"authored_more_sources_count": 12, "authored_visible_source_count": 4, "resolved_ref_count": 76, "resolved_source_count": 14, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AT-4", "SP800-53-AU-5"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V6.1.3", "ASVS-REQ-V6.3.4"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-4.1", "CIS-4.2"]}], "es_grounding_sources_full": [{"claim_count": 11, "ref_count": 11, "refs": ["ASVS-REQ-V15.1.2", "ASVS-REQ-V15.2.1", "ASVS-REQ-V16.1.1", "ASVS-REQ-V16.2.3", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.5.2", "ASVS-REQ-V16.5.3", "ASVS-REQ-V6.1.3", "ASVS-REQ-V6.3.4", "ASVS-REQ-V7.5.3", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-581", "CAPEC-673"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 23, "ref_count": 10, "refs": ["CIS-16.1", "CIS-16.11", "CIS-16.12", "CIS-16.2", "CIS-16.4", "CIS-16.6", "CIS-16.9", "CIS-4.1", "CIS-4.2", "CIS-8.7"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 2, "ref_count": 1, "refs": ["GDPR-ART-32"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 18, "ref_count": 18, "refs": ["SP800-53-AT-4", "SP800-53-AU-12.1", "SP800-53-AU-5", "SP800-53-AU-6", "SP800-53-AU-6.1", "SP800-53-AU-6.3", "SP800-53-AU-6.5", "SP800-53-AU-9.1", "SP800-53-CA-4", "SP800-53-PM-6", "SP800-53-PT-3", "SP800-53-RA-5.11", "SP800-53-SA-12.14", "SP800-53-SA-15", "SP800-53-SA-15.2", "SP800-53-SA-17", "SP800-53-SA-4.6", "SP800-53-SI-2.7"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 8, "ref_count": 8, "refs": ["DSOMM-ACTIVITY-03643CA203C2472B8E19956BF02FE9B7", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-6E180ABC7C984265B4E9852CB91B067B", "DSOMM-ACTIVITY-8F2B4D5A3C1E4B7A9D8F2E6C4A1B5D7F", "DSOMM-ACTIVITY-B597928E54D648A5A8068003DCD56AAB", "DSOMM-ACTIVITY-CF81922530CB47028E3260225EEDC33D", "DSOMM-ACTIVITY-D03BC41074A74E9282CBD01A020CB6BF", "DSOMM-ACTIVITY-FFE86CAF2FEC4630B5142DB83983984D"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OPC-C9"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 17, "ref_count": 14, "refs": ["SAMM-ACTIVITY-D_SA_1_B", "SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-G_PC_2_A", "SAMM-ACTIVITY-G_PC_3_A", "SAMM-ACTIVITY-G_SM_3_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_2_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_IM_1_A", "SAMM-ACTIVITY-V_AA_2_A", "SAMM-ACTIVITY-V_AA_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-4.1.1"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["PCISSLC-2.4", "PCISSLC-2.5", "PCISSLC-6.2", "PCISSLC-8.3"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-8"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCSIC-DELIVERY-SIGNING", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 1, "ref_count": 1, "refs": ["SLSA-PRINCIPLE-TRUST-PLATFORMS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-TASK-PO.4.1", "SSDF-TASK-PS.2.1"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "intro.md; aplicacao-lifecycle.md", "manual_v2_anchor": "Control / Requirement", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACO-SLG-007", "v1_entity_name": "Security Logging And Audit Trail Assurance", "v1_entity_type": "ControlObjective", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
884
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 3, "resolved_ref_count": 6, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-2", "SP800-53-AU-2.2"]}, {"source_display_name": "CWE SDV v4.19.1", "substrate_source": "mitre_cwe", "visible_refs": ["CWE-778"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-10.7.2"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["CWE-778"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 8, "ref_count": 4, "refs": ["SP800-53-AU-2", "SP800-53-AU-2.2", "SP800-53-AU-3", "SP800-53-AU-5.2"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 1, "ref_count": 1, "refs": ["PCI-10.7.2"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-001", "v1_entity_name": "Critical Event Catalog Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
885
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 4, "es_grounding_resolution": {"authored_more_sources_count": 4, "authored_visible_source_count": 4, "resolved_ref_count": 67, "resolved_source_count": 8, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-1.1", "CIS-1.4"]}, {"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-12.1", "SP800-53-AU-2"]}, {"source_display_name": "DSOMM", "substrate_source": "owasp_dsomm", "visible_refs": ["DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_A"]}], "es_grounding_sources_full": [{"claim_count": 2, "ref_count": 2, "refs": ["CAPEC-150", "CAPEC-571"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 26, "ref_count": 24, "refs": ["CIS-1.1", "CIS-1.4", "CIS-11.4", "CIS-12", "CIS-12.3", "CIS-12.5", "CIS-13.1", "CIS-13.6", "CIS-16.8", "CIS-17.3", "CIS-4.2", "CIS-6.7", "CIS-7", "CIS-7.1", "CIS-7.3", "CIS-7.4", "CIS-7.5", "CIS-7.6", "CIS-8.12", "CIS-8.4", "CIS-8.6", "CIS-8.7", "CIS-8.8", "CIS-8.9"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 20, "ref_count": 20, "refs": ["SP800-53-AC-12.1", "SP800-53-AU-2", "SP800-53-AU-3.2", "SP800-53-AU-6.4", "SP800-53-AU-6.8", "SP800-53-AU-8", "SP800-53-CM-1", "SP800-53-CM-11", "SP800-53-CM-12.1", "SP800-53-CM-3.5", "SP800-53-CM-4", "SP800-53-CM-6", "SP800-53-CM-8", "SP800-53-CM-8.2", "SP800-53-CM-8.7", "SP800-53-CM-8.8", "SP800-53-CP-10.2", "SP800-53-SA-15.13", "SP800-53-SC-36", "SP800-53-SI-2.4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 8, "ref_count": 8, "refs": ["DSOMM-ACTIVITY-1CD5E4B8BE364726ADC7D8F843F47AC8", "DSOMM-ACTIVITY-4ECED38A79044C45ADB050B663065540", "DSOMM-ACTIVITY-7C7350896A83419F8B27C1E676CEDEA1", "DSOMM-ACTIVITY-845F06EC148C4C6797557041911DCCA5", "DSOMM-ACTIVITY-8746647C638C473F8E1782C068E4C311", "DSOMM-ACTIVITY-E9A6D403A467445EB98A74F0C29DA0B1", "DSOMM-ACTIVITY-ED715B38C34B40CD83FDCE807F306FC1", "DSOMM-ACTIVITY-FE875E17AE4A45F8A359244AA4FCBC04"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 11, "ref_count": 8, "refs": ["SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-O_IM_2_B", "SAMM-ACTIVITY-O_OM_1_A", "SAMM-ACTIVITY-O_OM_2_B", "SAMM-ACTIVITY-V_AA_1_A", "SAMM-ACTIVITY-V_AA_1_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-1.2.4", "PCI-REQ-10"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 1, "ref_count": 1, "refs": ["SCAGILE-EXP-11"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SSDF-PRACTICE-PO.3", "SSDF-TASK-PW.1.3"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-002", "v1_entity_name": "Structured And Centralized Security Logging", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
886
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 22, "es_grounding_resolution": {"authored_more_sources_count": 22, "authored_visible_source_count": 4, "resolved_ref_count": 587, "resolved_source_count": 22, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AC-1", "SP800-53-AC-2"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-REQ-3", "PCI-REQ-4"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.2.6"]}, {"source_display_name": "CAPEC v3.9", "substrate_source": "mitre_capec", "visible_refs": ["CAPEC-21", "CAPEC-22"]}], "es_grounding_sources_full": [{"claim_count": 51, "ref_count": 51, "refs": ["ASVS-REQ-V1.2.4", "ASVS-REQ-V1.2.6", "ASVS-REQ-V1.3.6", "ASVS-REQ-V1.5.2", "ASVS-REQ-V11.1.2", "ASVS-REQ-V11.2.1", "ASVS-REQ-V11.2.5", "ASVS-REQ-V11.3.3", "ASVS-REQ-V11.4.3", "ASVS-REQ-V11.4.4", "ASVS-REQ-V11.7.1", "ASVS-REQ-V11.7.2", "ASVS-REQ-V14.1.1", "ASVS-REQ-V14.1.2", "ASVS-REQ-V14.2.2", "ASVS-REQ-V14.2.3", "ASVS-REQ-V14.2.4", "ASVS-REQ-V14.2.7", "ASVS-REQ-V14.2.8", "ASVS-REQ-V15.1.2", "ASVS-REQ-V15.1.5", "ASVS-REQ-V15.2.1", "ASVS-REQ-V15.3.1", "ASVS-REQ-V15.3.3", "ASVS-REQ-V15.3.4", "ASVS-REQ-V15.4.1", "ASVS-REQ-V15.4.2", "ASVS-REQ-V15.4.3", "ASVS-REQ-V16.2.5", "ASVS-REQ-V16.3.1", "ASVS-REQ-V16.3.3", "ASVS-REQ-V16.3.4", "ASVS-REQ-V16.4.1", "ASVS-REQ-V16.4.2", "ASVS-REQ-V16.4.3", "ASVS-REQ-V16.5.1", "ASVS-REQ-V16.5.3", "ASVS-REQ-V4.1.5", "ASVS-REQ-V6.1.1", "ASVS-REQ-V6.1.2", "ASVS-REQ-V6.3.3", "ASVS-REQ-V6.3.8", "ASVS-REQ-V6.5.2", "ASVS-REQ-V6.7.1", "ASVS-REQ-V7.5.1", "ASVS-REQ-V7.5.3", "ASVS-REQ-V8.1.3", "ASVS-REQ-V8.1.4", "ASVS-REQ-V8.2.2", "ASVS-REQ-V8.2.4", "ASVS-REQ-V8.4.2"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 41, "ref_count": 39, "refs": ["CAPEC-122", "CAPEC-157", "CAPEC-184", "CAPEC-187", "CAPEC-207", "CAPEC-21", "CAPEC-212", "CAPEC-22", "CAPEC-224", "CAPEC-268", "CAPEC-36", "CAPEC-37", "CAPEC-385", "CAPEC-39", "CAPEC-440", "CAPEC-477", "CAPEC-518", "CAPEC-519", "CAPEC-521", "CAPEC-54", "CAPEC-568", "CAPEC-57", "CAPEC-577", "CAPEC-578", "CAPEC-621", "CAPEC-643", "CAPEC-648", "CAPEC-655", "CAPEC-669", "CAPEC-673", "CAPEC-678", "CAPEC-679", "CAPEC-680", "CAPEC-681", "CAPEC-69", "CAPEC-692", "CAPEC-702", "CAPEC-81", "CAPEC-93"], "substrate_source_key": "capec_v3_9"}, {"claim_count": 47, "ref_count": 21, "refs": ["CIS-11.3", "CIS-16.1", "CIS-16.11", "CIS-16.12", "CIS-16.2", "CIS-16.4", "CIS-16.6", "CIS-16.9", "CIS-18.4", "CIS-2.5", "CIS-3", "CIS-3.1", "CIS-3.13", "CIS-3.14", "CIS-3.2", "CIS-3.3", "CIS-3.5", "CIS-3.7", "CIS-3.8", "CIS-4.11", "CIS-6.8"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 29, "ref_count": 29, "refs": ["CWE-1220", "CWE-1230", "CWE-209", "CWE-213", "CWE-215", "CWE-222", "CWE-224", "CWE-268", "CWE-277", "CWE-278", "CWE-294", "CWE-312", "CWE-319", "CWE-348", "CWE-349", "CWE-353", "CWE-354", "CWE-358", "CWE-434", "CWE-497", "CWE-501", "CWE-502", "CWE-538", "CWE-649", "CWE-656", "CWE-798", "CWE-836", "CWE-921", "CWE-924"], "substrate_source_key": "cwe_software_development_view_v4_19_1"}, {"claim_count": 2, "ref_count": 1, "refs": ["NIS2-ART-21"], "substrate_source_key": "eu_nis2"}, {"claim_count": 4, "ref_count": 2, "refs": ["GDPR-ART-32", "GDPR-ART-5"], "substrate_source_key": "eu_rgpd"}, {"claim_count": 9, "ref_count": 8, "refs": ["HIPAA-164-308a1", "HIPAA-164-308a4", "HIPAA-164-308a5", "HIPAA-164-308a6", "HIPAA-164-310c", "HIPAA-164-312a1", "HIPAA-164-312c1", "HIPAA-164-312d"], "substrate_source_key": "hipaa_security_rule"}, {"claim_count": 328, "ref_count": 299, "refs": ["SP800-53-AC-1", "SP800-53-AC-14", "SP800-53-AC-14.1", "SP800-53-AC-16", "SP800-53-AC-16.1", "SP800-53-AC-16.10", "SP800-53-AC-16.3", "SP800-53-AC-16.4", "SP800-53-AC-16.6", "SP800-53-AC-16.7", "SP800-53-AC-16.8", "SP800-53-AC-16.9", "SP800-53-AC-17.2", "SP800-53-AC-17.4", "SP800-53-AC-17.6", "SP800-53-AC-17.7", "SP800-53-AC-18.1", "SP800-53-AC-19.1", "SP800-53-AC-19.5", "SP800-53-AC-2", "SP800-53-AC-2.11", "SP800-53-AC-2.13", "SP800-53-AC-2.6", "SP800-53-AC-2.7", "SP800-53-AC-22", "SP800-53-AC-23", "SP800-53-AC-24", "SP800-53-AC-24.1", "SP800-53-AC-24.2", "SP800-53-AC-25", "SP800-53-AC-3", "SP800-53-AC-3.10", "SP800-53-AC-3.12", "SP800-53-AC-3.13", "SP800-53-AC-3.14", "SP800-53-AC-3.5", "SP800-53-AC-3.6", "SP800-53-AC-3.7", "SP800-53-AC-3.8", "SP800-53-AC-4", "SP800-53-AC-4.1", "SP800-53-AC-4.11", "SP800-53-AC-4.12", "SP800-53-AC-4.13", "SP800-53-AC-4.14", "SP800-53-AC-4.15", "SP800-53-AC-4.17", "SP800-53-AC-4.19", "SP800-53-AC-4.2", "SP800-53-AC-4.22", "SP800-53-AC-4.23", "SP800-53-AC-4.25", "SP800-53-AC-4.26", "SP800-53-AC-4.27", "SP800-53-AC-4.3", "SP800-53-AC-4.30", "SP800-53-AC-4.31", "SP800-53-AC-4.4", "SP800-53-AC-4.6", "SP800-53-AC-5", "SP800-53-AC-6.1", "SP800-53-AC-6.3", "SP800-53-AC-6.5", "SP800-53-AC-6.6", "SP800-53-AC-6.9", "SP800-53-AC-7.4", "SP800-53-AT-4", "SP800-53-AU-10.2", "SP800-53-AU-10.4", "SP800-53-AU-10.5", "SP800-53-AU-12.4", "SP800-53-AU-14.2", "SP800-53-AU-15", "SP800-53-AU-16.2", "SP800-53-AU-2.4", "SP800-53-AU-3.1", "SP800-53-AU-3.3", "SP800-53-AU-5.3", "SP800-53-AU-5.5", "SP800-53-AU-6.7", "SP800-53-AU-7", "SP800-53-AU-9", "SP800-53-AU-9.3", "SP800-53-AU-9.4", "SP800-53-AU-9.5", "SP800-53-AU-9.6", "SP800-53-CA-3.6", "SP800-53-CA-4", "SP800-53-CA-9", "SP800-53-CA-9.1", "SP800-53-CP-7.5", "SP800-53-CP-9.7", "SP800-53-CP-9.8", "SP800-53-IA-1", "SP800-53-IA-10", "SP800-53-IA-12", "SP800-53-IA-13.1", "SP800-53-IA-13.2", "SP800-53-IA-13.3", "SP800-53-IA-2.1", "SP800-53-IA-2.2", "SP800-53-IA-2.3", "SP800-53-IA-2.6", "SP800-53-IA-2.8", "SP800-53-IA-2.9", "SP800-53-IA-4.1", "SP800-53-IA-4.9", "SP800-53-IA-5.1", "SP800-53-IA-5.6", "SP800-53-IA-5.7", "SP800-53-IA-6", "SP800-53-IA-8.2", "SP800-53-IR-9.4", "SP800-53-MA-3.3", "SP800-53-MA-4.6", "SP800-53-MA-5.1", "SP800-53-MA-5.2", "SP800-53-MP-2.2", "SP800-53-MP-4.1", "SP800-53-MP-4.2", "SP800-53-MP-5", "SP800-53-MP-5.4", "SP800-53-MP-6.1", "SP800-53-MP-6.4", "SP800-53-MP-6.7", "SP800-53-MP-6.8", "SP800-53-MP-8.4", "SP800-53-PE-2", "SP800-53-PE-2.3", "SP800-53-PE-3", "SP800-53-PE-3.1", "SP800-53-PE-3.4", "SP800-53-PE-3.5", "SP800-53-PE-5", "SP800-53-PE-5.1", "SP800-53-PE-8", "SP800-53-PE-8.2", "SP800-53-PE-8.3", "SP800-53-PL-2", "SP800-53-PM-1", "SP800-53-PM-9", "SP800-53-PS-3.3", "SP800-53-PS-3.4", "SP800-53-PS-6", "SP800-53-PS-6.1", "SP800-53-PS-6.2", "SP800-53-PS-7", "SP800-53-PT-2", "SP800-53-PT-2.1", "SP800-53-PT-2.2", "SP800-53-PT-3", "SP800-53-PT-6.2", "SP800-53-RA-5.5", "SP800-53-SA-10.1", "SP800-53-SA-10.3", "SP800-53-SA-10.4", "SP800-53-SA-10.5", "SP800-53-SA-12.14", "SP800-53-SA-17", "SP800-53-SA-18", "SP800-53-SA-3", "SP800-53-SA-5.1", "SP800-53-SA-8", "SP800-53-SA-8.10", "SP800-53-SA-8.12", "SP800-53-SA-8.14", "SP800-53-SA-8.15", "SP800-53-SA-8.18", "SP800-53-SA-8.19", "SP800-53-SA-8.20", "SP800-53-SA-8.22", "SP800-53-SA-8.23", "SP800-53-SA-8.25", "SP800-53-SA-8.26", "SP800-53-SA-8.28", "SP800-53-SA-8.31", "SP800-53-SA-8.32", "SP800-53-SA-8.5", "SP800-53-SA-8.8", "SP800-53-SA-8.9", "SP800-53-SA-9.7", "SP800-53-SC-11", "SP800-53-SC-12.1", "SP800-53-SC-12.6", "SP800-53-SC-13", "SP800-53-SC-13.1", "SP800-53-SC-13.4", "SP800-53-SC-14", "SP800-53-SC-16", "SP800-53-SC-16.1", "SP800-53-SC-16.2", "SP800-53-SC-16.3", "SP800-53-SC-18.3", "SP800-53-SC-20.2", "SP800-53-SC-21.1", "SP800-53-SC-23", "SP800-53-SC-23.5", "SP800-53-SC-28", "SP800-53-SC-28.1", "SP800-53-SC-28.3", "SP800-53-SC-3", "SP800-53-SC-3.2", "SP800-53-SC-3.3", "SP800-53-SC-30.4", "SP800-53-SC-33", "SP800-53-SC-34.2", "SP800-53-SC-34.3", "SP800-53-SC-38", "SP800-53-SC-4", "SP800-53-SC-4.1", "SP800-53-SC-42.1", "SP800-53-SC-42.2", "SP800-53-SC-43", "SP800-53-SC-49", "SP800-53-SC-50", "SP800-53-SC-51", "SP800-53-SC-7.14", "SP800-53-SC-7.15", "SP800-53-SC-7.18", "SP800-53-SC-7.2", "SP800-53-SC-7.24", "SP800-53-SC-7.4", "SP800-53-SC-8", "SP800-53-SC-8.1", "SP800-53-SC-8.3", "SP800-53-SC-8.4", "SP800-53-SC-9", "SP800-53-SI-1", "SP800-53-SI-10.3", "SP800-53-SI-10.5", "SP800-53-SI-10.6", "SP800-53-SI-12.1", "SP800-53-SI-12.2", "SP800-53-SI-13.5", "SP800-53-SI-14.1", "SP800-53-SI-14.2", "SP800-53-SI-15", "SP800-53-SI-16", "SP800-53-SI-17", "SP800-53-SI-18", "SP800-53-SI-18.3", "SP800-53-SI-18.4", "SP800-53-SI-19", "SP800-53-SI-19.1", "SP800-53-SI-19.2", "SP800-53-SI-19.3", "SP800-53-SI-19.4", "SP800-53-SI-19.5", "SP800-53-SI-19.6", "SP800-53-SI-19.7", "SP800-53-SI-2", "SP800-53-SI-2.1", "SP800-53-SI-2.2", "SP800-53-SI-2.3", "SP800-53-SI-2.5", "SP800-53-SI-2.7", "SP800-53-SI-20", "SP800-53-SI-22", "SP800-53-SI-3", "SP800-53-SI-3.1", "SP800-53-SI-3.2", "SP800-53-SI-3.3", "SP800-53-SI-3.4", "SP800-53-SI-3.5", "SP800-53-SI-3.6", "SP800-53-SI-3.7", "SP800-53-SI-3.9", "SP800-53-SI-4", "SP800-53-SI-4.10", "SP800-53-SI-4.16", "SP800-53-SI-4.19", "SP800-53-SI-4.20", "SP800-53-SI-4.22", "SP800-53-SI-4.6", "SP800-53-SI-4.8", "SP800-53-SI-4.9", "SP800-53-SI-6", "SP800-53-SI-6.3", "SP800-53-SI-7", "SP800-53-SI-7.1", "SP800-53-SI-7.10", "SP800-53-SI-7.11", "SP800-53-SI-7.12", "SP800-53-SI-7.13", "SP800-53-SI-7.14", "SP800-53-SI-7.15", "SP800-53-SI-7.17", "SP800-53-SI-7.2", "SP800-53-SI-7.3", "SP800-53-SI-7.4", "SP800-53-SI-7.5", "SP800-53-SI-7.6", "SP800-53-SI-7.7", "SP800-53-SI-7.9", "SP800-53-SI-8.1", "SP800-53-SI-8.2", "SP800-53-SI-9", "SP800-53-SR-10", "SP800-53-SR-9"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 4, "refs": ["DSOMM-ACTIVITY-070BB14BE04A4F3D896AA08EBA7A35F9", "DSOMM-ACTIVITY-4CAE98C2416344EDBB883C67C569533A", "DSOMM-ACTIVITY-72737130472C498480F89AB2F1C2ED5D", "DSOMM-ACTIVITY-82E499D1F4634A4BBE9068812A874AF6"], "substrate_source_key": "owasp_dsomm"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-DEPLOYMENT"], "substrate_source_key": "owasp_mcp_secure_server_development_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["OWASP-MCP-3P-AUTH-AUTHZ-REGISTRATION"], "substrate_source_key": "owasp_mcp_third_party_servers_v1_0"}, {"claim_count": 1, "ref_count": 1, "refs": ["MCP01-2025"], "substrate_source_key": "owasp_mcp_top_10_v0_1_2025_beta"}, {"claim_count": 2, "ref_count": 2, "refs": ["OPC-C3", "OPC-C8"], "substrate_source_key": "owasp_proactive_controls_2018"}, {"claim_count": 14, "ref_count": 10, "refs": ["SAMM-ACTIVITY-D_SA_2_A", "SAMM-ACTIVITY-D_SA_3_B", "SAMM-ACTIVITY-D_SR_1_A", "SAMM-ACTIVITY-I_DM_1_A", "SAMM-ACTIVITY-I_SB_3_B", "SAMM-ACTIVITY-I_SD_1_A", "SAMM-ACTIVITY-I_SD_3_B", "SAMM-ACTIVITY-O_IM_1_B", "SAMM-ACTIVITY-O_OM_2_A", "SAMM-ACTIVITY-O_OM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["TOP10-A02-2021", "TOP10-A08-2021"], "substrate_source_key": "owasp_top_10_2021"}, {"claim_count": 86, "ref_count": 79, "refs": ["PCI-1.1.2", "PCI-1.2.3", "PCI-1.4.2", "PCI-10.3.1", "PCI-10.3.2", "PCI-11.2.1", "PCI-11.6.1", "PCI-12.3.4", "PCI-12.8.3", "PCI-2.2.5", "PCI-2.2.7", "PCI-3.1.2", "PCI-3.3.2", "PCI-3.3.3", "PCI-3.4.2", "PCI-3.6.1", "PCI-3.7.1", "PCI-3.7.2", "PCI-3.7.3", "PCI-3.7.4", "PCI-3.7.5", "PCI-3.7.6", "PCI-3.7.7", "PCI-4.1.2", "PCI-4.2.1", "PCI-4.2.2", "PCI-5.3.4", "PCI-6.1.2", "PCI-6.3.3", "PCI-7.1.1", "PCI-7.1.2", "PCI-7.2.1", "PCI-7.2.2", "PCI-7.2.3", "PCI-7.2.4", "PCI-7.2.5", "PCI-7.2.6", "PCI-7.3.1", "PCI-7.3.2", "PCI-7.3.3", "PCI-8.1.1", "PCI-8.1.2", "PCI-8.2.1", "PCI-8.2.2", "PCI-8.2.4", "PCI-8.2.5", "PCI-8.2.7", "PCI-8.3.1", "PCI-8.3.11", "PCI-8.3.2", "PCI-8.3.3", "PCI-8.3.4", "PCI-8.3.6", "PCI-8.3.7", "PCI-8.3.8", "PCI-8.4.1", "PCI-8.4.2", "PCI-8.4.3", "PCI-8.5.1", "PCI-8.6.1", "PCI-8.6.2", "PCI-8.6.3", "PCI-9.1.1", "PCI-9.1.2", "PCI-9.2.2", "PCI-9.2.4", "PCI-9.3.1", "PCI-9.3.2", "PCI-9.4.1", "PCI-9.4.2", "PCI-9.4.5", "PCI-9.4.6", "PCI-9.4.7", "PCI-9.5.1", "PCI-REQ-3", "PCI-REQ-4", "PCI-REQ-7", "PCI-REQ-8", "PCI-REQ-9"], "substrate_source_key": "pci_dss_v4_0_1"}, {"claim_count": 9, "ref_count": 9, "refs": ["PCISSLC-3.2", "PCISSLC-3.3", "PCISSLC-4.2", "PCISSLC-5.1", "PCISSLC-6.1", "PCISSLC-6.2", "PCISSLC-7.1", "PCISSLC-7.2", "PCISSLC-8.2"], "substrate_source_key": "pci_sslc_v1_1"}, {"claim_count": 4, "ref_count": 4, "refs": ["SCAGILE-EXP-2", "SCAGILE-EXP-8", "SCAGILE-OPS-16", "SCAGILE-OPS-2"], "substrate_source_key": "safecode_agile_2012"}, {"claim_count": 2, "ref_count": 2, "refs": ["SCFPSSD-DATA-HANDLING", "SCFPSSD-LOGGING"], "substrate_source_key": "safecode_fpssd_2018"}, {"claim_count": 6, "ref_count": 6, "refs": ["SCSIC-DELIVERY", "SCSIC-DELIVERY-SIGNING", "SCSIC-DEV-REPO", "SCSIC-DEVELOPMENT", "SCSIC-SOURCING-CONTRACT", "SCSIC-SOURCING-TRANSFER"], "substrate_source_key": "safecode_sic_2010"}, {"claim_count": 2, "ref_count": 2, "refs": ["SLSA-PRINCIPLE-TRUST-CODE", "SLSA-PRINCIPLE-TRUST-PLATFORMS"], "substrate_source_key": "slsa_spec_v1_0_build_track"}, {"claim_count": 15, "ref_count": 14, "refs": ["SSDF-PRACTICE-PO.1", "SSDF-PRACTICE-PO.4", "SSDF-PRACTICE-PS.1", "SSDF-PRACTICE-PS.2", "SSDF-PRACTICE-PS.3", "SSDF-PRACTICE-PW.1", "SSDF-PRACTICE-PW.2", "SSDF-PRACTICE-PW.4", "SSDF-PRACTICE-PW.7", "SSDF-TASK-PO.1.1", "SSDF-TASK-PO.1.2", "SSDF-TASK-PO.4.1", "SSDF-TASK-PS.2.1", "SSDF-TASK-PW.1.2"], "substrate_source_key": "ssdf_sp800_218_v1_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-003", "v1_entity_name": "Log Integrity And Protected Access", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
887
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 1, "es_grounding_resolution": {"authored_more_sources_count": 1, "authored_visible_source_count": 4, "resolved_ref_count": 15, "resolved_source_count": 4, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-4", "SP800-53-AU-5.1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_3_B"]}, {"source_display_name": "CIS Controls v8.1.2", "substrate_source": "cis_controls", "visible_refs": ["CIS-3.4", "CIS-8.1"]}, {"source_display_name": "PCI DSS v4.0.1", "substrate_source": "pci_dss", "visible_refs": ["PCI-3.2.1", "PCI-10.5.1"]}], "es_grounding_sources_full": [{"claim_count": 3, "ref_count": 2, "refs": ["CIS-3.4", "CIS-8.1"], "substrate_source_key": "cis_controls_v8_1_2"}, {"claim_count": 8, "ref_count": 8, "refs": ["SP800-53-AU-10.3", "SP800-53-AU-11", "SP800-53-AU-11.1", "SP800-53-AU-4", "SP800-53-AU-5.1", "SP800-53-SA-3", "SP800-53-SI-12", "SP800-53-SI-12.3"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 4, "ref_count": 3, "refs": ["SAMM-ACTIVITY-G_PC_1_A", "SAMM-ACTIVITY-G_PC_3_B", "SAMM-ACTIVITY-V_ST_2_B"], "substrate_source_key": "owasp_samm_v2_1"}, {"claim_count": 2, "ref_count": 2, "refs": ["PCI-10.5.1", "PCI-3.2.1"], "substrate_source_key": "pci_dss_v4_0_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "addon/00-catalogo-requisitos.md", "manual_v2_anchor": "Practice", "methodology_label": "Explícito", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-004", "v1_entity_name": "Log Retention And Lifecycle Governance", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
888
+ {"authority_class": "normative", "coverage_status": "substantive", "es_grounding_more_sources_count": 0, "es_grounding_resolution": {"authored_more_sources_count": 0, "authored_visible_source_count": 4, "resolved_ref_count": 6, "resolved_source_count": 3, "status": "resolved", "substrate_index": "ontology/substrate/v1_entity_source_refs.json"}, "es_grounding_sources": [{"source_display_name": "SP 800-53 r5", "substrate_source": "nist_sp_800_53", "visible_refs": ["SP800-53-AU-5.4", "SP800-53-MA-1"]}, {"source_display_name": "SAMM v2.1", "substrate_source": "owasp_samm", "visible_refs": ["SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_3_A"]}, {"source_display_name": "ASVS v5", "substrate_source": "owasp_asvs", "visible_refs": ["ASVS-REQ-V16.5.4"]}, {"source_display_name": "OWASP LLM Top 10", "substrate_source": "owasp_llm_top_10", "visible_refs": ["LLM03-2025"]}], "es_grounding_sources_full": [{"claim_count": 1, "ref_count": 1, "refs": ["ASVS-REQ-V16.5.4"], "substrate_source_key": "asvs_v5_0_0"}, {"claim_count": 3, "ref_count": 3, "refs": ["SP800-53-AU-5.4", "SP800-53-MA-1", "SP800-53-MA-4"], "substrate_source_key": "nist_sp800_53_rev5"}, {"claim_count": 2, "ref_count": 2, "refs": ["SAMM-ACTIVITY-O_EM_3_A", "SAMM-ACTIVITY-O_IM_3_A"], "substrate_source_key": "owasp_samm_v2_1"}], "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section_anchor": "chapter prose (detect, logging, pipeline kws verified)", "manual_v2_anchor": "Practice", "methodology_label": "Semântico", "rastreabilidade_role": "substrate_landing", "source_mode": "explicit", "substrate_release_tag": "cycle-a-frozen-2026-05-08", "v1_entity_id": "ACP-SLG-005", "v1_entity_name": "Logging Pipeline Health Visibility", "v1_entity_type": "Practice", "v1_family": "ACO-SLG", "v1_slice": "ASC-10"}
889
889
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "SAMM v2.1 OE/IM maturity; DSOMM operations activities", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "achievable-maturity.md", "manual_v2_anchor": "MaturityMapping", "rastreabilidade_role": "manual_only_coverage"}
890
890
  {"authority_class": "editorial / external", "coverage_status": "manual_only", "es_grounding_direct": "Política de Monitorização e Resposta a Incidentes", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "policies-relevantes.md", "manual_v2_anchor": "PolicyReference", "rastreabilidade_role": "manual_only_coverage"}
891
891
  {"authority_class": "external", "coverage_status": "manual_only", "es_grounding_direct": "Integração SIEM/SOAR (operacional)", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "f78dfe734a83b01fa9283c2df5a3eb0ba9528001", "manual_file": "canon/25-rastreabilidade.md", "manual_section": "addon/04-integracao-siem.md", "manual_v2_anchor": "ExternalObligation", "rastreabilidade_role": "manual_only_coverage"}