@shiftleftpt/sbd-toe-mcp 0.20.0-beta.3 → 0.20.0-beta.4

package/data/publish/runtime/controls.json

@@ -49,7 +49,7 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.84,
         "mode": "derived",
-        "n_links": 61,
+        "n_links": 58,
         "source_requirement_ids": [
           "API-001",
           "API-002",
@@ -59,7 +59,6 @@
           "API-007",
           "AUT-002",
           "AUT-004",
-          "AUT-008",
           "CFG-002",
           "CFG-003",
           "CFG-004",
@@ -80,7 +79,6 @@
           "ENC-004",
           "ENC-005",
           "ENC-006",
-          "ENC-007",
           "ENC-008",
           "ENC-009",
           "ERR-001",
@@ -103,7 +101,6 @@
           "INT-005",
           "INT-006",
           "INT-007",
-          "INT-008",
           "VAL-001",
           "VAL-002",
           "VAL-003",
@@ -394,8 +391,9 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.84,
         "mode": "derived",
-        "n_links": 11,
+        "n_links": 12,
         "source_requirement_ids": [
+          "ARC-001",
           "ARC-002",
           "ARC-003",
           "ARC-004",
@@ -519,15 +517,13 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.84,
         "mode": "derived",
-        "n_links": 19,
+        "n_links": 17,
         "source_requirement_ids": [
           "AUT-001",
           "AUT-003",
           "AUT-005",
           "AUT-006",
           "AUT-009",
-          "AUT-010",
-          "REQ-001",
           "REQ-002",
           "REQ-004",
           "REQ-005",
@@ -682,9 +678,8 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.87,
         "mode": "derived",
-        "n_links": 20,
+        "n_links": 19,
         "source_requirement_ids": [
-          "AUT-007",
           "CFG-001",
           "CFG-006",
           "CLA-001",
@@ -695,7 +690,7 @@
           "CLA-006",
           "CLA-007",
           "CLA-008",
-          "INT-008",
+          "REQ-001",
           "REQ-003",
           "REQ-005",
           "REQ-006",
@@ -824,17 +819,19 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.87,
         "mode": "derived",
-        "n_links": 9,
+        "n_links": 11,
         "source_requirement_ids": [
           "GOV-001",
           "GOV-004",
           "GOV-005",
           "GOV-006",
           "GOV-007",
+          "GOV-009",
           "GOV-010",
           "GOV-011",
           "GOV-012",
-          "GOV-013"
+          "GOV-013",
+          "INT-008"
         ],
         "via": "requirement_control_links"
       },
@@ -1093,7 +1090,7 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.54,
         "mode": "derived",
-        "n_links": 35,
+        "n_links": 32,
         "source_requirement_ids": [
           "ACC-001",
           "ACC-002",
@@ -1105,13 +1102,11 @@
           "ACC-008",
           "ACC-009",
           "ACC-010",
+          "AUT-007",
+          "AUT-008",
           "CNT-001",
           "CNT-002",
-          "CNT-003",
           "CNT-004",
-          "CNT-005",
-          "CNT-006",
-          "CNT-009",
           "CNT-010",
           "CNT-011",
           "CNT-012",
@@ -1119,7 +1114,6 @@
           "GOV-003",
           "GOV-006",
           "GOV-008",
-          "GOV-009",
           "GOV-010",
           "GOV-014",
           "SES-001",
@@ -1502,12 +1496,14 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.876,
         "mode": "derived",
-        "n_links": 4,
+        "n_links": 6,
         "source_requirement_ids": [
           "ARC-001",
           "ARC-006",
           "ARC-008",
-          "ARC-011"
+          "ARC-011",
+          "ARC-013",
+          "INT-008"
         ],
         "via": "requirement_control_links"
       },
@@ -1581,8 +1577,9 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.54,
         "mode": "derived",
-        "n_links": 25,
+        "n_links": 26,
         "source_requirement_ids": [
+          "AUT-010",
           "LOG-001",
           "LOG-002",
           "LOG-003",
@@ -1702,10 +1699,11 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.7338,
         "mode": "derived",
-        "n_links": 2,
+        "n_links": 3,
         "source_requirement_ids": [
           "CFG-006",
-          "CIC-003"
+          "CIC-003",
+          "ENC-007"
         ],
         "via": "requirement_control_links"
       },
@@ -1913,10 +1911,14 @@
       "applicable_levels_provenance": {
         "min_link_confidence": 0.9016,
         "mode": "derived",
-        "n_links": 3,
+        "n_links": 7,
         "source_requirement_ids": [
+          "CNT-003",
+          "CNT-005",
+          "CNT-006",
           "CNT-007",
           "CNT-008",
+          "CNT-009",
           "CNT-010"
         ],
         "via": "requirement_control_links"

package/data/publish/runtime/deterministic_manifest.json

@@ -118,7 +118,7 @@
       "source_artifact": "data/entities/artifact_requirements.json"
     },
     {
-      "count": 263,
+      "count": 265,
       "entity_type": "RequirementControlLink",
       "file": "requirement_control_links.json",
       "name": "requirement_control_links",

package/data/publish/runtime/evidence_patterns.json

@@ -1326,8 +1326,8 @@
         }
       ],
       "id": "EP-ARC-013",
-      "maps_to_control_id": "CTRL-governance-arquitetura-segura-e-rastreavel-74562442c4",
-      "maps_to_control_name": "Arquitetura segura e rastreável",
+      "maps_to_control_id": "CTRL-infrastructure-segmentacao-e-controlo-arquitetural-dceb3c1f0b",
+      "maps_to_control_name": "Segmentação e controlo arquitetural",
       "maps_to_requirement_id": "ARC-013",
       "requirement_category": "ARC",
       "requirement_name": "Validação automática de topologia em CI/CD ou como código",
@@ -1703,8 +1703,8 @@
         }
       ],
       "id": "EP-AUT-007",
-      "maps_to_control_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29",
-      "maps_to_control_name": "Classificação e governação por risco",
+      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
+      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
       "maps_to_requirement_id": "AUT-007",
       "requirement_category": "AUT",
       "requirement_name": "Suporte a autenticação federada",
@@ -1740,8 +1740,8 @@
         }
       ],
       "id": "EP-AUT-008",
-      "maps_to_control_id": "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460",
-      "maps_to_control_name": "Desenvolvimento seguro e validação de código",
+      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
+      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
       "maps_to_requirement_id": "AUT-008",
       "requirement_category": "AUT",
       "requirement_name": "Step-up para acções sensíveis",
@@ -1832,8 +1832,8 @@
         }
       ],
       "id": "EP-AUT-010",
-      "maps_to_control_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf",
-      "maps_to_control_name": "Capacitação e onboarding de segurança",
+      "maps_to_control_id": "CTRL-monitoring-monitorizacao-e-resposta-operacional-1797f0af70",
+      "maps_to_control_name": "Monitorização e resposta operacional",
       "maps_to_requirement_id": "AUT-010",
       "requirement_category": "AUT",
       "requirement_name": "Alerta de acessos suspeitos",
@@ -3040,8 +3040,8 @@
         }
       ],
       "id": "EP-CNT-003",
-      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
-      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
+      "maps_to_control_id": "CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d",
+      "maps_to_control_name": "Supply chain segura de imagens e containers",
       "maps_to_requirement_id": "CNT-003",
       "requirement_category": "CNT",
       "requirement_name": "Imagens minimalistas - ausência de componentes não necessários",
@@ -3111,8 +3111,8 @@
       "expected_artifact_type_ids": [],
       "expected_artifacts": [],
       "id": "EP-CNT-005",
-      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
-      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
+      "maps_to_control_id": "CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d",
+      "maps_to_control_name": "Supply chain segura de imagens e containers",
       "maps_to_requirement_id": "CNT-005",
       "requirement_category": "CNT",
       "requirement_name": "Sistema de ficheiros em modo de leitura em runtime",
@@ -3137,8 +3137,8 @@
       "expected_artifact_type_ids": [],
       "expected_artifacts": [],
       "id": "EP-CNT-006",
-      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
-      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
+      "maps_to_control_id": "CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d",
+      "maps_to_control_name": "Supply chain segura de imagens e containers",
       "maps_to_requirement_id": "CNT-006",
       "requirement_category": "CNT",
       "requirement_name": "Restrição de capabilities do kernel e perfis de syscall",
@@ -3270,8 +3270,8 @@
         }
       ],
       "id": "EP-CNT-009",
-      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
-      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
+      "maps_to_control_id": "CTRL-supply-chain-supply-chain-segura-de-imagens-e-containers-8a8af25a4d",
+      "maps_to_control_name": "Supply chain segura de imagens e containers",
       "maps_to_requirement_id": "CNT-009",
       "requirement_category": "CNT",
       "requirement_name": "Políticas de admission control activas",
@@ -5526,8 +5526,8 @@
         }
       ],
       "id": "EP-ENC-007",
-      "maps_to_control_id": "CTRL-code-integrity-desenvolvimento-seguro-e-validacao-de-codigo-63dedd7460",
-      "maps_to_control_name": "Desenvolvimento seguro e validação de código",
+      "maps_to_control_id": "CTRL-secrets-gestao-de-segredos-e-identidades-operacionais-e2c86cdfe9",
+      "maps_to_control_name": "Gestão de segredos e identidades operacionais",
       "maps_to_requirement_id": "ENC-007",
       "requirement_category": "ENC",
       "requirement_name": "Rotação periódica de chaves e segredos",
@@ -6222,8 +6222,8 @@
         }
       ],
       "id": "EP-GOV-009",
-      "maps_to_control_id": "CTRL-identity-gestao-de-identidades-acessos-e-ownership-d0919c69af",
-      "maps_to_control_name": "Gestão de identidades, acessos e ownership",
+      "maps_to_control_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628",
+      "maps_to_control_name": "Governação de fornecedores e exceções",
       "maps_to_requirement_id": "GOV-009",
       "requirement_category": "GOV",
       "requirement_name": "Evidência de decisões rastreável, referenciável e retida",
@@ -7556,8 +7556,8 @@
         }
       ],
       "id": "EP-INT-008",
-      "maps_to_control_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29",
-      "maps_to_control_name": "Classificação e governação por risco",
+      "maps_to_control_id": "CTRL-governance-governacao-de-fornecedores-e-excecoes-a9a9ab3628",
+      "maps_to_control_name": "Governação de fornecedores e exceções",
       "maps_to_requirement_id": "INT-008",
       "requirement_category": "INT",
       "requirement_name": "Revisão de segurança e contrato em integrações",
@@ -8678,8 +8678,8 @@
       "expected_artifact_type_ids": [],
       "expected_artifacts": [],
       "id": "EP-REQ-001",
-      "maps_to_control_id": "CTRL-governance-capacitacao-e-onboarding-de-seguranca-f84db7abdf",
-      "maps_to_control_name": "Capacitação e onboarding de segurança",
+      "maps_to_control_id": "CTRL-governance-classificacao-e-governacao-por-risco-97aceecf29",
+      "maps_to_control_name": "Classificação e governação por risco",
       "maps_to_requirement_id": "REQ-001",
       "requirement_category": "REQ",
       "requirement_name": "Inclusão de requisitos de segurança",