@shiftleftpt/sbd-toe-mcp 0.20.0-beta.42 → 0.20.0-beta.44

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (32) hide show
  1. package/consumed-bundle.json +8 -8
  2. package/data/entities/proportionality.json +2 -2
  3. package/data/entities/sdlc_integration.json +190 -13
  4. package/data/publish/indexes/canonical_chunks.jsonl +4907 -4907
  5. package/data/publish/indexes/publication_manifest.json +6 -4
  6. package/data/publish/ontology/sbdtoe-ontology.yaml +91 -5
  7. package/data/publish/runtime/artifact_requirements.json +334 -1
  8. package/data/publish/runtime/assignments.json +243 -25
  9. package/data/publish/runtime/controls.json +7 -1
  10. package/data/publish/runtime/decision_involvements.json +2216 -0
  11. package/data/publish/runtime/deterministic_manifest.json +13 -2
  12. package/data/publish/runtime/phases.json +26 -4
  13. package/data/publish/runtime/roles.json +14 -0
  14. package/data/publish/runtime/user_stories.json +12 -6
  15. package/data/publish/runtime/v1/v1_manifest.json +1 -1
  16. package/data/publish/semantic/ctrl_acore_alignment.jsonl +1 -1
  17. package/data/publish/semantic/macro_processes.jsonl +1 -1
  18. package/data/publish/semantic/mp_edges.jsonl +1 -1
  19. package/data/reports/run_manifest.json +4 -4
  20. package/dist/serving/traversal-assertions.d.ts +65 -0
  21. package/dist/serving/traversal-assertions.js +135 -0
  22. package/dist/serving/traversal-assertions.js.map +1 -0
  23. package/dist/tools/get-chapter-capability.js +46 -9
  24. package/dist/tools/get-chapter-capability.js.map +1 -1
  25. package/dist/tools/get-guide-by-role.js +101 -0
  26. package/dist/tools/get-guide-by-role.js.map +1 -1
  27. package/dist/tools/ontology-loader.d.ts +28 -0
  28. package/dist/tools/ontology-loader.js +22 -0
  29. package/dist/tools/ontology-loader.js.map +1 -1
  30. package/dist/tools/structured-tools.js +7 -4
  31. package/dist/tools/structured-tools.js.map +1 -1
  32. package/package.json +1 -1
package/data/publish/runtime/assignments.json CHANGED
@@ -1,7 +1,16 @@
1
1
  {
2
2
  "artifact_type": "deterministic_runtime_snapshot",
3
- "count": 1296,
3
+ "count": 1305,
4
4
  "entity_type": "PracticeAssignment",
5
+ "extraction_declarations": {
6
+ "count": 24,
7
+ "source_artifact": "data/entities/extraction_declarations.json",
8
+ "summary": {
9
+ "role_unresolved": 2,
10
+ "unmapped_phase_label": 15,
11
+ "unreadable_sdlc_table": 7
12
+ }
13
+ },
5
14
  "items": [
6
15
  {
7
16
  "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
@@ -15,7 +24,7 @@
15
24
  "practice assignment derived from US-01"
16
25
  ],
17
26
  "id": "01-classificacao-aplicacoes-developer-l1-us-01",
18
- "phase": "unassigned",
27
+ "phase": "plan",
19
28
  "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
20
29
  "proportionality": "Obrigatório - Classificação simplificada, apenas eixos principais",
21
30
  "risk_level": "L1",
@@ -37,7 +46,7 @@
37
46
  "practice assignment derived from US-01"
38
47
  ],
39
48
  "id": "01-classificacao-aplicacoes-developer-l2-us-01",
40
- "phase": "unassigned",
49
+ "phase": "plan",
41
50
  "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
42
51
  "proportionality": "Obrigatório - Classificação completa com validação formal por AppSec Engineer",
43
52
  "risk_level": "L2",
@@ -59,7 +68,73 @@
59
68
  "practice assignment derived from US-01"
60
69
  ],
61
70
  "id": "01-classificacao-aplicacoes-developer-l3-us-01",
62
- "phase": "unassigned",
71
+ "phase": "plan",
72
+ "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
73
+ "proportionality": "Obrigatório - Classificação formal, validada e aprovada por AppSec Engineer + GRC/Compliance",
74
+ "risk_level": "L3",
75
+ "role": "developer",
76
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
77
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-01-classificacao-inicial-da-aplicacao",
78
+ "user_story_id": "01-classificacao-aplicacoes-us-01",
79
+ "warnings": []
80
+ },
81
+ {
82
+ "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
83
+ "artifacts": [
84
+ "ficheiro_classificacao_aplicacao_yaml_localizacao_repo_security",
85
+ "ficheiro_matriz_controlos_aplicada_md_evidencia_anexo_ao_pr_ou_wiki"
86
+ ],
87
+ "chapter_id": "01-classificacao-aplicacoes",
88
+ "confidence": 0.86,
89
+ "evidence": [
90
+ "practice assignment derived from US-01"
91
+ ],
92
+ "id": "01-classificacao-aplicacoes-developer-l1-us-01",
93
+ "phase": "design",
94
+ "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
95
+ "proportionality": "Obrigatório - Classificação simplificada, apenas eixos principais",
96
+ "risk_level": "L1",
97
+ "role": "developer",
98
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
99
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-01-classificacao-inicial-da-aplicacao",
100
+ "user_story_id": "01-classificacao-aplicacoes-us-01",
101
+ "warnings": []
102
+ },
103
+ {
104
+ "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
105
+ "artifacts": [
106
+ "ficheiro_classificacao_aplicacao_yaml_localizacao_repo_security",
107
+ "ficheiro_matriz_controlos_aplicada_md_evidencia_anexo_ao_pr_ou_wiki"
108
+ ],
109
+ "chapter_id": "01-classificacao-aplicacoes",
110
+ "confidence": 0.86,
111
+ "evidence": [
112
+ "practice assignment derived from US-01"
113
+ ],
114
+ "id": "01-classificacao-aplicacoes-developer-l2-us-01",
115
+ "phase": "design",
116
+ "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
117
+ "proportionality": "Obrigatório - Classificação completa com validação formal por AppSec Engineer",
118
+ "risk_level": "L2",
119
+ "role": "developer",
120
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
121
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-01-classificacao-inicial-da-aplicacao",
122
+ "user_story_id": "01-classificacao-aplicacoes-us-01",
123
+ "warnings": []
124
+ },
125
+ {
126
+ "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
127
+ "artifacts": [
128
+ "ficheiro_classificacao_aplicacao_yaml_localizacao_repo_security",
129
+ "ficheiro_matriz_controlos_aplicada_md_evidencia_anexo_ao_pr_ou_wiki"
130
+ ],
131
+ "chapter_id": "01-classificacao-aplicacoes",
132
+ "confidence": 0.86,
133
+ "evidence": [
134
+ "practice assignment derived from US-01"
135
+ ],
136
+ "id": "01-classificacao-aplicacoes-developer-l3-us-01",
137
+ "phase": "design",
63
138
  "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
64
139
  "proportionality": "Obrigatório - Classificação formal, validada e aprovada por AppSec Engineer + GRC/Compliance",
65
140
  "risk_level": "L3",
@@ -81,7 +156,7 @@
81
156
  "practice assignment derived from US-01"
82
157
  ],
83
158
  "id": "01-classificacao-aplicacoes-scrum-master-l1-us-01",
84
- "phase": "unassigned",
159
+ "phase": "plan",
85
160
  "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
86
161
  "proportionality": "Obrigatório - Classificação simplificada, apenas eixos principais",
87
162
  "risk_level": "L1",
@@ -103,7 +178,7 @@
103
178
  "practice assignment derived from US-01"
104
179
  ],
105
180
  "id": "01-classificacao-aplicacoes-scrum-master-l2-us-01",
106
- "phase": "unassigned",
181
+ "phase": "plan",
107
182
  "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
108
183
  "proportionality": "Obrigatório - Classificação completa com validação formal por AppSec Engineer",
109
184
  "risk_level": "L2",
@@ -125,7 +200,73 @@
125
200
  "practice assignment derived from US-01"
126
201
  ],
127
202
  "id": "01-classificacao-aplicacoes-scrum-master-l3-us-01",
128
- "phase": "unassigned",
203
+ "phase": "plan",
204
+ "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
205
+ "proportionality": "Obrigatório - Classificação formal, validada e aprovada por AppSec Engineer + GRC/Compliance",
206
+ "risk_level": "L3",
207
+ "role": "scrum-master",
208
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
209
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-01-classificacao-inicial-da-aplicacao",
210
+ "user_story_id": "01-classificacao-aplicacoes-us-01",
211
+ "warnings": []
212
+ },
213
+ {
214
+ "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
215
+ "artifacts": [
216
+ "ficheiro_classificacao_aplicacao_yaml_localizacao_repo_security",
217
+ "ficheiro_matriz_controlos_aplicada_md_evidencia_anexo_ao_pr_ou_wiki"
218
+ ],
219
+ "chapter_id": "01-classificacao-aplicacoes",
220
+ "confidence": 0.86,
221
+ "evidence": [
222
+ "practice assignment derived from US-01"
223
+ ],
224
+ "id": "01-classificacao-aplicacoes-scrum-master-l1-us-01",
225
+ "phase": "design",
226
+ "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
227
+ "proportionality": "Obrigatório - Classificação simplificada, apenas eixos principais",
228
+ "risk_level": "L1",
229
+ "role": "scrum-master",
230
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
231
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-01-classificacao-inicial-da-aplicacao",
232
+ "user_story_id": "01-classificacao-aplicacoes-us-01",
233
+ "warnings": []
234
+ },
235
+ {
236
+ "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
237
+ "artifacts": [
238
+ "ficheiro_classificacao_aplicacao_yaml_localizacao_repo_security",
239
+ "ficheiro_matriz_controlos_aplicada_md_evidencia_anexo_ao_pr_ou_wiki"
240
+ ],
241
+ "chapter_id": "01-classificacao-aplicacoes",
242
+ "confidence": 0.86,
243
+ "evidence": [
244
+ "practice assignment derived from US-01"
245
+ ],
246
+ "id": "01-classificacao-aplicacoes-scrum-master-l2-us-01",
247
+ "phase": "design",
248
+ "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
249
+ "proportionality": "Obrigatório - Classificação completa com validação formal por AppSec Engineer",
250
+ "risk_level": "L2",
251
+ "role": "scrum-master",
252
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
253
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-01-classificacao-inicial-da-aplicacao",
254
+ "user_story_id": "01-classificacao-aplicacoes-us-01",
255
+ "warnings": []
256
+ },
257
+ {
258
+ "action": "classificar a aplicação com base nos eixos Exposição, Dados e Impacto (E+D+I)",
259
+ "artifacts": [
260
+ "ficheiro_classificacao_aplicacao_yaml_localizacao_repo_security",
261
+ "ficheiro_matriz_controlos_aplicada_md_evidencia_anexo_ao_pr_ou_wiki"
262
+ ],
263
+ "chapter_id": "01-classificacao-aplicacoes",
264
+ "confidence": 0.86,
265
+ "evidence": [
266
+ "practice assignment derived from US-01"
267
+ ],
268
+ "id": "01-classificacao-aplicacoes-scrum-master-l3-us-01",
269
+ "phase": "design",
129
270
  "practice_id": "01-classificacao-aplicacoes:classificacao-inicial-da-aplicacao",
130
271
  "proportionality": "Obrigatório - Classificação formal, validada e aprovada por AppSec Engineer + GRC/Compliance",
131
272
  "risk_level": "L3",
@@ -147,7 +288,7 @@
147
288
  "practice assignment derived from US-02"
148
289
  ],
149
290
  "id": "01-classificacao-aplicacoes-developer-l1-us-02",
150
- "phase": "unassigned",
291
+ "phase": "plan",
151
292
  "practice_id": "01-classificacao-aplicacoes:aplicacao-da-matriz-de-controlo",
152
293
  "proportionality": "Obrigatório - Aplicar controlos mínimos",
153
294
  "risk_level": "L1",
@@ -169,7 +310,7 @@
169
310
  "practice assignment derived from US-02"
170
311
  ],
171
312
  "id": "01-classificacao-aplicacoes-developer-l2-us-02",
172
- "phase": "unassigned",
313
+ "phase": "plan",
173
314
  "practice_id": "01-classificacao-aplicacoes:aplicacao-da-matriz-de-controlo",
174
315
  "proportionality": "Obrigatório - Controlos completos com rastreamento obrigatório",
175
316
  "risk_level": "L2",
@@ -191,7 +332,7 @@
191
332
  "practice assignment derived from US-02"
192
333
  ],
193
334
  "id": "01-classificacao-aplicacoes-developer-l3-us-02",
194
- "phase": "unassigned",
335
+ "phase": "plan",
195
336
  "practice_id": "01-classificacao-aplicacoes:aplicacao-da-matriz-de-controlo",
196
337
  "proportionality": "Obrigatório - Controlos completos + reforçados + validação por AppSec",
197
338
  "risk_level": "L3",
@@ -213,7 +354,7 @@
213
354
  "practice assignment derived from US-02"
214
355
  ],
215
356
  "id": "01-classificacao-aplicacoes-scrum-master-l1-us-02",
216
- "phase": "unassigned",
357
+ "phase": "plan",
217
358
  "practice_id": "01-classificacao-aplicacoes:aplicacao-da-matriz-de-controlo",
218
359
  "proportionality": "Obrigatório - Aplicar controlos mínimos",
219
360
  "risk_level": "L1",
@@ -235,7 +376,7 @@
235
376
  "practice assignment derived from US-02"
236
377
  ],
237
378
  "id": "01-classificacao-aplicacoes-scrum-master-l2-us-02",
238
- "phase": "unassigned",
379
+ "phase": "plan",
239
380
  "practice_id": "01-classificacao-aplicacoes:aplicacao-da-matriz-de-controlo",
240
381
  "proportionality": "Obrigatório - Controlos completos com rastreamento obrigatório",
241
382
  "risk_level": "L2",
@@ -257,7 +398,7 @@
257
398
  "practice assignment derived from US-02"
258
399
  ],
259
400
  "id": "01-classificacao-aplicacoes-scrum-master-l3-us-02",
260
- "phase": "unassigned",
401
+ "phase": "plan",
261
402
  "practice_id": "01-classificacao-aplicacoes:aplicacao-da-matriz-de-controlo",
262
403
  "proportionality": "Obrigatório - Controlos completos + reforçados + validação por AppSec",
263
404
  "risk_level": "L3",
@@ -280,7 +421,7 @@
280
421
  "practice assignment derived from US-03"
281
422
  ],
282
423
  "id": "01-classificacao-aplicacoes-appsec-engineer-l1-us-03",
283
- "phase": "unassigned",
424
+ "phase": "operate",
284
425
  "practice_id": "01-classificacao-aplicacoes:revisao-por-alteracao-relevante-event-based",
285
426
  "proportionality": "Sim (por alteração relevante)",
286
427
  "risk_level": "L1",
@@ -303,7 +444,7 @@
303
444
  "practice assignment derived from US-03"
304
445
  ],
305
446
  "id": "01-classificacao-aplicacoes-appsec-engineer-l2-us-03",
306
- "phase": "unassigned",
447
+ "phase": "operate",
307
448
  "practice_id": "01-classificacao-aplicacoes:revisao-por-alteracao-relevante-event-based",
308
449
  "proportionality": "Obrigatório",
309
450
  "risk_level": "L2",
@@ -326,7 +467,7 @@
326
467
  "practice assignment derived from US-03"
327
468
  ],
328
469
  "id": "01-classificacao-aplicacoes-appsec-engineer-l3-us-03",
329
- "phase": "unassigned",
470
+ "phase": "operate",
330
471
  "practice_id": "01-classificacao-aplicacoes:revisao-por-alteracao-relevante-event-based",
331
472
  "proportionality": "Obrigatório",
332
473
  "risk_level": "L3",
@@ -349,7 +490,7 @@
349
490
  "practice assignment derived from US-04"
350
491
  ],
351
492
  "id": "01-classificacao-aplicacoes-grc-compliance-l1-us-04",
352
- "phase": "unassigned",
493
+ "phase": "test",
353
494
  "practice_id": "01-classificacao-aplicacoes:analise-de-risco-residual",
354
495
  "proportionality": "Opcional (se crítico)",
355
496
  "risk_level": "L1",
@@ -372,7 +513,7 @@
372
513
  "practice assignment derived from US-04"
373
514
  ],
374
515
  "id": "01-classificacao-aplicacoes-grc-compliance-l2-us-04",
375
- "phase": "unassigned",
516
+ "phase": "test",
376
517
  "practice_id": "01-classificacao-aplicacoes:analise-de-risco-residual",
377
518
  "proportionality": "Obrigatório",
378
519
  "risk_level": "L2",
@@ -395,7 +536,7 @@
395
536
  "practice assignment derived from US-04"
396
537
  ],
397
538
  "id": "01-classificacao-aplicacoes-grc-compliance-l3-us-04",
398
- "phase": "unassigned",
539
+ "phase": "test",
399
540
  "practice_id": "01-classificacao-aplicacoes:analise-de-risco-residual",
400
541
  "proportionality": "Obrigatório",
401
542
  "risk_level": "L3",
@@ -418,7 +559,7 @@
418
559
  "practice assignment derived from US-05"
419
560
  ],
420
561
  "id": "01-classificacao-aplicacoes-qa-l1-us-05",
421
- "phase": "unassigned",
562
+ "phase": "test",
422
563
  "practice_id": "01-classificacao-aplicacoes:validacao-antes-do-go-live",
423
564
  "proportionality": "Recomendado",
424
565
  "risk_level": "L1",
@@ -441,7 +582,7 @@
441
582
  "practice assignment derived from US-05"
442
583
  ],
443
584
  "id": "01-classificacao-aplicacoes-qa-l2-us-05",
444
- "phase": "unassigned",
585
+ "phase": "test",
445
586
  "practice_id": "01-classificacao-aplicacoes:validacao-antes-do-go-live",
446
587
  "proportionality": "Recomendado (obrigatório)",
447
588
  "risk_level": "L2",
@@ -464,7 +605,7 @@
464
605
  "practice assignment derived from US-05"
465
606
  ],
466
607
  "id": "01-classificacao-aplicacoes-qa-l3-us-05",
467
- "phase": "unassigned",
608
+ "phase": "test",
468
609
  "practice_id": "01-classificacao-aplicacoes:validacao-antes-do-go-live",
469
610
  "proportionality": "Obrigatório (formal + assinatura)",
470
611
  "risk_level": "L3",
@@ -487,7 +628,7 @@
487
628
  "practice assignment derived from US-06"
488
629
  ],
489
630
  "id": "01-classificacao-aplicacoes-appsec-engineer-l1-us-06",
490
- "phase": "unassigned",
631
+ "phase": "design",
491
632
  "practice_id": "01-classificacao-aplicacoes:mapeamento-de-ameacas-por-nivel-de-risco",
492
633
  "proportionality": "Opcional (STRIDE básico)",
493
634
  "risk_level": "L1",
@@ -510,7 +651,7 @@
510
651
  "practice assignment derived from US-06"
511
652
  ],
512
653
  "id": "01-classificacao-aplicacoes-appsec-engineer-l2-us-06",
513
- "phase": "unassigned",
654
+ "phase": "design",
514
655
  "practice_id": "01-classificacao-aplicacoes:mapeamento-de-ameacas-por-nivel-de-risco",
515
656
  "proportionality": "Recomendado (STRIDE completo)",
516
657
  "risk_level": "L2",
@@ -533,7 +674,76 @@
533
674
  "practice assignment derived from US-06"
534
675
  ],
535
676
  "id": "01-classificacao-aplicacoes-appsec-engineer-l3-us-06",
536
- "phase": "unassigned",
677
+ "phase": "design",
678
+ "practice_id": "01-classificacao-aplicacoes:mapeamento-de-ameacas-por-nivel-de-risco",
679
+ "proportionality": "Obrigatório (STRIDE + MITRE ATT&CK)",
680
+ "risk_level": "L3",
681
+ "role": "appsec-engineer",
682
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
683
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-06-mapeamento-de-ameacas-por-nivel-de-risco",
684
+ "user_story_id": "01-classificacao-aplicacoes-us-06",
685
+ "warnings": []
686
+ },
687
+ {
688
+ "action": "verificar se as ameaças esperadas para o nível de criticidade estão cobertas por controlos aplicados ou exceções rastreáveis",
689
+ "artifacts": [
690
+ "ficheiro_ameacas_mapeamento_md_com_tabela_ameaca_categoria_controlo_aplicado_cobertura_sim_nao_excecao",
691
+ "localizacao_repo_documentacao_de_seguranca",
692
+ "rastreamento_em_jira_backlog_validacao_por_appsec_arquitetos"
693
+ ],
694
+ "chapter_id": "01-classificacao-aplicacoes",
695
+ "confidence": 0.86,
696
+ "evidence": [
697
+ "practice assignment derived from US-06"
698
+ ],
699
+ "id": "01-classificacao-aplicacoes-appsec-engineer-l1-us-06",
700
+ "phase": "test",
701
+ "practice_id": "01-classificacao-aplicacoes:mapeamento-de-ameacas-por-nivel-de-risco",
702
+ "proportionality": "Opcional (STRIDE básico)",
703
+ "risk_level": "L1",
704
+ "role": "appsec-engineer",
705
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
706
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-06-mapeamento-de-ameacas-por-nivel-de-risco",
707
+ "user_story_id": "01-classificacao-aplicacoes-us-06",
708
+ "warnings": []
709
+ },
710
+ {
711
+ "action": "verificar se as ameaças esperadas para o nível de criticidade estão cobertas por controlos aplicados ou exceções rastreáveis",
712
+ "artifacts": [
713
+ "ficheiro_ameacas_mapeamento_md_com_tabela_ameaca_categoria_controlo_aplicado_cobertura_sim_nao_excecao",
714
+ "localizacao_repo_documentacao_de_seguranca",
715
+ "rastreamento_em_jira_backlog_validacao_por_appsec_arquitetos"
716
+ ],
717
+ "chapter_id": "01-classificacao-aplicacoes",
718
+ "confidence": 0.86,
719
+ "evidence": [
720
+ "practice assignment derived from US-06"
721
+ ],
722
+ "id": "01-classificacao-aplicacoes-appsec-engineer-l2-us-06",
723
+ "phase": "test",
724
+ "practice_id": "01-classificacao-aplicacoes:mapeamento-de-ameacas-por-nivel-de-risco",
725
+ "proportionality": "Recomendado (STRIDE completo)",
726
+ "risk_level": "L2",
727
+ "role": "appsec-engineer",
728
+ "source_document_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle",
729
+ "source_section_id": "010-sbd-manual-01-classificacao-aplicacoes-aplicacao-lifecycle--aplicacao-da-classificacao-de-criticidade-ao-longo-do-ciclo-de-vida--user-stories-reutilizaveis--us-06-mapeamento-de-ameacas-por-nivel-de-risco",
730
+ "user_story_id": "01-classificacao-aplicacoes-us-06",
731
+ "warnings": []
732
+ },
733
+ {
734
+ "action": "verificar se as ameaças esperadas para o nível de criticidade estão cobertas por controlos aplicados ou exceções rastreáveis",
735
+ "artifacts": [
736
+ "ficheiro_ameacas_mapeamento_md_com_tabela_ameaca_categoria_controlo_aplicado_cobertura_sim_nao_excecao",
737
+ "localizacao_repo_documentacao_de_seguranca",
738
+ "rastreamento_em_jira_backlog_validacao_por_appsec_arquitetos"
739
+ ],
740
+ "chapter_id": "01-classificacao-aplicacoes",
741
+ "confidence": 0.86,
742
+ "evidence": [
743
+ "practice assignment derived from US-06"
744
+ ],
745
+ "id": "01-classificacao-aplicacoes-appsec-engineer-l3-us-06",
746
+ "phase": "test",
537
747
  "practice_id": "01-classificacao-aplicacoes:mapeamento-de-ameacas-por-nivel-de-risco",
538
748
  "proportionality": "Obrigatório (STRIDE + MITRE ATT&CK)",
539
749
  "risk_level": "L3",
@@ -30913,5 +31123,13 @@
30913
31123
  "profiles": [
30914
31124
  "guide"
30915
31125
  ],
31126
+ "roles_unassigned": {
31127
+ "assignment_count": 12,
31128
+ "by_user_story": {
31129
+ "05-dependencias-sbom-sca-us-14": 9,
31130
+ "13-formacao-onboarding-us-01": 3
31131
+ },
31132
+ "note": "papel `unassigned` = fallback do extractor quando a US não resolve papel canónico — declarado à imagem do phases_unassigned; fase `unassigned` é política ratificada e vive no envelope de phases.json"
31133
+ },
30916
31134
  "source_artifact": "data/entities/practice_assignments.json"
30917
31135
  }
package/data/publish/runtime/controls.json CHANGED
@@ -2711,5 +2711,11 @@
2711
2711
  "review",
2712
2712
  "threats"
2713
2713
  ],
2714
- "source_artifact": "data/entities/canonical_controls.json"
2714
+ "source_artifact": "data/entities/canonical_controls.json",
2715
+ "traversal_assertion": {
2716
+ "does_not_assert": "exclusividade de citação",
2717
+ "note": "possessivo LEGÍTIMO — 17/20 controlos têm um único capítulo definidor publicado",
2718
+ "source": "template de controlos (defining_chapters, decisão K)",
2719
+ "verb": "define"
2720
+ }
2715
2721
  }