@waratahlabs/canopy 0.5.0

package/vendor/atlas-release/README.md

@@ -0,0 +1,41 @@
+# MITRE ATLAS — vendored release asset (format v6)
+
+`vendor/atlas-data` (the git submodule) tracks MITRE's repo, but as of the
+format-6 restructure the authoritative data file is published only as a
+GitHub Release asset — the submodule's own `dist/ATLAS.yaml` is marked
+deprecated even at matching tags and still ships the old list-based schema.
+So the actual data lives here instead, downloaded directly from the release.
+
+- Source: https://github.com/mitre-atlas/atlas-data/releases/download/v2026.07/ATLAS-2026.07.yaml
+- sha256: `0e07bb07fc6423d72cdf24ddc2038a6905bcbc00ba571064153119ee1a5888d4`
+- format-version: 6.0.0 (schema, semver, changes rarely)
+- content version: 2026.07 (calendar, `YYYY.MM.N`, MITRE commits to monthly releases)
+- counts: 16 tactics, 178 techniques (101 parent + 77 sub-techniques), 37 mitigations, 68 case studies
+
+## Schema shape (v6, breaking change from v5.x)
+
+Top-level keys: `format-version`, `collection`, `matrix`, `tactics`,
+`techniques`, `mitigations`, `case-studies`, `relationships`.
+
+`tactics`, `techniques`, `mitigations` are now **keyed maps by AML ID**,
+not lists under `matrices[0]`. Technique→tactic and mitigation→technique
+links are no longer embedded fields — they live in `relationships`, keyed
+by source ID, with `relationship-type` one of `achieves` (technique→tactic),
+`mitigates` (mitigation→technique), `specializes` (subtechnique→parent),
+`employs` (case-study→technique), `sequences` (case-study step ordering).
+
+## Updating
+
+1. Check `https://api.github.com/repos/mitre-atlas/atlas-data/releases/latest`
+   monthly (first week of month, per MITRE's stated cadence).
+2. Download the new `ATLAS-YYYY.MM.yaml` asset, verify against the release
+   page's published sha256, drop it in this directory, update this README.
+3. Update `ATLAS_YAML_PATH` references if the filename changed (see
+   `src/aivss/atlas/loader.ts` and its call sites).
+4. `bun test` — the loader has schema-shape tests that will fail loudly if
+   MITRE changes the shape again.
+
+## History
+
+- 2026-08 uplift: v2026.06 → v2026.07 (16 tactics, 178 techniques [101
+  parent + 77 sub], 37 mitigations, 68 case studies — up from 173/35/63).