infraweaver 0.1.0

package/src/mcp/crosswalk.ts

@@ -0,0 +1,1253 @@
+import { createHash } from "node:crypto";
+import { type } from "arktype";
+import { EXPECTED_CROSSWALK_DIGEST } from "#app/mcp/crosswalkDigest";
+import { FRAMEWORKS } from "#app/mcp/frameworks";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import type { Concern } from "#app/mcp/terraform/types";
+import {
+  type ConcernVerificationStatus,
+  concernVerificationStatus,
+} from "#app/mcp/terraform/verification";
+import { log } from "#app/utils/cli";
+
+/**
+ * Compliance crosswalk ("explain like I'm the auditor", the
+ * seed of the moat). Maps a best-practice concern → the control families
+ * it touches across UK public-sector + general frameworks, so a remediation can
+ * be narrated to an assessor in their own language ("this closes NCSC Cloud
+ * Principle 2 / Cyber Essentials Secure Configuration") rather than as a raw
+ * scanner rule id.
+ *
+ * SCOPE / HONESTY: this is a deterministic STARTER rule-pack keyed on the
+ * defect's THEME (encryption, public exposure, least-privilege, logging, …),
+ * not a certified control-by-control mapping. The durable product is a
+ * versioned, framework-revision-pinned crosswalk — so every mapping
+ * carries the pack version + date and is labelled indicative, never an audit
+ * verdict. No open crosswalk to UK frameworks exists; this is the wedge.
+ */
+
+export const CROSSWALK_VERSION = "0.6.0";
+/** the date this rule-pack's framework references were last reviewed (absolute). */
+export const CROSSWALK_REVIEWED = "2026-07-26";
+
+export interface ControlRef {
+  /** the framework, e.g. "NCSC Cloud Security Principles". */
+  framework: string;
+  /** the control id within that framework, e.g. "Principle 2". */
+  control: string;
+  /** the control's short title. */
+  title: string;
+}
+
+/** a theme of defect, the signals that identify it, and the controls it maps to. */
+interface CrosswalkRule {
+  theme: string;
+  /** lowercased substrings that, if any appears in the rule_id/evidence, match. */
+  signals: string[];
+  controls: ControlRef[];
+}
+
+// The starter rule-pack. Themes are matched against the concern's rule_id +
+// evidence (lowercased). Ordered most-specific first; a concern can match
+// several themes (their controls are unioned). Kept deliberately small and
+// auditable — each control ref is a real, citable control family.
+const CROSSWALK: CrosswalkRule[] = [
+  {
+    theme: "encryption-at-rest",
+    // NB avoid the bare token "sse" — it's a substring of "essential"/"asset"
+    // and would false-match; use the explicit phrases instead.
+    signals: [
+      "encrypt",
+      "kms",
+      "server-side encryption",
+      "server_side_encryption",
+      "sse_algorithm",
+      "at rest",
+      "at-rest",
+      "unencrypted",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 1",
+        title: "Data in transit protection",
+      },
+      {
+        framework: "Cyber Essentials",
+        control: "Secure Configuration",
+        title: "Secure configuration",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "3.11",
+        title: "Encrypt sensitive data at rest",
+      },
+      {
+        framework: "NHS DSPT",
+        control: "Standard 1",
+        title: "Personal confidential data protected",
+      },
+    ],
+  },
+  {
+    theme: "encryption-in-transit",
+    signals: [
+      "tls",
+      "ssl",
+      "https",
+      "in transit",
+      "in-transit",
+      "insecure protocol",
+      "http ",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 1",
+        title: "Data in transit protection",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "3.10",
+        title: "Encrypt sensitive data in transit",
+      },
+    ],
+  },
+  {
+    theme: "public-exposure",
+    signals: [
+      "public",
+      "0.0.0.0/0",
+      "publicly",
+      "anonymous",
+      "open to the internet",
+      "ingress",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 9",
+        title: "Secure user management / network separation",
+      },
+      {
+        framework: "Cyber Essentials",
+        control: "Firewalls",
+        title: "Boundary firewalls and internet gateways",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "4.4",
+        title: "Implement and manage a firewall on servers",
+      },
+      {
+        framework: "Secure by Design",
+        control: "SbD-7",
+        title: "Protect data in transit and at rest",
+      },
+    ],
+  },
+  {
+    theme: "least-privilege",
+    signals: [
+      "iam",
+      "wildcard",
+      "least privilege",
+      "least-privilege",
+      "policy",
+      "admin",
+      "privilege",
+      "*:*",
+      "role",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 9",
+        title: "Secure user management",
+      },
+      {
+        framework: "Cyber Essentials",
+        control: "User Access Control",
+        title: "User access control",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "6.8",
+        title: "Define and maintain role-based access control",
+      },
+      {
+        framework: "NHS DSPT",
+        control: "Standard 4",
+        title: "Managing access",
+      },
+    ],
+  },
+  {
+    theme: "logging-audit",
+    // NB avoid the bare token "log" — it's a substring of "catalog"/"blog" and
+    // would false-match; use the explicit phrases/longer tokens instead.
+    signals: [
+      "logging",
+      "log group",
+      "audit",
+      "cloudtrail",
+      "flow log",
+      "access log",
+      "monitoring",
+      "cloudwatch",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 13",
+        title: "Audit information and alerting",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "8.2",
+        title: "Collect audit logs",
+      },
+      {
+        framework: "NHS DSPT",
+        control: "Standard 7",
+        title: "Continuity planning / monitoring",
+      },
+      { framework: "SOC 2", control: "CC7.2", title: "Security monitoring" },
+    ],
+  },
+  {
+    theme: "backup-resilience",
+    signals: [
+      "versioning",
+      "backup",
+      "snapshot",
+      "retention",
+      "deletion protection",
+      "multi-az",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 2",
+        title: "Asset protection and resilience",
+      },
+      {
+        framework: "NHS DSPT",
+        control: "Standard 7",
+        title: "Continuity planning",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "11.2",
+        title: "Perform automated backups",
+      },
+    ],
+  },
+  {
+    theme: "secrets-management",
+    signals: [
+      "secret",
+      "credential",
+      "password",
+      "hardcoded",
+      "plaintext",
+      "access key",
+      "token",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 10",
+        title: "Identity and authentication",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "16.4",
+        title: "Securely store credentials",
+      },
+      {
+        framework: "Cyber Essentials",
+        control: "Secure Configuration",
+        title: "Secure configuration",
+      },
+    ],
+  },
+  {
+    theme: "network-segmentation",
+    // internal segmentation (vs the internet-facing "public-exposure" theme):
+    // NB avoid the bare token "tag"/"acl" — use explicit phrases.
+    signals: [
+      "security group",
+      "network acl",
+      "nacl",
+      "subnet",
+      "vpc peering",
+      "unrestricted egress",
+      "egress to 0.0.0.0/0",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 9",
+        title: "Network separation",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "12.2",
+        title: "Establish and maintain a secure network architecture",
+      },
+      {
+        framework: "Secure by Design",
+        control: "SbD-5",
+        title: "Segment networks",
+      },
+    ],
+  },
+  {
+    theme: "mfa-strong-auth",
+    signals: [
+      "mfa",
+      "multi-factor",
+      "multi factor",
+      "password policy",
+      "root account",
+      "root user",
+      "console access",
+    ],
+    controls: [
+      {
+        framework: "Cyber Essentials",
+        control: "User Access Control",
+        title: "User access control",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "6.5",
+        title: "Require MFA for administrative access",
+      },
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 10",
+        title: "Identity and authentication",
+      },
+      {
+        framework: "NHS DSPT",
+        control: "Standard 4",
+        title: "Managing access",
+      },
+    ],
+  },
+  {
+    theme: "patch-currency",
+    signals: [
+      "deprecated",
+      "outdated",
+      "end of life",
+      "end-of-life",
+      "unsupported",
+      "legacy runtime",
+    ],
+    controls: [
+      {
+        framework: "Cyber Essentials",
+        control: "Security Update Management",
+        title: "Security update management",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "7.3",
+        title: "Perform automated operating system patch management",
+      },
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 5",
+        title: "Operational security",
+      },
+    ],
+  },
+  {
+    theme: "container-hardening",
+    // Covers Terraform ECS/EKS AND the multi-language Assess formats — Kubernetes
+    // manifests, Helm charts, and Dockerfiles (trivy/checkov emit these prose
+    // strings). NB "root user" is deliberately NOT here (it's an AWS-root signal
+    // under mfa-strong-auth); dockerfile "runs as root" uses "run as root" /
+    // "runasnonroot" instead so the two don't cross-match.
+    signals: [
+      "privileged",
+      "container",
+      "ecs task",
+      "fargate",
+      "kubernetes",
+      "pod security",
+      "host network",
+      "hostpath",
+      "runasnonroot",
+      "run as root",
+      "running as root",
+      "allowprivilegeescalation",
+      "privilege escalation",
+      "readonlyrootfilesystem",
+      "securitycontext",
+      "security context",
+      "linux capabilities",
+      "add capabilities",
+      "healthcheck",
+      "latest tag",
+      "image tag",
+      "seccomp",
+      "apparmor",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 5",
+        title: "Operational security",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "4.1",
+        title: "Establish and maintain a secure configuration process",
+      },
+      {
+        framework: "Secure by Design",
+        control: "SbD-3",
+        title: "Minimise the attack surface",
+      },
+    ],
+  },
+  {
+    theme: "resource-governance",
+    // governance / asset hygiene (tagging, naming) — matches real scanner prose
+    // ("resource is not tagged") without the bare token "tag" (substring of "stage").
+    signals: [
+      "not tagged",
+      "untagged",
+      "tagging",
+      "missing tag",
+      "required tags",
+      "naming convention",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 2",
+        title: "Asset protection and resilience",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "1.1",
+        title: "Establish and maintain detailed enterprise asset inventory",
+      },
+      {
+        framework: "GDS Service Standard",
+        control: "Point 14",
+        title: "Operate a reliable service",
+      },
+    ],
+  },
+  {
+    // The governance band of the native rule pack ([[nativeRules]]): imperative
+    // side-effects and input-bound destroy protection are change-control facts,
+    // not misconfigurations. Signals are the exact HCL constructs, so this theme
+    // can only fire on a finding that named one — no prose match, no drift into
+    // the other eleven themes.
+    theme: "change-control",
+    signals: [
+      "action_trigger",
+      "imperative-action-trigger",
+      "provider action",
+      "prevent_destroy",
+      "dynamic-destroy-protection",
+      "destroy protection",
+      // drift findings ([[planDrift]] `drift-<kind>-<address>` rule tokens): an
+      // out-of-band change to live infrastructure is the change-control failure
+      // mode itself. Exact rule tokens, same discipline as the rest of this
+      // theme — prose like "drift" alone must not match (tflint has fmt-drift
+      // rule names that are style, not change control).
+      "drift-modified",
+      "drift-deleted",
+      "drift-recreated",
+      "drift-replaced",
+    ],
+    controls: [
+      {
+        framework: "NCSC Cloud Security Principles",
+        control: "Principle 5",
+        title: "Operational security (change management)",
+      },
+      {
+        framework: "CIS Controls v8",
+        control: "4.2",
+        title:
+          "Establish and maintain a secure configuration process for network infrastructure",
+      },
+      {
+        framework: "GDS Service Standard",
+        control: "Point 14",
+        title: "Operate a reliable service",
+      },
+    ],
+  },
+];
+
+// ── §5.14 crosswalk hub: NIST SP 800-53 rev 5 spine + CSF 2.0 pivot ────────────
+// The hub keys THEMES (not findings) to 800-53 — one curated table — after which
+// every further framework layer is scheme-requirement-id → 800-53 → themes: one
+// mechanical, auditable hop. 800-53 is the only candidate whose full text is
+// embeddable forever at zero cost (CC0 OSCAL, usnistgov/oscal-content), and its
+// enhancement granularity (SC-28(1), SC-7(5)) fits IaC findings far better than
+// clause-level frameworks. CSF 2.0 is the EU-facing pivot (CyFun/Ireland are
+// CSF-2.0-shaped); its subcategories attach through their NIST-published 800-53
+// informative references, so both layers stay coherent for free.
+
+const NIST_800_53_NAME = "NIST SP 800-53";
+const NIST_CSF_NAME = "NIST CSF 2.0";
+const DORA_RTS_NAME = "DORA RTS (EU) 2024/1774";
+const NCSC_CAF_NAME = "NCSC Cyber Assessment Framework";
+
+/**
+ * Titles of every 800-53 control the hub references, keyed by display id
+ * ("SC-28(1)" — OSCAL id "sc-28.1"). Transcribed from the CC0 OSCAL rev 5.2.0
+ * catalog (public domain worldwide), so embedding is unconditionally lawful.
+ */
+const NIST_800_53_TITLES: Record<string, string> = {
+  "AC-3": "Access Enforcement",
+  "AC-4": "Information Flow Enforcement",
+  "AC-6": "Least Privilege",
+  "AC-6(1)": "Authorize Access to Security Functions",
+  "AC-6(10)":
+    "Prohibit Non-privileged Users from Executing Privileged Functions",
+  "AC-17(2)": "Protection of Confidentiality and Integrity Using Encryption",
+  "AU-2": "Event Logging",
+  "AU-11": "Audit Record Retention",
+  "AU-12": "Audit Record Generation",
+  "CM-2": "Baseline Configuration",
+  "CM-3": "Configuration Change Control",
+  "CM-4": "Impact Analyses",
+  "CM-5": "Access Restrictions for Change",
+  "CM-6": "Configuration Settings",
+  "CM-7": "Least Functionality",
+  "CM-8": "System Component Inventory",
+  "CM-12": "Information Location",
+  "CP-6": "Alternate Storage Site",
+  "CP-9": "System Backup",
+  "CP-10": "System Recovery and Reconstitution",
+  "IA-2": "Identification and Authentication (Organizational Users)",
+  "IA-2(1)": "Multi-factor Authentication to Privileged Accounts",
+  "IA-2(2)": "Multi-factor Authentication to Non-privileged Accounts",
+  "IA-5": "Authenticator Management",
+  "IA-5(1)": "Password-based Authentication",
+  "IA-5(7)": "No Embedded Unencrypted Static Authenticators",
+  "SA-22": "Unsupported System Components",
+  "SC-7": "Boundary Protection",
+  "SC-7(3)": "Access Points",
+  "SC-7(5)": "Deny by Default — Allow by Exception",
+  "SC-8": "Transmission Confidentiality and Integrity",
+  "SC-8(1)": "Cryptographic Protection",
+  "SC-12": "Cryptographic Key Establishment and Management",
+  "SC-13": "Cryptographic Protection",
+  "SC-28": "Protection of Information at Rest",
+  "SC-28(1)": "Cryptographic Protection",
+  "SC-39": "Process Isolation",
+  "SI-2": "Flaw Remediation",
+  "SI-4": "System Monitoring",
+};
+
+/**
+ * THE HUB TABLE (§5.14 step 2): defect theme → the 800-53 rev 5 controls it
+ * evidences. Hand-curated to the technically-enforceable band an IaC scan can
+ * honestly speak to (crypto, IAM, segmentation, logging, secure-config, backup
+ * topology) — never the organisational/process/physical bands. The theme layer
+ * insulates every downstream framework from an 800-53 rev 6 restructure.
+ */
+export const THEME_TO_NIST: Record<string, string[]> = {
+  "encryption-at-rest": ["SC-28", "SC-28(1)", "SC-12", "SC-13"],
+  "encryption-in-transit": ["SC-8", "SC-8(1)", "SC-13", "AC-17(2)"],
+  "public-exposure": ["SC-7", "SC-7(3)", "SC-7(5)", "AC-3", "CM-7"],
+  "least-privilege": ["AC-3", "AC-6", "AC-6(1)", "AC-6(10)"],
+  "logging-audit": ["AU-2", "AU-11", "AU-12", "SI-4"],
+  "backup-resilience": ["CP-6", "CP-9", "CP-10"],
+  "secrets-management": ["IA-5", "IA-5(7)", "SC-12", "SC-28"],
+  "network-segmentation": ["AC-4", "SC-7", "SC-7(5)"],
+  "mfa-strong-auth": ["IA-2", "IA-2(1)", "IA-2(2)", "IA-5(1)"],
+  "patch-currency": ["SI-2", "SA-22"],
+  "container-hardening": ["CM-2", "CM-6", "CM-7", "SC-39"],
+  "resource-governance": ["CM-8", "CM-12"],
+  "change-control": ["CM-2", "CM-3", "CM-4", "CM-5"],
+};
+
+/** One requirement of a hub-anchored framework layer. */
+interface HubRequirement {
+  /** The requirement id as the Cloud pack and evidence bundle cite it. */
+  id: string;
+  /** Short label for `ControlRef.title` (the pack carries the full wording). */
+  title: string;
+  /** The 800-53 spine ids this requirement is anchored to. A requirement
+   *  attaches to a theme exactly when one of these appears in that theme's
+   *  `THEME_TO_NIST` row — the single mechanical, auditable hop. */
+  nist: string[];
+}
+
+/** A framework layer that rides the 800-53 spine rather than being hand-themed. */
+interface HubLayer {
+  /** Display name — MUST equal a `FrameworkDef.name` in the registry. */
+  framework: string;
+  requirements: HubRequirement[];
+}
+
+/**
+ * NIST CSF 2.0 — the EU-facing pivot (CyFun and Ireland's baseline are
+ * CSF-2.0-shaped). Anchors are NIST's own CSF↔800-53 informative references
+ * (OLIR/CPRT), trimmed to the ids the spine carries. References that would
+ * create dishonest joins are deliberately omitted (PR.PS-01 keeps CM-2/CM-6 but
+ * not CM-7, so a public-exposure finding never claims "configuration
+ * management practices").
+ */
+const CSF_2_0_LAYER: HubLayer = {
+  framework: NIST_CSF_NAME,
+  requirements: [
+    {
+      id: "PR.DS-01",
+      title: "Data-at-rest protected",
+      nist: ["SC-28", "SC-28(1)"],
+    },
+    {
+      id: "PR.DS-02",
+      title: "Data-in-transit protected",
+      nist: ["SC-8", "SC-8(1)"],
+    },
+    {
+      id: "PR.DS-11",
+      title: "Backups created, protected, and tested",
+      nist: ["CP-6", "CP-9", "CP-10"],
+    },
+    {
+      id: "PR.AA-01",
+      title: "Identities and credentials managed",
+      nist: ["IA-5", "IA-5(7)"],
+    },
+    {
+      id: "PR.AA-03",
+      title: "Users, services, and hardware authenticated",
+      nist: ["IA-2", "IA-2(1)", "IA-2(2)"],
+    },
+    {
+      id: "PR.AA-05",
+      title: "Least-privilege access permissions enforced",
+      nist: ["AC-3", "AC-6", "AC-6(1)"],
+    },
+    {
+      id: "PR.PS-01",
+      title: "Configuration management practices applied",
+      nist: ["CM-2", "CM-6"],
+    },
+    {
+      id: "PR.PS-02",
+      title: "Software maintained and replaced by risk",
+      nist: ["SI-2", "SA-22"],
+    },
+    {
+      id: "PR.PS-04",
+      title: "Log records generated for monitoring",
+      nist: ["AU-2", "AU-12"],
+    },
+    {
+      id: "PR.IR-01",
+      title: "Networks protected from unauthorized access",
+      nist: ["SC-7", "SC-7(5)", "AC-4"],
+    },
+    {
+      id: "DE.CM-09",
+      title: "Computing resources monitored for adverse events",
+      nist: ["SI-4"],
+    },
+    {
+      id: "ID.AM-02",
+      title: "Software and system inventories maintained",
+      nist: ["CM-8"],
+    },
+  ],
+};
+
+/**
+ * DORA technical layer (§5.15) — Commission Delegated Regulation (EU) 2024/1774,
+ * the RTS on ICT risk-management tools, methods, processes and policies. It is
+ * the RTS that gives concrete technical form to DORA (Reg. (EU) 2022/2554)
+ * **Art. 9 "Protection and prevention"** and **Art. 10 "Detection"**; the
+ * requirement ids below are RTS articles, not DORA Level-1 articles (RTS Art. 9
+ * is "Capacity and performance management" and RTS Art. 10 is "Vulnerability and
+ * patch management" — different instruments, same numbers, so we cite the RTS
+ * explicitly and never write a bare "Article 9").
+ *
+ * Surface: RTS Section 4 (Encryption and cryptography, Arts 6–7), Section 5 (ICT
+ * operations security, Arts 8–12), Section 6 (Network security, Arts 13–14) and
+ * Chapter II access control (Arts 20–21) — precisely the config-band articles.
+ *
+ * HONESTY: this is "evidence toward the DORA technical controls", never "DORA
+ * compliant". Roughly half of DORA — governance, business-continuity testing,
+ * third-party risk and the Register of Information, TLPT, physical security — is
+ * outside anything an IaC scan can observe; the Cloud pack carries those
+ * articles as scanner-less rows so the published coverage % states the gap.
+ * EUR-Lex text is reusable commercially under Commission Decision 2011/833/EU.
+ */
+const DORA_RTS_LAYER: HubLayer = {
+  framework: DORA_RTS_NAME,
+  requirements: [
+    {
+      id: "RTS-6(2)",
+      title: "Encryption of data at rest, in transit, and in use",
+      nist: ["SC-28", "SC-28(1)", "SC-8", "SC-8(1)", "SC-13"],
+    },
+    {
+      id: "RTS-7(1)",
+      title: "Cryptographic key lifecycle management",
+      nist: ["SC-12"],
+    },
+    {
+      id: "RTS-8(2)(b)",
+      title: "Backup, restore, and environment separation",
+      nist: ["CP-6", "CP-9", "CP-10"],
+    },
+    {
+      id: "RTS-10(4)",
+      title: "Patch identification and deployment",
+      nist: ["SI-2", "SA-22"],
+    },
+    {
+      id: "RTS-11(2)(a)",
+      title: "Access restrictions by data classification",
+      nist: ["AC-3"],
+    },
+    {
+      id: "RTS-11(2)(b)",
+      title: "Secure configuration baselines minimising exposure",
+      nist: ["CM-2", "CM-6"],
+    },
+    {
+      id: "RTS-12(2)(a)",
+      title: "Log event scope and retention periods",
+      nist: ["AU-11"],
+    },
+    {
+      id: "RTS-12(2)(c)",
+      title: "Logging of access, ICT operations, and network traffic",
+      nist: ["AU-2", "AU-12"],
+    },
+    {
+      id: "RTS-13(a)",
+      title: "Network segregation and segmentation",
+      nist: ["AC-4", "SC-7"],
+    },
+    {
+      id: "RTS-13(d)",
+      title: "Network access controls on unauthorised connections",
+      nist: ["SC-7", "SC-7(5)"],
+    },
+    {
+      id: "RTS-13(e)",
+      title: "Encryption of network communications",
+      nist: ["SC-8", "SC-8(1)", "AC-17(2)"],
+    },
+    {
+      id: "RTS-13(g)",
+      title: "Securing traffic to internet and external connections",
+      nist: ["SC-7", "SC-7(3)"],
+    },
+    {
+      id: "RTS-13(h)",
+      title: "Firewall rule specification and review",
+      nist: ["SC-7(5)"],
+    },
+    {
+      id: "RTS-14(1)",
+      title: "Securing information in transit",
+      nist: ["SC-8", "SC-8(1)"],
+    },
+    {
+      id: "RTS-20(2)(a)",
+      title: "Unique identity and user account",
+      nist: ["IA-2"],
+    },
+    {
+      id: "RTS-21(a)",
+      title: "Least-privilege and need-to-know access rights",
+      nist: ["AC-6", "AC-6(1)"],
+    },
+    {
+      id: "RTS-21(d)",
+      title: "Access restriction controls on ICT assets",
+      nist: ["AC-3"],
+    },
+    {
+      id: "RTS-21(f)",
+      title: "Strong authentication for privileged and remote access",
+      nist: ["IA-2(1)", "IA-2(2)", "IA-5(1)"],
+    },
+  ],
+};
+
+/**
+ * NCSC Cyber Assessment Framework v4.0 (B.2) — the UK layer that matters for
+ * the Cyber Security and Resilience Bill, NIS-regulated operators and the
+ * public-sector buyers who assess against GovAssure.
+ *
+ * ⚠️ READ THIS BEFORE EDITING. The CAF is **not** the framework the legacy
+ * `ncsc-caf` slug names — that slug belongs to the NCSC *Cloud Security
+ * Principles*, and for a while five product surfaces advertised "NCSC CAF"
+ * while mapping to the Principles. This layer is the real thing; its registry
+ * slug is `ncsc-caf-v4` precisely so the two can never merge.
+ *
+ * Authored against the published v4.0 PDF, not from recall — v4.0 restructured
+ * the contributing outcomes substantially (A2.b became "Understanding Threat",
+ * A4.b "Secure Software Development and Support" is new, C1 lost an outcome to
+ * consolidation, C2 collapsed to a single "Threat Hunting"), so a v3.2-shaped
+ * mapping would cite outcomes that no longer exist.
+ *
+ * HONESTY. The CAF is an **outcome-based** framework assessed on Indicators of
+ * Good Practice, most of which describe organisational behaviour — governance,
+ * risk process, supply chain, staff training, incident response. Of its 37
+ * contributing outcomes, the 13 below are the only ones an IaC scan can speak
+ * to at all, and even those it evidences *partially*: CAF asks whether a
+ * practice is working, and we can only show what the code declares. The Cloud
+ * pack carries all 37 rows so the published coverage % states that gap rather
+ * than hiding it. This is "evidence toward CAF outcomes", never "CAF achieved"
+ * — the CAF's own achievement levels (Not / Partially / Achieved) are an
+ * assessor's judgement and nothing here may present as one.
+ */
+const NCSC_CAF_LAYER: HubLayer = {
+  framework: NCSC_CAF_NAME,
+  requirements: [
+    { id: "A3.a", title: "Asset Management", nist: ["CM-8", "CM-12"] },
+    {
+      id: "B2.a",
+      title: "Identity Verification, Authentication and Authorisation",
+      nist: ["IA-2", "IA-2(1)", "IA-2(2)", "IA-5(1)"],
+    },
+    {
+      id: "B2.c",
+      title: "Privileged User Management",
+      nist: ["AC-6", "AC-6(1)", "AC-6(10)"],
+    },
+    {
+      id: "B2.d",
+      title: "Identity and Access Management (IdAM)",
+      nist: ["AC-3", "IA-5", "IA-5(7)"],
+    },
+    {
+      id: "B3.b",
+      title: "Data in Transit",
+      nist: ["SC-8", "SC-8(1)", "AC-17(2)"],
+    },
+    {
+      id: "B3.c",
+      title: "Stored Data",
+      nist: ["SC-28", "SC-28(1)", "SC-12", "SC-13"],
+    },
+    // CM-7 (least functionality) is deliberately omitted, exactly as CSF
+    // PR.PS-01 omits it: it would make every public-exposure finding claim
+    // "Secure Configuration", a join the evidence does not support.
+    { id: "B4.b", title: "Secure Configuration", nist: ["CM-2", "CM-6"] },
+    { id: "B4.c", title: "Secure Management", nist: ["CM-3", "CM-4", "CM-5"] },
+    { id: "B4.d", title: "Vulnerability Management", nist: ["SI-2", "SA-22"] },
+    { id: "B5.a", title: "Resilience Preparation", nist: ["CP-9", "CP-10"] },
+    { id: "B5.b", title: "Design for Resilience", nist: ["CP-6", "AC-4"] },
+    {
+      id: "C1.a",
+      title: "Sources and Tools for Logging and Monitoring",
+      nist: ["AU-2", "AU-12", "SI-4"],
+    },
+    // Retention only (AU-11). The access half of C1.b would need AC-3, which
+    // would drag every least-privilege finding into a logging claim.
+    { id: "C1.b", title: "Securing Logs", nist: ["AU-11"] },
+  ],
+};
+
+/**
+ * Every hub-anchored layer, in citation order. Adding a framework wave is one
+ * more entry here plus the matching Cloud pack rows — no engine logic changes.
+ */
+const HUB_LAYERS: HubLayer[] = [CSF_2_0_LAYER, DORA_RTS_LAYER, NCSC_CAF_LAYER];
+
+/**
+ * The hub-derived control refs for a set of themes: the 800-53 spine controls
+ * (sorted) plus every hub-layer requirement whose anchors intersect those spine
+ * ids. Deterministic + pure. Conservative fan-out is by design — an exposure
+ * finding lights all boundary controls rather than risk a false pass on a
+ * related one.
+ */
+export function hubControlsForThemes(themes: string[]): ControlRef[] {
+  const nistIds = new Set<string>();
+  for (const theme of themes) {
+    for (const id of THEME_TO_NIST[theme] ?? []) nistIds.add(id);
+  }
+  const refs: ControlRef[] = [];
+  for (const id of [...nistIds].sort()) {
+    refs.push({
+      framework: NIST_800_53_NAME,
+      control: id,
+      title: NIST_800_53_TITLES[id] ?? id,
+    });
+  }
+  for (const layer of HUB_LAYERS) {
+    for (const req of layer.requirements) {
+      if (!req.nist.some((id) => nistIds.has(id))) continue;
+      refs.push({
+        framework: layer.framework,
+        control: req.id,
+        title: req.title,
+      });
+    }
+  }
+  return refs;
+}
+
+/**
+ * Map a single concern to the indicative control references it touches. Matches
+ * the concern's `rule_id` + `evidence` (and an optional `category`) against the
+ * crosswalk themes; unions the controls of every theme that fires. Pure.
+ * Returns an empty array when nothing matches (honest — better than a forced
+ * mapping). De-duplicates identical control refs.
+ */
+export function mapConcernToControls(concern: {
+  rule_id: string;
+  evidence: string;
+  category?: string;
+}): { themes: string[]; controls: ControlRef[] } {
+  assertCrosswalkIntegrity();
+  const haystack = `${concern.rule_id} ${concern.evidence}`.toLowerCase();
+  const themes: string[] = [];
+  const controls: ControlRef[] = [];
+  const seen = new Set<string>();
+  for (const rule of CROSSWALK) {
+    if (!rule.signals.some((s) => haystack.includes(s))) continue;
+    themes.push(rule.theme);
+    for (const c of rule.controls) {
+      const key = `${c.framework}|${c.control}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      controls.push(c);
+    }
+  }
+  // The §5.14 hub layers ride behind the theme layer: 800-53 spine + CSF pivot.
+  for (const c of hubControlsForThemes(themes)) {
+    const key = `${c.framework}|${c.control}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    controls.push(c);
+  }
+  return { themes, controls };
+}
+
+/**
+ * Authored mapping from a defect THEME → the maintained Cloud crosswalk PACK
+ * control ids it evidences (infraweaver-ui `src/features/crosswalk/pack.ts`). This
+ * is the engine⇄Cloud JOIN KEY: a reported finding carries these ids in its
+ * `compliance[]`, so the Cloud `/compliance` verdicts and the required-control
+ * violation detection bind to REAL findings (without it they keyed on engine
+ * control names and never joined the pack's ids — the C1 divergence).
+ *
+ * HAND-SYNCED with pack.ts, exactly like the report wire schema — every id here
+ * must exist there. The engine themes are coarser than the pack's controls, so a
+ * theme fans out to every control it plausibly evidences (conservative: an
+ * exposure finding lights all boundary/exposure controls rather than risk a false
+ * pass on a related one). A theme with no honest pack control maps to `[]` — we
+ * emit NOTHING rather than mis-attribute (vuln-management, key-rotation and
+ * malware controls have no code-verifiable theme and stay unmapped).
+ */
+const THEME_TO_PACK_CONTROLS: Record<string, string[]> = {
+  // encryption at rest → CE A2.1, ISO A.8.24, NCSC P2.
+  "encryption-at-rest": ["A2.1", "A.8.24", "P2"],
+  // in-transit has no CE/ISO-pinned control here → NCSC P1 only.
+  "encryption-in-transit": ["P1"],
+  // boundary + public storage exposure across all three frameworks.
+  "public-exposure": ["A1.1", "A1.2", "A2.3", "A.8.20", "A.5.23", "P5"],
+  "least-privilege": ["A4.1", "A.5.15", "P9"],
+  // secure configuration & logging (CE A2.2 explicitly covers logging).
+  "logging-audit": ["A2.2", "A.8.16", "P13"],
+  // resilience maps onto NCSC P2 (asset protection & resilience).
+  "backup-resilience": ["P2"],
+  // hardcoded secrets are a secure-configuration failure (CE A2.2).
+  "secrets-management": ["A2.2"],
+  // internal segmentation lights the boundary-firewall + network controls.
+  "network-segmentation": ["A1.1", "A1.2", "P5"],
+  // MFA / strong auth maps onto user-access control + identity.
+  "mfa-strong-auth": ["A4.1", "P9"],
+  // privileged/over-broad container config is a secure-configuration failure.
+  "container-hardening": ["A2.2"],
+  // patch-currency + governance/tagging have no honest UK-pack control → no UK
+  // ids here. Since the §5.14 hub they DO emit their 800-53/CSF pack ids (SI-2,
+  // SA-22, CM-8, … via `packControlsForThemes`) — real homes, not mis-attribution.
+  "patch-currency": [],
+  "resource-governance": [],
+  // change-control is a governance band no UK starter-pack control speaks to
+  // honestly (CE and the NCSC principles are technical-configuration frameworks).
+  // Its 800-53/CSF/DORA ids still flow through `packControlsForThemes` via the
+  // hub, which is where a change-control claim actually belongs.
+  "change-control": [],
+};
+
+// ── Integrity gate (LLM04) ──────────────────────────────────────────────────────
+// The crosswalk drives compliance verdicts, so a poisoned control mapping would
+// yield a false "compliant" — the worst failure for an attestation product. We pin a
+// sha256 of the reviewed tables and verify it before any verdict is produced; a
+// mismatch fail-closes. Regenerate the pin with `pnpm run gen:crosswalk-digest` after
+// an intended crosswalk edit. The digest also rides in the (Ed25519-signed) evidence
+// bundle, so the exact table that produced each attestation is cryptographically bound.
+
+/** Deterministic, key-sorted serialization — the exact bytes the digest covers. */
+function stableStringify(value: unknown): string {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value as Record<string, unknown>;
+  return `{${Object.keys(obj)
+    .sort()
+    .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)
+    .join(",")}}`;
+}
+
+/** The canonical payload of the curated crosswalk tables + version stamps. Pure. */
+export function canonicalCrosswalkPayload(): string {
+  return stableStringify({
+    version: CROSSWALK_VERSION,
+    reviewed: CROSSWALK_REVIEWED,
+    crosswalk: CROSSWALK,
+    themeToPackControls: THEME_TO_PACK_CONTROLS,
+    // §5.14 hub layers — a poisoned spine or layer table would mis-verdict every
+    // downstream framework, so the digest covers them (and the registry) too.
+    frameworks: FRAMEWORKS,
+    themeToNist: THEME_TO_NIST,
+    nistTitles: NIST_800_53_TITLES,
+    hubLayers: HUB_LAYERS,
+  });
+}
+
+/** sha256 (hex) of the canonical crosswalk payload. Pure. */
+export function crosswalkDigest(): string {
+  return createHash("sha256").update(canonicalCrosswalkPayload()).digest("hex");
+}
+
+/** The digest of the crosswalk actually loaded in this build (computed once). */
+export const CROSSWALK_DIGEST = crosswalkDigest();
+
+/**
+ * Fail-closed integrity gate. Throws when the loaded crosswalk doesn't match the
+ * pinned, reviewed digest — so no compliance verdict can be produced from a tampered
+ * or poisoned table. Every verdict-producing entry calls this. The args are injectable
+ * so a test can exercise the mismatch path without corrupting the real module.
+ */
+export function assertCrosswalkIntegrity(
+  actual: string = CROSSWALK_DIGEST,
+  expected: string = EXPECTED_CROSSWALK_DIGEST,
+): void {
+  if (actual !== expected) {
+    throw new Error(
+      `crosswalk integrity check failed: loaded digest ${actual} does not match the pinned ${expected}. ` +
+        "The compliance crosswalk was modified without re-pinning — run `pnpm run gen:crosswalk-digest` if the " +
+        "change is intended, otherwise treat this as tampering (LLM04).",
+    );
+  }
+}
+
+/** The maintained-pack control ids a concern's themes evidence (deduped, sorted).
+ *  Empty when nothing maps. Pure. See {@link THEME_TO_PACK_CONTROLS}. */
+export function packControlsForThemes(themes: string[]): string[] {
+  const ids = new Set<string>();
+  for (const theme of themes) {
+    for (const id of THEME_TO_PACK_CONTROLS[theme] ?? []) ids.add(id);
+  }
+  // The hub layers (800-53 + CSF 2.0) exist in the Cloud pack under the SAME
+  // control ids the hub tables carry, so the join needs no second hand-synced
+  // table — one source (THEME_TO_NIST / HUB_LAYERS) feeds both the narrated
+  // crosswalk and the pack join key.
+  for (const ref of hubControlsForThemes(themes)) ids.add(ref.control);
+  return [...ids].sort();
+}
+
+/**
+ * The maintained Cloud-pack control ids a single concern maps to — the values
+ * the cloud report puts in each finding's `compliance[]` so the dashboard's
+ * control verdicts and required-control gate join on real findings. Pure.
+ */
+export function packControlsForConcern(concern: {
+  rule_id: string;
+  evidence: string;
+  category?: string;
+}): string[] {
+  return packControlsForThemes(mapConcernToControls(concern).themes);
+}
+
+export interface ConcernForCrosswalk {
+  id: string;
+  rule_id: string;
+  evidence: string;
+  category?: string;
+  severity?: string;
+  location?: { file: string; line: number | null };
+}
+
+export interface CrosswalkEntry {
+  concern_id: string;
+  rule_id: string;
+  themes: string[];
+  controls: ControlRef[];
+  /** the five-status verdict for this control statement: `fail` (code-verified
+   * violation) or `not-code-verifiable` (a human-decision control the engine can
+   * flag but not prove). Lets an assessor read the crosswalk honestly. */
+  status: ConcernVerificationStatus;
+}
+
+export interface CrosswalkReport {
+  version: string;
+  reviewed: string;
+  /** per-concern control mappings (only concerns that mapped to ≥1 control). */
+  entries: CrosswalkEntry[];
+  /** framework → the distinct controls this scan touched, for an auditor index. */
+  by_framework: Record<string, { control: string; title: string }[]>;
+  /** concerns that did not map to any control (honest coverage signal). */
+  unmapped_concern_ids: string[];
+}
+
+/**
+ * Build the auditor crosswalk for a set of concerns: per-concern control refs
+ * plus a `by_framework` index (which controls this scan touched, deduped) and an
+ * honest `unmapped` list. Pure + deterministic. Carries the pack version + date
+ * so the report is reproducible and clearly indicative.
+ */
+export function buildCrosswalkReport(
+  concerns: ConcernForCrosswalk[],
+): CrosswalkReport {
+  assertCrosswalkIntegrity();
+  const entries: CrosswalkEntry[] = [];
+  const unmapped: string[] = [];
+  const byFramework = new Map<string, Map<string, string>>();
+  for (const c of concerns) {
+    const { themes, controls } = mapConcernToControls(c);
+    if (controls.length === 0) {
+      unmapped.push(c.id);
+      continue;
+    }
+    entries.push({
+      concern_id: c.id,
+      rule_id: c.rule_id,
+      themes,
+      controls,
+      status: concernVerificationStatus(c).status,
+    });
+    for (const ctl of controls) {
+      const map = byFramework.get(ctl.framework) ?? new Map<string, string>();
+      if (!map.has(ctl.control)) map.set(ctl.control, ctl.title);
+      byFramework.set(ctl.framework, map);
+    }
+  }
+  const by_framework: Record<string, { control: string; title: string }[]> = {};
+  for (const [framework, controls] of [...byFramework.entries()].sort((a, b) =>
+    a[0].localeCompare(b[0]),
+  )) {
+    by_framework[framework] = [...controls.entries()]
+      .map(([control, title]) => ({ control, title }))
+      .sort((a, b) => a.control.localeCompare(b.control));
+  }
+  return {
+    version: CROSSWALK_VERSION,
+    reviewed: CROSSWALK_REVIEWED,
+    entries,
+    by_framework,
+    unmapped_concern_ids: unmapped,
+  };
+}
+
+/**
+ * The tokens a `required_controls` policy can match a concern on (lower-cased):
+ * each mapped control's framework, control id, `framework|control` key and title,
+ * the defect themes, AND the maintained-pack control ids the concern evidences.
+ * So a policy entry can require a whole framework ("Cyber Essentials"), a single
+ * control ("Secure Configuration" or "Cyber Essentials|Secure Configuration"), a
+ * theme ("encryption-at-rest"), or a Cloud-pack control id ("A2.1") — the last is
+ * what the Cloud "required controls" policy sends down via run-context. Pure.
+ */
+export function controlMatchTokens(concern: {
+  rule_id: string;
+  evidence: string;
+  category?: string;
+}): string[] {
+  const { themes, controls } = mapConcernToControls(concern);
+  const tokens = new Set<string>();
+  for (const t of themes) tokens.add(t.toLowerCase());
+  for (const c of controls) {
+    tokens.add(c.framework.toLowerCase());
+    tokens.add(c.control.toLowerCase());
+    tokens.add(`${c.framework}|${c.control}`.toLowerCase());
+    tokens.add(c.title.toLowerCase());
+  }
+  // The Cloud pack control ids (e.g. "A2.1") so an org's dashboard required-control
+  // policy, delivered as pack ids over run-context, enforces in the CI gate.
+  for (const id of packControlsForThemes(themes)) tokens.add(id.toLowerCase());
+  return [...tokens];
+}
+
+/**
+ * The OPEN concerns that map to at least one REQUIRED compliance control — these
+ * fail the CI gate regardless of severity (the 2g-vi "required control" policy:
+ * a CISO marks the controls that MUST stay clean, e.g. encryption-at-rest for
+ * SOC 2). `required` is matched case-insensitively against each concern's
+ * framework / control / `framework|control` / title / theme (see
+ * `controlMatchTokens`). Suppressed (accepted) concerns never count. Pure.
+ */
+export function requiredControlViolations(
+  concerns: Concern[],
+  required: string[],
+): Concern[] {
+  assertCrosswalkIntegrity();
+  const wanted = new Set(
+    required.map((r) => r.trim().toLowerCase()).filter(Boolean),
+  );
+  if (wanted.size === 0) return [];
+  return concerns.filter(
+    (c) =>
+      !c.suppression &&
+      controlMatchTokens(c).some((token) => wanted.has(token)),
+  );
+}
+
+export const ComplianceCrosswalkParams = type({
+  concerns: type({
+    id: type.string,
+    rule_id: type.string,
+    evidence: type.string,
+    "category?": type.string,
+    "severity?": type.string,
+  })
+    .array()
+    .describe(
+      "the concerns to map (pass the `concerns` array from terraform_scan/read_findings).",
+    ),
+});
+
+export function ComplianceCrosswalkTool(ctx: LocalToolContext) {
+  void ctx;
+  return tool({
+    name: "terraform_compliance_crosswalk",
+    description:
+      "Map a scan's concerns to the UK public-sector + general compliance controls they touch — NCSC " +
+      "Cloud Security Principles, Cyber Essentials, NHS DSPT, Secure by Design, CIS Controls, SOC 2, plus the " +
+      "NIST SP 800-53 rev 5 spine, NIST CSF 2.0 pivot, DORA RTS (EU) 2024/1774 and the NCSC Cyber " +
+      "Assessment Framework v4.0 (§5.14 crosswalk hub) — so a " +
+      "remediation PR can be narrated to an ASSESSOR in their own framework. Pass the `concerns` from " +
+      "terraform_scan/read_findings; returns a per-concern control mapping plus a `by_framework` index and an " +
+      "honest `unmapped_concern_ids` list. The mapping is an INDICATIVE starter rule-pack (version + review " +
+      "date included) keyed on the defect theme — cite it as 'indicative alignment', never an audit verdict.",
+    parameters: ComplianceCrosswalkParams,
+    execute: execute(async ({ concerns }) => {
+      const report = buildCrosswalkReport(concerns as ConcernForCrosswalk[]);
+      log.info(
+        `» terraform_compliance_crosswalk: ${report.entries.length} mapped / ${report.unmapped_concern_ids.length} unmapped across ${Object.keys(report.by_framework).length} framework(s)`,
+      );
+      return toolOk({
+        ...report,
+        note: `Indicative crosswalk v${report.version} (reviewed ${report.reviewed}) — alignment guidance, not an audit verdict.`,
+      });
+    }),
+  });
+}