Benjamin Admin fdaf547b06 feat(ucca): re-point NIST primary_implementation to CORE obligations (#6) ...

Registry materialized the generic CORE security objectives (#5b, Modell C), so
the two broad NIST controls now point at their canonical parents instead of the
domain-scoped matches:
  SI-7 -> software_integrity_protection  (CORE, Annex I (2)(f))
  CM-7 -> attack_surface_minimization    (CORE, Annex I (2)(j))
Non-breaking: the domain-scoped obligations stay valid and specialize the CORE.

SI-7 evidence = sbom + config_export (SBOM evidences component/supply-chain
integrity; config = signing/secure-boot). Export proposed_obligation_id + handler
test (2 CORE cases) updated. go test green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-06-26 09:35:46 +02:00

..

cra_nist.jsonl

feat(ucca): re-point NIST primary_implementation to CORE obligations (#6)

2026-06-26 09:35:46 +02:00

cra_owasp.jsonl

feat(ucca): adopt obligation_id + harden join to semantic (step 3 core)

2026-06-25 12:18:34 +02:00