Sharang ParnerkarandClaude Fable 5
54cf39383c
CI / Check (push) Skipped
CI / Check (pull_request) Successful in 5m50s
CI / Detect Changes (pull_request) Skipped
CI / Deploy Agent (pull_request) Skipped
CI / Deploy Dashboard (pull_request) Skipped
CI / Deploy Docs (pull_request) Skipped
CI / Deploy MCP (pull_request) Skipped
The OSCAL emitter now reports EVERY non-false-positive finding: mapped findings (via their stamped control_refs) target their controls; UNMAPPED findings are emitted as standalone observations, reported as-is (cwe/tool/severity props) so nothing is lost — they can be mapped later as the LUT / master-controls grow. assess() keys off Finding.control_refs now, not the CWE linker. New compliance-mcp `oscal_assessment` tool serves this OSCAL over MCP — what breakpilot's scanner_mcp_client pulls. Assess endpoint simplified to match. Emitter tests cover mapped / unmapped-as-is / false-positive-excluded. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>