Sharang ParnerkarandClaude Fable 5 7cd4ffdaab feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC) ...

Closes out B's coverage of the 16 needs_tooling CRA controls:

- cra-ai-2,3,4,5 (minimal attack surface, secure architecture, least-privilege,
  tamper protection) are design properties, not local code patterns -> marked
  not_code_checkable (out of static-scan scope) with reviewer notes.
- cra-ai-12 (RBAC) is surface-checkable (authorization points) -> added to the
  grounded surface pass; note points to the gated grounded mechanism.

Final CRA coverage: covered 13 | needs_tooling 8 (all grounded-covered, gated) |
not_code_checkable 19. The 16 needs_tooling now fully categorized:
4 custom-semgrep (B1) + 8 grounded surface (B2/B3, gated) + 4 architectural (B3).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-21 14:50:50 +02:00

..

rules

feat(controls): B1 — custom semgrep detectors for 4 CRA controls (#218)

2026-07-21 12:31:20 +00:00

src

feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC)

2026-07-21 14:50:50 +02:00

tests

feat(oscal): live assessment endpoint POST /api/v1/oscal/assess (#212)

2026-07-20 19:13:47 +00:00

Cargo.toml

feat: control-driven SAST — LUT + grounded LLM triage over tool findings (#213)

2026-07-21 09:01:51 +00:00