{"datasets/cncf-ai-benchmarks":{"title":"CNCF AI Ecosystem OSCAL Benchmarks","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"31 OSCAL component definitions from oscal-compass-lab/ai-benchmarks, one for each of 31 CNCF AI ecosystem projects (PyTorch, TensorFlow, LangChain, Kubernetes and others), in tests/data/cncf-ai-benchmarks/ under Apache-2.0, with fault-injected copies in tests/data/invalid/cncf-ai-benchmarks/ whose last-modified offset is +0000; tests/test_data.py and just test validate both as ComponentDefinitionDocument after rewriting their keys with underscores."},"datasets/generated-artefacts":{"title":"Generated artefacts","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Files generated from the OSCAL schema and never edited by hand: project/ (what just gen-project writes, such as JSON Schema, JSON-LD, OWL, SHACL, ShEx, SQL, GraphQL, protobuf, Excel and TypeScript, and the further formats of just gen-project-extended), the dataclass and Pydantic models in src/oscal/datamodel/, docs/schema/oscal.yaml, the gen-doc pages in docs/elements/ and the domain schema copy .lokf/oscal.yaml."},"datasets/luigi-carpio-component-definition":{"title":"NIST 800-53 Rev 5 to AWS Service Mapping (Luigi Carpio)","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"A third-party OSCAL 1.1.2 component definition by Luigi Carpio, tests/data/luigi_carpio/component-definition.json under MIT, mapping 31 NIST 800-53 Rev 5 controls to AWS services, each with a fedramp-high property, and marking with cjis-delta where CJIS v6.0 exceeds FedRAMP High (AC-2, IA-2, AU-6, SC-28, IR-6); the test-luigi-carpio recipe, which just test runs, checks it."},"datasets/metaschema-copy":{"title":"OSCAL metaschema copy","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"OSCAL's metaschema sources from the v1.2.3 release (usnistgov/OSCAL `src/metaschema` at commit e061961), copied byte for byte with NIST's LICENSE.md into `src/oscal/schema/metaschema/`: never edited here, the source of the allowed values every enum renders, which tests/test_schema_rules.py checks, and compared weekly with upstream by scripts/check_upstream_release.py."},"datasets/oscal-assessment-plan-schema":{"title":"OSCAL Assessment Plan Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The assessment plan module of the OSCAL schema, `src/oscal/schema/oscal_assessment_plan.yaml` (id `https://w3id.org/lmodel/oscal/oscal_assessment_plan`, OSCAL 1.2.3): the AssessmentPlan model of what an assessment covers, and the assessment-common and implementation-common classes (subjects, tasks, observations, findings, risks, system components) that the component, SSP, assessment results and POA&M modules import."},"datasets/oscal-assessment-results-schema":{"title":"OSCAL Assessment Results Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The assessment results module of the OSCAL schema, `src/oscal/schema/oscal_assessment_results.yaml` (id `https://w3id.org/lmodel/oscal/oscal_assessment_results`, OSCAL 1.2.3): the AssessmentResults model of what an assessment observed and found, with its results, attestations and assessment log, and AssessmentResultsDocument as its document root; it imports the catalog and assessment plan modules."},"datasets/oscal-catalog-schema":{"title":"OSCAL Catalog Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The catalog module of the OSCAL schema, `src/oscal/schema/oscal_catalog.yaml` (id `https://w3id.org/lmodel/oscal/oscal_catalog`, OSCAL 1.2.3): the Catalog model of controls, groups, parameters and parts, the metadata, back matter, shared types and mixins every other module imports, and OscalDocument, the schema's tree root."},"datasets/oscal-component-schema":{"title":"OSCAL Component Definition Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The component definition module of the OSCAL schema, `src/oscal/schema/oscal_component.yaml` (id `https://w3id.org/lmodel/oscal/oscal_component`, OSCAL 1.2.3): the ComponentDefinition model of components, their capabilities and the controls each implements, with ComponentDefinitionDocument as its document root, against which the CNCF and Luigi Carpio fixtures are validated; it imports the catalog and assessment plan modules."},"datasets/oscal-mapping-schema":{"title":"OSCAL Mapping Collection Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The mapping collection module of the OSCAL schema, `src/oscal/schema/oscal_mapping.yaml` (id `https://w3id.org/lmodel/oscal/oscal_mapping`, OSCAL 1.2.3): the MappingCollection model of how the controls of one catalog or profile relate to another's, with its provenance, maps, qualifiers, gap summaries, confidence scores and coverage, and MappingCollectionDocument as its document root; it imports the catalog module."},"datasets/oscal-poam-schema":{"title":"OSCAL POA&M Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The plan of action and milestones module of the OSCAL schema, `src/oscal/schema/oscal_poam.yaml` (id `https://w3id.org/lmodel/oscal/oscal_poam`, OSCAL 1.2.3): the PlanOfActionAndMilestones model of the risks a system still carries and how they are tracked, through its POA&M items, with PoamDocument as its document root; it imports the catalog and assessment plan modules."},"datasets/oscal-profile-schema":{"title":"OSCAL Profile Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The profile module of the OSCAL schema, `src/oscal/schema/oscal_profile.yaml` (id `https://w3id.org/lmodel/oscal/oscal_profile`, OSCAL 1.2.3): the Profile model, a selection of controls from catalogs or profiles and how it merges and modifies them, with ProfileDocument as its document root; it imports the catalog module."},"datasets/oscal-schema":{"title":"OSCAL Schema (top-level)","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The umbrella LinkML schema of OSCAL 1.2.3, `src/oscal/schema/oscal.yaml` (schema id `https://w3id.org/lmodel/oscal`, prefix `oscal:`): it imports the eight model modules, pins OSCAL's tag v1.2.3 and commit e061961 in its annotations, and its `lokf adapt` copy `.lokf/oscal.yaml`, rooted on the eight models, is this bundle's domain schema."},"datasets/oscal-ssp-schema":{"title":"OSCAL System Security Plan Schema","type":"Dataset","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"The system security plan module of the OSCAL schema, `src/oscal/schema/oscal_ssp.yaml` (id `https://w3id.org/lmodel/oscal/oscal_ssp`, OSCAL 1.2.3): the SystemSecurityPlan model of a system's characteristics, its implementation and how it implements a profile's controls, with SspDocument as its document root; it imports the catalog and assessment plan modules."},"datasets/test-data":{"title":"Test data and schema tests","type":"Dataset","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Example instances of the OSCAL schema in tests/data/: 36 valid files and 26 counter-examples, each named after the class it instantiates (Catalog-001.yaml, Profile-missing-imports.yaml), with an example and a counter-example for every model, the problem/ fixtures and two third-party OSCAL sets; tests/test_data.py and just test hold them to the dataclasses, the generated JSON Schema and linkml-validate, and tests/test_schema_rules.py holds the schema to the metaschema copy and the adapt copy's names apart from LOKF's, slsa's and github-actions'."},"explanations/element-names":{"title":"Element names and the shared namespace","type":"Explanation","genre":"explanation","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Why the OSCAL schema names its elements as it does: OSCAL's own keys as slot names (`last-modified`, and `class_` for OSCAL's `class`), UpperCamelCase classes and enums, and every element under `oscal:`; and why its adapt copy gives LOKF's Role, Parameter, Citation and Revision an Oscal prefix and seventeen keys an `oscal_` one, and shares seven keys (attestations, dependencies, parties, provenance, subject, value, actions) with slsa's and github-actions' copies under another IRI."},"explanations/scope-and-influences":{"title":"Scope, influences and mappings","type":"Explanation","genre":"explanation","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"What the OSCAL schema renders and leaves out, and why: OSCAL 1.2.3's eight models as NIST's metaschema defines them, no influence beyond OSCAL apart from lmodel/slsa's module layout, release asset and governance files, no mapping yet to another vocabulary, and the metaschema constraints it does not check (index, index-has-key, is-unique, expect and has-cardinality)."},"org/lmodel":{"title":"lmodel","type":"Organization","label":"nobody has checked this yet","tone":"nobody","definition":"lmodel, the GitHub organization that holds this repository (github.com/lmodel/oscal), its documentation site at lmodel.github.io/oscal and the schema's w3id namespace under w3id.org/lmodel/oscal/, and the publisher of this bundle; lmodel/slsa and lmodel/github-actions release the adapt copies the tests read as neighbours."},"playbooks/knowledge-sources":{"title":"Knowledge Sources","type":"Playbook","genre":"reference","label":"checked by automation only","tone":"automation","definition":"The librarian's scrape map: every repository location and external page this bundle derives concepts from (schema, metaschema copy, adapt copy, generated artefacts, tests and fixtures, workflows, website, governance files), the concepts each yields, how to re-check each on a refresh run, and the paths left out on purpose."},"playbooks/regenerate-and-test":{"title":"Regenerate and test the schema","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How to change the OSCAL schema: set up with uv and just, edit src/oscal/schema/ but never the metaschema copy, give each enum its oscal_allowed_values, regenerate with just gen-project, gen-doc and lokf-adapt, add examples, then run just test, just lint, just lokf-adapt-check and the pre-commit hooks, as the Build and test workflow does on Python 3.10 to 3.14."},"playbooks/release":{"title":"Release the schema","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How a releasing commit merged to main makes semantic-release promote CHANGELOG.md's Unreleased section, tag vX.Y.Z and publish a GitHub Release, then dispatch the Knowledge Release workflow once KNOWLEDGE_RELEASE_ENABLED is true; below 1.0.0 from a v0.0.0 baseline tag, with a breaking change as a minor bump, no file bumped and nothing published to PyPI."},"playbooks/update-upstream-pins":{"title":"Move the upstream pins","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"What to do when the upstream watch opens its issue because NIST released a newer OSCAL or the metaschema copy drifted: replace src/oscal/schema/metaschema/ whole from the new tag's src/metaschema/, move PINNED_TAG and PINNED_COMMIT with the schema header's version, source and annotations, run just test and update every enum that tests/test_schema_rules.py reports."},"playbooks/validate-data":{"title":"Validate OSCAL data against the schema","type":"Playbook","genre":"how-to","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How to check an OSCAL document against the schema with linkml-validate, naming the module and the class (-s src/oscal/schema/oscal_catalog.yaml -C Catalog), after rewriting native OSCAL JSON's hyphenated keys with underscores; what the generated JSON Schema and the dataclasses check, and the metaschema constraints no tool here checks."},"policies/ai-covenant":{"title":"AI covenant","type":"Policy","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The rules for AI-assisted work in oscal: a contributor owns what they submit; every element says what OSCAL's metaschema says at the pinned release and each enum names its lists in oscal_allowed_values; the metaschema copy is never edited; everything the schema defines lives under oscal:; and the scheduled librarian works through pull requests a person approves, with least privilege."},"policies/license-and-attribution":{"title":"License and attribution","type":"Policy","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"Which licence covers what in the oscal repository: Apache-2.0 for the schema, the generated models and the code; the OSCAL metaschema copy, NIST's work in the public domain and dedicated worldwide under CC0 1.0, with NIST's request for acknowledgement; the CNCF AI benchmark fixtures under Apache-2.0 and Luigi Carpio's fixture under MIT; the linkml-project-copier scaffolding under MIT; the KTL sidecar and site templates under Apache-2.0; and the bundle under CC BY 4.0."},"policies/security-policy":{"title":"Security policy","type":"Policy","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"How to report a vulnerability in oscal (GitHub's private vulnerability reporting, not a public issue), which release gets fixes, what the repository releases and runs, what holds each workflow, and the three repository settings not yet in force: required reviewers on the release Environment, a deletion and force-push rule on main, and secret scanning with push protection."},"references/linkml":{"title":"LinkML","type":"Reference","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"LinkML, the Linked Data Modeling Language the OSCAL schema is written in: the repository was built from linkml-project-copier v0.5.0, uv.lock pins linkml and linkml-runtime 1.11.1, and its recipes run LinkML's generators (gen-project, gen-pydantic, gen-doc, gen-java, gen-owl), linkml-lint, linkml-validate and linkml-run-examples; the tests record where the generated code falls short."},"references/nist-oscal":{"title":"NIST OSCAL","type":"Reference","genre":"reference","label":"nobody has checked this yet","tone":"nobody","definition":"NIST's Open Security Controls Assessment Language (OSCAL), the upstream standard this repository renders: release 1.2.3 (tag v1.2.3, commit e061961 of usnistgov/OSCAL), whose metaschema defines the catalog, profile, component definition, system security plan, assessment plan, assessment results, POA&M and mapping collection models, documented at pages.nist.gov/OSCAL."},"services/documentation-site":{"title":"oscal documentation site","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Astro Starlight site in website/, built from the README, docs/, the schema's gen-doc pages, the changelog and the knowledge bundle by the Knowledge website workflow, which deploys it to GitHub Pages at lmodel.github.io/oscal once KNOWLEDGE_WEBSITE_ENABLED is true; it replaced the mkdocs site, and its REDIRECTS send the mkdocs addresses on to the new pages."},"workflows/knowledge-librarian":{"title":"Knowledge Librarian (knowledge-librarian.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge Librarian workflow, .github/workflows/knowledge-librarian.yaml: every Monday at 05:00 UTC and by hand, once KNOWLEDGE_LIBRARIAN_ENABLED is true, it runs an LLM agent with the ktl-librarian skill (pinned by TRUST_LADDER_SKILLS_REF at v0.57.0) in a read-only job and opens a review pull request with the bundle change from a separate privileged job."},"workflows/knowledge-registrar":{"title":"Knowledge Registrar (knowledge-registrar.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge Registrar workflow, .github/workflows/knowledge-registrar.yaml: the gate on the knowledge bundle, run on pull requests that touch .lokf/, every Monday at 06:00 UTC and by hand; it validates the bundle and its relation targets against the domain schema, runs the conventions script, and checks that each new confirmation by a person is backed by an approval or a signed commit."},"workflows/knowledge-release":{"title":"Knowledge Release (knowledge-release.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge Release workflow, .github/workflows/knowledge-release.yaml: dispatched with a release's tag, or started by a published release once KNOWLEDGE_RELEASE_ENABLED is true, it attaches `knowledge-<tag>-<name>.zip`, the domain schema as `schema-<tag>-oscal.yaml` and the Copilot skills to the release, but only when the bundle changed since the last release that carries one, or when force is set."},"workflows/knowledge-sync":{"title":"Knowledge sync (knowledge-sync.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge sync workflow, .github/workflows/knowledge-sync.yaml: every Monday at 04:10 UTC and by hand, it moves the sidecar's copies and the skills pin to the newest Knowledge Trust Ladder release through one pull request from the knowledge-sync branch, opened with the KNOWLEDGE_SYNC_TOKEN secret, and holds the workflow changes for a person to apply."},"workflows/knowledge-website":{"title":"Knowledge website (knowledge-website.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Knowledge website workflow, .github/workflows/knowledge-website.yaml: on pushes and pull requests that touch the site's sources, every Monday at 05:23 UTC and by hand, its build job builds website/ and checks its links read-only, and its deploy job publishes the default branch's build to GitHub Pages once KNOWLEDGE_WEBSITE_ENABLED is true."},"workflows/lint-and-docs":{"title":"Lint & docs (lint-and-docs.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Lint & docs workflow, .github/workflows/lint-and-docs.yaml: on a push to main, every pull request, a Monday 06:00 UTC schedule and by hand, four jobs run ShellCheck, actionlint, the word budgets of CONTRIBUTING.md (1000) and SECURITY.md (900), and markdownlint, lychee and codespell over the Markdown."},"workflows/main":{"title":"Build and test (main.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Build and test workflow, .github/workflows/main.yaml: on a push to main and on every pull request, its test job runs just test on Python 3.10 to 3.14, and on 3.13 also just lint and just lokf-adapt-check, the check that .lokf/oscal.yaml is current."},"workflows/semantic-release":{"title":"Semantic release (semantic-release.yml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Semantic release workflow, .github/workflows/semantic-release.yml: on a pull request into main, its plan job checks that the commits, the changelog and the title would release and previews the release; on a push to main, its release job in the release Environment tags vX.Y.Z, publishes the GitHub Release and dispatches Knowledge Release."},"workflows/upstream-watch":{"title":"Upstream watch (upstream-watch.yaml)","type":"Service","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The Upstream watch workflow, .github/workflows/upstream-watch.yaml: every Monday at 07:00 UTC and by hand, its oscal-metaschema job runs scripts/check_upstream_release.py against usnistgov/OSCAL's releases and the pinned metaschema tree, and on a finding opens or updates the issue titled Upstream watch: OSCAL has changed."}}