question: remove CWE vulnerability semantics, or reconcile weakness classification with the governed attack/defence vocabularies? #676

Open question

Should the SDL retain the current CWE-locked vulnerabilities semantics at all — and if a weakness-classification concept survives, should it be expressed through the governed concept-authority vocabularies (MITRE ATT&CK / ATLAS, and any defensive vocabulary) via the same governed-extension mechanism as behavior-specifications, rather than a hardcoded ^CWE-\d+$ regex?

Why this is a question

• Vulnerability (implementations/python/packages/aces_sdl/vulnerabilities.py) carries only name, description, technical, and class (CWE). It holds no configuration and no mechanism — the actual weakness lives in nodes/services/accounts/runtime. It is a label, not environment state.
• docs/explain/sdl/precedents.md classifies the section as a "Direct port" from Open Cyber Range — inherited syntax, not derived from ACES's own semantic model.
• A "vulnerability" is not an intrinsic property of a system. A system is configured a certain way; that configuration is ground truth. "Vulnerability" is a relational, perspectival assertion — actor A judges configuration C undesirable/exploitable relative to goal/policy G. It only exists from a perspective. The ^CWE-\d+$ lock further bakes one external observer's taxonomy into what is supposed to be environment ground truth.
• Domain neutrality: vulnerability classification and scoring are prior and posterior to ACES, not inherent to it — one use case in the cyber domain. ACES is the foundation of a discipline of autonomous organization engineering, broader than cyber. Weakness classification is not required to instantiate or operate a system — at most it matters when a concept must be expressed to a participant in a load-bearing way, and even then it may be a species of content in a broader participant-informing scheme rather than a first-class section.

Options to examine

1. Remove the vulnerabilities section / CWE semantics. Express weaknesses as (a) configuration ground truth (already expressible) plus (b) perspectival assertions in the interpretation/assessment layers — participant action-contracts (e.g. what an exploit targets), the threat-model/risk-scenario/finding surfaces, observation-boundaries, and objectives.
2. Demote to content: model weakness assertions as a species of participant-informing content, not a node attribute.
3. Reconcile with governed vocabularies: keep a weakness-classification concept but drive it through the concept-authority mechanism used by behavior-specifications.offensive_behavior_refs (MITRE ATT&CK Enterprise tactics) / ai_offensive_behavior_refs (MITRE ATLAS), and any defensive vocabulary — instead of a hardcoded CWE regex — so classification is not locked to a single external taxonomy and stays domain-neutral / governed-extensible.
4. Status quo (retain CWE vulnerabilities).

Relationship

Same class of question as #671 (should scoring/reward language exist in ACES). Surfaced by REP-003 (#637): authoring CAGE-2 required either fabricating CWEs or not using the section, because CAGE models exploitability operationally, not by CWE.

Refs: #637, #671, contracts/concept-authority/attack-enterprise-tactics-source-v1.json, contracts/concept-authority/atlas-tactics-source-v1.json, ADR-001, docs/explain/sdl/precedents.md.