Feat(fedramp): FedRAMP CR26 KSI emission on conmon (v0.11 Wave 2)#194
Merged
Conversation
The plan's Wave-2 premise ("FRMR JSON") went stale when FedRAMP retired
its docs stack; re-verified 2026-07-14 against the live CR26 repos and
ratified same day: the emit target is the keySecurityIndicators block
of the Security Decision Record (SDR replaces the SSP; JSON form is a
MUST for 20x since 2026-07-04, extended to Rev5-path Class A by a
2026-07-14 rules update). Re-base record: v0.11-plan §Wave 2 + ROADMAP.
- `evidentia conmon ksi` — third conmon output mode: assembles the
operator's per-KSI YAML statements into a standalone SDR document and
validates it OFFLINE against the vendored CR26 schema before writing;
unknown KSI IDs / cadence slugs are hard errors, catalog coverage is
reported (FRC-CSX-MAS is a SHOULD, so gaps report — not fail).
- Vendored SDR + common-definitions schemas with provenance pins
(UPSTREAM.json) and ONE documented local delta: upstream publishes
every cross-document $ref with the JSON Pointer in the URI path,
which no conforming 2020-12 validator resolves (FedRAMP/schemas#3,
fix PR #4 unmerged) — the vendored copy moves it into the fragment.
- fedramp-ksi-2026 bundled catalog (10 families / 46 indicators,
Tier A) + KSI->800-53 crosswalk, generated verbatim from the pinned
FedRAMP/rules dataset by gen_fedramp_ksi.py (--check drift mode);
five class-variant indicators take their class-C statement as the
description with every variant preserved in guidance; two indicators
declare no 800-53 mapping upstream and the crosswalk mirrors that.
- persistence_cycles tie-in: SDR-CSX-KSI's "cycle for persistently
implemented measures" statements render from the same CONMON cadence
calendar the rest of conmon runs on (dates via --state-file).
- fedramp-schema-watch weekly sentinel (Wed 09:17 UTC): both upstream
repos are 2026 Public Preview drafts with same-day churn observed at
vendor time; NOTICE drift files a tracking issue, MAJOR drift (KSI
content hash, major $schemaVersion bump, new dated ruleset) also
reds the run. Probe prefers the gh CLI (proxy-reliable for the
567 KB dataset) with a urllib fallback.
- jsonschema + referencing promoted transitive->direct in
evidentia-core (the offline validation path imports them).
- Parity: conmon ksi is exempt-with-reason (offline emitter, no server
surface by design — the conmon-watch precedent); wiki CLI/API/
catalog/crosswalk references regenerated; README counts 96/16.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Evidentia gap diffNo changes Frameworks analyzed: nist-800-53-rev5-moderate, soc2-tsc Summary
Generated by |
allenfbyrd
enabled auto-merge
July 15, 2026 02:47
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Comment on lines
+289
to
+291
| "FedRAMP upstream drift against the pins in " | ||
| "`packages/evidentia-core/src/evidentia_core/fedramp/schemas/" | ||
| "UPSTREAM.json` (weekly `fedramp-schema-watch` sentinel):", |
Comment on lines
+297
to
+299
| "Re-sync procedure: `evidentia_core/fedramp/schemas/README.md`. " | ||
| "MAJOR findings red the sentinel run until the pins are " | ||
| "deliberately re-verified and bumped.", |
Comment on lines
+56
to
+60
| from _generators import ( # type: ignore[import-not-found] | ||
| DATA_ROOT, | ||
| REPO_ROOT, | ||
| emit_control_catalog, | ||
| ) |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.11 Wave 2 item 1 — FedRAMP CR26 KSI emission
The plan's Wave-2 premise ("FRMR JSON") went stale when FedRAMP retired its docs stack. Re-verified 2026-07-14 against the live CR26 repos and ratified same day: the emit target is the
keySecurityIndicatorsblock of the Security Decision Record (the SDR replaces the SSP; JSON form is a MUST for 20x since 2026-07-04, extended to Rev5-path Class A certifications by a 2026-07-14 rules update). Re-base record:docs/releases/plans/v0.11-plan.md§Wave 2 + ROADMAP.What's in here
evidentia conmon ksi— third conmon output mode: assembles the operator's per-KSI YAML statements into a standalone SDR document and validates it offline against the vendored CR26 schema before writing. Unknown KSI IDs / cadence slugs are hard errors; catalog coverage is reported (FRC-CSX-MAS is a SHOULD, so gaps report — they don't fail).UPSTREAM.json) and ONE documented local delta: upstream publishes every cross-document$refwith the JSON Pointer in the URI path, which no conforming JSON Schema 2020-12 validator can resolve (VER 2026-06-24 schemas: unresolvable cross-document $refs, and finalDisposition has no remediated value FedRAMP/schemas#3, fix PR Catalog upstream drift — 2026-04-26 #4 unmerged) — the vendored copy moves the pointer into the fragment.fedramp-ksi-2026bundled catalog (10 families / 46 indicators, Tier A) + KSI→800-53 crosswalk, generated verbatim from the pinned FedRAMP/rules dataset byscripts/catalogs/gen_fedramp_ksi.py(--checkdrift mode included). Five class-variant indicators take their class-C statement as the description with every variant preserved in guidance; two indicators declare no 800-53 mapping upstream and the crosswalk mirrors that.persistence_cyclesentries render SDR-CSX-KSI's "cycle for measures implemented persistently" statements from the same cadence calendar the rest of conmon runs on (dates via--state-file).fedramp-schema-watchweekly sentinel (Wed 09:17 UTC): both upstream repos are 2026 Public Preview drafts with same-day churn observed at vendor time. NOTICE drift files a tracking issue; MAJOR drift (KSI content hash change, major$schemaVersionbump, a new dated ruleset) also reds the run.jsonschema+referencingpromoted transitive→direct in evidentia-core (the offline validation path imports them).conmon ksiis exempt-with-reason (offline emitter, no server surface by design — theconmon watchprecedent). Wiki CLI/API/catalog/crosswalk references regenerated; README counts 96/16. Operator doc:docs/fedramp-ksi.md.Verification
$refresolves and bites; catalog content; CLI).--strict-optional(290 files), consistency scope 8/8, parity, doc-counts, docs-health,check_workflow_tools --strict,audit_workflow_permissions --strict, zizmor 1.26.1 (no findings) — all green locally.