Feat(fedramp): FedRAMP CR26 KSI emission on conmon (v0.11 Wave 2)

.github/workflows/fedramp-schema-watch.yml

@@ -0,0 +1,82 @@
+# FedRAMP upstream drift sentinel (v0.11 Wave 2). The `evidentia conmon
+# ksi` emitter validates against schemas vendored from FedRAMP/schemas
+# and a KSI catalog generated from FedRAMP/rules — both "2026 Public
+# Preview" drafts that move frequently (same-day commits observed at
+# vendor time). This sentinel compares live upstream against the pins in
+# packages/evidentia-core/src/evidentia_core/fedramp/schemas/UPSTREAM.json
+# weekly: NOTICE-level drift (minor/patch $schemaVersion bumps, vendored
+# blob drift such as the upstream $ref-defect fix merging) opens/updates
+# a single tracking issue; MAJOR drift (KSI content hash change, a MAJOR
+# $schemaVersion bump, the CR26 dated fileset changing) additionally
+# turns the run red until the pins are deliberately re-verified. Clones
+# the python-ceiling-watch.yml / uv-pilot-watch.yml sentinel pattern; its
+# own liveness is covered by the G10 dead-trigger detector
+# (base-freshness.yml).
+name: fedramp schema watch
+
+on:
+  schedule:
+    - cron: "17 9 * * 3"   # Wednesdays 09:17 UTC (Mon rescan / Tue base-freshness / Wed 08:41 python-ceiling / Thu dast / Fri uv-pilot + verify-recipes)
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fedramp-schema-watch
+  cancel-in-progress: false
+
+jobs:
+  sentinel:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # Single-job workflow — write scope lives at the job level, not repeated
+    # at the workflow level (zizmor excessive-permissions).
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
+
+      # Stdlib-only probe — no uv sync needed; it reaches upstream via the
+      # preinstalled gh CLI (authenticated with the workflow token).
+      - name: Probe FedRAMP upstream against UPSTREAM.json pins
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python3 scripts/check_fedramp_upstream_drift.py \
+            --output drift-findings.md
+
+      - name: Open or update the tracking issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ ! -s drift-findings.md ]; then
+            echo "No drift — upstream matches the UPSTREAM.json pins."
+            exit 0
+          fi
+          TITLE="FedRAMP upstream drift — re-verify the CR26 pins (fedramp-schema-watch)"
+          BODY=$(printf '%s\n\n%s\n' \
+            "$(cat drift-findings.md)" \
+            "Action: follow the re-sync procedure in packages/evidentia-core/src/evidentia_core/fedramp/schemas/README.md (re-verify upstream, bump UPSTREAM.json, re-vendor schemas and/or re-run scripts/catalogs/gen_fedramp_ksi.py + regenerate_manifest.py, review the diff). This is a scheduled sentinel — MAJOR findings also red this run; NOTICE findings only track here.")
+          existing=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
+            --search "in:title \"$TITLE\"" --json number -q '.[0].number' || echo "")
+          if [ -n "$existing" ]; then
+            gh issue edit "$existing" --repo "$GITHUB_REPOSITORY" --body "$BODY"
+            echo "Updated issue #$existing"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body "$BODY"
+          fi
+
+      - name: Red the run on MAJOR drift
+        run: |
+          set -euo pipefail
+          if grep -q '^- \*\*MAJOR\*\*' drift-findings.md; then
+            echo "MAJOR upstream drift — failing the sentinel run (see the tracking issue)."
+            exit 1
+          fi
+          echo "No MAJOR drift."

CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **FedRAMP CR26 KSI emission — `evidentia conmon ksi`** (v0.11 Wave 2,
+  target re-verified against the live CR26 stack + ratified 2026-07-14; see
+  the plan's §Wave 2 re-base record): emits the `keySecurityIndicators`
+  block of a CR26 **Security Decision Record** as a standalone JSON
+  document, validated OFFLINE against
+  `fedramp-security-decision-record-schema-2026-06-24.json` before writing
+  (rules SDR-CSO-FRR / SDR-CSX-KSI / SDR-CSO-MTD; in force for 20x since
+  2026-07-04). Ships with:
+  - the **`fedramp-ksi-2026` bundled catalog** (10 families / 46 Key
+    Security Indicators, generated verbatim from `FedRAMP/rules`
+    `fedramp-consolidated-rules.json` at a pinned commit by
+    `scripts/catalogs/gen_fedramp_ksi.py`, `--check` drift mode included)
+    plus a **KSI→NIST 800-53 Rev 5 crosswalk** extracted from the upstream
+    per-indicator `controls` declarations (base-control granularity;
+    enhancement citations preserved verbatim in notes);
+  - **vendored CR26 schemas** under `evidentia_core/fedramp/schemas/` with
+    full provenance pins (`UPSTREAM.json`) and one documented local delta:
+    upstream publishes every cross-document `$ref` with the JSON Pointer in
+    the URI path, which no conforming JSON Schema 2020-12 validator can
+    resolve (FedRAMP/schemas#3; fix PR #4 unmerged) — the vendored copy
+    moves the pointer into the fragment;
+  - **CONMON cadence integration**: `persistence_cycles` entries in the
+    operator's KSI status file render the SDR-CSX-KSI "cycle for measures
+    implemented persistently" statements from the same cadence calendar the
+    rest of `evidentia conmon` runs on (last-completed / next-due dates via
+    `--state-file`);
+  - the **`fedramp-schema-watch` weekly sentinel** (Wed 09:17 UTC):
+    compares live `FedRAMP/rules` + `FedRAMP/schemas` against the
+    UPSTREAM.json pins — NOTICE drift opens/updates a tracking issue; a KSI
+    content change, MAJOR `$schemaVersion` bump, or a new dated ruleset
+    (CR27) also reds the run. Both upstream repos are 2026 Public Preview
+    drafts with same-day churn observed at vendor time — the pins rot
+    without a watcher.
+  - Operator doc: `docs/fedramp-ksi.md`. `jsonschema` + `referencing`
+    promoted from transitive to direct `evidentia-core` dependencies (the
+    offline validation path).
+
 ## [0.10.18] - 2026-07-14
 
 **Theme**: *Container rebuild on a fresh hardened base (day-N CVE response).* A rebuild-only patch fired by the post-publish rescan's fixable-only gate: the 2026-07-13 weekly rescan of the published v0.10.17 image surfaced **DEBIAN-CVE-2026-34743** (xz-utils/liblzma 5.8.1-1, Medium 5.3) with a fix published upstream (`5.8.1-1+deb13u1`), and the standing policy is *"a fix is now available → rebuild the published image on a fresh base"*. Both pinned bases move to their current digests (the same drift the base-freshness sentinel flagged in issue #182) and the image is rebuilt, smoke-tested, re-signed, and re-attested end-to-end; the post-publish rescan re-verifies the published image's CVE posture after release. This tag also ships everything that merged to `main` between v0.10.17 and the tag: the v0.11 cycle-open gate work (ROADMAP-currency gate + ROADMAP restructure, previously tracked as Unreleased) **and the entire v0.11 hygiene track (H1–H6, below)** — the hygiene PRs merged ahead of the tag, so the v0.11 plan's release boundary re-cuts to v0.11.0 = Waves 1–2. No package (`packages/*/src`) code changes beyond the version bump.

README.md

@@ -37,7 +37,7 @@ Evidentia turns compliance from a spreadsheet problem into a software problem. I
 Built for compliance engineers, GRC teams, and CISOs who want to:
 
 - Ship audit-grade evidence with cryptographic provenance (Sigstore + PEP 740 + SLSA Provenance v1).
-- Map controls across frameworks via **95 bundled catalogs** (NIST 800-53 Rev 5, FedRAMP, CMMC 2.0, ISO 27001, CSF 2.0, EU AI Act, DORA, NIS2, GDPR, OpenSSF OSPS Baseline, the full FFIEC stack, and all 15 comprehensive US state privacy laws).
+- Map controls across frameworks via **96 bundled catalogs** (NIST 800-53 Rev 5, FedRAMP + FedRAMP CR26 KSIs, CMMC 2.0, ISO 27001, CSF 2.0, EU AI Act, DORA, NIS2, GDPR, OpenSSF OSPS Baseline, the full FFIEC stack, and all 15 comprehensive US state privacy laws).
 - Drive AI agents (Claude Desktop, Claude Code, Cursor, Copilot CLI) deterministically via MCP tools with signed output envelopes.
 
 ## Install
@@ -90,7 +90,7 @@ See it first, no install — a self-hosted [asciinema](https://asciinema.org/) r
 
 - **OSCAL-native end-to-end** — Ingest NIST OSCAL catalogs (Catalog 1.2.1); emit OSCAL Assessment Results + Plan-of-Action-and-Milestones (POA&M). Ready for FedRAMP 20x machine-readable submissions.
 - **Cryptographic evidence chain** — Sigstore keyless signing on Assessment Results; PEP 740 attestations on every published wheel; SLSA Provenance v1 on the container; CycloneDX 1.6 SBOM on every GitHub Release.
-- **95 framework catalogs + 15 crosswalks** — NIST 800-53 Rev 5 (full 1,196 controls + Low/Moderate/High/Privacy baselines), CSF 2.0, FedRAMP, CMMC 2.0 L1/L2, OpenSSF OSPS Baseline (Maturity 1/2/3 + first public OSCAL serialization), ISO 27001:2022, EU AI Act, DORA, NIS2, GDPR, all 15 US state privacy laws, full FFIEC IT Examination Handbook, OCC Bulletin 2026-13a / FRB SR 26-02. Plus 15 inter-framework crosswalks.
+- **96 framework catalogs + 16 crosswalks** — NIST 800-53 Rev 5 (full 1,196 controls + Low/Moderate/High/Privacy baselines), CSF 2.0, FedRAMP (Rev 5 baselines + CR26 Key Security Indicators), CMMC 2.0 L1/L2, OpenSSF OSPS Baseline (Maturity 1/2/3 + first public OSCAL serialization), ISO 27001:2022, EU AI Act, DORA, NIS2, GDPR, all 15 US state privacy laws, full FFIEC IT Examination Handbook, OCC Bulletin 2026-13a / FRB SR 26-02. Plus 16 inter-framework crosswalks.
 - **14 evidence collectors** — AWS, GitHub (including v0.10.6 OSPS conformance helpers), Postgres, MySQL, Oracle, SQLite, MS-SQL, Snowflake, Databricks, Okta, Vanta, Drata, BitSight, SecurityScorecard. All OCSF-aligned with `compliance_status` field.
 - **OCSF-aligned findings** — OCSF Compliance Finding (class_uid 2003) via `--format ocsf`; OCSF Detection Finding (class_uid 2004) via `--format ocsf-detection`. SARIF 2.1.0 for CI gates via `--format sarif`. CycloneDX 1.6 VEX via `--format cyclonedx-vex`.
 - **13 MCP tools** — Drive Evidentia from Claude Desktop, Claude Code, Cursor, or any MCP host. Append-only tool contract per [`docs/api-stability.md`](docs/api-stability.md) (NORMATIVE). Signed output envelopes (CIMD) per [`docs/evidence-integrity.md`](docs/evidence-integrity.md).
@@ -101,8 +101,8 @@ See it first, no install — a self-hosted [asciinema](https://asciinema.org/) r
 | Surface | Count |
 |---|---|
 | Workspace packages | 9 (8 Python on PyPI + 1 TypeScript/Vite frontend) |
-| Framework catalogs | 95 |
-| Inter-framework crosswalks | 15 |
+| Framework catalogs | 96 |
+| Inter-framework crosswalks | 16 |
 | Evidence collectors | 14 |
 | MCP tools | 13 |
 | OSCAL serializations | 1 (OpenSSF OSPS Baseline; more on the v0.11+ roadmap) |

docs/ROADMAP.md

@@ -2047,16 +2047,21 @@ ratification asks. Sourced from Phase B audit v3 + integration plan
 §"Per-release detailed integration plan" §v0.11. Substantive minor
 (~6-8 weeks):
 
-- **KSI (Key Security Indicators) emission** per FedRAMP's
-  machine-readable schemas (FRMR JSON; the `FedRAMP/schemas`
-  JSON-Schema repo) — wires as third output mode on `evidentia
-  conmon` alongside the 7 bundled cadences shipped v0.9.0. (Re-based
-  2026-06-10: KSIs are FRMR JSON, not OSCAL feeds — OSCAL remains the
-  Rev5/RFC-0024 package format per NTC-0009; see
-  integration-survey §8.2.) Evidentia's natural slot per Phase B
-  Stream E4: OSS engine for the audit-quality middle layer between
-  Trestle (raw OSCAL SDK) and RegScale (commercial FedRAMP package
-  generator).
+- **KSI (Key Security Indicators) emission** — wires as third output
+  mode on `evidentia conmon` alongside the 7 bundled cadences shipped
+  v0.9.0. **Re-based 2026-07-14 (target re-verified against the live
+  CR26 stack; ratified same day):** the emit target is the
+  `keySecurityIndicators` block of the CR26 Security Decision Record
+  per `fedramp-security-decision-record-schema-2026-06-24.json`
+  (`FedRAMP/schemas`), populated from the KSI catalog in
+  `fedramp-consolidated-rules.json` (`FedRAMP/rules` — 10 families /
+  46 indicators). The earlier "FRMR JSON" framing is retired upstream;
+  still not OSCAL (nothing in the active CR26 stack pins an OSCAL
+  version — the OSCAL 1.2.1 verdict below is unaffected). Full re-base
+  record: [`v0.11-plan.md`](releases/plans/v0.11-plan.md) §Wave 2.
+  Evidentia's natural slot per Phase B Stream E4: OSS engine for the
+  audit-quality middle layer between Trestle (raw OSCAL SDK) and
+  RegScale (commercial FedRAMP package generator).
 - **Evaluate OSCAL 1.2.1 → 1.2.2** — DONE; **VERDICT (ratified
   2026-07-13): DEFER-WITH-TRIGGER — stay on 1.2.1 for emitted
   documents.** The 1.2.2 delta is content-free for every surface

docs/cli-gui-parity.yaml

@@ -512,6 +512,11 @@ commands:
     gui: null
     status: exempt
     reason: "Long-running poll daemon; the API exposes read-only daemon-status/history, not a start verb."
+  - cli: "conmon ksi"
+    api: null
+    gui: null
+    status: exempt
+    reason: "Offline document emitter: writes a schema-validated FedRAMP CR26 SDR JSON to local disk (air-gap-first artifact generation, v0.11 Wave 2); no server surface by design."
   - cli: "oscal verify"
     api: "POST /api/oscal/verify"
     gui: "/oscal"

docs/conmon-runbook.md

@@ -18,6 +18,7 @@ the canonical cadences and lets operators query "what's due next?"
 | `evidentia conmon list --framework <fw>` | Filter to one framework |
 | `evidentia conmon next <slug> --last-completed <date>` | Compute the next-due date |
 | `evidentia conmon check --last-completed-file state.yaml` | Report due-soon + overdue cycles from tracked state |
+| `evidentia conmon ksi --status-file ksi.yaml --out sdr.json` | Emit a FedRAMP CR26 SDR with the KSI block ([runbook](fedramp-ksi.md)) |
 
 ## Conceptual model
 

docs/fedramp-ksi.md

@@ -0,0 +1,115 @@
+# FedRAMP CR26 KSI Emission (`evidentia conmon ksi`)
+
+> Status: **v0.11 Wave 2**. Emits the `keySecurityIndicators` block of a
+> FedRAMP CR26 **Security Decision Record (SDR)** as a schema-validated
+> JSON document — the third `conmon` output mode alongside the rich
+> tables and `--json`.
+
+Under the FedRAMP Consolidated Rules for 2026 (CR26), the Security
+Decision Record replaces the traditional System Security Plan, and
+providers MUST supply it in both human-readable and JSON forms
+(rule `SDR-CSO-FRR`), including per-KSI summaries of measures,
+persistence cycles, verification, and validation (`SDR-CSX-KSI`) and
+version/date/source metadata (`SDR-CSO-MTD`). This is in force for 20x
+certifications since 2026-07-04; a 2026-07-14 rules update extends the
+KSI obligation to Rev 5-path Class A certifications (`FRC-CLA-MFR`).
+FedRAMP recommends applying ALL Key Security Indicators across the
+Minimum Assessment Scope (`FRC-CSX-MAS`, SHOULD).
+
+Evidentia assembles, validates, and reports — the compliance statements
+are the operator's own. It never invents prose.
+
+## Quick start
+
+```bash
+evidentia conmon ksi \
+  --status-file ksi-status.yaml \
+  --state-file conmon-state.yaml \
+  --out sdr.json
+```
+
+Output: a Security Decision Record JSON document, validated offline
+against the vendored
+`fedramp-security-decision-record-schema-2026-06-24.json` before it is
+written (invalid output is a hard failure, never a file), plus a
+KSI-catalog coverage summary on the console.
+
+## The status file
+
+`--status-file` is operator-authored YAML
+(`evidentia_core.models.fedramp_ksi.KsiStatusDocument`):
+
+```yaml
+certification_package_overview_uri: "https://provider.example/fedramp/cpo.json"
+document_version: "1.0.0"          # SDR-CSO-MTD
+source: "GRC team"                 # SDR-CSO-MTD
+indicators:
+  KSI-CED-RAT:
+    status: Implemented            # optional; Implemented / Partially Implemented / Not Implemented
+    implementation:                # >= 1 required; Markdown allowed
+      - "Quarterly all-hands security training; role-specific tracks for engineering."
+    validation:
+      - "Completion dashboards reviewed monthly."
+    assessment:
+      - "Independent assessor sampled Q2 completion records."
+    tests:
+      - "test-training-coverage"
+    evidence:
+      - evidence_type: Report      # Log / Report / Screenshot / Configuration / Policy / Procedure / Audit Record
+        description: "Q2 training completion report"
+        location: "https://provider.example/evidence/q2-training.pdf"
+        last_updated: 2026-07-01
+    persistence_cycles:            # SDR-CSX-KSI persistence-cycle statements
+      - cadence_slug: nist-800-53-rev5-ca7
+```
+
+- **Indicator IDs** are checked against the bundled `fedramp-ksi-2026`
+  catalog (10 families / 46 indicators, generated verbatim from
+  FedRAMP's consolidated-rules dataset). Unknown IDs are hard errors
+  (exit 2). Indicators you have not addressed yet are reported as
+  coverage, not errors.
+- **`persistence_cycles`** references the same CONMON cadence calendar
+  as the rest of `evidentia conmon` (see the
+  [CONMON runbook](conmon-runbook.md)). With `--state-file` (the same
+  YAML `conmon check` reads), the rendered cycle statements include
+  last-completed and next-due dates.
+- **`--last-updated`** pins the SDR metadata timestamp for
+  deterministic snapshots; it defaults to now (UTC).
+
+## Where the schemas and catalog come from (provenance)
+
+| Artifact | Source | Pin |
+|---|---|---|
+| SDR + common-definitions schemas | [`FedRAMP/schemas`](https://github.com/FedRAMP/schemas) (CR26, draft) | vendored under `evidentia_core/fedramp/schemas/` |
+| `fedramp-ksi-2026` catalog + KSI→800-53 crosswalk | [`FedRAMP/rules`](https://github.com/FedRAMP/rules) `fedramp-consolidated-rules.json` | generated by `scripts/catalogs/gen_fedramp_ksi.py` |
+
+Exact commits, blob SHAs, and sha256 hashes live in
+`evidentia_core/fedramp/schemas/UPSTREAM.json`; the vendored SDR schema
+carries one documented local delta (the cross-document `$ref` fragment
+fix — upstream publishes the pointer in the URI path, which no
+conforming JSON Schema 2020-12 validator can resolve; FedRAMP/schemas
+issue #3, fix PR #4 unmerged at vendor time). Validation is fully
+offline — air-gapped installs validate identically.
+
+Both upstream repos are **2026 Public Preview drafts** that change
+frequently. The weekly `fedramp-schema-watch` sentinel
+(Wednesdays 09:17 UTC) compares live upstream against the pins: minor
+drift opens/updates a tracking issue; a KSI content change, a MAJOR
+`$schemaVersion` bump, or a new dated ruleset (CR27) also turns the
+sentinel run red until the pins are deliberately re-verified.
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| 0 | Document written, schema-valid |
+| 1 | Bad `--last-updated`, or (defensive) emitted document failed schema validation |
+| 2 | Invalid status file, unknown KSI ID, or unknown cadence slug |
+
+## Not OSCAL — deliberately
+
+Nothing in the active CR26 stack pins an OSCAL version; KSI submission
+is plain JSON per the CR26 schemas. Evidentia's OSCAL surfaces (POA&M,
+assessment results, traceability, catalogs) are unaffected and remain
+on OSCAL 1.2.1 per the v0.11 Wave 1 verdict
+([plan](releases/plans/v0.11-plan.md)).