Fix(fedramp): Re-vendor CR26 schemas at the upstream 1.0.0 SDR graduation#198
Merged
Conversation
…tion FedRAMP/schemas moved 2026-07-15T17:43Z — 8.5 hours after the weekly fedramp-schema-watch sentinel ran green (the documented blind window), caught by a manual pre-release drift probe. The Security Decision Record schema's $schemaVersion graduated 0.1.0 -> 1.0.0; every other tracked schema took a minor bump. Content analysis (verified against upstream ae0dc43e): - The 1.0.0 change fixes the Public-Preview draft's vacuous 'items' wrapper nesting (keySecurityIndicator / nistSecurityControl / fedRAMPRequirement) so the intended per-item constraints now actually enforce, and moves portsAndProtocols' properties inside 'items'. The enforced KSI item shape is exactly what 'evidentia conmon ksi' already emits — emitted documents were re-validated against the upstream 1.0.0 schema (clean; zero emitter changes). - No additionalProperties tightening: the SDR-CSO-MTD metadata block the emitter rides remains schema-permitted. - The cross-document $ref defect is NOT fixed by the graduation (upstream PR #4 still open) — the documented one-line fragment delta is retained on the vendored SDR copy. Changes: - fedramp-security-decision-record-schema-2026-06-24.json re-vendored at 1.0.0 (+ the retained $ref delta). - fedramp-common-definitions-schema-2026-06-24.json re-vendored byte-identical at 0.1.1. - UPSTREAM.json: commit pin -> ae0dc43e; all 11 tracked $schemaVersions refreshed; new blob/sha256 pins; verified_at 2026-07-16. The KSI rules pin (FedRAMP/rules, dataset 2026.07.14.01) is unchanged — the drift probe reports the rules content untouched. - schemas/README.md delta note + v0.11-plan.md Wave-2 record updated; CHANGELOG entry under Unreleased. Gates: drift probe clean against the new pins; 60 scoped emitter/catalog/conmon tests + full suite green; gen_fedramp_ksi --check OK; ruff, mypy, docs-health --strict, version-consistency, roadmap-currency all green.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
allenfbyrd
enabled auto-merge
July 17, 2026 03:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-vendor FedRAMP CR26 schemas at the upstream 1.0.0 SDR graduation
FedRAMP/schemasmoved on 2026-07-15 at 17:43 UTC — 8.5 hours after theweekly
fedramp-schema-watchsentinel ran green that morning (the sentinel'sdocumented ~7-day blind window). A manual pre-release drift probe caught it:
the Security Decision Record schema graduated
$schemaVersion0.1.0 →1.0.0 (MAJOR per our severity model); every other tracked schema took a
minor bump. Same dated fileset (no CR27).
Impact analysis (verified against upstream
ae0dc43e)itemswrapper nesting sothe intended per-KSI constraints now actually enforce — exactly the shape
evidentia conmon ksialready emits. Emitted documents re-validate cleanlyagainst the upstream 1.0.0 schema; zero emitter code changes.
additionalPropertiestightening — the SDR-CSO-MTD metadata blockremains schema-permitted.
$refdefect is not fixed by the graduation(upstream PR #4 still open),
so the documented one-line fragment delta is retained.
Changes
$refdelta);common-definitions re-vendored byte-identical at 0.1.1.
UPSTREAM.json: commit pin →ae0dc43e; all 11 tracked$schemaVersions refreshed; new blob/sha256 pins;verified_at2026-07-16. KSI rules pin unchanged (rules content untouched upstream).
schemas/README.mddelta note +v0.11-plan.mdWave-2 record updated;CHANGELOG entry under Unreleased.
Verification
stays green instead of firing MAJOR).
gen_fedramp_ksi.py --checkOK; ruff / mypy / docs-health --strict /version-consistency / roadmap-currency all green.