Re-tag MI-2 as a meta control and reframe it around evidence references

[meekrosoft]

Summary

Re-tags MI-2 Content Addressable Identities from BUILD to META, and reframes the control body to match.

MI-2 was written as an artifact control: the requirements spoke only about build outputs, and the commentary about hashing them. But content addressable identity is not a property of the build phase. It is the property that lets any control's evidence name its subject unambiguously — a review naming a source revision, a scan naming a codebase state, an approval naming a version.

Where that reference is a mutable label rather than a digest, the binding can be broken without altering the evidence, and reviewing the evidence cannot detect the change — because the evidence is not what changed. That makes MI-2 a control over other controls rather than a phase control, so it joins MI-22 under META (introduced in #97).

The BUILD phase keeps MI-3, which owns the binding of an artifact's digest to its source and build metadata. MI-2 now states the identity property that binding relies on. No other control is re-tagged.

Changes

• Phase — BUILD → META
• Summary and Description — reframed around the evidence-to-subject reference, naming the controls that depend on it (MI-1, MI-3, MI-5, MI-14, MI-19)
• Requirements — restructured as named, testable properties. Replaces the circular "MUST be immutable and cannot be forged or reassigned to different content" with Content-Derived Identity, Collision-Resistant Algorithm and Recorded Algorithm, which state what has to hold and can be checked. The artifact-only reference requirement generalises into Fingerprint References in Evidence, Verifiable on Use and Preserved Across Handoffs.
• Examples & Commentary — now spans the lifecycle rather than build outputs: Git commit IDs as already content addressable, OCI digests vs re-pushable tags, lockfile digests, evidence naming its subject instead of a CI build number, the label-to-digest mapping, verification at deployment gates, and algorithm migration
• ## Links — added; this section was missing and was the readiness blocker flagged in Mitigation Review Tracker #96
• mitigates — added ri-5 Audit and Compliance Evidence Failure, which under this framing is the risk MI-2 most directly addresses. ri-1, ri-7, ri-11 unchanged.
• related_mitigations — expanded with MI-8, MI-14 and MI-22 to reflect the cross-cutting scope

Verification

• scripts/lint-check passes
• scripts/readiness-check reports MI-2 ready — it previously failed on the missing ## Links section, the blocker recorded against MI-2 in the Mitigation Review Tracker (Mitigation Review Tracker #96)
• make build succeeds and resolves all nine new {% link %} cross-references, with correct single-baseurl URLs
• The catalogue emits data-phase="META" for MI-2, so the Meta phase filter now lists MI-2 alongside MI-22

Notes for reviewers

Three changes go slightly beyond a phase re-tag, called out for a working-group view:

1. Adding ri-5 to mitigates is a risk-mapping judgement, not a mechanical consequence of the re-tag.
2. Adding ## Links fixes the Mitigation Review Tracker #96 readiness blocker in passing. Happy to split it out if the working group would rather review the re-tag alone.
3. The Fingerprint References in Evidence requirement is deliberately scoped to how evidence names its subject. It does not take over MI-3's tag-to-digest mapping, which stays where it is and is cross-referenced instead.

Still outstanding against the MI-8 exemplar, not addressed here: the frontmatter carries only three bare NIST 800-53 IDs with no note: annotations. MI-8 annotates every reference across five frameworks, and SSDF ps-1/ps-3, ISO 27002, FFIEC and SLSA all have plausible mappings for MI-2. That work needs new entries in the hand-maintained docs/_data/*.yml files plus a checksum refresh, so it is better as a follow-up.

Two pre-existing issues noticed while working, unrelated to this change: docs/_data/iso-iec-27002.yml fails its recorded checksum on a clean tree, and readiness-report.md is stale (dated 2026-06-20, still reports mi-1 as non-existent).

Refs #96

[github-actions]

Readiness Check

SDLC Controls Framework — Readiness Report

Generated: 2026-08-17

Scope: changed files only

Risks

ID	Title	Doc Status	Type	Sections	Cross-refs	Ready

Mitigations

ID	Title	Doc Status	Type	Sections	Mitigates	Reg. Refs	Cross-refs	Ready
mi-2	Content Addressable Identities	Draft	PREV	✅	✅	✅	✅	✅

Framework Validation Coverage

Reference IDs are validated against a data file when one is available.

Framework	Status
eu-ai-act	✅ validated (checksum ok)
ffiec-itbooklets	✅ validated (checksum ok)
iso-42001	✅ validated (checksum ok)
iso-iec-27002	⚠️ content changed since the checksum was recorded — run scripts/readiness-check --update-checksums if this was intentional
nist-ai-600-1	✅ validated (checksum ok)
nist-sp-800-53r5	✅ validated (checksum ok)
nist-ssdf	✅ validated (checksum ok)
owasp-llm	✅ validated (checksum ok)
owasp-ml	✅ validated (checksum ok)
slsa	✅ validated (checksum ok)

Risk–Mitigation Coverage Matrix

Risk	mi-2