feat(s132): the control mapping, held to the tree and to NIST's catalogue

Slice 132, stacked on slice 130 (PR #117), whose image it maps.

docs/regulated/control-mapping.md maps Trinity's mechanisms to NIST SP
800-53 Rev 5 and SP 800-218. It opens by saying what it is not: an
assessment, an ATO, an SSP, or a claim that any baseline is met.
- SP 800-53: 65 rows across 45 controls; 25 Trinity's, 25 shared and 15
  the deployment's.
- SP 800-218: 13 SSDF task rows.
- Every family and practice with no row is listed with its reason.

test/control_mapping_test.exs holds the document to the tree:
- every row's path, test, Mix task or function must exist;
- every identifier must be active in NIST's OSCAL catalogues, pinned by
  commit and SHA-256 in usnistgov/oscal-content, CC0;
- a row's ownership must match the responsibility matrix and the
  standards register;
- the opening's disclaimers and the forbidden words are checked;
- every regulated refusal, census test and gate step is cited or listed
  with a reason.
Each rule has a planted violation; R1 to R7 are in the slice NOTES.

The matrix was stale, and the first run found it: it still said the model
allow-list was NOT IN TREE, which the regulated profile has enforced since
regulated-boot. That row is corrected. Nine rows are added for the
regulated profile, transport and access, and the container image,
including two the pack had not stated:
- connections to Trinity are plain HTTP;
- the web pages, among them the permissions page where approvals are
  answered, carry no authentication, while the image binds every
  interface.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

CHANGELOG.md

@@ -24,6 +24,25 @@ evidence for each increment is retained by the maintainers and summarised here.
 
 ## 2026-10-08
 
+### `slice/132`: a control mapping an assessor can check against the tree
+
+The regulated pack explained the boundary, the data flow, the cryptography and who owns what, and
+named not one control. `docs/regulated/control-mapping.md` now states which NIST SP 800-53 Rev. 5
+controls and SP 800-218 practices each mechanism in this tree contributes to, where the mechanism
+lives, what proves it, and whether the rest of the control is Trinity's, shared, or the
+deployment's. It opens with what it is not: not an assessment, not an authorization to operate, not
+a System Security Plan, and not a claim that any baseline is met.
+
+The mapping is checked rather than maintained. A test fails when a row names a file that has moved,
+a test or function that no longer exists, or a control identifier that NIST's own catalogue, pinned
+by commit and digest, does not have; when a row's ownership disagrees with the customer
+responsibility matrix or its status with the standards register; and when a refusal of the regulated
+profile, a census, a step of the gate, a row of the matrix or a control family is left unmapped. The
+matrix was brought up to date first. It still said nothing refused an unapproved model, which the
+regulated profile has done since it landed, and it now also covers the gateway allow-list, the
+external authority, transport, the web pages' lack of their own authentication, and the container
+image.
+
 ### `slice/130`: the headless image, hardened, and checked as built
 
 The headless container is what a government program would actually run, and it was built to run

LICENSES/CC0-1.0.txt

@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

README.md

@@ -319,6 +319,7 @@ do over the next year, and why the order is what it is.
 | `docs/adr/` | Architecture decision records. One is added whenever a decision changes |
 | `docs/10-assurance-case.md` | The structured argument that the security claims hold, with the evidence for each and the assumptions and limits named |
 | `docs/09-standards-register.md` | One row per control a regulated deployment may ask about, with its evidence path and status |
+| `docs/regulated/` | The pack for a regulated deployment: boundary, data flow, responsibility matrix, cryptographic inventory, the hardened image and its STIG statement, and `control-mapping.md`, which maps each mechanism to the NIST SP 800-53 controls and SP 800-218 practices it contributes to and says whose the rest of each control is. The mapping is not an assessment, and a test fails when a path, check or control identifier it names stops existing |
 | `lib/`, `test/`, `config/` | The application |
 | `src-tauri/` | The native desktop shell |
 | `scripts/`, `credo_checks/` | The release check, the benchmark scripts and this project's own Credo checks |

REUSE.toml

@@ -56,3 +56,14 @@ path = ["lib/trinity_web/components/layouts/root.html.heex"]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "Sudo Apt Holdings LLC"
 SPDX-License-Identifier = "Apache-2.0"
+
+# Slice 132. **Not ours either.** The identifier lists the control mapping is checked against are
+# derived from NIST's OSCAL catalogues (`usnistgov/oscal-content`), which that repository dedicates
+# to the public domain under CC0 1.0; each file's header names the commit and the SHA-256 of the
+# catalogue it came from, and `scripts/nist_catalogues.exs` re-derives them. The `**/*.tsv` line
+# above would otherwise assign them to this project.
+[[annotations]]
+path = ["test/support/fixtures/nist/**"]
+precedence = "override"
+SPDX-FileCopyrightText = "National Institute of Standards and Technology"
+SPDX-License-Identifier = "CC0-1.0"

docs/regulated/README.md

@@ -65,12 +65,14 @@ model prompt and what may not. Read both before the others.
 | `crypto-inventory.md` | Every cryptographic capability, its module, and its certificate status |
 | `headless-image.md` | How the container image is built and hardened, and the checks run against it |
 | `stig-applicability.md` | The image's STIG applicability statement, generated from OpenSCAP's evaluation of it |
+| `control-mapping.md` | Which NIST SP 800-53 controls and SP 800-218 practices each mechanism contributes to, and whose the rest of each control is |
 
 ## Status of this pack
 
 This directory is documentation only. It adds no code, changes no behaviour, and asserts no control
 that is not already in the tree. `stig-applicability.md` is generated rather than written, and says
-how. Where the tree does not implement something this pack names, the
-row says **NOT IN TREE** rather than describing an intention.
+how. `control-mapping.md` is held to the tree by `test/control_mapping_test.exs`, which fails when a
+path, a check or a control identifier it names stops existing. Where the tree does not implement
+something this pack names, the row says **NOT IN TREE** rather than describing an intention.
 
 This pack documents the gap; it does not close it.