End-to-end ATO workflow: SCAP -> POA&M -> OSCAL -> AO brief

[cognis-digital]

A common end-to-end RMF flow with stigsentry, mapped to the bundled demos:

1. Sysadmin runs a SCAP/SCC benchmark and triages opens — demos/01_sysadmin_scan.py turns raw rows into a per-host, severity-ranked fix list.
2. ISSO / ISSM generates the POA&M of record — demos/02_isso_poam.py emits an eMASS-ready CSV with the official NIST 800-53 rev5 Control Title column resolved from the real OSCAL catalog.
3. Assessor / SCA ingests machine-readable evidence — demos/03_auditor_oscal.py emits a real OSCAL 1.1.2 Assessment Results document (paired observation+finding, deterministic UUIDs, not-satisfied targets, STIG/CCI provenance). Deterministic UUIDs mean two runs diff cleanly.
4. ATO / Authorizing Official reads the posture — demos/04_ato_risk_brief.py gives the composite risk score, a control-family rollup, and a paste-ready Markdown briefing block.
5. CI / air-gap gates the build — demos/05_airgap_pipeline.py shows the offline resolve, SARIF export, and the --fail-on high gate.

Run the whole thing offline with PYTHONUTF8=1 python demos/run_all.py. How are you wiring stigsentry into your ATO package or continuous-monitoring pipeline?