v1.12.2 — Evidence API, hdf-cli 3.4.1, boundary/organization management

SPARC v1.12.2 — Evidence API, hdf-cli 3.4.1, and boundary/organization management

A feature + fix patch release bundling eight PRs on top of v1.12.1.

Highlights

Evidence API (#756)

Evidence is now fully manageable over REST — create, update, file-upload, and associate with controls — closing the gap where evidence was UI-only and the API could attest against records it had no way to create. Document-scoped control links drive OSCAL back-matter, referencing the artifact by its durable /artifacts/:uuid resolver URL. Uploads accept arbitrary artifact content, guarded by an executable-signature deny-list plus the size cap (NIST SI-10); collected_at/collected_by remain system-recorded (AU-10).

hdf-cli 3.2.0 → 3.4.1 (#764)

Moves the HDF↔OSCAL translation bridge off two silent data-corruption defects in the older CLI: fabricated POA&M expiry dates and conversion-time-stamped-as-assessment-time SARs. Removes the baselines injection workaround (fixed upstream in 3.3.1) — which on 3.4.1 was the only thing letting non-HDF input through, so removing it strengthens input validation. Surfaces the new "POA&M requires a deadline" failure as an actionable 422.

Boundary & organization management (#770)

• Configurable environments — SPARC_ENVIRONMENTS_LIST (Name:CODE pairs), defaulting to the six standard RMF environments (DEV/TEST/STAG/UAT/QA/PROD). Previously a hardcoded 4-value set missing UAT and QA.
• Unified personnel roster — the boundary screen now shows personnel assigned through both the admin screen (canonical roles) and the boundary screen (legacy memberships); previously only one path was visible (AC-3).
• Organization ↔ boundary association — associate a boundary with an organization from the admin org screen, with one authorization matrix shared by the UI and a new API endpoint: instance admin may move between orgs; a non-admin org admin may attach an unassigned boundary into their own org only (AC-3/AC-6).
• Three UI fixes: a filter on the environment form's CDEF picker, uniform clickable Artifact Summary tiles, and boundary-scoped artifact management surfaced on the boundary screen.

SonarCloud reliability (#762)

Clears the actionable half of the reliability backlog — nine fixes (bounded ReDoS in the STIG parser, explicit ENV.fetch, keyboard-operable summary chips, table row headers), with the remaining findings triaged as false positives or won't-fix.

Admin: Create User (#755)

Adds "Create User" to the admin UI over the shared provisioning service.

Security & dependencies

• rails-html-sanitizer 1.7.0 → 1.7.1 (#767) — remediates an XSS advisory (GHSA-cj75-f6xr-r4g7) in the gem SPARC uses for HTML sanitization.
• Scanner-findings audit reconciled against the UBI9 prod image (#777) — every CVE disposition re-verified against a live Trivy + Grype scan; mislabeled entries re-triaged, obsolete Debian-era suppressions removed. Release verification now runs against the UBI9 production image. Follow-ups filed for outbound-TLS trust gaps (#773–775), an hdf-libs Go-stdlib bump (#776), and automated review-date enforcement (#778).
• GitHub Actions pins (#769) and AWS SDK minor bumps (#768).

Also included

• API tooling (#759): sparc-api helper CLI; fixes a stale Postman prod URL.
• Docs (#754, #761): wiki-canonical consolidation; README cleanup.

Upgrade notes

• No migration required. The environment change stores the name slug, so existing production/development/staging/test values round-trip.
• New env var: SPARC_ENVIRONMENTS_LIST (optional; defaults to the six RMF environments). See Configuration.
• hdf-cli in the image is now 3.4.1; the translation bridge pins to it. POA&M inputs to the amendments path must now carry risks[].deadline (previously a date was fabricated).

Full changelog: v1.12.1...v1.12.2