v1.6.0 — HDF ↔ OSCAL Translation Bridge, CMS Attestation Export & OSCAL Export Hardening

v1.6.0 — HDF ↔ OSCAL Translation Bridge, CMS Attestation Export & OSCAL Export Hardening

Minor release. Closes 4 issues from the Phase 12 active backlog. No breaking changes; existing deployments upgrade in place. One backwards-compatible migration (add_frequency_and_status_to_attestations).

Highlights

HDF ↔ OSCAL translation bridge (#449)

Three new authenticated REST endpoints under /api/v1/ that let tenant compliance pipelines move scan data between the HDF and OSCAL ecosystems without managing the hdf CLI on their side:

Method	Path	Purpose
POST	/api/v1/oscal/sar_from_hdf	HDF results → OSCAL Assessment Results
POST	/api/v1/oscal/poam_from_hdf	HDF results → OSCAL Plan of Action and Milestones
POST	/api/v1/hdf/amendments_from_oscal_poam	OSCAL POA&M → HDF Amendments JSON (round-tripped through hdf amend verify before serving)

Optional Evidence back-matter enrichment — pass ?authorization_boundary_id=N to either OSCAL emission endpoint and SPARC merges the boundary's Evidence + Attestation records into the OSCAL output as back-matter.resources[] (with control-id, attestation provenance, and rlinks). Requires evidence.read on the boundary.

MITRE hdf-libs v3.1.0 baked into the SPARC container — bin/install-hdf.sh provisions the binary at build time, SHA-256 verified against checksums.txt from the GitHub release. Same script used by the security_gate CI job; bumping HDF_LIBS_VERSION updates both surfaces.

CMS attestation JSON export (#440)

Api::V1::AttestationsController#export emits SPARC attestations in the canonical CMS / SAF CLI 6-field schema, denormalized one record per linked control_id. New frequency (cadence: daily / weekly / monthly / quarterly / annually / ad_hoc) and status (passed / failed) columns on attestations align SPARC with the upstream pattern without forking the internal model. UI form gains corresponding selects.

OSCAL export hardening (#451)

Three fixes that closed a long-standing UX gap on OSCAL export validation:

• Metadata leak fixed — OscalMetadata#build_oscal_metadata was merging the entire metadata_extra blob into OSCAL output. ProgressTrackable's processing_stage / processing_message / processing_*_at keys leaked into metadata and tripped schema validation. Switched to slice(*METADATA_EXTRA_KEYS) allowlist — covers every document type (CDEF, SSP, SAR, POAM, Profile, SAP, Catalog) that includes the concern. Version-agnostic.
• YAML/XML download 500s fixed — download_yaml / download_xml across 7 controllers now rescue OscalValidationError and redirect with a flash message that includes the ?skip_validation=1 escape hatch, matching the existing download_oscal UX.
• Inconsistent error UX unified — six index views (CDEF / SSP / SAR / POAM / Profile / SAP) replaced their inline plain-link export dropdowns with the shared _oscal_export_dropdown partial. The Stimulus controller's new connect() hook reads ?oscal_validation_failed=1&oscal_format=… from the redirected show page and auto-opens the validation modal so direct-URL hits land in the same modal as dropdown clicks. Every human-facing path → same modal, same specific errors.

OSCAL schemas baked into the container (#453)

New oscal:bundle_schemas rake task downloads all 5 supported versions (1.1.1 / 1.1.2 / 1.1.3 / 1.2.0 / 1.2.1) × 8 document types from NIST GitHub release assets at Docker build time and writes them to lib/oscal_schemas_bundle/v<version>/<file> plus a manifest.json with SHA-256 checksums. oscal:seed_schemas extended with three-tier fallback: bundle (offline, checksum-verified) → NIST GitHub fetch → legacy disk fallback. Air-gapped deployments validate against all 5 versions without runtime network dependency on raw.githubusercontent.com.

Two pre-existing bugs surfaced + fixed in passing:

• OscalSchema::NIST_SCHEMA_URL_TEMPLATE was pointing at a raw.githubusercontent.com/.../json/schema/... path that NIST never published. Every fetch was 404'ing and silently falling back to disk; only v1.1.2 was ever loaded in prior releases. Corrected to the GitHub release-asset URL pattern.
• OscalSchema::DOCUMENT_TYPE_MAP had oscal_component-definition_schema.json for component-definition; NIST publishes that schema as oscal_component_schema.json. Corrected.

This release is the first deploy where SPARC actually validates against the correct schema version for each tenant document.

Migrations

• add_frequency_and_status_to_attestations — adds frequency (string, nullable) + status (string, default "passed", NOT NULL) + index on status. Backwards-compatible; existing rows default to passed.

Verified

• bundle exec rspec — 2160 examples, 0 failures, 2 pending (real-binary integration specs gated on hdf being on PATH)
• bundle exec rubocop — clean
• bundle exec brakeman — clean (2 ignored, 0 active)
• bin/install-hdf.sh — verified against MITRE hdf-libs v3.1.0 release SHA-256
• oscal:bundle_schemas — 37 schemas downloaded + SHA-256 verified at seed time, all 37 loaded into DB without runtime network calls

NIST 800-53 Rev 5 mapping updates

• CA-2 Control Assessments — attestation records with cadence + tamper-evident signatures
• CA-7 Continuous Monitoring — translation bridge endpoints + attestation cadence field
• RA-3 Risk Assessment — tenant pipelines convert scanner output to OSCAL POA&M
• SI-2 Flaw Remediation — tenant amendment generation via translation bridge

Issues closed

• #440 CMS attestation export (Option B)
• #449 HDF ↔ OSCAL translation bridge
• #451 OSCAL export schema-validation fixes + UX uniformity
• #453 Bake OSCAL schemas into the container

Pull requests merged

• #448 — CMS attestation export
• #450 — HDF ↔ OSCAL translation bridge
• #454 — OSCAL export hardening
• #455 — OSCAL schema bake

Upgrade notes

• Run bin/rails db:migrate (one new migration on attestations).
• The oscal:seed_schemas rake task now reads from the in-image bundle automatically — no operator action required.
• Optional: set HDF_LIBS_VERSION env var to pin an alternate hdf-libs CLI version. Defaults to 3.1.0.