Fix #35: parse control identifiers by framework grammar, not by column position

[emmanuelgjr]

Closes the data half of #35. 611 prose-shaped control_id values → 0.

The bug

parseControlTable() asked looksLikeId(), which rejects any identifier containing a space — Req 6.2.4, Art. 9, §5.3, SR 3.3 — and then fell through to "column 0 is the id". Where a table wrote CC3.2 — Name | requirement prose, the row came out as:

{ "control_id": "Prompt injection documented as a threat in LLM application risk assessment — vectors, likelihood, impact assessed",
  "control_name": "CC3.2" }

A reader could not follow an id back to its framework, and the control-level join resolved by luck.

The fix

scripts/control-ids.js — a per-framework identifier grammar for the ten affected frameworks. Each row is scanned for its own framework's id shape, wherever it sits; the id becomes control_id, the remainder of that cell becomes the name, and the requirement moves to notes. Where a table has no name column, the name is taken from the framework registry's title for that id instead of repeating the id.

Canonical forms are your ruling on #35: §5.3, Art. 9, Req 6.2.4, NHI-5, bare ISO clauses (6.1), SP 800-218A keeping NIST's -PS.

• (A) CIS — control_id is the safeguard (16.1), with the control carried as parent (CIS-16); 138 rows.
• (B) SP 800-53 rows inside the 800-82 files — kept, and labelled id_source: "NIST SP 800-53 control cited by the SP 800-82 overlay"; 30 rows.

EU AI Act keeps paragraph references (Art. 55(1)(b)), because the paragraph is what says which obligation was mapped.

Framework	Before	After
SOC 2	168	0
EU AI Act	123	0
OWASP NHI Top 10	105	0
CIS Controls v8.1	58	0
PCI DSS v4.0	40	0
NIST SP 800-218A	40	0
NIST SP 800-82 Rev 3	33	0
CWE/CVE	25	0
OWASP AI Testing Guide	17	0
ISO/IEC 42001:2023	3	0

Two parser bugs found on the way

• A section can hold more than one table. LLM_NISTSP80082.md follows its SP 800-82 sections with an SP 800-53 table, and that second table's header row was being parsed as a mapping — 10 junk rows like control_id: "Title". Splitting on the |---| separators drops them and gives each table its own headers, which is what lets the SP 800-53 rows keep their titles (SI-10 → Information Input Validation) instead of naming themselves.
• Two-column tables lost the requirement text once the id stopped being mis-filed there. It now becomes notes, so nothing is discarded: 1,149 of 1,337 repaired rows carry their requirement.

Guard

checkControlIdShapes() in validate.js fails the build if any of the 1,337 rows in these frameworks stops carrying a well-formed identifier. scripts/control-ids.test.mjs pins the grammar against 20 row shapes taken from the files as they are today, including the ones that must yield no name rather than promote a requirement into one.

Scope and verification

• Mappings 3,781 → 3,771 — exactly the 10 header rows. 969 rows changed id. No row was removed, and no severity, relationship, confidence or rationale changed.
• node scripts/validate.js: 0 errors, 87 warnings, 326 passed.
• npm run test:scripts: 85 passed, 0 failed, twice (81 + 4 new).
• npm run stats:check current; generator reruns clean.

Not in this PR

The registries in data/frameworks/ were seeded from these same broken rows and still hold prose ids (NHI 104 of 117, AI Testing Guide 58 of 58). Migrating them moves headline control counts substantially and needs a note on the README and the webapp, so it follows as its own PR.

🤖 Generated with Claude Code