Fix #35 (registries): migrate the framework registries off the swapped ids

[emmanuelgjr]

Stacked on #110 — base is fix/swapped-control-ids, so review that one first. Together they close #35.

Why

extract-registry.js seeded data/frameworks/ from the mapping rows while the parser had the columns the wrong way round. 573 registry items across ten frameworks ended up with a requirement sentence as their identifier:

{ "control_id": "Hijacked agent with excess privilege causes larger blast radius",
  "title": "NHI-5 Over-Privileged NHI" }

These ids ship in the npm package, docs/frameworks-registry.js and the OSCAL catalogs.

What this does

Each item is re-read with the same grammar the parser now uses — the identifier comes out of the title, the remainder becomes the title, the description is kept. Nothing is invented:

• items that already had a proper id are untouched, and win on the title when a converted item collapses onto them;
• 14 CIS safeguards that mapping rows cite but the registry lacked are added, titled from the row;
• registry ids also accept the CIS parent controls (CIS-16) that no mapping row cites, since the registry legitimately holds both levels;
• ISO Annex B (B.2) is recognised alongside Annex A;
• header rows that the double-table bug turned into registry items are dropped.

Framework	Before	After		Framework	Before	After
SOC 2	209	46		EU AI Act	145	30
OWASP NHI Top 10	104	10		ISO/IEC 42001	87	56
CWE/CVE	76	61		PCI DSS v4.0	72	49
CIS Controls v8.1	70	68		NIST SP 800-82	59	26
OWASP AI Testing Guide	58	9		NIST SP 800-218A	52	12

Registry controls 1,541 → 991. Registry items 1,685 → 1,120.

The count falls because the removed entries were artefacts, not content: the seeding produced one registry item per mapping row, where the framework has one control. The OWASP AI Testing Guide has nine categories, not 58; the NHI Top 10 has ten entries, not 104. The requirement text those items carried is not lost — it lives in each mapping row's notes after #110.

Dangling references from mappings into registries: 153 → 1 (one FedRAMP row, unrelated to #35).

Guards

• checkControlIdShapes() now validates registry ids as well as mapping ids.
• The prose-id baseline in exports.test.mjs is emptied, not lowered, so no framework is exempt any more and any sentence-shaped id in an OSCAL export fails the build.

Verification

• node scripts/validate.js: 0 errors, 87 warnings, 326 passed.
• npm run test:scripts: 85 passed, 0 failed, twice.
• npm run stats:check current; generator reruns clean.

For your attention

1. A headline count moves. data/stats.json drops from 1,541 to 991 registry controls, and the webapp renders that from the data layer, so it updates by itself. But the About timeline still contains the historical line "Registry items typed by kind — 1,372 controls" from v4.0. It is a dated record of what shipped then, so I have not touched it (C2). Tell me if you want a new timeline row noting the correction.
2. 345 U+FFFD replacement characters remain in 15 registry files — the encoding guard from T-ACC06 covers Markdown only. Titles I rewrote here are clean; the descriptions are not. Worth its own issue and fix.
3. 35 mapping rows still name themselves after their id (mostly PCI Req 11.3), because neither the table nor the registry has a title for those ids. Filling them needs the published requirement text, not a guess.

🤖 Generated with Claude Code