Title the 19 registry entries that carried only their identifier, from the published standards - #115
Merged
Merged
Conversation
…uard data files Fourteen registry files carried 328 U+FFFD replacement characters, mostly where an em dash belongs. They ship: the registries go out in the npm package, in docs/frameworks-registry.js and in the OSCAL/STIX exports. Every character is recovered from the source text rather than assumed. The registries were extracted from the mapping rows, so for each corrupted string the text either side of the character is looked up in the Markdown and the entry JSON, and the character that sits between them is read off. A character is taken only when every match agrees; the window narrows from 24 to 8 characters when a description concatenates several rows, and keeps the raw slice when only one word follows, since trimming to a word boundary could otherwise empty it. All 328 resolved, every one to U+2014. None was guessed, and no other character was found. The guard from T-ACC06 only ever read Markdown, which is why this sat unnoticed. It now also reads data/frameworks/*.json, data/entries/*.json and data/*.json, checking for U+FFFD alone — the arrow heuristic is tuned for prose and diagrams, not JSON. Negative-tested: a replacement character injected into soc2.json fails validation, naming the file and line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…m the published standards After #110 and #111, 35 mapping rows still named themselves after their id — "Req 11.3 | Req 11.3" — because neither the mapping table nor the registry held a title for those 19 ids. The text now comes from the standards themselves, transcribed rather than written. PCI DSS, 17 requirements: the headings as printed in PCI SSC's own "PCI DSS v4.0 SAQ D for Merchants", extracted with pdftotext from the published PDF so the wording is the document's, not a paraphrase. Req 11.3 reads "External and internal vulnerabilities are regularly identified, prioritized, and addressed." SOC 2, PI1.3 and P7.1: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022). The AICPA download needs a session, so the wording was taken from two independent copies of that document and compared; both agree character for character. Only entries whose title was empty or equal to their own id were filled, so no curated title is overwritten. Rows with no published title available were left alone — there are none left. Mapping rows whose control_name is merely their control_id: 35 -> 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Item 3 of the three follow-ups. Stacked on #114 (
fix/registry-encoding).Why
After #110 and #111, 35 mapping rows still named themselves after their id —
Req 11.3 | Req 11.3— because neither the mapping table nor the registry held a title for those 19 ids.Where the text comes from
Transcribed from the standards, not written.
listings.pcisecuritystandards.org), extracted from the published PDF withpdftotextrather than retyped, so the wording is the document's:Req 11.3— "External and internal vulnerabilities are regularly identified, prioritized, and addressed."Req 10.2— "Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events."Req 12.6— "Security awareness education is an ongoing activity."PI1.3andP7.1. TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022). The AICPA download needs a session, so I took the wording from two independent copies of that document and compared them — they agree character for character. Both read, forP7.1: "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy."I did not fetch the AICPA PDF from AICPA itself; if you would rather those two waited for a first-party copy, say so and I will drop them from this PR and keep the 17 PCI ones.
Safety of the edit
Only entries whose title was empty or identical to their own id are filled, so no curated title is overwritten. The mapping rows pick the text up through the registry, as they already do for every other framework.
Rows whose
control_nameis merely theircontrol_id: 35 → 0.Verification
node scripts/validate.js: 0 errors, 327 passed.npm run test:scripts: 85 passed, 0 failed.npm run stats:checkcurrent; generator reruns clean.🤖 Generated with Claude Code