compliance-mapping

Compliance Mapping

Map controls between two OSCAL Catalogs and emit an OSCAL Mapping Collection. The system separates adaptive agent judgment (threshold selection, parallelism decisions) from a deterministic pipeline (ingest, embedding-based candidate generation, scoring, aggregation, emission). All semantic judgment (relationship/confidence/coverage) is performed by subagents you spawn — no external LLM API is ever called. Embedding and nearest-neighbor search run locally via sentence-transformers and FAISS (no API key required).

┌─ Mapping Agent (you: orchestration) ────────────────────────────────┐
│  ┌─ Deterministic Pipeline (scripts/) ────────────────────────────┐ │
│  │ Ingest → (Stage 2: reserved) → Blocking → Judge → Score        │ │
│  │       → Aggregate → Emit → Validate + Report                    │ │
│  └────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘

Note on stage numbering. Stages are numbered 1, 3, 4, 5, 6, 7, 8 (no Stage 2) so this file lines up with the 8-stage numbering used on the downstream branch, where Stage 2 (Granularity Align) is inserted between Ingest and Blocking. The OSS variant here does not run Stage 2 — controls are compared at their input granularity — so the number is simply skipped.

Trigger

Use this skill when asked to map/compare controls between two compliance frameworks expressed as OSCAL Catalogs, or to produce/update an OSCAL Mapping Collection.

Inputs

• source_catalog (required): Path to the source-side OSCAL Catalog JSON (the framework whose controls you are trying to show coverage for).
• target_catalog (required): Path to the target-side OSCAL Catalog JSON (the reference framework).
• output_dir (required): Directory to write all intermediate and final artifacts.
• mapping_spec (optional): Path to a JSON/YAML profile (see scripts/mapping_spec.py) overriding thresholds, relationship vocabulary, or blocking K. If omitted, built-in defaults are used (confidence≥0.75, coverage≥0.15, K=20).