CCoE conformance: OID identification, CBOM releases, attestation register and policy packs

data/detection-tiers.json

@@ -0,0 +1,124 @@
+{
+  "$comment": "How an algorithm name was obtained, and how much that basis is worth. Ordered, first match wins, adapted from the identity priority ladder in the Enterprise CBOM Aggregation Engine design — the same principle applied to identification rather than asset matching. A finding always records the tier it was established at, so a reviewer can tell an API call site from a variable name that merely looked cryptographic.",
+  "$schemaVersion": "1.0.0",
+  "$updated": "2026-08-12",
+  "$comment_review": "Tiers at or below the reviewFrom rank carry reviewRequired. They are reported, never silently dropped — a weak signal is still evidence — but they are not presented as established fact.",
+  "reviewFrom": 7,
+  "tiers": [
+    {
+      "rank": 1,
+      "id": "api-call-exact",
+      "confidence": 1.0,
+      "strength": "exact",
+      "description": "A known cryptographic API was called and its algorithm argument matched a registry pattern exactly."
+    },
+    {
+      "rank": 2,
+      "id": "api-call-normalised",
+      "confidence": 0.9,
+      "strength": "strong",
+      "description": "A known cryptographic API was called and its algorithm argument matched a registry pattern once real-world spelling was normalised — HMAC-SHA256 for the registry's HMAC-SHA-256."
+    },
+    {
+      "rank": 3,
+      "id": "api-constant",
+      "confidence": 0.85,
+      "strength": "strong",
+      "description": "A library constant that names an algorithm outright, such as an OpenSSL padding or curve constant."
+    },
+    {
+      "rank": 4,
+      "id": "config-value",
+      "confidence": 0.75,
+      "strength": "strong",
+      "description": "A configuration or manifest value in a field known to carry an algorithm — a cipher suite list, a signature algorithm setting."
+    },
+    {
+      "rank": 5,
+      "id": "family-name-only",
+      "confidence": 0.65,
+      "strength": "strong",
+      "description": "The name is a registry algorithm family but carries no parameter set — a CBOM component named ML-KEM, or a call site naming the family alone. The family is established; the parameters that decide its strength are not."
+    },
+    {
+      "rank": 6,
+      "id": "import-inferred",
+      "confidence": 0.6,
+      "strength": "heuristic",
+      "description": "A cryptographic module import that names the algorithm, without an observed call site. Evidence the algorithm is available, not that it is used."
+    },
+    {
+      "rank": 7,
+      "id": "string-literal",
+      "confidence": 0.5,
+      "strength": "heuristic",
+      "description": "A bare string literal matching a registry name, with no call site to anchor it. May be a log message or a comment."
+    },
+    {
+      "rank": 8,
+      "id": "identifier-name",
+      "confidence": 0.3,
+      "strength": "weak",
+      "description": "A variable, function or field name containing an algorithm name. Frequently a legacy name that outlived the algorithm it refers to."
+    },
+    {
+      "rank": 9,
+      "id": "ambiguous",
+      "confidence": 0.25,
+      "strength": "weak",
+      "description": "The name matched, but more than one registry family accepts it and nothing in the evidence settles which — a bare RSA-PKCS1-1.5 is both an encryption and a signature scheme."
+    }
+  ],
+  "$comment_riskMapping": "Overlay assessment mapped onto the risk vocabulary the scanners already emit. Status governs; quantum exposure raises the floor for an otherwise sound algorithm, because harvest-now-decrypt-later makes a classically fine algorithm a scheduling problem rather than a safe one.",
+  "riskMapping": {
+    "broken": {
+      "level": "CRITICAL",
+      "score": 95
+    },
+    "deprecated": {
+      "level": "HIGH",
+      "score": 75
+    },
+    "test-only": {
+      "level": "HIGH",
+      "score": 70
+    },
+    "legacy": {
+      "level": "MEDIUM",
+      "score": 45
+    },
+    "active": {
+      "level": "SAFE",
+      "score": 10
+    }
+  },
+  "quantumFloor": {
+    "shor": {
+      "level": "MEDIUM",
+      "score": 40
+    },
+    "depends": {
+      "level": "LOW",
+      "score": 20
+    },
+    "grover": null,
+    "safe": null
+  },
+  "$comment_categoryMapping": "Registry primitive mapped onto the category vocabulary the scanners already emit.",
+  "categoryMapping": {
+    "block-cipher": "symmetric",
+    "stream-cipher": "symmetric",
+    "ae": "symmetric",
+    "key-wrap": "symmetric",
+    "signature": "asymmetric",
+    "pke": "asymmetric",
+    "kem": "asymmetric",
+    "key-agree": "asymmetric",
+    "hash": "hash",
+    "xof": "hash",
+    "mac": "mac",
+    "kdf": "kdf",
+    "drbg": "rbg",
+    "other": "other"
+  }
+}