Skip to main content

Release Notes

Next release: OSCAL 1.2 and evidence tooling​

OSCAL consumer action required​

DecisionTraceExporter.generate_oscal_artifact() now creates new OSCAL document and result UUIDs for every call. Previous versions reused hardcoded UUID constants; that could cause unrelated artifacts to collide in a GRC store.

The emitted metadata.oscal-version also changes from 1.1.2 to 1.2.0. Treat this as an artifact schema-version bump:

  • allow OSCAL 1.2.0 in validators and ingestion pipelines;
  • do not rely on the previous document or result UUID values;
  • use request IDs, hashes, timestamps, and explicit evidence metadata for correlation;
  • regression-test any OSCAL-to-GRC mappings before upgrading.

The document remains an OSCAL assessment-results artifact. Runtime exporter artifacts receive fresh identities per call. Offline assessment artifacts can use deterministic UUIDs for reproducible builds.

Shared OSCAL builder​

All OSCAL shape construction now belongs to llm_shield_proxy/compliance/oscal.py. Both the offline assessment path and the runtime decision-trace exporter use it, preventing schema drift between callers.

Other evidence-plane additions​

  • offline, aggregate-only pilot assessment reports;
  • optional durable, acknowledged audit JSONL delivery with restart recovery;
  • offline hash-chain, sequence, fingerprint, and Ed25519 verification;
  • versioned streaming privacy conformance reports and reproducible benchmark guidance.

These features support technical control evidence. They do not certify an organization or make local storage WORM without independently configured immutable retention.