github.com/gemaraproj/gemara@v0.23.0

docs/adrs/0012-schema-types.md raw

 1---
 2layout: page
 3title: Refine Terms for Top-level Schema Types
 4---
 5
 6- **ADR:** 0012
 7- **Proposal Author(s):** @eddie-knight
 8- **Status:** Accepted
 9
10## Context
11
12We have been organizing schemas based on the layer they fit into — one document per layer. The terms we use for the schema types have been evolving over time and do not successfully achieve consistency and clarity.
13
14Additionally, the model changes from [ADR-0010](./0010-dual-ladder-layers) have not all been applied to the latest schemas.
15
16Below are the current top-level types at the time of this proposal:
17
18- Layer 1: `#GuidanceDocument`
19- Layer 2: `#Catalog`
20- Layer 3: `#Policy`
21- Layer 4: Not applicable
22- Layer 5: `#EvaluationLog`
23- Layer 6: Not yet implemented
24- Layer 7: Not yet implemented
25
26## Decision
27
281. Any result which is released as a single self-contained output will be referred to as a "Document"
292. Multiple definitions compiled into a shared artifact will be referred to as a "Catalog"
303. Multiple measurements compiled into a shared artifact will be referred to as a "Log"
31
32The specific artifacts may evolve over time, but the top-level schema terms should be roughly:
33
34- Layer 1: Vector Catalog, Guidance Catalog
35- Layer 2: Threat Catalog, Control Catalog
36- Layer 3: Risk Catalog, Policy Document
37- Layer 4: n/a
38- Layer 5: Evaluation Log
39- Layer 6: Enforcement Log
40- Layer 7: Monitoring Log, Audit Log
41
42## Consequences
43
44- All schemas must be updated
45- All documentation and web content must be updated
46- Adopters of previous versions will be disrupted by these breaking schema changes; this must be locked-in with release of v1
47
48## Alternatives Considered
49
50We could avoid naming conventions, but it leaves the relevant parts open to potential confusion.