1metadata:
 2  id: audit-log-undeclared-criteria
 3  type: AuditLog
 4  gemara-version: "1.1.0"
 5  version: "1.0.0"
 6  description: "Invalid audit log: result scored against criteria the audit never declared"
 7  author:
 8    id: lead-auditor
 9    name: "Auditor"
10    type: Human
11  mapping-references:
12    - id: security-policy
13      title: "Information Security Policy"
14      version: "2.1.0"
15    - id: OSPS
16      title: "Open Source Project Security Baseline"
17      version: "2025.1"
18      url: "https://baseline.openssf.org"
19
20target:
21  id: gemara-repo
22  name: "gemaraproj/gemara"
23  type: Software
24  uri: "https://github.com/gemaraproj/gemara"
25  environment: production
26
27owner:
28  responsible:
29    - name: "Auditor"
30      affiliation: "External Audit Firm"
31  accountable:
32    - name: "Project Lead"
33      affiliation: "OpenSSF"
34
35summary: "Criteria declaration test."
36
37criteria:
38  - reference-id: security-policy
39
40results:
41  - id: AR-AC-01
42    title: "MFA enforcement verified"
43    type: Strength
44    description: "Scored against OSPS, which is not declared in criteria."
45    criteria-reference:
46      reference-id: OSPS
47      entries:
48        - reference-id: OSPS-AC-01