1metadata:
2 id: audit-log-001
3 type: AuditLog
4 gemara-version: "1.1.0"
5 version: "1.0.0"
6 description: "Q1 2026 Gemara Audit"
7 author:
8 id: lead-auditor
9 name: "Jane Auditor"
10 type: Human
11 mapping-references:
12 - id: security-policy
13 title: "Information Security Policy"
14 version: "2.1.0"
15 - id: OSPS
16 title: "Open Source Project Security Baseline"
17 version: "2025.1"
18 url: "https://baseline.openssf.org"
19 - id: eval-log
20 title: "PVTR Evaluation Log"
21 version: "2025-08-22"
22 url: "https://artifacts.example.com/eval-logs/pvtr-baseline-scan.yaml"
23 - id: enforcement-log
24 title: "Example Enforcement Log"
25 version: "2025-08-22"
26 url: "https://artifacts.example.com/enforcement-logs/enforcement-log-001.yaml"
27 - id: github-api
28 title: "GitHub Dependency Graph API"
29 version: "2026"
30 url: "https://docs.github.com/en/rest/dependency-graph"
31
32target:
33 id: gemara-repo
34 name: "gemaraproj/gemara"
35 type: Software
36 uri: "https://github.com/gemaraproj/gemara"
37 environment: production
38 owner:
39 name: "Gemara Maintainers"
40 affiliation: "OpenSSF"
41
42owner:
43 responsible:
44 - name: "Jane Auditor"
45 affiliation: "External Audit Firm"
46 accountable:
47 - name: "Project Lead"
48 affiliation: "OpenSSF"
49
50summary: "Access control and quality controls are strong. Documentation controls have gaps requiring remediation."
51
52criteria:
53 - reference-id: security-policy
54 remarks: "Organizational policy establishing the audit's scope."
55 - reference-id: OSPS
56 remarks: "Baseline whose controls each result is scored against."
57
58results:
59 - id: AR-AC-01
60 title: "MFA enforcement verified"
61 type: Strength
62 description: "Multi-factor authentication is enforced at the organization level for all contributors."
63 criteria-reference:
64 reference-id: OSPS
65 entries:
66 - reference-id: OSPS-AC-01
67
68 - id: AR-DO-01
69 title: "User documentation missing"
70 type: Gap
71 description: "No user guide is published or referenced in the Security Insights data."
72 criteria-reference:
73 reference-id: OSPS
74 entries:
75 - reference-id: OSPS-DO-01
76 evidence:
77 - id: EV-DO-01
78 type: EvaluationLog
79 description: "PVTR evaluation results for documentation controls"
80 collected-at: "2025-08-22T16:02:00Z"
81 source:
82 reference-id: eval-log
83 entry-id: "assessment-do-01"
84 digest: "sha256:c4d5e6f7a8b9012cdef34567890abcdef1234567890abcdef1234567890abc123"
85 recommendations:
86 - id: REC-01
87 text: "Add user guide references to the Security Insights file and publish basic user documentation."
88 required: true
89
90 - id: AR-DO-02
91 title: "Vulnerability reporting channel not formalized"
92 type: Finding
93 description: "Private vulnerability reporting was not enabled prior to enforcement remediation."
94 criteria-reference:
95 reference-id: OSPS
96 entries:
97 - reference-id: OSPS-DO-02
98 evidence:
99 - id: EV-DO-02
100 type: EnforcementLog
101 description: "Enforcement actions taken for documentation failures"
102 collected-at: "2025-08-22T16:05:00Z"
103 recommendations:
104 - id: REC-02
105 text: "Formalize the private vulnerability reporting process and document it in SECURITY.md."
106
107 - id: AR-QA-01
108 title: "Dependency manifests present"
109 type: Observation
110 description: "Repository includes dependency manifests and the dependency graph is accessible via GitHub API."
111 criteria-reference:
112 reference-id: OSPS
113 entries:
114 - reference-id: OSPS-QA-02
115 evidence:
116 - id: EV-QA-01
117 type: api-response
118 description: "Dependency manifests from the GitHub dependency graph SBOM endpoint"
119 collected-at: "2026-02-10T15:05:00Z"
120 source:
121 reference-id: github-api
122 coordinate: "/repos/gemaraproj/gemara/dependency-graph/sbom"
123 digest: "sha256:a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890"