Is your feature request related to a problem? 🤖
On main at b47d028, #Evidence is {id, type, collected-at, payload?, source?, description?} (auditlog.cue:82-100). Nothing records who or what produced the payload, as distinct from who collected it, and nothing records how it was obtained. A verbatim cloud API response and a summary of a conversation are the same shape.
OSCAL requires this: observation.methods is a required field on Observation. Because Gemara has no source for it, go-gemara's converter infers this — gemaraconv/assessment_results.go:222-224 defaults methods to ["EXAMINE"] and switches to ["TEST"] on a step-count condition.
Describe the solution you'd like
Add to #Evidence:
method? An evidence collection method,
collector?: #Actor (gathered it; when absent, the artifact's metadata.author is the collector).
Both optional and non-breaking.
Describe alternatives you've considered
Keep inferring method in the converter - rejected because it infers an OSCAL-required field from a step count assuming that all EvaluationLogs were created by the SDK which may not be true.
Success Criteria
#Evidence carries method and collector.gemaraconv can populate observation.methods from the artifact.make breaking-check is clean against the v1.5.0 baseline.
Additional context
Breakdown item 1 from the comment proposing this split on #488. Overlaps #485. The author/reviewer split mirrors CycloneDX. Closes the "how" and "by whom" half of #417, which resolved to "#Evidence with Provenance as a type" but only landed the "where" half (source: #EvidenceMapping).
Is your feature request related to a problem? 🤖
On
mainatb47d028,#Evidenceis{id, type, collected-at, payload?, source?, description?}(auditlog.cue:82-100). Nothing records who or what produced the payload, as distinct from who collected it, and nothing records how it was obtained. A verbatim cloud API response and a summary of a conversation are the same shape.OSCAL requires this:
observation.methodsis a required field on Observation. Because Gemara has no source for it,go-gemara's converter infers this —gemaraconv/assessment_results.go:222-224defaultsmethodsto["EXAMINE"]and switches to["TEST"]on a step-count condition.Describe the solution you'd like
Add to
#Evidence:method?An evidence collection method,collector?: #Actor(gathered it; when absent, the artifact'smetadata.authoris the collector).Both optional and non-breaking.
Describe alternatives you've considered
Keep inferring method in the converter - rejected because it infers an OSCAL-required field from a step count assuming that all EvaluationLogs were created by the SDK which may not be true.
Success Criteria
#Evidencecarriesmethodandcollector.gemaraconvcan populateobservation.methodsfrom the artifact.make breaking-checkis clean against the v1.5.0 baseline.Additional context
Breakdown item 1 from the comment proposing this split on #488. Overlaps #485. The author/reviewer split mirrors CycloneDX. Closes the "how" and "by whom" half of #417, which resolved to "
#Evidencewith Provenance as a type" but only landed the "where" half (source: #EvidenceMapping).