The compliance package a machine can refuse

Before you start

Module 10's crosswalk was a table a human reads; this workspace holds the same idea as documents a machine can refuse. It is staged exactly as `bash labs/setup.sh ./lab12` leaves it: a minimal OSCAL catalog (the spine as data), a profile that selects from it, a component-definition that links control `ac-2` to the Module-09 policy that enforces it, a deliberately broken catalog, and the validator's own source. The "Run validator" button IS the pipeline's validate step — it runs the committed `validate-oscal.ts` logic, verified byte-for-byte in CI against real `bun` runs of that script, so every verdict and exit code you see here is the one a real machine produces. The pipeline reads the catalog at a fixed path, `lab12/catalog-under-validation.json` — seeded with your good catalog, exactly like a CI checkout — while the pristine fixtures stay untouched beside it. One more thing to notice while you trace: the spine also defines `sc-28`, protection of information at rest — the laptop-encryption claim this curriculum keeps re-asking — and this SOC 2 profile doesn't select it. Selection is a decision, and now it's data.