StackToIT Migration Intelligence Workspace

Evidence

The counts, versions and sources behind every statement in this workspace.

Where each unit leads to

Every unit leads from its source through its intent and its plan to the blocks of the draft and the checks over them. A stage that reads unsupported is not produced by this build (the blocks of that family are written by a generator that records them without an intent or a plan); one that reads not available is produced by this build and made nothing in this run; none means nothing applies at the stage, and the reason is in workspace.json (units[].refs). None of these is a finding of no risk. A unit whose evidence coverage is not traced has no evidence drawer.

• A unit id is its Terraform address: renaming a resource in the source is a new unit. Continuity of a unit across a rename is not built (a semantic fingerprint is a later item).
• An id names an object and holds no run: the same estate gives the same ids in every run. The JSON pointer into a file of the report is valid for the run named in header.run.
• A line is given only for a block of the draft that parses as HCL. A block the draft writes as a comment has a file and no line, and a block the report could not place has neither.
• A hop that reads UNSUPPORTED is not produced by this build; one that reads NOT_AVAILABLE is produced by this build and made nothing in this run. Neither is a finding of no risk.

The reverse table (which unit every block of the draft comes from, with its file and line) is evidence_index.targets in engineering/evidence-index.json; workspace.json states how many entries it has. A block written as a comment has a file and no line; no line is ever invented. A block that has a comment in the draft ends it with a # trace: TR-... line; the reverse table gives that id (trace_id, the anchor of the block's section) and its file (trace_file, engineering/trace/<draft file>.md, one for each file of the draft), the section holds the whole comment the generators wrote for the block, and engineering/trace-index.csv lists them all.

Findings that repeat on several units

41 finding records. 7 groups hold 31 of them: findings of the same check, severity, message and evidence on two or more units, shown once with every unit they concern. 10 are on one unit only. A group is a view: the records stay in assessment.json, a group has no status, and nothing in it is accepted. Findings that differ in wording or severity are never merged.

Identity transition

The direction from static long-lived secrets to short-lived workload identity is followed only where the evidence supports it. This table states the facts of the source and what stays open; it makes no statement about whether federation is an option for any workload. Privilege delta, break-glass access and human identity are not assessed for any row.

• Workload identity federation is not assessed as an option for any workload. A row states an OIDC issuer where the source names one, as a fact of the source, and never that federation can replace a key.
• A static credential is named only where the knowledge base reads a machine user with access keys on the unit. A scan that finds no key cannot say a workload has none, so the absence of a credential is never written.
• Privilege delta, break-glass access and human identity are not assessed for any row.
• A workload that names no identity in the source has no row, and a run whose draft held no identity intents lists only the units that are an identity themselves.
• The block states what the identity plan holds open. It does not attach, grant or federate anything.

The two ledgers

Two files in this report folder hold the rows behind the statements of this workspace as a spreadsheet. A row never states more than the assessment, the plans or the knowledge base state.

• assurance/equivalence-ledger.csv: the equivalence ledger, 201 rows, one per unit and semantic that the source states and one per unit and property for the properties the draft does not carry, no semantic accounts for or that are critical and still open.
• assurance/evidence-ledger.csv: the evidence ledger, 72 rows, one per document the other blocks cite, with the date it was checked and the date after which it is to be checked again. Evidence that states no such dates is undated, never current.

Limits of the equivalence ledger:

• Grain: one row per source unit and semantic of the assessment that the source states or may state (UNIT_SEMANTIC), plus one row per source unit and property for each of three lists the assessment names: properties the draft does not carry, properties no semantic accounts for, and critical properties still open (UNIT_PROPERTY). A property named by more than one list has one row per list. A row for every source property is not possible yet: the assessment does not record which properties a generator reads.
• Vocabulary v1: the disposition column prints the words the contracts and the property accounting use today. LEDGER means the contract hands the semantic to the semantic ledger of the draft; PRESERVED and TRANSFORMED appear only where the contract result or the draft's plan ledger states them.
• intent_id, target_capability and target_resource are stated only for a semantic that a family written from a plan (security groups, routing tables) carries through the plan's own ledger; for every other row they are not recorded.
• target_effective_behavior is NOT_ASSESSED on every row: the behaviour of the target is evidenced per field of a plan resource (units[].behavior_evidence), and a semantic is not a field.
• residual_risk, required_action and decision_id are stated only for a critical semantic that is open; they are the sentences and the record that the Decisions section already shows, quoted whole. A sentence that names a record internal to the product is not quoted, and its column is not recorded.
• invalidated_by names the inputs of the whole run (manifest.json invalidation) that, when they change, invalidate the row; no row has an invalidation of its own.
• evidence_refs name rows of evidence_ledger. Evidence that names a record internal to the product is not listed, and evidence that states no check date and no date to check it again is listed UNDATED, never CURRENT.
• 504 semantics of the contracts that the source does not state (it observed no) are not listed: the source has nothing there to carry. The kernel claims of assessment.json count them the same way (absent_claims).

Source: partly decided only at plan time. 5 unit(s) have a count/for_each that is not known statically; whether and how often they exist is decided at plan time