ADR-0062.

Status: accepted 2026-08-27 Date: 2026-08-27 Closes: the open decision recorded in RWD-2026-0072.

Context

The 2026-08-26 audit found that nothing checked the SARIF runward emits. test/fixtures/ vendors a NIST OSCAL schema and an in-toto schema, and each emission is validated against its own; the SARIF had no net at all. The auditor ran the missing one by hand — 22 mission states against the official OASIS schema, all valid — so the emitter is well formed today, and nothing would have said if it stopped being.

A structural net shipped the same day (test/sarif-shape.js) and was recorded as not being schema validation, because it is not: it checks the invariants a consumer relies on, not conformance. Claiming otherwise would have been the exact overstatement the audit spent itself correcting.

The obstacle was mechanical. The OASIS SARIF 2.1.0 schema is draft-04; ajv 8 dropped draft-04 (id rather than $id, boolean exclusiveMinimum) and refuses to compile it. Full validation needs ajv-draft-04. On a project that ships an attested CycloneDX SBOM on every release, adding a dependency is not a detail, so it was left as an operator decision rather than taken silently.

Decision

Add ajv-draft-04 as a dev dependency and validate the emitted SARIF against the vendored official OASIS schema, on four mission states.

What makes the trade a small one, checked rather than assumed:

• Same maintainer, already trusted here. ajv-draft-04 is published by the ajv-validator organisation — the same one that publishes ajv and ajv-formats, both already dev dependencies of this project. The marginal trust surface is one package from a maintainer whose code already runs in this test suite.
• Dev-only, never shipped. It appears in devDependencies; the published package's runtime dependencies remain @inquirer/prompts, chalk, commander.
• Offline. The schema is vendored at test/fixtures/sarif_schema.v2.1.0.json with its source URL, vendoring date, $id and sha256 recorded in test/fixtures/README.md, exactly as the OSCAL and in-toto schemas are. The network-isolated CI leg is unaffected.
• It detects. Verified before adoption, not after: the real emission validates; a wrong version, a missing runs, and a level outside the SARIF enumeration are each refused.

The structural checks stay, and are not redundant. A schema cannot say that an artifactLocation.uri RESOLVES in the checkout — RWD-2026-0041 shipped uris that no checkout held, and every one of them was schema-valid. Nor that two runs on an unchanged tree are byte-identical. Conformance and truthfulness are different questions; this file now asks both.

Consequences

• Positive. The three emissions with a published schema are now each held to it. The gap the audit named is closed as a gap rather than narrated as a limitation.
• Negative. One more dev dependency, and one more vendored third-party artifact to refresh when OASIS revises the schema. The refresh procedure is in test/fixtures/README.md beside the others.
• Accepted. A schema is a floor, not a proof: a document can be perfectly conformant and still say something false about the tree. That is why the structural half exists.

Reevaluation trigger

Trigger set on: 2027-02-27.

The decision is wrong and must be revisited if: ajv-draft-04 stops being maintained by the ajv-validator organisation (the whole basis of the trade); or OASIS publishes a SARIF revision in a draft ajv supports natively, which would make the dependency removable; or the vendored schema starts refusing an emission that consumers accept, which would mean the schema, not the emitter, is the thing out of date.

Watched via: test/sarif-shape.js, .github/dependabot.yml, and the SBOM drift job.