set-parameter in the context of an SSP is ambiguously defined

[GaryGapinski]

Describe the bug

The "correct" use of set-parameter is inadequately defined.

Who is the bug affecting?

OSCAL implementation authors.

What is affected by this bug?

Ambiguity has an adverse effect on the fidelity of OSCAL implementations.

When does this occur?

As of the time of this issue creation, It is a contemporary affliction.

How do we replicate the issue?

By use of examples.

If applicable, add screenshots to help explain your problem.}

Expected behavior (i.e. solution)

Apodictic certitude regarding interpretation of set-parameter.

Other Comments

Examples will follow.

[GaryGapinski]

Simple example:

<?xml version="1.0" encoding="UTF-8"?>
<?xml-model schematypens="http://www.w3.org/2001/XMLSchema" title="OSCAL complete schema" href="https://raw.githubusercontent.com/usnistgov/OSCAL/v1.0.2/xml/schema/oscal_complete_schema.xsd" ?>
<system-security-plan
    uuid="9c81479b-1704-492f-ad51-27a2428fd249"
    xmlns="http://csrc.nist.gov/ns/oscal/1.0">
    <metadata>
        <title>Example</title>
        <last-modified>2022-04-15T04:47:32Z</last-modified>
        <version>latest</version>
        <oscal-version>1.0.2</oscal-version>
    </metadata>
    <import-profile
        href="#" />
    <system-characteristics>
        <system-id>Example</system-id>
        <system-name>Example</system-name>
        <description>
            <p>Example</p>
        </description>
        <security-sensitivity-level>triple secret</security-sensitivity-level>
        <system-information>
            <information-type>
                <title />
                <description />
                <confidentiality-impact>
                    <base>trivial</base>
                </confidentiality-impact>
                <integrity-impact>
                    <base>worrysome</base>
                </integrity-impact>
                <availability-impact>
                    <base>grave</base>
                </availability-impact>
            </information-type>
        </system-information>
        <security-impact-level>
            <security-objective-confidentiality>caution</security-objective-confidentiality>
            <security-objective-integrity>deliberation</security-objective-integrity>
            <security-objective-availability>obfuscation</security-objective-availability>
        </security-impact-level>
        <status
            state="nascent" />
        <authorization-boundary>
            <description />
        </authorization-boundary>
    </system-characteristics>
    <system-implementation>
        <user
            uuid="754b76e2-9ef7-4a17-8357-0ae819d8dd6a" />
        <component
            type="component"
            uuid="ccf5986f-89f8-4427-8492-a794f614c1e1">
            <title />
            <description />
            <status
                state="comfortable" />
        </component>
    </system-implementation>
    <control-implementation>
        <!-- 
            https://pages.nist.gov/OSCAL/reference/latest/system-security-plan/xml-reference/#/system-security-plan/control-implementation/set-parameter
            does not levy any constraints on set-parameter
        -->
        <description />
        <set-parameter
            param-id="one">
            <value>V1</value>
        </set-parameter>
        <implemented-requirement
            control-id="C1"
            uuid="3903fcca-e3a8-4141-bc37-7a014d82cb20">
            <!-- 
                https://pages.nist.gov/OSCAL/reference/latest/system-security-plan/xml-reference/#/system-security-plan/control-implementation/implemented-requirement
                asserts "for set-parameter: any target value must be unique (i.e., occur only once)"
                without specifying the scope of uniqueness
                i.e., 
                implemented-requirement, 
                implemented-requirement/descendant:set-parameter, 
                /system-security-plan/control-implementation/implemented-requirement/set-parameter, 
                /system-security-plan/control-implementation/implemented-requirement/statement/by-component/set-parameter,
                etc.
            -->
            <set-parameter
                param-id="one">
                <value>V1</value>
            </set-parameter>
            <statement
                statement-id="S1"
                uuid="a6ca6c29-ae75-4071-aa7b-0fd3fa652d81">
                <by-component
                    component-uuid="ccf5986f-89f8-4427-8492-a794f614c1e1"
                    uuid="4200da40-5af1-468e-b186-37eef596d834">
                    <description />
                    <!-- 
                        https://pages.nist.gov/OSCAL/reference/latest/system-security-plan/xml-reference/#/system-security-plan/control-implementation/implemented-requirement/by-component/set-parameter
                        does not levy any constraints on set-parameter
                    -->
                    <set-parameter
                        param-id="one">
                        <value>V1</value>
                    </set-parameter>
                </by-component>
            </statement>
        </implemented-requirement>
    </control-implementation>
</system-security-plan>