EPIC: Update Profile Resolution Specification

[david-waltermire]

Describe the bug

The OSCAL profile resolution specitication is out of date and needs to be updated.

There are a few additional issues that relate to this:

• Checking if the profile-resolution files provided take into account the merge/custom function (Checking if the profile-resolution files provided take into account the merge/custom function  #897)
• Profile: identifier specificity when multiple catalogs are imported (Profile: identifier specificity when multiple catalogs are imported #843)
• target examples in Profile Resolution selection and merge phase documentation (target examples in Profile Resolution selection and merge phase documentation #740)
• Profiles when resolved should show their provenance (Profiles when resolved should show their provenance #680)
• How to handle profile resolution title addition? (How to handle profile resolution title addition? #579)
• Tracking control identity via catalog of origin (Tracking control identity via catalog of origin #538)

Updates to the profile resolution specification must:

• Address the issues above.
• Provide clear processing narrative for a tool implementer focused on XML, JSON, and/or YAML.
• Be consistent with the current OSCAL models.
• Any changes and clarifications should be presented and reviewed during the OSCAL model review,

Who is the bug affecting?

Anyone implementing profile resolution.

What is affected by this bug?

The current specification is not completely accurate and will lead to improper implementations.

[ohsh6o]

Is this the issue where we should provide feedback on @stephenbanghart's excellent presentation today or elsewhere?

[stephenbanghart]

Responding to this issue to connect to PR #1017 . which intends to resolve these issues in addition to it's other goals. I've summarized inline below how the PR addresses (or does not address) these issues. For additional information please look thru the PR changes, and leave questions or comments on the PR discussion page.

• Checking if the profile-resolution files provided take into account the merge/custom function (Checking if the profile-resolution files provided take into account the merge/custom function #897)

  While the intended behavior has been clarified in the new version of the specification, this can only be fully resolved by updating our provided implementations and examples.

• Profile: identifier specificity when multiple catalogs are imported (Profile: identifier specificity when multiple catalogs are imported #843)

  Resolved by the new mapping feature (Found under the Import Section). Mapping allows for Profile authors to selectively change the IDs of incoming Controls (or other Objects), giving the author full control over Object Identity.

• target examples in Profile Resolution selection and merge phase documentation (target examples in Profile Resolution selection and merge phase documentation #740)

  Resolved by new prose and examples in the PR. New examples and test cases are also in the works if what is provided in the specification is insufficient to resolve.

• Profiles when resolved should show their provenance (Profiles when resolved should show their provenance #680)

  Resolved by new guidance in the specification for resolved Catalogs to contain metadata that links back to their source profile.

• How to handle profile resolution title addition? (How to handle profile resolution title addition? #579)

  Out of scope for the profile resolution specification. This issue relates to the model level definition of the Title element, and would not affect the resolution process.

• Tracking control identity via catalog of origin (Tracking control identity via catalog of origin #538)

  Also resolved by the new Mapping feature set. See Above.

Updates to the profile resolution specification must:

• Address the issues above.

• Provide clear processing narrative for a tool implementer focused on XML, JSON, and/or YAML.

• Be consistent with the current OSCAL models.

• Any changes and clarifications should be presented and reviewed during the OSCAL model review,>