{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_0a32e8628925b3c4116d75c0af192f5e50088bff5447f61d25ac5b5e9cbb95aa","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_0a32e8628925b3c4116d75c0af192f5e50088bff5447f61d25ac5b5e9cbb95aa","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"3ece88624bceaf424998136c20256c5460af6b3cb3533ebd7e5cdb3a75dc9859","published":"Tue, 14 Jul 2026 00:00:00 -0400","receipt_hash":"3ece88624bceaf424998136c20256c5460af6b3cb3533ebd7e5cdb3a75dc9859","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"3ece88624bceaf424998136c20256c5460af6b3cb3533ebd7e5cdb3a75dc9859","observed_at":"2026-07-14T04:43:37.834979Z","parent_run_hash":"66b89520a448b8d9fe7d8f602ef38b82b6c95e57f532ce72de51375b41870477","published":"Tue, 14 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2607.08292v1 Announce Type: cross \nAbstract: The NIS-2 Directive increases the need for continuous, auditable compliance evidence and motivates a shift from document-based compliance toward machine-readable compliance artifacts. The Open Security Controls Assessment Language (OSCAL) is a standard for this purpose, which the German Federal Office for Information Security (BSI) is adapting with Grundschutz++. However, companies are still managing extensive legacy IT security concepts (IT-SCs), and migrating them without verification could transfer outdated assets into the new format. While existing research primarily addresses the generation of new concepts, there is a lack of a verification framework that extracts legacy IT-SCs into an auditable intermediate representation, deterministically compares the extracted graph with an independently constructed reference state, and exports schema-valid OSCAL artifacts.\n  This paper introduces the Automated Security Concept Structure Extra","title":"Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts","url":"https://arxiv.org/abs/2607.08292","vendor":"arxiv_cs_ai"},"summary":"arXiv:2607.08292v1 Announce Type: cross \nAbstract: The NIS-2 Directive increases the need for continuous, auditable compliance evidence and motivates a shift from document-based compliance toward machine-readable compliance artifacts. The Open Security Controls Assessment Language (OSCAL) is a standard for this purpose, which the German Federal Office for Information Security (BSI) is adapting with Grundschutz++. However, companies are still managing extensive legacy IT security concepts (IT-SCs), and migrating them without verification could transfer outdated assets into the new format. While existing research primarily addresses the generation of new concepts, there is a lack of a verification framework that extracts legacy IT-SCs into an auditable intermediate representation, deterministically compares the extracted graph with an independently constructed reference state, and exports schema-valid OSCAL artifacts.\n  This paper introduces the Automated Security Concept Structure Extra","title":"Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-14T04:43:37Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2607.08292"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:9d8d8039eb81a7380af6f1f6370e2dbd8cb269bb9947ea3fe53c89c593c547223aeb8c434b08eb216218c7017897871fe3eef3728c87839c901a8a8de3470005","signer":"crovia.substrate","subject":{"observed_at":"2026-07-14T04:43:37Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2607.08292"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"a3db05d2f5b39058f83cfcd085bdab584e437ce8d55aed9abe3e7b465776c29a","leaf_index":312896,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"c82b932c8e490979e7c3114cd4447127b9329cc133974ca56c980a79dcf57324","side":"right"},{"sibling":"46d1cf31d75ccb2b41b00d13114769491439e92b1262d43e6a83a0cb80dc491f","side":"right"},{"sibling":"11d6afab2e9a9e4572fe691688a31025f43a1641fe33d1b08bfbed5382ac4de9","side":"right"},{"sibling":"c1ea31625ec786e4b967d82636d5f151930f123f04afa63cd614b0ec13742c78","side":"right"},{"sibling":"934dcfbc9d7e52489b7eb56b5845ca7a68ff1130b70aa93381e81333befc34fd","side":"right"},{"sibling":"b55341db964dff97d1f0bdf958511d9a0a5ebb763bd4091e5e5b0920e5f1b249","side":"right"},{"sibling":"fccac03eef6676a6350a95afcd277425f87c0fc8ca6ed34e68a7f13c01eec848","side":"left"},{"sibling":"b6420221ab220053217910d6a61ccf0d6e8ca1f1eb9e0cc40a25723c21042168","side":"right"},{"sibling":"ca17e703a3fca19bfbb090cbed9e2450594a9c237665dd9a566195d3ef3072f7","side":"right"},{"sibling":"8393dc03644000353c5d503b6ec261c022cd2aa85a649223916153bc8af2dc75","side":"left"},{"sibling":"1627ce6908965f2e5fbc7c16bc8e247867478c587014561d0de1359dc2dc0afc","side":"left"},{"sibling":"74e1ba9fd48bdd0f52777dd5b56c10706e73f42629013748eca13ef113cd59db","side":"right"},{"sibling":"682fd39539db5bce908d0ab6f180374728fed6b34a9a8c87c7b4eb5a726e30b8","side":"right"},{"sibling":"184927f71d667ac0c6ebeadb33394626973738b9107c6dc3c0c4949b44acf295","side":"right"},{"sibling":"f302542c38ba7c3aab7c9280dd60259ecec777dca6e6f71b6f0729b0b8791b72","side":"left"},{"sibling":"d8b9143917b539c543cf4448cec00131f8b807bd8004979c54ebe09798748c66","side":"left"},{"sibling":"c4c189d79669979b59d9aa976ee249c54a7e065b4a05bf49463459cc7f37428e","side":"right"},{"sibling":"19475e206bdf2698769a286db2c97c4d3f089741319f9b29a139038c6e511975","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":313381,"merkle_root":"5f7d48580373d0ab0bc6bdf34f26de442f9a86d130946f7ee45addd1a55cb9f4","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260714T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-14T05:38:23Z","sig_algorithm":"ed25519","signature":"97364224142ed1b2a8925fed1bfba2e0a8a6a15f8ca0999b934846ad83584a78c7f0f5cd09dbc1c938b35383fcc5c8fa4b723118e30916628879d1c5fd3a9908","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_0a32e8628925b3c4116d75c0af192f5e50088bff5447f61d25ac5b5e9cbb95aa"}}