clean_profile.text.out

model: profile

UNVERIFIABLE PATTERN_NOT_CHECKED  at=/profile
    TokenDatatype = 3 value(s)
    3 value(s) declared as TokenDatatype were not checked against its pattern ^(\p{L}|_)(\p{L}|\p{N}|[.\-_])*$ , because that pattern uses regular-expression syntax this tool cannot compile. They are neither passed nor failed.
    rule: oscal-validate policy: the schema declares a regular expression this tool cannot compile, because JSON Schema patterns are ECMA-262 regular expressions and Python's re module does not implement the Unicode property escapes ECMA-262 allows. Values governed by such a pattern are reported as unchecked rather than approximated with a hand-written substitute, which would be a rule encoded from memory.
    source: README.md (Limits) (retrieved -)

UNVERIFIABLE CONSTRAINT_NOT_EVALUATED  at=/profile
    allowed-values = 200 constraint(s)
    NIST publishes 200 allowed-values constraint(s) that this tool did not evaluate: most allowed-value sets declare allow-other, so a value outside them is not necessarily a violation. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.
    rule: oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.
    source: README.md (Limits) (retrieved -)

UNVERIFIABLE CONSTRAINT_NOT_EVALUATED  at=/profile
    expect = 12 constraint(s)
    NIST publishes 12 expect constraint(s) that this tool did not evaluate: the test is a Metapath expression, which this tool does not implement. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.
    rule: oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.
    source: README.md (Limits) (retrieved -)

UNVERIFIABLE CONSTRAINT_NOT_EVALUATED  at=/profile
    index = 1 constraint(s)
    NIST publishes 1 index constraint(s) that this tool did not evaluate: their target expressions are outside the Metapath subset this tool parses. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.
    rule: oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.
    source: README.md (Limits) (retrieved -)

UNVERIFIABLE CONSTRAINT_NOT_EVALUATED  at=/profile
    matches = 25 constraint(s)
    NIST publishes 25 matches constraint(s) that this tool did not evaluate: the value constraint is applied through Metapath datatype coercion. They are neither passed nor failed. Every one of them is listed, with its reason, in docs/CONSTRAINT-COVERAGE.md.
    rule: oscal-validate policy: where the published schema combines alternatives in a form this tool does not resolve, the subtree is left unread and reported. An unread subtree is not a clean one, and the two are never merged in the output.
    source: README.md (Limits) (retrieved -)

INFO         IMPORT_NOT_SUPPLIED  at=/profile/imports/0/href
    href = clean_catalog.json
    No document with this file name was supplied. Identifiers it declares are outside the effective data model this run could see, so references into it are reported UNVERIFIABLE rather than as failures. Pass it with --resolve to settle them.
    rule: NIST, "URI Usage", section Linking to another OSCAL object (page last updated 2025-03-03): a reference "uses a relative reference consisting of only a URI fragment containing the identifier or UUID of the referenced object within the current documents effective data model. The effective data model of a document includes all objects identified with the document and any directly or transitively imported documents."
    source: https://pages.nist.gov/OSCAL/learn/concepts/uri-use/ (retrieved 2026-08-14)

UNVERIFIABLE REFERENCE_UNVERIFIABLE  at=/profile/imports/0/include-controls/0/with-ids/0
    with-ids = ex-1
    This names a control in an imported control set, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (clean_catalog.json), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.
    rule: NIST, "Identifier Use and UUIDs", section Scope (page last updated 2025-06-10): "since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references." Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.
    source: https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/ (retrieved 2026-08-14)

UNVERIFIABLE REFERENCE_UNVERIFIABLE  at=/profile/imports/0/include-controls/0/with-ids/1
    with-ids = ex-2
    This names a control in an imported control set, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (clean_catalog.json), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.
    rule: NIST, "Identifier Use and UUIDs", section Scope (page last updated 2025-06-10): "since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references." Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.
    source: https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/ (retrieved 2026-08-14)

UNVERIFIABLE REFERENCE_UNVERIFIABLE  at=/profile/modify/set-parameters/0/param-id
    param-id = ex-1_prm_1
    This names a parameter, and no such identifier is declared in the documents supplied. 1 imported document(s) named by this document were not supplied (clean_catalog.json), so the effective data model is incomplete. Supply the imported document with --resolve to settle this.
    rule: NIST, "Identifier Use and UUIDs", section Scope (page last updated 2025-06-10): "since OSCAL supports composition relationships, there are many cases where identifiers in a source OSCAL instance need to be referenced from other OSCAL instances. These are considered cross-instance scoped identifier references." Where an imported document has not been supplied to this tool, a reference that does not resolve locally may be perfectly valid, and nothing here can settle it.
    source: https://pages.nist.gov/OSCAL/learn/concepts/identifier-use/ (retrieved 2026-08-14)

9 finding(s): 0 ERROR, 0 WARNING, 1 INFO, 8 UNVERIFIABLE

[exit 0]