Map evidence to NIST 800-171

# Decosa CMMC / NIST 800-171 evidence map: use the hosted API (synthetic sets only)

You are wiring Decosa's CMMC evidence map into this project. It takes a contractor's SSP statements and evidence
artefacts (policies, config exports, logs, records, scans, and on the hosted API only the bundled sample screenshot and
test run) and, for each NIST SP 800-171 Rev 2 requirement and each NIST SP 800-171A objective, says evidence present,
partial or missing, with the lines quoted and the artefact checks (draft, stale, undated, out of scope). It returns a
Markdown gap map, a draft POA&M with the 32 CFR 170.21 eligibility of each row, an evidence index with every artefact's
SHA-256 and a record signed by the server, with a signed receipt for every model call. Use only what is listed below.
If you need something else, stop and ask me.

- Base URL: `https://api.decosa.ai`
- Health check: `GET https://api.decosa.ai/healthz`.
- **The hosted API takes synthetic sets only.** An SSP and its evidence are often CUI, which must not go to a hosted API.
  Every request must carry `"synthetic": true` (HTTP 422 otherwise); text with CUI banner or portion markings, a CUI
  designation block or a distribution statement B-F is refused with 422 before any model call; screenshots are accepted
  only when they are the bundled sample images. Real SSPs belong on a self-hosted box (see the self-host prompt).
- It is an evidence-gap map, not an assessment, a certification or a score. Never show its output as "MET", "compliant"
  or as an SPRS score. Fields such as `certify`, `score` or `affirm` in a request get HTTP 400. Show gaps first.

## Auth: API key (or a demo session)
1. Preferred: an API key (`dk_…`) from "Get an API key" on the tool page. Keep it in `DECOSA_API_KEY`, never in
   code. Send `Authorization: Bearer $DECOSA_API_KEY`.
2. Without a key: `POST https://api.decosa.ai/demo/session` with `{"vertical": "cmmc-evidence-map"}` returns `{"token", "expires_at", "budget"}`.
   Sessions per IP are limited; over a limit you get HTTP 429 with `Retry-After`.
3. A map needs about 700 generated tokens of budget per requirement plus about 370 per objective and 700 per screenshot (402 otherwise; the budget check uses these ceilings, actual use is lower). One
   map at a time per demo token (409 while one is going). Up to 12 requirements per run.

## Endpoints
- `POST /cmmc/map` (token). Body:
  ```json
  {"system": {"name": "Example CUI enclave", "assessment_date": "2026-09-15", "scope": ["ex-fs01", "ex-wks*"]},
   "ssp": {"statements": [{"requirement": "3.1.8", "status": "implemented", "text": "...", "artefacts": ["A1"]}]},
   "artefacts": [{"id": "A1", "title": "Account lockout settings export", "kind": "config", "date": "2026-08-30",
                  "system": "ex-fs01", "status": "final", "text": "..."}],
   "requirements": ["3.1.8"], "synthetic": true, "stream": false}
  ```
  `kind`: policy, procedure, config, log, screenshot, scan, record, inventory, test_run, other. `ssp` may instead be
  `{"text": "..."}` (the SSP pasted as text, split on requirement ids such as `3.1.8` or `AC.L2-3.1.8`). Up to 30
  artefacts (20,000 characters each, 120,000 in total). `{"sample": "harbor-precision"}` runs a built-in sample.
- JSON answer: `{status: gaps | no_gaps_in_evidence, summary, counts, requirements: [{id, cmmc_id, points, poam:
  {eligible, rule, why}, ssp, notes, status: present | partial | missing | not_applicable, objectives: [{id, text, status,
  reason, issues, quotes: [{line, artefact, text, transcribed, issues}], typed, grounding}]}], poam: {note, rows},
  evidence_index: [{id, sha256, issues, certificate?, cited_for, counted_for}], estimate: {shown: false, why}, receipts,
  gap_map_md, record}`.
- SSE: send `Accept: text/event-stream` (or `"stream": true`): `ready`, `receipt`, `artefacts`, `requirement` (one per
  requirement), `report`, `budget`, `done`.
- `POST /cmmc/check` (no token, no model): the same body → the artefact checks and the CUI guard only.
- `GET /cmmc/catalog?requirement=3.10.3` or `?family=PE` (no token): requirements, objectives, points, POA&M rules.
- `POST /record/verify` (no token): the `record` → `{ok, checks, summary}`.
- `GET /cmmc/info`, `GET /cmmc/samples` (no token): the rules, the catalog's sources, limits and three samples.

## Errors
400 bad input (the message names the field or limit, or refuses a certify or score field), 401/403 token, 402 budget,
409 a map already going on this demo token, 413 body over 8 MB, 422 not synthetic, marked CUI or a screenshot that is
not a sample, 429 busy (`Retry-After`).

On request. The container images and the compose file aren’t public yet. Ask for self-host access and Decosa sends the registry (DECOSA_REGISTRY) and the compose file’s URL (DECOSA_COMPOSE_URL) these steps use. They are the steps we tested end to end on a fresh machine.

# Decosa CMMC / NIST 800-171 evidence map: run it yourself (containers)

You are setting up the Decosa CMMC evidence map on this machine, so the SSP and its evidence (often CUI) never leave it.
For each NIST SP 800-171 Rev 2 requirement and NIST SP 800-171A objective it says evidence present, partial or missing,
with the lines quoted from the artefacts, flags artefacts that cannot count, drafts a POA&M with the 32 CFR 170.21
eligibility of each row, and signs an evidence index with every artefact's SHA-256. Nothing is sent to Decosa's hosted
API. It is an evidence-gap map, not an assessment or a score: an assessor decides MET, the senior official affirms.

Status: the container images (${DECOSA_REGISTRY}/decosa-*) and the compose file are on request while self-host is in early access (not on a public registry yet): ask at https://decosa.ai/contact?topic=self-host, and Decosa sends the registry as DECOSA_REGISTRY, the compose file URL as DECOSA_COMPOSE_URL, and pull access. If a pull fails with
"not found", "denied" or "unauthorized", stop and tell me. Do not substitute other images.

Ask me before any command that needs sudo, and show me the command first.

## Step 0: set up with a coding agent, rehearse on mock data, then go private

This prompt is for a coding agent running on the machine that will host the service. We recommend Claude Code with
Claude Opus 5.5; any capable coding agent works. Work in this order:

1. Set up on mock data only. During the whole setup you (the agent) work with the synthetic sample bundle below and
   nothing else. Do not ask me for real data, and do not open, read, list or copy files that hold real data, even to
   "test with something realistic".
2. Rehearse. When the steps below are done and the service is healthy, fetch the mock-data bundle for this tool,
   https://decosa.ai/samples/cmmc-evidence-map.zip (66 KB, 21 checks, synthetic or openly licensed: see `licence` in expected.json),
   show me what is in it, and run the rehearsal against the local API:
   `docker compose exec api python scripts/rehearse.py cmmc-evidence-map` (the api image carries the same bundle under /app/rehearsal/cmmc-evidence-map/;
   with no key set, the script asks the local API for a short demo token). From a decosa-api checkout instead:
   `python scripts/rehearse.py cmmc-evidence-map --bundle cmmc-evidence-map.zip --base-url http://127.0.0.1:<PORT>`.
   It sends the mock inputs to the local API and prints PASS or FAIL for each expected property (for example: "encryption is only planned in the SSP, so 3.13.11 has no evidence", "3.1.8 has a planted gap, so it is not fully evidenced", "3.3.1 has a planted gap, so it is not fully evidenced"). Show me
   the full output. Every check must pass. If one fails, fix the install and run it again; never edit `expected.json`
   to make a check pass.
3. Stop there. Once the rehearsal passes, tell me, and I will run my own data against the local API myself, on this
   machine.

For the person running this: a coding agent that runs in the cloud sees everything in its context, including files it
reads, command output and anything pasted into the chat. Keep real data out of the chat and out of anything the agent
can read. Switch to your own data only after the rehearsal has passed and the agent's work is done.

## Steps
1. Docker: if `docker compose version` fails, install Docker Engine and the compose plugin using Docker's official
   instructions for this distribution (docs.docker.com/engine/install). Install the NVIDIA container toolkit and check
   `docker run --rm --gpus all nvidia/cuda:12.8.0-base-ubuntu24.04 nvidia-smi`.
2. Fetch the compose file:
   `mkdir -p ~/decosa && cd ~/decosa && curl -fsSL "${DECOSA_COMPOSE_URL}" -o compose.yaml`
   Read it. Keep the `llm` service (Qwen3.8-27B on vLLM, with prefix caching on) and the `api` service. For the `api`
   service set `DECOSA_LLM_ROUTE=direct`, `DECOSA_LLM_URL=http://llm:8000/v1`, `DECOSA_LLM_MODEL=qwen3.8-27b`,
   `DECOSA_CMMC_SYNTHETIC_ONLY=0` (so this box accepts real SSPs), `DECOSA_CMMC_MAX_REQUIREMENTS=110`, and bind every
   port to 127.0.0.1. In real-data mode the api refuses to map (503) if model calls would go to a hosted endpoint; never
   set the gateway route on this box.
3. Pull and start: `docker compose pull && docker compose up -d`. Wait for the `llm` health check (the first start
   downloads about 20 GB of weights).
4. Check: `curl -fsS http://127.0.0.1:<PORT>/cmmc/info` shows `data_rule.synthetic_only: false`,
   `data_rule.real_data_ready: true` and 320 objectives; `GET /attest/signing-key` shows this box's public key. Show me
   the key: it is what an assessor pins to verify my evidence index.
5. Smoke test: get a token with `POST /demo/session {"vertical":"cmmc-evidence-map"}` and send
   `{"sample": "harbor-precision", "synthetic": true}` to `POST /cmmc/map`. Expect 3.13.11 missing (planned in the SSP),
   none of 3.1.8, 3.3.1, 3.5.3, 3.5.7, 3.10.3 or 3.14.2 fully evidenced, artefacts A4 stale, A5 draft and A9 out of
   scope, the test run T1 verified, the screenshot S1 transcribed, the POA&M row for 3.10.3 marked "never on a POA&M"
   and no estimate. Send the record to `POST /record/verify`: `ok` must be true.
6. Report back: the public key, the counts, the gaps with their reasons, and how long it took.

Off by default. Joining as a provider serves other people's requests on this GPU; never do it on a box that holds CUI.
If I ask for it later, follow the Provide page instead of improvising.

No NVIDIA GPU? This tool also runs entirely on an Apple Silicon Mac (MLX, 32 GB of unified memory or more): use https://decosa.ai/prompts/cmmc-evidence-map-mac.md instead.