One control inventory for a DoD CUI boundary. The five NDAA-driven regimes attach to it as crosswalk edges — not as five parallel compliance programs. The same pipeline that produces the assessment package also derives the SPRS score from assertion records and emits the OSCAL O1–O5 package with deterministic UUIDs.
Source · This runs the real tool out-of-process against the bundled synthetic fixtures. It contacts no real system and uses no credentials — by design.
ccp coverage, ccp sprs, ccp variance and ccp emit all against the stamped NOT REAL EVIDENCE fixture assertions. Everything below is the tool's own output — nothing is a recording, and the SPRS scorer refuses to call a fixture-derived number submittable.