EU Schema and Taxonomy Assets
This directory holds the local manifest and the license-approved, locally vendored copies of the EU compliance schemas and taxonomies that Stella Ops uses for offline regulatory validation. Stella Ops is offline/air-gap-first, so every schema a runtime or test depends on is pinned and served from disk — never fetched from an upstream standards body at execution time.
Audience: maintainers vendoring or validating EU compliance assets (CRA, DORA, NIS2) and contributors wiring schema validation into Stella Ops services.
Layout
| Path | Contents |
|---|---|
eu-schema-taxonomy-assets-v1.yaml | Authoritative local manifest (asset IDs, sources, hashes, intake status). |
csaf/2.0/ | OASIS CSAF 2.0 JSON Schema package plus the FIRST CVSS transitive schemas required for local CSAF score validation (present). |
dora/incident/eba-reporting-framework-4.3/ | DORA major-incident technical taxonomy intake (BLOCKED — awaiting approved EBA package). |
dora/roi/eba-reporting-framework-4.0/ | DORA Register of Information (RoI) taxonomy package (present). |
The pin inventory that tracks every asset’s source, version, and review status lives at docs/europe/schema-taxonomy-pin-inventory.md.
Intake rules
- The manifest is the source of truth. Each asset records its source URLs, vendored file hashes, byte counts, and intake status.
- A
BLOCKED-pending-approved-asset-intakeentry must stay blocked until the named owner records the license review, package source, file hashes, and the runtime/offline copy strategy. - Runtime and tests must consume local files only. They must not fetch from OASIS, EBA, ENISA, IEC, ETSI, ISO, or any other external source at execution time.