fix(evidence): per-rule OSCAL export + unmapped-rule conformance fix

[remyluslosius]

Context

The OpenWatch team asked: OSCAL is a whole-scan document (one AR per host), but Evidence is per-rule — how should the OSCAL option work in the per-rule UI expansion?

Investigating it surfaced a real conformance bug at exactly that granularity, plus the answer.

The design answer

• CheckEvidence is the per-rule primitive — that's what a per-rule expansion should render.
• OSCAL AR is a whole-document artifact, but the exporter is granularity-agnostic: a one-outcome ScanResult yields a valid one-finding AR. So "per-rule OSCAL" is the same exporter fed a single-rule slice — no separate serializer.

This PR makes that first-class and fixes what was blocking it.

The bug (found via the question)

reviewed-controls is required on every OSCAL result, and a control-selection must select include-all or a non-empty include-controls (minItems 1). The exporter emitted an empty include-controls when a result had no framework-mapped control. A whole-host scan never hits this (some corpus rule is always mapped) — but a single-rule document for an unmapped rule produces invalid OSCAL, which is precisely the per-rule-expansion case.

Fix: a shared controlSelection helper falls back to OSCAL include-all when there are no control refs — applied to both ExportOSCALScan (scan) and ExportOSCAL (remediation) paths.

Per-rule entry point

pkg/kensa.ExportOSCALOutcome(scan, outcome, hostname) / WriteOSCALOutcome render a single api.RuleOutcome as its own valid one-finding AR, preserving the parent scan's host context (HostID/Capabilities/Platform) so the caller doesn't hand-roll the slice and drop it. Thin wrapper over the granularity-agnostic exporter, not a second implementation.

// per-rule expansion → OSCAL for just that rule
doc, _ := kensa.ExportOSCALOutcome(scan, scan.Outcomes[i], scan.HostID)
// whole host → unchanged
doc, _ := kensa.ExportOSCALScan(scan, scan.HostID)

Tests / spec

• Regression: unmapped single-rule validates against OSCAL 1.0.6 (both the scan path and the public helper)
• evidence-oscal-scan C-08/AC-09 (include-all fallback); oscal-public-export AC-06/AC-07 (per-rule helper)

Gate

go test ./... green · golangci-lint 0 · specter 118/118 (evidence-oscal-scan 9/9, oscal-public-export 7/7). No engine/capture/rollback touched.

Recommendation to OpenWatch

Show CheckEvidence in the per-rule expansion (it's the right primitive); offer OSCAL as an export action that calls ExportOSCALOutcome for one rule or ExportOSCALScan for the whole host. Both yield valid OSCAL 1.0.6 now, including unmapped rules.

🤖 Generated with Claude Code