TC360 · advisory mapping

Diagnose canonical mapping

TC Diagnose findings are advisory until a human confirms promotion. Check Write™ independently decides at runtime.

Registry source of truth

Governed mappings live in website/data/framework-library/mappings/diagnose-signal-control-mappings.v1.json. PHP resolves through framework-diagnose-mapping-lib.php (fdmap_*). TC360 consumes the same adapter via POST /api/v1/diagnose-mapping.

Mapping fields

  • mappingId, signalType, signalId
  • controlRefs (canonical uppercase operational control IDs)
  • requirementRefs, evidenceContractRefs
  • mappingVersion, mappingBasis, mappingStatus
  • domainApplicability (optional; governs context-aware resolution)
  • legacyControlAliases (compatibility only)

Mapping statuses

  • approved: visible in Diagnose; promotable after human confirmation.
  • proposed: suggested only; cannot be treated as enforced.
  • unresolved: no canonical controls guessed; promotion unavailable.

Domain / applicability resolution

Signals such as entity_join_gap resolve through domainApplicability in the registry (for example healthcare → PATIENT_CONTEXT_BINDING, EDA → DESIGN_REVISION_BINDING). Without a resolvable domain, the mapper returns unresolved rather than leaking cross-domain controls.

Human-confirmed promotion

Promotion stores canonical control IDs as primary identity in promoted_controls. Legacy snake-case aliases remain for runtime merge compatibility. Promotion is strengthen-only, versioned, attributed, and traced. Caller-provided mappingVersion or control refs that disagree with the registry are rejected.

Check Write™ independence

Runtime enforcement resolves Action Profiles, control packs, framework requirements, evidence contracts, and current evidence. A Diagnose recommendation alone cannot change an ALLOW, PAUSE, or BLOCK result.

TC Fix and fresh re-check

TC Fix prepares corrections; it is not authorization. After correction readiness, a fresh Check Write™ call produces a new decisionId linked in Trace.

Trace correlation

Trace records connect Diagnose assessment and gap ID, mapping version and provenance, human confirmation, Action Profile, original and fresh Check Write™ decision IDs, and TC Fix remediation class. Metadata only; no secrets or PHI payloads.

API

POST /api/v1/diagnose-mapping
Content-Type: application/json

{
  "gaps": [{"gapId": "g1", "gapType": "permission_overreach", "title": "..."}],
  "dimensions": {"semantic": {"score": 20}},
  "domain": "banking"
}

Response includes enriched gaps[], dimensionMappings, and aggregate canonicalMapping. All fields are advisory (advisoryOnly: true) until promotion.