| name | import-legacy-ssp |
| description | Import a legacy SSP, PDF, DOCX, or Markdown package into a traceable OSCAL Document Workbench workspace using extraction, source mapping, Trestle bootstrap, and validation. |
| disable-model-invocation | true |
Import Legacy SSP
Run the end-to-end legacy SSP import workflow for Cursor.
Before you start
Read:
AGENTS.mdagent-skills/oscal-document-engineering/SKILL.mdagent-skills/compliance-trestle-engineering/SKILL.mdplugins/document-transform/oscal-document-workbench/commands/ingest-ssp.md
Steps
- Confirm source files and the target workspace path, usually
workspaces/<system>-ssp-import/.
- Copy source documents into
input/ without modifying originals.
- Extract source text and section structure:
bash plugins/document-transform/oscal-document-workbench/scripts/extract-legacy-doc.sh <input> --output <workspace>/extracted
- Bootstrap or reuse a Compliance Trestle workspace:
bash plugins/document-transform/oscal-document-workbench/scripts/bootstrap-trestle-workspace.sh <workspace> [--profile <name>]
- Map extracted content to OSCAL SSP fields with
source-map.csv traceability.
- Mark uncertain mappings as
needs_review; do not invent compliance facts.
- Build the review queue:
bash plugins/document-transform/oscal-document-workbench/scripts/build-review-queue.sh <workspace>/extracted/source-map.csv --output <workspace>/reports/review-queue.md
- Validate the package or document missing tools explicitly:
bash plugins/document-transform/oscal-document-workbench/scripts/validate-oscal-package.sh <workspace>/trestle-workspace --output <workspace>/reports/validation-report.json
- Produce:
reports/import-summary.mdreports/validation-report.jsonreports/unmapped-items.mdreports/review-queue.md
Synthetic example
bash examples/legacy-ssp-to-oscal/scripts/run-example.sh
Safety
- Do not commit real customer SSPs or sensitive evidence.
- Schema-valid OSCAL does not prove compliance effectiveness.
- Require human review for all
needs_review and unmapped rows before assessment use.
