OSCAL Catalog/Profile import (and SSP export)

[topriko]

Problem / motivation

OSCAL (NIST's machine-readable control/assessment models) is becoming the interchange format for control catalogs, baselines, and SSPs, table-stakes for FedRAMP/gov work and increasingly for catalog sharing generally. Probo has no OSCAL support, so control catalogs move as PDFs/spreadsheets.

Proposed solution

Start small and standards-based, using github.com/defenseunicorns/go-oscal (generated Go structs no hand-rolled schema):

• Import OSCAL Catalog → framework (proboctl oscal import catalog file.json): a mapper from OSCAL controls/groups to Probo's framework+control rows, reusing the existing framework-import path (no schema change).
• Import Profile → baseline as a framework variant.
• Later: export an OSCAL SSP a read projection of controls + implementation narratives.