# Compliance Trestle Engineering

> Use Compliance Trestle to manage OSCAL catalogs, profiles, component definitions, SSPs, markdown assembly, validation, and source-traceable updates from legacy compliance documents.

- Skill: `oscal-compass-lab/compliance-trestle-engineering` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add oscal-compass-lab/compliance-trestle-engineering`
- Raw SKILL.md: https://api.skillmd.com/api/skills/oscal-compass-lab/compliance-trestle-engineering/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: oscal-compass-lab (https://skillmd.com/u/oscal-compass-lab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/oscal-compass-lab/compliance-trestle-engineering

---


# Compliance Trestle Engineering

Use this skill when an agent must operate a Compliance Trestle workspace.
Use it to import or validate OSCAL models, assemble markdown, regenerate OSCAL, or turn legacy SSP content into a traceable Trestle-managed workflow.

## Required guardrails

- Preserve source traceability for every generated OSCAL field that came from a legacy PDF, DOCX, Markdown, TXT file, interview note, spreadsheet, ticket, or evidence package.
- Never invent control mappings. If the source does not clearly support a mapping, set status to `needs_review` and explain the uncertainty.
- Schema-valid OSCAL is not a statement of compliance effectiveness.
- Keep reviewer-owned decisions in review queues or traceability maps.
- Do not hide reviewer decisions in generated prose.
- Prefer small, reversible Trestle operations.
- Do not do large opaque rewrites.

## Standard workflow

1. Start or inspect the workspace.
   - `trestle init`
   - `trestle version`
   - `find . -maxdepth 3 -type d | sort`
2. Import or create OSCAL artifacts.
   - catalogs under `catalogs/`
   - profiles under `profiles/`
   - component definitions under `component-definitions/`
   - SSPs under `system-security-plans/`
3. Resolve the applicable profile before you write control implementations.
4. Author or update markdown with source references.
5. Assemble markdown back into OSCAL.
6. Validate with Compliance Trestle and any available OSCAL validator.
7. Make review outputs for `needs_review`, unmapped, or low-confidence items.

## Typical commands

Use the wrapper when you want consistent reports:

```bash
bash scripts/trestle-workflow.sh init workspaces/acme/trestle-workspace
bash scripts/trestle-workflow.sh validate workspaces/acme/trestle-workspace
bash scripts/trestle-workflow.sh assemble workspaces/acme/trestle-workspace markdown/system-security-plans/acme-ssp acme-ssp
bash scripts/trestle-workflow.sh status workspaces/acme/trestle-workspace
```

Use raw Trestle when the reviewer needs exact CLI control:

```bash
trestle init
trestle validate -a
trestle author ssp-generate -n acme-ssp -p profiles/fedramp-moderate/profile.json
trestle author ssp-assemble -m markdown/system-security-plans/acme-ssp -o system-security-plans/acme-ssp.json
```

## Output expectations

Every Trestle-backed document import must leave behind:

- `source-map.csv` with source IDs, target OSCAL fields, status, and notes.
- `reports/import-summary.md` that explains source counts and known gaps.
- `reports/review-queue.md` for `needs_review` and unmapped items.
- validation output from `trestle validate` or a documented skipped or missing-tool status.

See:

- `references/trestle-workspace-lifecycle.md`
- `references/trestle-oscal-operations.md`
- `templates/trestle-workflow-checklist.md`
- `templates/trestle-command-log.md`