# Review Oscal Mappings

> Review source-to-OSCAL mappings, triage needs_review rows, and update the review queue before treating generated OSCAL as ready for stakeholders.

- Skill: `oscal-compass-lab/review-oscal-mappings` (Agent Skill)
- Install (CLI): `npx skillmds@latest add oscal-compass-lab/review-oscal-mappings`
- Raw SKILL.md: https://api.skillmd.com/api/skills/oscal-compass-lab/review-oscal-mappings/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: oscal-compass-lab (https://skillmd.com/u/oscal-compass-lab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/oscal-compass-lab/review-oscal-mappings

---


# Review OSCAL Mappings

Human-in-the-loop review workflow for source traceability and mapping quality.

## Read first

- `docs/OSCAL-REVIEW-WORKFLOW.md`
- `adapters/generic-agent-package/prompts/review-oscal-mappings.md`
- `plugins/document-transform/oscal-document-workbench/templates/review-queue.md`
- `plugins/document-transform/oscal-document-workbench/templates/control-mapping-review.csv`

## Steps

1. Load `source-map.csv` and any generated `reports/review-queue.md`.
2. For each `needs_review` or unmapped row:
   - make sure the source text supports the OSCAL target
   - mark unsupported claims `needs_review` or `reject`
   - identify missing evidence
   - keep reviewer notes
3. Make or update the review queue:

```bash
bash plugins/document-transform/oscal-document-workbench/scripts/build-review-queue.sh <workspace>/extracted/source-map.csv --output <workspace>/reports/review-queue.md
```

4. Summarize counts of mapped, `needs_review`, and unmapped items.
5. Block "ready for assessment" claims while unresolved review rows remain.

## Reviewer decisions

Use explicit statuses in the traceability map.

Allowed `source-map.csv` statuses:

- `mapped`
- `needs_review`
- `unmapped`
- `reject`

Allowed reviewer decisions in the queue. Keep these separate from mapping status:

- `approve`
- `remap`
- `reject`
- `needs_more_evidence`
- `defer`

Do not silently rewrite uncertain source statements as implemented technical reality.