{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:UGH7EUPGK72PQAVJXAXELRCKCH","short_pith_number":"pith:UGH7EUPG","canonical_record":{"source":{"id":"2607.08292","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-09T09:35:58Z","cross_cats_sorted":[],"title_canon_sha256":"6cbbae04c6bc8722d7a1fb81d04da6b23d65c7bf0a2b3116e0009e5f0033cc68","abstract_canon_sha256":"260e5a51418977fd30ffb38808bfbeaf52283b68062994a1ab6db9896c235354"},"schema_version":"1.0"},"canonical_sha256":"a18ff251e657f4f802a9b82e45c44a11fa7bd319c551a1ba09659bd0e541f111","source":{"kind":"arxiv","id":"2607.08292","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.08292","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"arxiv_version","alias_value":"2607.08292v1","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.08292","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"pith_short_12","alias_value":"UGH7EUPGK72P","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"pith_short_16","alias_value":"UGH7EUPGK72PQAVJ","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"pith_short_8","alias_value":"UGH7EUPG","created_at":"2026-07-10T01:19:32Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:UGH7EUPGK72PQAVJXAXELRCKCH","target":"record","payload":{"canonical_record":{"source":{"id":"2607.08292","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-09T09:35:58Z","cross_cats_sorted":[],"title_canon_sha256":"6cbbae04c6bc8722d7a1fb81d04da6b23d65c7bf0a2b3116e0009e5f0033cc68","abstract_canon_sha256":"260e5a51418977fd30ffb38808bfbeaf52283b68062994a1ab6db9896c235354"},"schema_version":"1.0"},"canonical_sha256":"a18ff251e657f4f802a9b82e45c44a11fa7bd319c551a1ba09659bd0e541f111","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-10T01:19:32.043420Z","signature_b64":"kzNi6TVb/CqMox9ip/R7bwLl1NhRJOqGM4Mc8iDYhSGnDaD8mFqfO0zVBEARbJP4Zhbq6zN8ugsyGW4m+37uBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a18ff251e657f4f802a9b82e45c44a11fa7bd319c551a1ba09659bd0e541f111","last_reissued_at":"2026-07-10T01:19:32.043042Z","signature_status":"signed_v1","first_computed_at":"2026-07-10T01:19:32.043042Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.08292","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-10T01:19:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Dwbit9AUwaaKSWgG8CJDypD4GnLichOs6M73VubtdqfLPnwzgxqlgL9fer+iRUNwcr9EcnVF+jmE9oN7NMg0Bw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T10:30:12.806514Z"},"content_sha256":"d3bd8852773e1d04970ab29114375996a76e108b8f0e871302732a47e9ad1683","schema_version":"1.0","event_id":"sha256:d3bd8852773e1d04970ab29114375996a76e108b8f0e871302732a47e9ad1683"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:UGH7EUPGK72PQAVJXAXELRCKCH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Lea Roxanne Muth, Marian Margraf","submitted_at":"2026-07-09T09:35:58Z","abstract_excerpt":"The NIS-2 Directive increases the need for continuous, auditable compliance evidence and motivates a shift from document-based compliance toward machine-readable compliance artifacts. The Open Security Controls Assessment Language (OSCAL) is a standard for this purpose, which the German Federal Office for Information Security (BSI) is adapting with Grundschutz++. However, companies are still managing extensive legacy IT security concepts (IT-SCs), and migrating them without verification could transfer outdated assets into the new format. While existing research primarily addresses the generati"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.08292","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.08292/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-10T01:19:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CFELHpDaE7XezLKorq8wKA1yksxWcilhS/ge2+8KaaDAMG4oMSvcekMf8o7BzZGuFhJ3ShhJWdQP4JL2M8QiDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T10:30:12.807272Z"},"content_sha256":"5ef11b90435e84caa256932590340657c5bd4bc7e17aec381f61db38461d8bb1","schema_version":"1.0","event_id":"sha256:5ef11b90435e84caa256932590340657c5bd4bc7e17aec381f61db38461d8bb1"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:UGH7EUPGK72PQAVJXAXELRCKCH","target":"integrity","payload":{"note":"This paper contains a 40-token span identical to one in arXiv:2605.21350. The two papers share no author per Pith records and neither cites the other. The duplication is the verbatim shared span; the framing makes no claim about intent or directionality.","snippet":"all other uses in any current or future media including reprinting republishing this material for advertising or promotional purposes creating new collective works for resale or redistribution to servers or lists or reuse of any copyrighted","arxiv_id":"2607.08292","detector":"shingle_duplication","evidence":{"shared_text":"all other uses in any current or future media including reprinting republishing this material for advertising or promotional purposes creating new collective works for resale or redistribution to servers or lists or reuse of any copyrighted component of this work","verdict_class":"incontrovertible","shared_arxiv_id":"2605.21350","shared_token_count":40,"shared_paper_version":1,"shared_offset_in_citing_paper":349},"severity":"advisory","ref_index":null,"audited_at":"2026-07-11T13:54:04.593463Z","event_type":"pith.integrity.v1","detected_doi":null,"detector_url":"https://pith.science/pith-integrity-protocol#shingle_duplication","external_url":null,"finding_type":"prose_duplication","evidence_hash":"b3e4d0a1e061146166f7170b88cc9244822d7344f3c48a66f2184af4b55bd940","paper_version":1,"verdict_class":"incontrovertible","resolved_title":null,"detector_version":"0.1.0","detected_arxiv_id":"2605.21350","integrity_event_id":12209,"payload_sha256":"b6f50cdcc01cca26146d349c33a4f5ca8cd49bd7f9dab12ed4a27202d375cc3e","signature_b64":"gdyrUWBqTj3ka/1op8JZg/xeRtllFc8ZuQs97UxbcdfVgg+3K93roVs/wHM6gDk8Ts5SRZfpwl0ihU7UTtB6AQ==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-11T13:56:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QRSmV9jBL5VPXQSII+bQ1VVbaZTc/GMBInsINkq/+ScVck4PNXerdhaNk/9vwAma3G+voaLXJc7x1HwLRTLRAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T10:30:12.812239Z"},"content_sha256":"f6ce9d38b3908c8ccfad17b4fbb7410523458ac6aceee7f7e3995a0fa1cafec2","schema_version":"1.0","event_id":"sha256:f6ce9d38b3908c8ccfad17b4fbb7410523458ac6aceee7f7e3995a0fa1cafec2"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:UGH7EUPGK72PQAVJXAXELRCKCH","target":"integrity","payload":{"note":"This paper contains a 40-token span identical to one in arXiv:2605.20136. The two papers share no author per Pith records and neither cites the other. The duplication is the verbatim shared span; the framing makes no claim about intent or directionality.","snippet":"be obtained for all other uses in any current or future media including reprinting republishing this material for advertising or promotional purposes creating new collective works for resale or redistribution to servers or lists or reuse of","arxiv_id":"2607.08292","detector":"shingle_duplication","evidence":{"shared_text":"be obtained for all other uses in any current or future media including reprinting republishing this material for advertising or promotional purposes creating new collective works for resale or redistribution to servers or lists or reuse of any copyrighted component","verdict_class":"incontrovertible","shared_arxiv_id":"2605.20136","shared_token_count":40,"shared_paper_version":1,"shared_offset_in_citing_paper":346},"severity":"advisory","ref_index":null,"audited_at":"2026-07-11T13:54:04.593463Z","event_type":"pith.integrity.v1","detected_doi":null,"detector_url":"https://pith.science/pith-integrity-protocol#shingle_duplication","external_url":null,"finding_type":"prose_duplication","evidence_hash":"ef32f19643c39d83995c0031dbd0d4812a36396ab98834a9a70833edd2e2fc45","paper_version":1,"verdict_class":"incontrovertible","resolved_title":null,"detector_version":"0.1.0","detected_arxiv_id":"2605.20136","integrity_event_id":12208,"payload_sha256":"26532ee9cbbb8fa07e58cb52060893a66b02155c4fe8d95ce932816a888d744e","signature_b64":"huwhuowAAc8wWj9jQ5CkfIgeyUCUqKpu8clHG1evBlbBlW0DXCf+KorWQxFWJ/Z6Fv4PeBTBBUEjyILxZgkODw==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-11T13:56:10Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pgPEcbq1BIMNkxWqX70iNhvGB6EYV0fbB++kRsncpW4H7KaY5+fajIUN6a73GKtLLN6L33cGKqMtIsB6IK5SDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T10:30:12.812644Z"},"content_sha256":"ee6f63a3f8db29054056858625d8f4f34b34e3c6335ddc402a60416cd236d499","schema_version":"1.0","event_id":"sha256:ee6f63a3f8db29054056858625d8f4f34b34e3c6335ddc402a60416cd236d499"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/UGH7EUPGK72PQAVJXAXELRCKCH/bundle.json","state_url":"https://pith.science/pith/UGH7EUPGK72PQAVJXAXELRCKCH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/UGH7EUPGK72PQAVJXAXELRCKCH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T10:30:12Z","links":{"resolver":"https://pith.science/pith/UGH7EUPGK72PQAVJXAXELRCKCH","bundle":"https://pith.science/pith/UGH7EUPGK72PQAVJXAXELRCKCH/bundle.json","state":"https://pith.science/pith/UGH7EUPGK72PQAVJXAXELRCKCH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/UGH7EUPGK72PQAVJXAXELRCKCH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:UGH7EUPGK72PQAVJXAXELRCKCH","merge_version":"pith-open-graph-merge-v1","event_count":4,"valid_event_count":4,"invalid_event_count":0,"equivocation_count":1,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"260e5a51418977fd30ffb38808bfbeaf52283b68062994a1ab6db9896c235354","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-09T09:35:58Z","title_canon_sha256":"6cbbae04c6bc8722d7a1fb81d04da6b23d65c7bf0a2b3116e0009e5f0033cc68"},"schema_version":"1.0","source":{"id":"2607.08292","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.08292","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"arxiv_version","alias_value":"2607.08292v1","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.08292","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"pith_short_12","alias_value":"UGH7EUPGK72P","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"pith_short_16","alias_value":"UGH7EUPGK72PQAVJ","created_at":"2026-07-10T01:19:32Z"},{"alias_kind":"pith_short_8","alias_value":"UGH7EUPG","created_at":"2026-07-10T01:19:32Z"}],"graph_snapshots":[{"event_id":"sha256:5ef11b90435e84caa256932590340657c5bd4bc7e17aec381f61db38461d8bb1","target":"graph","created_at":"2026-07-10T01:19:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.08292/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The NIS-2 Directive increases the need for continuous, auditable compliance evidence and motivates a shift from document-based compliance toward machine-readable compliance artifacts. The Open Security Controls Assessment Language (OSCAL) is a standard for this purpose, which the German Federal Office for Information Security (BSI) is adapting with Grundschutz++. However, companies are still managing extensive legacy IT security concepts (IT-SCs), and migrating them without verification could transfer outdated assets into the new format. While existing research primarily addresses the generati","authors_text":"Lea Roxanne Muth, Marian Margraf","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-09T09:35:58Z","title":"Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.08292","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d3bd8852773e1d04970ab29114375996a76e108b8f0e871302732a47e9ad1683","target":"record","created_at":"2026-07-10T01:19:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"260e5a51418977fd30ffb38808bfbeaf52283b68062994a1ab6db9896c235354","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-09T09:35:58Z","title_canon_sha256":"6cbbae04c6bc8722d7a1fb81d04da6b23d65c7bf0a2b3116e0009e5f0033cc68"},"schema_version":"1.0","source":{"id":"2607.08292","kind":"arxiv","version":1}},"canonical_sha256":"a18ff251e657f4f802a9b82e45c44a11fa7bd319c551a1ba09659bd0e541f111","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a18ff251e657f4f802a9b82e45c44a11fa7bd319c551a1ba09659bd0e541f111","first_computed_at":"2026-07-10T01:19:32.043042Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-10T01:19:32.043042Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"kzNi6TVb/CqMox9ip/R7bwLl1NhRJOqGM4Mc8iDYhSGnDaD8mFqfO0zVBEARbJP4Zhbq6zN8ugsyGW4m+37uBw==","signature_status":"signed_v1","signed_at":"2026-07-10T01:19:32.043420Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.08292","source_kind":"arxiv","source_version":1}}},"equivocations":[{"signer_id":"pith.science","event_type":"integrity_finding","target":"integrity","event_ids":["sha256:ee6f63a3f8db29054056858625d8f4f34b34e3c6335ddc402a60416cd236d499","sha256:f6ce9d38b3908c8ccfad17b4fbb7410523458ac6aceee7f7e3995a0fa1cafec2"]}],"invalid_events":[],"applied_event_ids":["sha256:d3bd8852773e1d04970ab29114375996a76e108b8f0e871302732a47e9ad1683","sha256:5ef11b90435e84caa256932590340657c5bd4bc7e17aec381f61db38461d8bb1"],"state_sha256":"32a81e8cd0a8a741575db5967c11db3dcbdf7c6ad045214e595a5efed7200048"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ks9OHDjVHrY1w207Dn1OUVT61iNZC3ItKesMhzODhxGrYJisAVWrN63sxT3vLRnHOQwIcDSjAcs0CJskxH5mBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T10:30:12.815469Z","bundle_sha256":"ce7c563af4b3ede90d8322128d209a0975ddd93355e41a6bf4e03ae11fe7007e"}}