feat(config): manage ADM-constrained allowed values

.dockerignore

@@ -4,3 +4,7 @@ npm-debug.log
 
 app/tests
 local-only
+
+# Local developer logs
+/TODO.md
+/FRONTEND_TODO.md

.gitignore

@@ -1,6 +1,13 @@
 # A place to store artifacts during local development (scripts, datasets, dotenv files, etc.)
 .nocommit/**/*
 
+# Local planning and handoff logs; never commit or force-add these files.
+/TODO.md
+/FRONTEND_TODO.md
+# Keep the retired documentation paths from being recreated.
+/docs/developer/TODO.md
+/docs/developer/FRONTEND_TODO.md
+
 # Machine-specific agent configuration (copy AGENTS.local.example.md to create)
 AGENTS.local.md
 

AGENTS.md

@@ -15,11 +15,11 @@ before searching the filesystem for any of the resources below.
   API), `attack-workbench-deployment` (Docker Compose configs),
   `attack-workbench-taxii-server`. Use them when you need consumer or
   deployment context.
-- **ADM (ATT&CK Data Model)** — this API validates STIX objects against the
-  published `@mitre-attack/attack-data-model` package. A local checkout of the
-  ADM source (`src/schemas/{sdo,sro,smo,common}`) is the authoritative
-  reference for STIX shapes: valid enum values, required fields, refinements.
-  Consult it when authoring payloads, especially for regression tests.
+- **ADM (ATT&CK Data Model)** — the installed
+  `@mitre-attack/attack-data-model` package determines runtime validation.
+  Consult its Zod schemas when authoring payloads and regression tests.
+  A local source checkout is useful for investigation; check its version
+  against the installed package before treating its shapes as current.
 - **Bruno API collection** — manual smoke-test requests maintained outside
   this repo (see Bruno section below).
 
@@ -95,19 +95,23 @@ Tests use `mongodb-memory-server` — no external MongoDB or env setup needed.
 
 ## Task workflow
 
-1. **Plan in a committable scratchpad**: track multi-step work as checkboxes in
-   `docs/developer/TODO.md` so progress survives context-window resets and
-   sessions. Check items off as they complete. Throwaway artifacts (notes,
-   datasets, one-off scripts) go in `.nocommit/` (gitignored).
+1. **Keep working notes local**: use the gitignored root `TODO.md` for plans
+   and `FRONTEND_TODO.md` for temporary frontend handoffs. Create them only
+   when needed; a fresh clone need not contain either file. Never stage or
+   force-add them, recreate planning logs under `docs/`, or link published
+   documentation to local notes. Other scratch artifacts (scripts, datasets,
+   session notes) belong in `.nocommit/` (gitignored).
 2. **Definition of done** — a task is complete only when it includes:
    - implementation,
    - regression tests (see below),
    - test verification, strictly in this order: run the relevant spec files
      with `npm run test:file -- <path>` while iterating, then run the **full**
      `npm test` suite — all of it must pass before the task is done,
    - OpenAPI spec updates for any API-surface change,
-   - documentation updates (`docs/user/**` = what the behavior *is*;
-     `docs/developer/**` = why/how, including how behavior evolved),
+   - documentation of current behavior in `docs/user/**` and `docs/admin/**`,
+     and contracts/design decisions in `docs/developer/**`; keep task checklists,
+     execution transcripts, test-run tallies, and proposed commit messages in
+     local notes or the final response, not tracked documentation,
    - Bruno collection updates for any API-surface change,
    - a proposed conventional commit message.
 3. **Commits**: conventional commits are enforced (commitlint +

app/api/definitions/components/system-configuration.yml

@@ -63,6 +63,165 @@ components:
               type: string
               example: 'Linux'
 
+    allowed-value-option:
+      type: object
+      additionalProperties: false
+      required: [value, enabled, objectTypes]
+      properties:
+        value:
+          type: string
+          minLength: 1
+          description: Trimmed, case-sensitive value accepted by the installed backend ADM for every selected object type and domain, even when disabled.
+        enabled:
+          type: boolean
+        objectTypes:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          description: Supported object types to which this option applies.
+          items:
+            type: string
+            minLength: 1
+
+    allowed-value-rule:
+      type: object
+      additionalProperties: false
+      required: [propertyName, domainName, objectTypes, values, invalidValues]
+      properties:
+        propertyName:
+          type: string
+          example: x_mitre_platforms
+        domainName:
+          type: string
+          example: enterprise-attack
+        objectTypes:
+          type: array
+          uniqueItems: true
+          description: All ADM-supported object types for this property/domain, including those with no options.
+          items:
+            type: string
+        values:
+          type: array
+          description: Equal value and enabled pairs are grouped across object types.
+          items:
+            $ref: '#/components/schemas/allowed-value-option'
+        invalidValues:
+          type: array
+          description: Persisted legacy options rejected by the installed ADM. Never offered as dropdown choices; saving replaces these along with the rule.
+          items:
+            $ref: '#/components/schemas/allowed-value-invalid-option'
+
+    allowed-value-rule-replace:
+      type: object
+      additionalProperties: false
+      required: [values]
+      properties:
+        values:
+          type: array
+          description: Complete replacement option set. An empty array clears the rule.
+          items:
+            $ref: '#/components/schemas/allowed-value-option'
+
+    allowed-value-invalid-option:
+      type: object
+      additionalProperties: false
+      required: [value, enabled, objectTypes, reason]
+      properties:
+        value:
+          type: string
+        enabled:
+          type: boolean
+        objectTypes:
+          type: array
+          items:
+            type: string
+        reason:
+          type: string
+
+    allowed-value-definition:
+      type: object
+      additionalProperties: false
+      required: [propertyName, domainName, objectTypes, valueType, choices, description]
+      properties:
+        propertyName:
+          type: string
+        domainName:
+          type: string
+        objectTypes:
+          type: array
+          items:
+            type: string
+        valueType:
+          type: string
+          enum: [enum, formatted]
+        choices:
+          type: array
+          description: ADM enum choices, or validated seed suggestions for formatted fields. Each choice lists its valid object types.
+          items:
+            type: object
+            required: [value, objectTypes]
+            additionalProperties: false
+            properties:
+              value:
+                type: string
+              objectTypes:
+                type: array
+                items:
+                  type: string
+        description:
+          type: string
+
+    allowed-value-catalog:
+      type: object
+      additionalProperties: false
+      required: [admVersion, rules]
+      properties:
+        admVersion:
+          type: string
+        rules:
+          type: array
+          items:
+            $ref: '#/components/schemas/allowed-value-definition'
+
+    allowed-value-rule-create:
+      type: object
+      additionalProperties: false
+      required: [propertyName, domainName, values]
+      properties:
+        propertyName:
+          type: string
+          minLength: 1
+        domainName:
+          type: string
+          minLength: 1
+        values:
+          type: array
+          description: Initial ADM-valid options. Empty arrays create a persistent empty rule.
+          items:
+            $ref: '#/components/schemas/allowed-value-option'
+
+    allowed-value-validate:
+      type: object
+      additionalProperties: false
+      required: [propertyName, domainName, objectTypes, value]
+      properties:
+        propertyName:
+          type: string
+          minLength: 1
+        domainName:
+          type: string
+          minLength: 1
+        objectTypes:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            type: string
+            minLength: 1
+        value:
+          type: string
+          minLength: 1
+
     organization-identity:
       type: object
       properties:

app/api/definitions/openapi.yml

@@ -440,6 +440,18 @@ paths:
   /api/config/allowed-values:
     $ref: 'paths/system-configuration-paths.yml#/paths/~1api~1config~1allowed-values'
 
+  /api/config/allowed-values/catalog:
+    $ref: 'paths/system-configuration-paths.yml#/paths/~1api~1config~1allowed-values~1catalog'
+
+  /api/config/allowed-values/validate:
+    $ref: 'paths/system-configuration-paths.yml#/paths/~1api~1config~1allowed-values~1validate'
+
+  /api/config/allowed-values/rules:
+    $ref: 'paths/system-configuration-paths.yml#/paths/~1api~1config~1allowed-values~1rules'
+
+  /api/config/allowed-values/rules/{propertyName}/{domainName}:
+    $ref: 'paths/system-configuration-paths.yml#/paths/~1api~1config~1allowed-values~1rules~1{propertyName}~1{domainName}'
+
   /api/config/organization-identity:
     $ref: 'paths/system-configuration-paths.yml#/paths/~1api~1config~1organization-identity'