# Vendored reference corpus

This directory contains files vendored (copied) from an upstream FedRAMP repository.
It is **not** a git submodule — the content is tracked directly so it is present in
every checkout of this repository with no submodule initialization required.

- **Upstream:** https://github.com/FedRAMP/schemas
- **Vendored commit:** `5d418813f5bb93f8f447c1df7aeae44ce022c0f2`
- **Vendored on:** 2026-08-11 (UTC)
- **Curated:** `fedramp-*-schema-*.json` + `README.md` (upstream `tools/` and CI configs are not vendored).
- **Note:** the repo is the source of truth — www.fedramp.gov/schemas/ links several stale filenames that 404 (advisor/assessor `v2026.06.06.01`, `certification-overview-package`, singular `significant-change-notification`).

To refresh from upstream, run:

```bash
scripts/update-fedramp-refs.sh
```

Do not hand-edit these files — local edits are overwritten on the next refresh.
