Five constraint occurrences exist only inside XML comments (including the with-child-controls vocabulary)

[JonathanBezdek]

At v1.2.2 (commit 21403b4), five constraint occurrences in the Metaschema sources live entirely inside <!-- … --> blocks, so they are visible to a human reader but never compiled or enforced. The most consequential is the complete allowed-values vocabulary for profile with-child-controls; another is the assessment plan's index-has-key for cross-document UUIDs, retained only as a commented "bogus example".

If these are intentional retirements, deleting them would prevent readers from mistaking them for active constraints; if they are meant to be active, they need to be uncommented and validated.

Found during a lexical inventory of all constraint occurrences in the 1.2.2 Metaschema sources. We can provide the exact locator list (file + line per occurrence) as a follow-up comment if helpful.

[iMichaela]

@JonathanBezdek - The profile definition with the constraints you mention was moved to oscal_control-common_metaschema.xml.
All code needs to be cleaned - I agree - not just the commented out constraints you identified, which were either experimental or relaxed on purpose, but not completely removed until the community validates, through examples and specific use cases, the change meets the expectations.

[JonathanBezdek]

Thank you @iMichaela, and you are right about the move: at v1.2.2 the active define-flag name="with-child-controls" with its allowed-values (oscal-with-child-controls-values) lives in oscal_control-common_metaschema.xml (L291/L295) and the profile module references it via <flag ref>. Our validator enforces that active occurrence; what we flagged is only the retained commented copy in oscal_profile_metaschema.xml (oscal-profile-with-child-controls-values, ~L467), as a reader-confusion hazard rather than a functional gap.

Understood on the intent, keeping experimental or deliberately relaxed constraints visible until the community validates the change through examples and use cases makes sense.

As promised, here is the complete list of commented-out constraint occurrences our lexical inventory retains at v1.2.2 (commit 21403b4a), for whenever a cleanup pass happens:

File	Line	Type	Id
oscal_metadata_metaschema.xml	~L51	has-cardinality	(anonymous)
oscal_implementation-common_metaschema.xml	~L496	allowed-values	(anonymous)
oscal_mapping-common_metaschema.xml	~L507	allowed-values	(anonymous)
oscal_mapping-common_metaschema.xml	~L540	allowed-values	(anonymous)
oscal_assessment-common_metaschema.xml	~L1000	allowed-values	(anonymous)
oscal_assessment-plan_metaschema.xml	~L125	index	index-assessment-plan-roles
oscal_assessment-plan_metaschema.xml	~L128	index-has-key	(anonymous)
oscal_profile_metaschema.xml	~L467	allowed-values	oscal-profile-with-child-controls-values

If it helps the community-validation step, we are happy to contribute example documents and specific use cases per occurrence, or a PR that removes the ones which already have active replacements (like the profile copy above). Just say which route you prefer.

[iMichaela]

@JonathanBezdek - Thank you. Having a summary helps 💯