Not possible to remove control title

[michaeldavie-amzn]

When modifying a control in a profile, the description of the modify/alters/remove/by-item-name keyword indicates that a control's title can be removed. However, the allowed-values list does not include title as a valid value.

OSCAL/src/metaschema/oscal_profile_metaschema.xml

Lines 312 to 328 in b39789e

	<define-flag name="by-item-name" as-type="token">
	<formal-name>Item Name Reference</formal-name>
	<description>Identify items to remove by the name of the
	item's information object name, e.g.
	<code>title</code> or
	<code>prop</code>.</description>
	<constraint>
	<allowed-values>
	<enum value="param">A descendant parameter and all of its descendants.</enum>
	<enum value="prop">A descendant property and all of its descendants.</enum>
	<enum value="link">A descendant link and all of its descendants.</enum>
	<enum value="part">A descendant parameter and all of its descendants.</enum>
	<enum value="mapping">A descendant mapping and all of its descendants.</enum>
	<enum value="map">A descendant mapping entry (map) and all of its descendants.</enum>
	</allowed-values>
	</constraint>
	</define-flag>

[brian-ruf]

First, I agree this is a bug. The constraint directly contradicts the text.

This contradiction seems to have been introduced in the transition from OSCAL v1.0.6 to v1.1.0:

• v1.0.6 by-item-name definition: https://github.com/usnistgov/OSCAL/blob/v1.0.6/src/metaschema/oscal_profile_metaschema.xml#L364-L367

• v1.1.0 by-item-name definition: https://github.com/usnistgov/OSCAL/blob/v1.1.0/src/metaschema/oscal_profile_metaschema.xml#L312-L328

I am still trying to trace this to a PR or an issue to better understand why the change was made. It's not obvious from the Blame.

I believe this is caught between competing intentions.

1. OSCAL profile alter directives are supposed to always result in valid catalog syntax.
2. OSCAL profile alter directives have no concept of "update" or "replace". They were designed to first remove the content to be replaced and then add the replacement content.

As title is a required filed, I suspect it was intentionally blocked from remove with the idea that the removal would make the control invalid, but the use case for needing to update a title wasn't addressed when this decision was made.

The options for addressing this include:

1. Simply removing the constraint and reverting the by-item-name constraint to its v1.0.6 state.
2. Expand the constraint to include required fields, such as title and accept the risk that a profile author could inadvertently remove a required field without replacing it (resulting in invalid OSCAL content.)
   2a. Expand option 2 to include an additional constraint for each required field that ensures a //alter/remove for a required field is only valid if there is also a //alter/add for the required field.
3. Add //alter/replace syntax for required fields.