Remove hardcoded version "1.0" from buildConfigFromFlags in mcp.go
since the MCP server does not use the version field (it's only needed
for pack/scan commands).

Add comprehensive test for buildConfigFromFlags to verify complete
flag-to-config transformation including source parsing, schema parsing,
and proper struct field population.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Multi-stage build with UBI 9 micro base image.
Produces a minimal container for MCP server distribution via GHCR.

Refs: complytime#24
ADR: docs/adr/012-container-mcp-distribution.md

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Uses org-infra reusable workflows for GHCR publish with SLSA
provenance, SBOM attestations, and Sigstore signing.
Multi-arch (amd64/arm64) build on version tags and main pushes.

Refs: complytime#24

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Claude Code, Cursor, and Gemini CLI manifests following the
superpowers multi-manifest pattern. Updates .mcp.json to reference
the container image. Restructures skill directory layout.
Removes openpackage.yml and legacy install docs.

Refs: complytime#24

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Covers Claude Code, OpenCode, flag syntax, config file fallback,
and image verification.

Refs: complytime#24

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Copy CA certificates into the UBI micro container so the CUE registry
(registry.cue.works) is reachable over TLS.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Pin reusable workflow references to SHA and pin ubi9-micro to a
versioned digest to satisfy zizmor and hadolint.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Signed-off-by: Jennifer Power <[email protected]>

Co-authored-by: Jennifer Power <[email protected]>

Signed-off-by: Jennifer Power <[email protected]>

Previously, passing only --schema without --source fell through to
config file loading and failed. Now either flag triggers the flags-based
config path.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Prevents auto-loading a broken config with placeholder values and
:latest tag. Users copy and fill in their own registry, source, and
pinned version.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

- Fix allowed_identity_regex to match org-infra reusable workflow origin
- Add Trivy image scan stage between build and sign
- Gate signing on scan success via verify_vuln
- Run container as non-root user (ARG USER_UID=10001)

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Add delta comparison engine for parameter harmonization across
framework layers with mismatch-only verdicts. Add analyze_parameter_delta
MCP tool. Extend get_assessment_requirements with scope filter (array
of applicability groups) so models can query by maturity level without
parsing catalog files. Include artifact kind (Policy, ControlCatalog,
etc.) in MCP resource listing. Add ImportedGuidanceIDs to ResolvedPolicy.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Add comply pipeline skills (scoping, mapping, adherence) with router
that dispatches sub-stages by filename from the skill base directory.
Add /comply:pack for Rego generation and /comply:setup for workspace
configuration. Skills enforce MCP-grounded control data access via
get_assessment_requirements with scope filter. Update plugin manifests
to register new commands.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

…mply pipeline

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Strip verdicts, specificity detection, and string-matching heuristics
from the delta engine. The tool now gathers structured L3 parameter
values alongside L1/L2 requirement text and returns them as pairs.
The model interprets the relationship — parsing prose for parameter
values is what AI does well and heuristics do poorly.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Signed-off-by: Jennifer Power <[email protected]>

Remove verdict types, specificity layers, and heuristic references.
Mapping skill now instructs the model to interpret parameter
comparisons using domain context rather than relying on engine
verdicts. Output schema uses comparisons with interpretation field.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

The tool previously only looked up resolved policies by name. When a
catalog name was passed, it failed with "policy not found". Now falls
back to wrapping a bare catalog in a synthetic ResolvedPolicy so the
tool works with both policy and catalog names.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>

Signed-off-by: Jennifer Power <[email protected]>

Signed-off-by: Jennifer Power <[email protected]>

Fixes golangci-lint unused finding.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <[email protected]>