Add implemented state and justification to controls

Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.

The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/schema.graphql

@@ -127,6 +127,20 @@ enum TrustCenterVisibility
         )
 }
 
+enum ControlImplementationState
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.ControlImplementationState"
+    ) {
+    IMPLEMENTED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateImplemented"
+        )
+    NOT_IMPLEMENTED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateNotImplemented"
+        )
+}
+
 enum TrustCenterDocumentAccessStatus
     @goModel(
         model: "go.probo.inc/probo/pkg/coredata.TrustCenterDocumentAccessStatus"
@@ -2221,6 +2235,8 @@ type Control implements Node {
     name: String!
     description: String
     bestPractice: Boolean!
+    implemented: ControlImplementationState!
+    notImplementedJustification: String
     regulatory: Boolean! @goField(forceResolver: true)
     contractual: Boolean! @goField(forceResolver: true)
     riskAssessment: Boolean! @goField(forceResolver: true)
@@ -4468,6 +4484,8 @@ input CreateControlInput {
     name: String!
     description: String
     bestPractice: Boolean!
+    implemented: ControlImplementationState!
+    notImplementedJustification: String
 }
 
 input UpdateControlInput {
@@ -4476,6 +4494,8 @@ input UpdateControlInput {
     name: String
     description: String @goField(omittable: true)
     bestPractice: Boolean
+    implemented: ControlImplementationState
+    notImplementedJustification: String @goField(omittable: true)
 }
 
 input DeleteControlInput {

pkg/server/api/console/v1/types/control.go

@@ -57,11 +57,13 @@ func NewControl(control *coredata.Control) *Control {
 		Framework: &Framework{
 			ID: control.FrameworkID,
 		},
-		SectionTitle: control.SectionTitle,
-		Name:         control.Name,
-		Description:  control.Description,
-		BestPractice: control.BestPractice,
-		CreatedAt:    control.CreatedAt,
-		UpdatedAt:    control.UpdatedAt,
+		SectionTitle:                control.SectionTitle,
+		Name:                        control.Name,
+		Description:                 control.Description,
+		BestPractice:                control.BestPractice,
+		Implemented:                 control.Implemented,
+		NotImplementedJustification: control.NotImplementedJustification,
+		CreatedAt:                   control.CreatedAt,
+		UpdatedAt:                   control.UpdatedAt,
 	}
 }

pkg/server/api/console/v1/v1_resolver.go

@@ -2945,11 +2945,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 	control, err := prb.Controls.Create(
 		ctx,
 		probo.CreateControlRequest{
-			FrameworkID:  input.FrameworkID,
-			Name:         input.Name,
-			Description:  input.Description,
-			SectionTitle: input.SectionTitle,
-			BestPractice: input.BestPractice,
+			FrameworkID:                 input.FrameworkID,
+			Name:                        input.Name,
+			Description:                 input.Description,
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 input.Implemented,
+			NotImplementedJustification: input.NotImplementedJustification,
 		},
 	)
 	if err != nil {
@@ -2977,11 +2979,13 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 	control, err := prb.Controls.Update(
 		ctx,
 		probo.UpdateControlRequest{
-			ID:           input.ID,
-			Name:         input.Name,
-			Description:  gqlutils.UnwrapOmittable(input.Description),
-			SectionTitle: input.SectionTitle,
-			BestPractice: input.BestPractice,
+			ID:                          input.ID,
+			Name:                        input.Name,
+			Description:                 gqlutils.UnwrapOmittable(input.Description),
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 input.Implemented,
+			NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
 		},
 	)
 

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -1550,10 +1550,13 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
 	control, err := svc.Controls.Create(
 		ctx,
 		probo.CreateControlRequest{
-			FrameworkID:  input.FrameworkID,
-			Name:         input.Name,
-			Description:  input.Description,
-			SectionTitle: input.SectionTitle,
+			FrameworkID:                 input.FrameworkID,
+			Name:                        input.Name,
+			Description:                 input.Description,
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 coredata.ControlImplementationState(input.Implemented),
+			NotImplementedJustification: input.NotImplementedJustification,
 		},
 	)
 	if err != nil {
@@ -1570,13 +1573,22 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
 
 	svc := r.ProboService(ctx, input.ID)
 
+	var implemented *coredata.ControlImplementationState
+	if input.Implemented != nil {
+		v := coredata.ControlImplementationState(*input.Implemented)
+		implemented = &v
+	}
+
 	control, err := svc.Controls.Update(
 		ctx,
 		probo.UpdateControlRequest{
-			ID:           input.ID,
-			Name:         input.Name,
-			Description:  UnwrapOmittable(input.Description),
-			SectionTitle: input.SectionTitle,
+			ID:                          input.ID,
+			Name:                        input.Name,
+			Description:                 UnwrapOmittable(input.Description),
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 implemented,
+			NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
 		},
 	)
 	if err != nil {

pkg/server/api/mcp/v1/specification.yaml

@@ -4219,6 +4219,8 @@ components:
         - framework_id
         - section_title
         - name
+        - best_practice
+        - implemented
         - created_at
         - updated_at
       properties:
@@ -4242,6 +4244,19 @@ components:
             - string
             - "null"
           description: Control description
+        best_practice:
+          type: boolean
+          description: Whether control is a best practice
+        implemented:
+          type: string
+          enum: [IMPLEMENTED, NOT_IMPLEMENTED]
+          description: Control implementation state
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
+        not_implemented_justification:
+          type:
+            - string
+            - "null"
+          description: Justification for non-implementation
         created_at:
           type: string
           format: date-time
@@ -4315,6 +4330,8 @@ components:
         - framework_id
         - section_title
         - name
+        - best_practice
+        - implemented
       properties:
         organization_id:
           $ref: "#/components/schemas/GID"
@@ -4331,6 +4348,19 @@ components:
         description:
           type: string
           description: Control description
+        best_practice:
+          type: boolean
+          description: Whether control is a best practice
+        implemented:
+          type: string
+          enum: [IMPLEMENTED, NOT_IMPLEMENTED]
+          description: Control implementation state
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
+        not_implemented_justification:
+          type:
+            - string
+            - "null"
+          description: Justification for non-implementation
 
     AddControlOutput:
       type: object
@@ -4358,6 +4388,18 @@ components:
           type: ["string", "null"]
           description: Control description
           go.probo.inc/mcpgen/omittable: true
+        best_practice:
+          type: boolean
+          description: Whether control is a best practice
+        implemented:
+          type: string
+          enum: [IMPLEMENTED, NOT_IMPLEMENTED]
+          description: Control implementation state
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
+        not_implemented_justification:
+          type: ["string", "null"]
+          description: Justification for non-implementation
+          go.probo.inc/mcpgen/omittable: true
 
     UpdateControlOutput:
       type: object

pkg/server/api/mcp/v1/types/control.go

@@ -20,14 +20,17 @@ import (
 
 func NewControl(c *coredata.Control) *Control {
 	return &Control{
-		ID:             c.ID,
-		OrganizationID: c.OrganizationID,
-		SectionTitle:   c.SectionTitle,
-		FrameworkID:    c.FrameworkID,
-		Name:           c.Name,
-		Description:    c.Description,
-		CreatedAt:      c.CreatedAt,
-		UpdatedAt:      c.UpdatedAt,
+		ID:                          c.ID,
+		OrganizationID:              c.OrganizationID,
+		SectionTitle:                c.SectionTitle,
+		FrameworkID:                 c.FrameworkID,
+		Name:                        c.Name,
+		Description:                 c.Description,
+		BestPractice:                c.BestPractice,
+		Implemented:                 ControlImplemented(c.Implemented),
+		NotImplementedJustification: c.NotImplementedJustification,
+		CreatedAt:                   c.CreatedAt,
+		UpdatedAt:                   c.UpdatedAt,
 	}
 }