rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CMMI maturity level to compliance controls

Browse Source 
Adds an optional CMMI 0-5 maturity level field to Control to support
ISO 27001 clause 9.1 effectiveness measurement and HITRUST CSF maturity
requirements. The field is nullable, framework-agnostic, and exposed
across all four API surfaces (GraphQL, MCP, CLI, n8n) plus the
generated SoA document.

Signed-off-by: Alejandro Juan <alejandrojuan@alejandrojuan.com>
This commit is contained in:
Alejandro Juan
2026-04-20 13:26:19 +02:00
committed by Sacha Al Himdani
parent 98487953b9
commit da91afc2a7
31 changed files with 919 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/api/console/v1/control_resolvers.go
View File

@@ -417,6 +417,7 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: input.NotImplementedJustification,
MaturityLevel: input.MaturityLevel,
},
)
if err != nil {
@@ -454,6 +455,7 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
BestPractice: input.BestPractice,
Implemented: input.Implemented,
NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
MaturityLevel: gqlutils.UnwrapOmittable(input.MaturityLevel),
},
)

31
pkg/server/api/console/v1/graphql/control.graphql
View File

@@ -12,6 +12,34 @@ enum ControlImplementationState
)
}
enum ControlMaturityLevel
@goModel(model: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevel") {
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelNone"
)
INITIAL
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelInitial"
)
MANAGED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelManaged"
)
DEFINED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelDefined"
)
QUANTITATIVELY_MANAGED
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelQuantitativelyManaged"
)
OPTIMIZING
@goEnum(
value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelOptimizing"
)
}
enum ControlOrderField
@goModel(model: "go.probo.inc/probo/pkg/coredata.ControlOrderField") {
CREATED_AT
@@ -87,6 +115,7 @@ type Control implements Node {
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
maturityLevel: ControlMaturityLevel
regulatory: Boolean! @goField(forceResolver: true)
contractual: Boolean! @goField(forceResolver: true)
riskAssessment: Boolean! @goField(forceResolver: true)
@@ -280,6 +309,7 @@ input CreateControlInput {
bestPractice: Boolean!
implemented: ControlImplementationState!
notImplementedJustification: String
maturityLevel: ControlMaturityLevel
}
input UpdateControlInput {
@@ -290,6 +320,7 @@ input UpdateControlInput {
bestPractice: Boolean
implemented: ControlImplementationState
notImplementedJustification: String @goField(omittable: true)
maturityLevel: ControlMaturityLevel @goField(omittable: true)
}
input DeleteControlInput {

1
pkg/server/api/console/v1/types/control.go
View File

@@ -77,6 +77,7 @@ func NewControl(control *coredata.Control) *Control {
BestPractice: control.BestPractice,
Implemented: control.Implemented,
NotImplementedJustification: control.NotImplementedJustification,
MaturityLevel: control.MaturityLevel,
CreatedAt: control.CreatedAt,
UpdatedAt: control.UpdatedAt,
}

18
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -1473,6 +1473,12 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
svc := r.ProboService(ctx, input.FrameworkID)
var maturityLevel *coredata.ControlMaturityLevel
if input.MaturityLevel != nil {
v := coredata.ControlMaturityLevel(*input.MaturityLevel)
maturityLevel = &v
}
control, err := svc.Controls.Create(
ctx,
probo.CreateControlRequest{
@@ -1483,6 +1489,7 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
BestPractice: input.BestPractice,
Implemented: coredata.ControlImplementationState(input.Implemented),
NotImplementedJustification: input.NotImplementedJustification,
MaturityLevel: maturityLevel,
},
)
if err != nil {
@@ -1505,6 +1512,16 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
implemented = &v
}
var maturityLevel **coredata.ControlMaturityLevel
if rawMaturity := UnwrapOmittable(input.MaturityLevel); rawMaturity != nil {
var inner *coredata.ControlMaturityLevel
if *rawMaturity != nil {
v := coredata.ControlMaturityLevel(**rawMaturity)
inner = &v
}
maturityLevel = &inner
}
control, err := svc.Controls.Update(
ctx,
probo.UpdateControlRequest{
@@ -1515,6 +1532,7 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
BestPractice: input.BestPractice,
Implemented: implemented,
NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
MaturityLevel: maturityLevel,
},
)
if err != nil {

20
pkg/server/api/mcp/v1/specification.yaml
View File

@@ -4249,6 +4249,13 @@ components:
- string
- "null"
description: Justification for non-implementation
maturity_level:
type:
- string
- "null"
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
created_at:
type: string
format: date-time
@@ -4353,6 +4360,13 @@ components:
- string
- "null"
description: Justification for non-implementation
maturity_level:
type:
- string
- "null"
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
AddControlOutput:
type: object
@@ -4392,6 +4406,12 @@ components:
type: ["string", "null"]
description: Justification for non-implementation
go.probo.inc/mcpgen/omittable: true
maturity_level:
type: ["string", "null"]
enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
description: CMMI 0-5 maturity level of the control
go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
go.probo.inc/mcpgen/omittable: true
UpdateControlOutput:
type: object

7
pkg/server/api/mcp/v1/types/control.go
View File

@@ -19,6 +19,12 @@ import (
)
func NewControl(c *coredata.Control) *Control {
var maturityLevel *string
if c.MaturityLevel != nil {
s := string(*c.MaturityLevel)
maturityLevel = &s
}
return &Control{
ID: c.ID,
OrganizationID: c.OrganizationID,
@@ -29,6 +35,7 @@ func NewControl(c *coredata.Control) *Control {
BestPractice: c.BestPractice,
Implemented: ControlImplemented(c.Implemented),
NotImplementedJustification: c.NotImplementedJustification,
MaturityLevel: maturityLevel,
CreatedAt: c.CreatedAt,
UpdatedAt: c.UpdatedAt,
}