Add CMMI maturity level to compliance controls

Adds an optional CMMI 0-5 maturity level field to Control to support
ISO 27001 clause 9.1 effectiveness measurement and HITRUST CSF maturity
requirements. The field is nullable, framework-agnostic, and exposed
across all four API surfaces (GraphQL, MCP, CLI, n8n) plus the
generated SoA document.

Signed-off-by: Alejandro Juan <alejandrojuan@alejandrojuan.com>

pkg/server/api/console/v1/control_resolvers.go

@@ -417,6 +417,7 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 			BestPractice:                input.BestPractice,
 			Implemented:                 input.Implemented,
 			NotImplementedJustification: input.NotImplementedJustification,
+			MaturityLevel:               input.MaturityLevel,
 		},
 	)
 	if err != nil {
@@ -454,6 +455,7 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 			BestPractice:                input.BestPractice,
 			Implemented:                 input.Implemented,
 			NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
+			MaturityLevel:               gqlutils.UnwrapOmittable(input.MaturityLevel),
 		},
 	)
 

pkg/server/api/console/v1/graphql/control.graphql

@@ -12,6 +12,34 @@ enum ControlImplementationState
         )
 }
 
+enum ControlMaturityLevel
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevel") {
+    NONE
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelNone"
+        )
+    INITIAL
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelInitial"
+        )
+    MANAGED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelManaged"
+        )
+    DEFINED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelDefined"
+        )
+    QUANTITATIVELY_MANAGED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelQuantitativelyManaged"
+        )
+    OPTIMIZING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlMaturityLevelOptimizing"
+        )
+}
+
 enum ControlOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.ControlOrderField") {
     CREATED_AT
@@ -87,6 +115,7 @@ type Control implements Node {
     bestPractice: Boolean!
     implemented: ControlImplementationState!
     notImplementedJustification: String
+    maturityLevel: ControlMaturityLevel
     regulatory: Boolean! @goField(forceResolver: true)
     contractual: Boolean! @goField(forceResolver: true)
     riskAssessment: Boolean! @goField(forceResolver: true)
@@ -280,6 +309,7 @@ input CreateControlInput {
     bestPractice: Boolean!
     implemented: ControlImplementationState!
     notImplementedJustification: String
+    maturityLevel: ControlMaturityLevel
 }
 
 input UpdateControlInput {
@@ -290,6 +320,7 @@ input UpdateControlInput {
     bestPractice: Boolean
     implemented: ControlImplementationState
     notImplementedJustification: String @goField(omittable: true)
+    maturityLevel: ControlMaturityLevel @goField(omittable: true)
 }
 
 input DeleteControlInput {

pkg/server/api/console/v1/types/control.go

@@ -77,6 +77,7 @@ func NewControl(control *coredata.Control) *Control {
 		BestPractice:                control.BestPractice,
 		Implemented:                 control.Implemented,
 		NotImplementedJustification: control.NotImplementedJustification,
+		MaturityLevel:               control.MaturityLevel,
 		CreatedAt:                   control.CreatedAt,
 		UpdatedAt:                   control.UpdatedAt,
 	}