Add CMMI maturity level to compliance controls

Adds an optional CMMI 0-5 maturity level field to Control to support
ISO 27001 clause 9.1 effectiveness measurement and HITRUST CSF maturity
requirements. The field is nullable, framework-agnostic, and exposed
across all four API surfaces (GraphQL, MCP, CLI, n8n) plus the
generated SoA document.

Signed-off-by: Alejandro Juan <alejandrojuan@alejandrojuan.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -1473,6 +1473,12 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
 
 	svc := r.ProboService(ctx, input.FrameworkID)
 
+	var maturityLevel *coredata.ControlMaturityLevel
+	if input.MaturityLevel != nil {
+		v := coredata.ControlMaturityLevel(*input.MaturityLevel)
+		maturityLevel = &v
+	}
+
 	control, err := svc.Controls.Create(
 		ctx,
 		probo.CreateControlRequest{
@@ -1483,6 +1489,7 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
 			BestPractice:                input.BestPractice,
 			Implemented:                 coredata.ControlImplementationState(input.Implemented),
 			NotImplementedJustification: input.NotImplementedJustification,
+			MaturityLevel:               maturityLevel,
 		},
 	)
 	if err != nil {
@@ -1505,6 +1512,16 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
 		implemented = &v
 	}
 
+	var maturityLevel **coredata.ControlMaturityLevel
+	if rawMaturity := UnwrapOmittable(input.MaturityLevel); rawMaturity != nil {
+		var inner *coredata.ControlMaturityLevel
+		if *rawMaturity != nil {
+			v := coredata.ControlMaturityLevel(**rawMaturity)
+			inner = &v
+		}
+		maturityLevel = &inner
+	}
+
 	control, err := svc.Controls.Update(
 		ctx,
 		probo.UpdateControlRequest{
@@ -1515,6 +1532,7 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
 			BestPractice:                input.BestPractice,
 			Implemented:                 implemented,
 			NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
+			MaturityLevel:               maturityLevel,
 		},
 	)
 	if err != nil {

pkg/server/api/mcp/v1/specification.yaml

@@ -4249,6 +4249,13 @@ components:
             - string
             - "null"
           description: Justification for non-implementation
+        maturity_level:
+          type:
+            - string
+            - "null"
+          enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
+          description: CMMI 0-5 maturity level of the control
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
         created_at:
           type: string
           format: date-time
@@ -4353,6 +4360,13 @@ components:
             - string
             - "null"
           description: Justification for non-implementation
+        maturity_level:
+          type:
+            - string
+            - "null"
+          enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
+          description: CMMI 0-5 maturity level of the control
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
 
     AddControlOutput:
       type: object
@@ -4392,6 +4406,12 @@ components:
           type: ["string", "null"]
           description: Justification for non-implementation
           go.probo.inc/mcpgen/omittable: true
+        maturity_level:
+          type: ["string", "null"]
+          enum: [NONE, INITIAL, MANAGED, DEFINED, QUANTITATIVELY_MANAGED, OPTIMIZING, null]
+          description: CMMI 0-5 maturity level of the control
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlMaturityLevel
+          go.probo.inc/mcpgen/omittable: true
 
     UpdateControlOutput:
       type: object

pkg/server/api/mcp/v1/types/control.go

@@ -19,6 +19,12 @@ import (
 )
 
 func NewControl(c *coredata.Control) *Control {
+	var maturityLevel *string
+	if c.MaturityLevel != nil {
+		s := string(*c.MaturityLevel)
+		maturityLevel = &s
+	}
+
 	return &Control{
 		ID:                          c.ID,
 		OrganizationID:              c.OrganizationID,
@@ -29,6 +35,7 @@ func NewControl(c *coredata.Control) *Control {
 		BestPractice:                c.BestPractice,
 		Implemented:                 ControlImplemented(c.Implemented),
 		NotImplementedJustification: c.NotImplementedJustification,
+		MaturityLevel:               maturityLevel,
 		CreatedAt:                   c.CreatedAt,
 		UpdatedAt:                   c.UpdatedAt,
 	}