Prepare v0.1.0: MIT license, command entry points, README, and catalog fixes (#6)

Release requirements
--------------------
- License is now MIT. Replaces PolyForm Noncommercial across LICENSE.md,
  SKILL.md, README.md, CONTRIBUTING.md, MAINTAINERS.md, the CLA relicensing
  clause, and the issue-template contact links. Removes
  docs/legal/COMMERCIAL-LICENSING.md, which described a restriction that no
  longer exists. TRADEMARKS.md now states the boundary explicitly, since it
  used to lean on the noncommercial license: the code is MIT, the DSB names,
  logos, and curriculum are not.

- Adds /devsecops-engineer:advise, :design, and :assess via
  .claude-plugin/plugin.json and commands/. Each command selects an operating
  mode, passes $ARGUMENTS through, and reads SKILL.md — nothing more. A
  command that restates a rule creates a second catalog nobody validates, so
  tests/test_commands.py fails any command containing a rule ID or an
  enforcement level, and the policy is written down in CONTRIBUTING.md.

- README rewritten as a product front door: what it is, why (four outcomes),
  60-second install, three runnable prompts, workflows, how the reasoning
  works, documentation index, status. Adds a table of contents and links every
  file under docs/ — docs/legal/CLA.md had never been reachable from it.
  tests/test_readme.py holds both properties.

- Adds CHANGELOG.md with the v0.1.0 entry and explicit pre-1.0 language. A
  test asserts plugin.json and the changelog agree on the version, so they
  cannot diverge at tag time.

- Moves project documentation into docs/. LICENSE.md stays at the root, where
  GitHub looks for it.

Correctness fixes
-----------------
- Re-keys 21 rules onto capabilities that describe what actually satisfies
  them, and adds the 10 capabilities they needed. Resolution keys on
  capability, so DSB-SRC-001, DSB-ID-002, DSB-EVD-001 and others previously
  resolved to REUSE the moment an organization declared any
  pipeline-configuration scanner — reporting branch protection and least
  privilege as satisfied by a tool that does neither. Likewise
  sbom-generation on DSB-BUILD-001, and secret-scanning on DSB-ID-003, which
  requires a secret store rather than a detector.

- Fixes the GitHub Actions reference pipeline's DSB-EXC-003 assertion, whose
  grep pattern contained the literal string it searched for and so failed on
  a clean repository. Patterns now live in env, bracket-escaped, and allow a
  line annotated `# DSB-WARN:` because continue-on-error is how this platform
  expresses a WARN-level control.

- Replaces `aws ecs deploy`, which is not an AWS CLI command, with
  describe/register/update-service by digest; adds the ECR registry and login
  that DSB-ART-001 requires; separates the publish role from the deployment
  roles; gates the scan jobs on test per DSB-TEST-001.

- Pins the Jenkins shared library to a commit. `@v3` is a mutable reference
  and is the defect DSB-SC-002 exists to catch.

- Adds five Workload Profile fields that SKILL.md documents and rules depend
  on but the schema rejected, and lets array fields express `unknown`. Two of
  the three published example profiles failed their own schema.

- Pins tools/requirements.txt exactly. `>=` floors mean a commit does not
  resolve a fixed dependency set, which is what DSB-BUILD-002 forbids.

- Corrects TESTING.md's validator demonstration, which targeted a string not
  present in SKILL.md and therefore proved nothing, and CONTRIBUTING.md's
  documented rule format, which omitted the curriculum module title the
  validator requires.

Verification: validate_skill.py reports 42 rules across 11 families with no
violations, the generated mapping index is current, and the suite is at 106
tests, up from 56.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: mdixon47

.claude-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "name": "devsecops-engineer",
+  "version": "0.1.0",
+  "description": "Advise on, design, and assess CI/CD delivery pipelines using The DevSec Blueprint's Build → Test → Scan → Deploy DevSecOps engineering methodology.",
+  "author": {
+    "name": "The DevSec Blueprint",
+    "url": "https://github.com/devsecblueprint"
+  },
+  "homepage": "https://github.com/devsecblueprint/devsecops-claude-skill",
+  "repository": "https://github.com/devsecblueprint/devsecops-claude-skill",
+  "license": "MIT",
+  "keywords": [
+    "devsecops",
+    "cicd",
+    "pipeline",
+    "appsec",
+    "supply-chain",
+    "sast",
+    "sca",
+    "sbom",
+    "ssdf",
+    "slsa"
+  ]
+}

.github/CODEOWNERS

@@ -1,17 +1,21 @@
 # Ownership for The DSB DevSecOps Engineering Skill.
-# See MAINTAINERS.md. Later matches win, so the narrow rules come last.
+# See docs/MAINTAINERS.md. Later matches win, so the narrow rules come last.
 
 * @damienjburks
 
 # SKILL.md is the product. Every change to it is a change to guidance that
-# reaches users directly.
+# reaches users directly. commands/ and the plugin manifest define the public
+# entry points and the released version.
 /SKILL.md @damienjburks
+/commands/ @damienjburks
+/.claude-plugin/ @damienjburks
+/CHANGELOG.md @damienjburks
 
 # Rule content and the registries rules are validated against.
 /rules/ @damienjburks
 /references/ @damienjburks
 /schema/ @damienjburks
 
-# Licensing and contributor terms.
+# Project documentation, licensing, and contributor terms.
+/docs/ @damienjburks
 /LICENSE.md @damienjburks
-/docs/legal/ @damienjburks

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,7 +7,7 @@ body:
       value: |
         If the problem is that generated configuration would introduce a real
         security weakness, report it privately instead — see
-        [SECURITY.md](https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/SECURITY.md).
+        [SECURITY.md](https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/docs/SECURITY.md).
 
   - type: dropdown
     id: area

.github/ISSUE_TEMPLATE/config.yml

@@ -12,6 +12,6 @@ contact_links:
     url: https://github.com/devsecblueprint/devsecblueprint/issues/new
     about: The four phases and baseline principles come from DSB curriculum — raise those on the platform repository.
 
-  - name: Commercial licensing
-    url: https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/docs/legal/COMMERCIAL-LICENSING.md
-    about: Using this inside a company requires prior written authorization.
+  - name: Trademark and brand use
+    url: https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/docs/legal/TRADEMARKS.md
+    about: The code is MIT. DSB names, logos, and curriculum content are not.

.github/workflows/validate.yml

@@ -20,11 +20,21 @@ jobs:
         with:
           python-version: "3.13"
 
+      # DSB-BUILD-002: requirements.txt pins direct dependencies exactly, so a
+      # given commit resolves the same versions of the tools CI runs. Transitive
+      # versions still float — a fully hashed lock file is the next step up, and
+      # is only worth it if this repository starts shipping an executable
+      # artifact rather than Markdown.
       - name: Install dependencies
         run: pip install -r tools/requirements.txt
 
       - name: Validate SKILL.md
         run: python tools/validate_skill.py
 
+      # DSB-EVD-001: the generated index must match SKILL.md. tests/ covers this
+      # too; running it here names the fix in the failure output.
+      - name: Check generated mappings are current
+        run: python tools/generate_mappings.py --check
+
       - name: Run tests
         run: python -m pytest -v

CHANGELOG.md

@@ -0,0 +1,44 @@
+# Changelog
+
+All notable changes to this project are documented here. This project follows
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] — 2026-08-16
+
+Initial public release.
+
+**Pre-1.0.** The rule catalog and the skill's output structure will evolve based on
+real usage before 1.0. Rule *IDs* are the exception and are already stable: they
+appear in review output that ends up in audit records, so a retired ID is deprecated,
+never reused or renumbered.
+
+### Added
+
+- `SKILL.md` — the skill. Self-contained: 42 rules across 11 families, the
+  Build → Test → Scan → Deploy methodology, the twenty baseline principles, and the
+  Advise / Design / Review operating modes. Installing it needs this file and nothing
+  else.
+- Command entry points for Claude Code, under the `devsecops-engineer` plugin:
+  - `/devsecops-engineer:advise` — where controls belong, given a stack and the tools
+    already owned
+  - `/devsecops-engineer:design` — implementation-ready pipeline configuration
+  - `/devsecops-engineer:assess` — findings against an existing pipeline or repository
+- Worked examples across four stacks — greenfield GitHub Actions, an enterprise
+  Jenkins toolchain that introduces zero new scanners, a Terraform-only repository
+  where twelve rules are Not Applicable, and a review of a pipeline with real defects.
+- Framework mappings to NIST SSDF, SLSA, OWASP CI/CD, OWASP SAMM, and CNCF supply
+  chain guidance, generated from the rule catalog into `docs/framework-mappings.md`.
+- Machine-readable capability registry, curriculum snapshot, JSON Schemas for the rule
+  and workload-profile structures, and a partial YAML projection of the catalog.
+- `tools/validate_skill.py` and a pytest suite, both run in CI.
+
+### Changed
+
+- **License is now MIT** (was PolyForm Noncommercial 1.0.0). Commercial use no longer
+  requires prior written authorization, and `docs/legal/COMMERCIAL-LICENSING.md` has
+  been removed. DSB names, logos, and curriculum content remain outside the license —
+  see `docs/legal/TRADEMARKS.md`.
+- README rewritten as a product front door: what it is, why it exists, install, three
+  prompts to try, and how the reasoning works.
+
+[0.1.0]: https://github.com/devsecblueprint/devsecops-claude-skill/releases/tag/v0.1.0

LICENSE.md

@@ -1,83 +1,21 @@
-# PolyForm Noncommercial License 1.0.0
-
-<https://polyformproject.org/licenses/noncommercial/1.0.0>
-
-Required Notice: Copyright © 2026 The DevSec Blueprint LLC. All rights reserved.
-
-Required Notice: Commercial use of this software requires prior written authorization from The DevSec Blueprint LLC.
-
-Required Notice: The DevSec Blueprint name, DSB name, logos, trademarks, service marks, and branding are not licensed under these terms.
-
-## Acceptance
-
-In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
-
-## Copyright License
-
-The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose. However, you may only distribute the software according to Distribution License and make changes or new works based on the software according to Changes and New Works License.
-
-## Distribution License
-
-The licensor grants you an additional copyright license to distribute copies of the software. Your license to distribute covers distributing the software with changes and new works permitted by Changes and New Works License.
-
-## Notices
-
-You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software. For example:
-
-> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
-
-## Changes and New Works License
-
-The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
-
-## Patent License
-
-The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
-
-## Noncommercial Purposes
-
-Any noncommercial purpose is a permitted purpose.
-
-## Personal Uses
-
-Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
-
-## Noncommercial Organizations
-
-Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
-
-## Fair Use
-
-You may have "fair use" rights for the software under the law. These terms do not limit them.
-
-## No Other Rights
-
-These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else. These terms do not imply any other licenses.
-
-## Patent Defense
-
-If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
-
-## Violations
-
-The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice. Otherwise, all your licenses end immediately.
-
-## No Liability
-
-As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.
-
-## Definitions
-
-The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
-
-**You** refers to the individual or entity agreeing to these terms.
-
-**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization. **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise. Control can be direct or indirect.
-
-**Your licenses** are all the licenses granted to you for the software under these terms.
-
-**Use** means anything you do with the software requiring one of your licenses.
-
----
-
-PolyForm Noncommercial License 1.0.0 is a standard license published by the PolyForm Project. The required notices above identify The DevSec Blueprint LLC and state conditions applicable to DSB-owned software distributed with this file.
+# MIT License
+
+Copyright (c) 2026 The DevSec Blueprint LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.