feat(cli)!: complyctl redesign#381

Open

jpower432 wants to merge 27 commits intocomplytime:mainfrom

jpower432:001-gemara-native-workflow

Member

jpower432 commented Feb 17, 2026 •

edited

Loading

Summary

The PR implements a complyctl to include plugin API and UX breaking changes.

Related Issues

Inform any issues relevant to this PR. For example:

Closes #ISSUE_NUMBER

Review Hints

For specs look at the first commit
For code changes look at the third commit

jpower432 requested review from gvauter and marcusburghardt

February 17, 2026 23:55

jpower432 force-pushed the 001-gemara-native-workflow branch 2 times, most recently from 1a8c16d to 0dc86bc Compare

February 18, 2026 21:19

Member Author

jpower432 commented Feb 18, 2026

@marcusburghardt I think we may need to exclude vendor directories from the linting checks

jpower432 force-pushed the 001-gemara-native-workflow branch 2 times, most recently from d1a107a to 47b0488 Compare

February 20, 2026 17:26

This was referenced Feb 23, 2026

chore: exclude vendor directory from lint checks #384

Merged

feat: CPLYTM-1302 - include a constitution file for speckit #387

Closed

marcusburghardt reviewed

View reviewed changes

Contributor

marcusburghardt left a comment

Some initial comments Jenn.

specs/001-gemara-native-workflow/contracts/README.md Outdated

+              - `targets`: Repeated `Target` entries (one per target to scan)
+                - `target_id`: Target identifier from workspace configuration
+                - `variables`: Plugin-defined variables map (plugin-specific configuration such as authentication tokens, connection strings, API endpoints, credentials). Each plugin defines what variables it expects.
+              - `requirement_ids`: Requirement IDs to evaluate (repeated string field). Plugins evaluate only the specified requirements.

Contributor

marcusburghardt Feb 24, 2026

Do we need to inform the requirement_ids during the SCAN considering the plugin policy is already "generated" including all requirements ids?

Member Author

jpower432 Feb 24, 2026

I think you are right the only thing I think we need at scan time is target information.

specs/001-gemara-native-workflow/contracts/README.md Show resolved Hide resolved

specs/001-gemara-native-workflow/contracts/README.md Show resolved Hide resolved

specs/001-gemara-native-workflow/contracts/README.md

+              - `plugin_info`: Plugin metadata
+              - `duration_seconds`: Execution time
+              **Note**: All targets configured in workspace config for the specified policy ID are scanned in a single Scan call.

Contributor

marcusburghardt Feb 24, 2026

I included a plugin configuration file for targets in ampel-plugin (#380). I wonder if we can create a targets configuration file generic enough for all plugins or should we keep this on the plugin responsibility since we are now considering more than only a local system.

Member Author

jpower432 Feb 24, 2026

There might be multiple plugins evaluating a single target. The plugin might have more granular knowledge of the specific target, but the host conveys the user selection.

specs/001-gemara-native-workflow/contracts/README.md

+. **Health Check**: Must respond to `HealthCheck` within 1 second
+. **API Version**: Must report correct API version in `HealthCheckResponse`
+. **Error Handling**: Must return appropriate gRPC status codes
+. **Timeout**: Must complete `Scan` within configured timeout (default: 5 minutes)

Contributor

marcusburghardt Feb 24, 2026

Should we define what to do when the timeout is reached? Maybe checking the plugin health before stopping?

Member Author

jpower432 Feb 24, 2026

Hmm. Maybe. I would wonder if the plugin would respond because it's up, but just has a blocking process.

Contributor

marcusburghardt Feb 27, 2026

The idea to check the status after the timeout is to finish the process only if it not responding for this timeout. In case a plugin is working in a time-consuming task for a particular target, it should be better to wait it to finish. Essentially it would differentiate time-consuming tasks than unresponsive plugins.

I understand this PR is already bringing many changes so all fine to discuss this further in a next opportunity.

specs/001-gemara-native-workflow/contracts/README.md

+. Configure `buf.yaml` and `buf.gen.yaml` in `api/proto/`
+. Run `buf generate` to generate Go code
+              **References**:

Contributor

marcusburghardt Feb 24, 2026

Maybe it would be good to include references for Gemara project, where the schemes are available.

Member Author

jpower432 Feb 24, 2026

Good idea!

specs/001-gemara-native-workflow/data-model.md Show resolved Hide resolved

specs/001-gemara-native-workflow/data-model.md


		### AssessmentConfiguration

		Configuration extracted from the policy graph and passed to plugins via Generate RPC.

Contributor

marcusburghardt Feb 24, 2026

gRPC

specs/001-gemara-native-workflow/data-model.md Outdated Show resolved Hide resolved

specs/001-gemara-native-workflow/quickstart.md Outdated Show resolved Hide resolved

marcusburghardt added 2 commits

February 25, 2026 11:56


          feat: include a constitution file for speckit

76efbef

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>


          docs: ratify complytime constitution for agent consumption

9e792d8

Refactor constitution from human-oriented style guide into
agent-enforceable directives. Normalize all rules to RFC 2119
(MUST/SHOULD/MAY), remove repository-specific references, add lint
configuration awareness rule, and define the incremental constitution
model for downstream repositories.

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>

jpower432 force-pushed the 001-gemara-native-workflow branch from 5c8ec26 to 0b59700 Compare

February 26, 2026 01:19

github-advanced-security bot found potential problems

View reviewed changes

.github/workflows/behavioral_assessment.yml Fixed Show fixed Hide fixed

jpower432 requested a review from marcusburghardt

February 26, 2026 01:20

jpower432 force-pushed the 001-gemara-native-workflow branch from 0b59700 to 78189bf Compare

February 26, 2026 02:02

marcusburghardt and others added 14 commits

February 26, 2026 12:16


          chore: fix yaml lint issues

babe234

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>


          chore: fix shellcheck lint issues

cc54b15

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>


          chore: fix python lint issues

f9c5ee9

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>


          chore: remove unnecessary line

399a172

It was also causing shellcheck to fail.

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>


          chore: update references with previously unnused variables

41b9dab

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>


          chore(deps): update vendored files

70a84f3

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>

# Conflicts:
#	vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go
#	vendor/github.com/cloudflare/circl/sign/sign.go
#	vendor/modules.txt


          docs: add spec files for redesign

1f7dace

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          docs: adds complytime redesign governance documetation

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          docs: updates documentation for redesign

f702798

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          feat!: updates logic and tests for complyctl redesign

65f5147

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          chore: exclude openscap vendor dir

ebd3e1e

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          fix: removes unused function

0897e58

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          chore: updates Go version in go.mod

40e60a3

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          feat: updates RPM spec and solution

ae8bbcc

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          chore: removes dead code and zombie features

b34d5d8

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>

jpower432 force-pushed the 001-gemara-native-workflow branch from 78189bf to b34d5d8 Compare

February 26, 2026 12:12

jpower432 added 2 commits

February 26, 2026 07:20


          Merge remote-tracking branch 'marcus-fork/lint-issues' into 001-gemar…

463f592

…a-native-workflow


          Merge remote-tracking branch 'marcus-fork/speckit-constitution' into …

223cf90

…001-gemara-native-workflow

jpower432 commented

View reviewed changes

cmd/complyctl/cli/list.go Outdated

+              	for _, p := range cfg.Policies {
+              		ref := complytime.ParsePolicyRef(p.URL)
+              		if _, ok := cached[ref.Repository]; !ok {
+              			cached[ref.Repository] = []string{"(not cached — " + p.EffectiveID() + ")"}

Member Author

jpower432 Feb 26, 2026

Good catch. Thanks @sonupreetam.

sonupreetam reviewed

View reviewed changes

cmd/complyctl/cli/list.go Outdated

+              	if plain {
+              		terminal.ShowPlainTable(w, columns, rows)
+              		return nil
+              	}

Contributor

sonupreetam Feb 26, 2026

@jpower432 Just a thought for UX part, I liked the generate output which actually more boxed than the list command terminal.ShowPlainTable. We can use the same border styles. WDYT?

Member Author

jpower432 Feb 27, 2026

Thanks @sonupreetam. I ended up removing these options and just went to with plain, tabular output. Seems like a much simpler solution and still look good (IMO).

sonupreetam reviewed

View reviewed changes

cmd/complyctl/cli/generate.go Outdated Show resolved Hide resolved

sonupreetam reviewed

View reviewed changes

internal/terminal/table.go Show resolved Hide resolved

sonupreetam reviewed

View reviewed changes

internal/output/execution_plan.go Outdated

    
              	routeRows := make([]table.Row, 0, len(routes))

              	for _, r := range routes {

              		pluginPath := r.PluginPath

Contributor

sonupreetam Feb 26, 2026

@jpower432 For UX, I think the plugin path could be shortened.

sonupreetam reviewed

View reviewed changes

Contributor

sonupreetam left a comment

@jpower432 Added minor suggestions on UX front. Everything else with UX part LGTM.

gvauter reviewed

View reviewed changes

Member

gvauter left a comment

Just left a few nit comments

specs/001-gemara-native-workflow/contracts/plugin.proto Outdated Show resolved Hide resolved

internal/policy/loader.go Outdated Show resolved Hide resolved

cmd/complyctl/cli/get.go Show resolved Hide resolved

internal/policy/resolver.go Outdated Show resolved Hide resolved

jpower432 added 3 commits

February 26, 2026 20:12


          feat: adds PR feedback

891a29a

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          fix: linting fixes

b58ea8c

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          chore: regenerate proto

01333b1

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>

jpower432 requested review from gvauter and sonupreetam

February 27, 2026 01:26

Member Author

jpower432 commented Feb 27, 2026 •

edited

Loading

Testing farm is failing here because all of the plans are removed, we might put them back, but the only plan was for OSCAL content. It may be simpler to squash-merge this.

jpower432 marked this pull request as ready for review

February 27, 2026 01:30

jpower432 requested review from a team as code owners

February 27, 2026 01:30

qduanmu mentioned this pull request

chore: fix old lint issues #385

Merged

marcusburghardt mentioned this pull request

feat: CPLYTM-1285 - add AMPEL plugin for complyctl #380

Draft

jpower432 added 5 commits

February 27, 2026 10:51


          docs: add back man pages

2bd1331

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          test: adds a testing farm plans to test functionality

93d6451

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          chore: removes out of scope specs

7f8f3d3

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          docs: updates documentation with latest workflow

5206d76

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>


          docs: add spec clarification on cache directory location

daa0d37

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet