devsecblueprint · leeclay95 · Aug 16, 2026 · Aug 16, 2026
@@ -0,0 +1,24 @@
+{
+  "name": "devsecops-engineer",
+  "version": "0.1.0",
+  "description": "Advise on, design, and assess CI/CD delivery pipelines using The DevSec Blueprint's Build → Test → Scan → Deploy DevSecOps engineering methodology.",
+  "author": {
+    "name": "The DevSec Blueprint",
+    "url": "https://github.com/devsecblueprint"
+  },
+  "homepage": "https://github.com/devsecblueprint/devsecops-claude-skill",
+  "repository": "https://github.com/devsecblueprint/devsecops-claude-skill",
+  "license": "MIT",
+  "keywords": [
+    "devsecops",
+    "cicd",
+    "pipeline",
+    "appsec",
+    "supply-chain",
+    "sast",
+    "sca",
+    "sbom",
+    "ssdf",
+    "slsa"
+  ]
+}
@@ -1,17 +1,21 @@
 # Ownership for The DSB DevSecOps Engineering Skill.
-# See MAINTAINERS.md. Later matches win, so the narrow rules come last.
+# See docs/MAINTAINERS.md. Later matches win, so the narrow rules come last.
 
 * @damienjburks
 
 # SKILL.md is the product. Every change to it is a change to guidance that
-# reaches users directly.
+# reaches users directly. commands/ and the plugin manifest define the public
+# entry points and the released version.
 /SKILL.md @damienjburks
+/commands/ @damienjburks
+/.claude-plugin/ @damienjburks
+/CHANGELOG.md @damienjburks
 
 # Rule content and the registries rules are validated against.
 /rules/ @damienjburks
 /references/ @damienjburks
 /schema/ @damienjburks
 
-# Licensing and contributor terms.
+# Project documentation, licensing, and contributor terms.
+/docs/ @damienjburks
 /LICENSE.md @damienjburks
-/docs/legal/ @damienjburks
@@ -7,7 +7,7 @@ body:
       value: |
         If the problem is that generated configuration would introduce a real
         security weakness, report it privately instead — see
-        [SECURITY.md](https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/SECURITY.md).
+        [SECURITY.md](https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/docs/SECURITY.md).
 
   - type: dropdown
     id: area

@@ -12,6 +12,6 @@ contact_links:
     url: https://github.com/devsecblueprint/devsecblueprint/issues/new
     about: The four phases and baseline principles come from DSB curriculum — raise those on the platform repository.
 
-  - name: Commercial licensing
-    url: https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/docs/legal/COMMERCIAL-LICENSING.md
-    about: Using this inside a company requires prior written authorization.
+  - name: Trademark and brand use
+    url: https://github.com/devsecblueprint/devsecops-claude-skill/blob/main/docs/legal/TRADEMARKS.md
+    about: The code is MIT. DSB names, logos, and curriculum content are not.
@@ -20,11 +20,21 @@ jobs:
         with:
           python-version: "3.13"
 
+      # DSB-BUILD-002: requirements.txt pins direct dependencies exactly, so a
+      # given commit resolves the same versions of the tools CI runs. Transitive
+      # versions still float — a fully hashed lock file is the next step up, and
+      # is only worth it if this repository starts shipping an executable
+      # artifact rather than Markdown.
       - name: Install dependencies
         run: pip install -r tools/requirements.txt
 
       - name: Validate SKILL.md
         run: python tools/validate_skill.py
 
+      # DSB-EVD-001: the generated index must match SKILL.md. tests/ covers this
+      # too; running it here names the fix in the failure output.
+      - name: Check generated mappings are current
+        run: python tools/generate_mappings.py --check
+
       - name: Run tests
         run: python -m pytest -v
@@ -0,0 +1,44 @@
+# Changelog
+
+All notable changes to this project are documented here. This project follows
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] — 2026-08-16
+
+Initial public release.
+
+**Pre-1.0.** The rule catalog and the skill's output structure will evolve based on
+real usage before 1.0. Rule *IDs* are the exception and are already stable: they
+appear in review output that ends up in audit records, so a retired ID is deprecated,
+never reused or renumbered.
+
+### Added
+
+- `SKILL.md` — the skill. Self-contained: 42 rules across 11 families, the
+  Build → Test → Scan → Deploy methodology, the twenty baseline principles, and the
+  Advise / Design / Review operating modes. Installing it needs this file and nothing
+  else.
+- Command entry points for Claude Code, under the `devsecops-engineer` plugin:
+  - `/devsecops-engineer:advise` — where controls belong, given a stack and the tools
+    already owned
+  - `/devsecops-engineer:design` — implementation-ready pipeline configuration
+  - `/devsecops-engineer:assess` — findings against an existing pipeline or repository
+- Worked examples across four stacks — greenfield GitHub Actions, an enterprise
+  Jenkins toolchain that introduces zero new scanners, a Terraform-only repository
+  where twelve rules are Not Applicable, and a review of a pipeline with real defects.
+- Framework mappings to NIST SSDF, SLSA, OWASP CI/CD, OWASP SAMM, and CNCF supply
+  chain guidance, generated from the rule catalog into `docs/framework-mappings.md`.
+- Machine-readable capability registry, curriculum snapshot, JSON Schemas for the rule
+  and workload-profile structures, and a partial YAML projection of the catalog.
+- `tools/validate_skill.py` and a pytest suite, both run in CI.
+
+### Changed
+
+- **License is now MIT** (was PolyForm Noncommercial 1.0.0). Commercial use no longer
+  requires prior written authorization, and `docs/legal/COMMERCIAL-LICENSING.md` has
+  been removed. DSB names, logos, and curriculum content remain outside the license —
+  see `docs/legal/TRADEMARKS.md`.
+- README rewritten as a product front door: what it is, why it exists, install, three
+  prompts to try, and how the reasoning works.
+
+[0.1.0]: https://github.com/devsecblueprint/devsecops-claude-skill/releases/tag/v0.1.0
@@ -1,83 +1,21 @@
-# PolyForm Noncommercial License 1.0.0
-
-<https://polyformproject.org/licenses/noncommercial/1.0.0>
-
-Required Notice: Copyright © 2026 The DevSec Blueprint LLC. All rights reserved.
-
-Required Notice: Commercial use of this software requires prior written authorization from The DevSec Blueprint LLC.
-
-Required Notice: The DevSec Blueprint name, DSB name, logos, trademarks, service marks, and branding are not licensed under these terms.
-
-## Acceptance
-
-In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
-
-## Copyright License
-
-The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose. However, you may only distribute the software according to Distribution License and make changes or new works based on the software according to Changes and New Works License.
-
-## Distribution License
-
-The licensor grants you an additional copyright license to distribute copies of the software. Your license to distribute covers distributing the software with changes and new works permitted by Changes and New Works License.
-
-## Notices
-
-You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software. For example:
-
-> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
-
-## Changes and New Works License
-
-The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
-
-## Patent License
-
-The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
-
-## Noncommercial Purposes
-
-Any noncommercial purpose is a permitted purpose.
-
-## Personal Uses
-
-Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
-
-## Noncommercial Organizations
-
-Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
-
-## Fair Use
-
-You may have "fair use" rights for the software under the law. These terms do not limit them.
-
-## No Other Rights
-
-These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else. These terms do not imply any other licenses.
-
-## Patent Defense
-
-If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
-
-## Violations
-
-The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice. Otherwise, all your licenses end immediately.
-
-## No Liability
-
-As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.
-
-## Definitions
-
-The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
-
-**You** refers to the individual or entity agreeing to these terms.
-
-**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization. **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise. Control can be direct or indirect.
-
-**Your licenses** are all the licenses granted to you for the software under these terms.
-
-**Use** means anything you do with the software requiring one of your licenses.
-
----
-
-PolyForm Noncommercial License 1.0.0 is a standard license published by the PolyForm Project. The required notices above identify The DevSec Blueprint LLC and state conditions applicable to DSB-owned software distributed with this file.
+# MIT License
+
+Copyright (c) 2026 The DevSec Blueprint LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.