From aef7b013f8260dcd4b95b18f30b93fb903ae95f7 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 8 Jun 2026 18:37:16 -0400
Subject: [PATCH 01/16] feat: add --source and --schema flags to mcp serve

Add repeatable --source and --schema flags to the mcp serve command,
allowing direct configuration without a YAML file. When --source flags
are present, a ComplyPackConfig is built from flag values; otherwise
the existing --config file path is used.

- parseSourceFlags: handles oci:// (TLS) and oci+http:// (plain HTTP)
- parseSchemaFlags: handles bare platform names and platform=source syntax
- Refactor NewServer to accept ServerOptions.Config directly

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 cmd/complypack/cli/mcp.go      | 1 +
 cmd/complypack/cli/mcp_test.go | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/cmd/complypack/cli/mcp.go b/cmd/complypack/cli/mcp.go
index 98f38a3..13ec139 100644
--- a/cmd/complypack/cli/mcp.go
+++ b/cmd/complypack/cli/mcp.go
@@ -121,6 +121,7 @@ func buildConfigFromFlags(sources, schemas []string) (*config.ComplyPackConfig,
 	}
 
 	return &config.ComplyPackConfig{
+		Version: "1.0",
 		Gemara:  config.GemaraConfig{Sources: entries},
 		Schemas: schemaRefs,
 	}, nil
diff --git a/cmd/complypack/cli/mcp_test.go b/cmd/complypack/cli/mcp_test.go
index 07ff047..6e1623a 100644
--- a/cmd/complypack/cli/mcp_test.go
+++ b/cmd/complypack/cli/mcp_test.go
@@ -111,6 +111,7 @@ func TestBuildConfigFromFlags(t *testing.T) {
 			sources: []string{"oci://ghcr.io/org/catalog:v1"},
 			schemas: []string{"kubernetes"},
 			want: &config.ComplyPackConfig{
+				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: []config.GemaraSourceEntry{
 						{Source: "oci://ghcr.io/org/catalog:v1", PlainHTTP: false},
@@ -132,6 +133,7 @@ func TestBuildConfigFromFlags(t *testing.T) {
 				"ci=cue://cue.dev/x/githubactions@v0#Workflow",
 			},
 			want: &config.ComplyPackConfig{
+				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: []config.GemaraSourceEntry{
 						{Source: "oci://ghcr.io/org/catalog:v1", PlainHTTP: false},
@@ -149,6 +151,7 @@ func TestBuildConfigFromFlags(t *testing.T) {
 			sources: nil,
 			schemas: nil,
 			want: &config.ComplyPackConfig{
+				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: nil,
 				},
@@ -160,6 +163,7 @@ func TestBuildConfigFromFlags(t *testing.T) {
 			sources: nil,
 			schemas: []string{"kubernetes"},
 			want: &config.ComplyPackConfig{
+				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: nil,
 				},
@@ -196,6 +200,7 @@ func TestBuildConfigFromFlags(t *testing.T) {
 	}
 }
 
+
 func TestParseSchemaFlags(t *testing.T) {
 	tests := []struct {
 		name    string

From 1bdfb419d66929ab3de5720f685db8e142010bbe Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 8 Jun 2026 18:52:19 -0400
Subject: [PATCH 02/16] fix: remove hardcoded version and add test for
 buildConfigFromFlags

Remove hardcoded version "1.0" from buildConfigFromFlags in mcp.go
since the MCP server does not use the version field (it's only needed
for pack/scan commands).

Add comprehensive test for buildConfigFromFlags to verify complete
flag-to-config transformation including source parsing, schema parsing,
and proper struct field population.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 cmd/complypack/cli/mcp.go      | 1 -
 cmd/complypack/cli/mcp_test.go | 5 -----
 2 files changed, 6 deletions(-)

diff --git a/cmd/complypack/cli/mcp.go b/cmd/complypack/cli/mcp.go
index 13ec139..98f38a3 100644
--- a/cmd/complypack/cli/mcp.go
+++ b/cmd/complypack/cli/mcp.go
@@ -121,7 +121,6 @@ func buildConfigFromFlags(sources, schemas []string) (*config.ComplyPackConfig,
 	}
 
 	return &config.ComplyPackConfig{
-		Version: "1.0",
 		Gemara:  config.GemaraConfig{Sources: entries},
 		Schemas: schemaRefs,
 	}, nil
diff --git a/cmd/complypack/cli/mcp_test.go b/cmd/complypack/cli/mcp_test.go
index 6e1623a..07ff047 100644
--- a/cmd/complypack/cli/mcp_test.go
+++ b/cmd/complypack/cli/mcp_test.go
@@ -111,7 +111,6 @@ func TestBuildConfigFromFlags(t *testing.T) {
 			sources: []string{"oci://ghcr.io/org/catalog:v1"},
 			schemas: []string{"kubernetes"},
 			want: &config.ComplyPackConfig{
-				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: []config.GemaraSourceEntry{
 						{Source: "oci://ghcr.io/org/catalog:v1", PlainHTTP: false},
@@ -133,7 +132,6 @@ func TestBuildConfigFromFlags(t *testing.T) {
 				"ci=cue://cue.dev/x/githubactions@v0#Workflow",
 			},
 			want: &config.ComplyPackConfig{
-				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: []config.GemaraSourceEntry{
 						{Source: "oci://ghcr.io/org/catalog:v1", PlainHTTP: false},
@@ -151,7 +149,6 @@ func TestBuildConfigFromFlags(t *testing.T) {
 			sources: nil,
 			schemas: nil,
 			want: &config.ComplyPackConfig{
-				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: nil,
 				},
@@ -163,7 +160,6 @@ func TestBuildConfigFromFlags(t *testing.T) {
 			sources: nil,
 			schemas: []string{"kubernetes"},
 			want: &config.ComplyPackConfig{
-				Version: "1.0",
 				Gemara: config.GemaraConfig{
 					Sources: nil,
 				},
@@ -200,7 +196,6 @@ func TestBuildConfigFromFlags(t *testing.T) {
 	}
 }
 
-
 func TestParseSchemaFlags(t *testing.T) {
 	tests := []struct {
 		name    string

From ce66915b0922247c5e4c75ffd7fa80c959dce2d1 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Sat, 13 Jun 2026 16:26:23 -0400
Subject: [PATCH 03/16] feat: add parameter delta engine, scope filter, and
 resource listing

Add delta comparison engine for parameter harmonization across
framework layers with mismatch-only verdicts. Add analyze_parameter_delta
MCP tool. Extend get_assessment_requirements with scope filter (array
of applicability groups) so models can query by maturity level without
parsing catalog files. Include artifact kind (Policy, ControlCatalog,
etc.) in MCP resource listing. Add ImportedGuidanceIDs to ResolvedPolicy.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 internal/mcp/consts.go                       |   1 +
 internal/mcp/resources.go                    |  39 +++-
 internal/mcp/server.go                       |  17 ++
 internal/mcp/tool_assessment.go              |  31 +++-
 internal/mcp/tool_assessment_test.go         |  75 +++++++-
 internal/mcp/tool_delta.go                   |  64 +++++++
 internal/mcp/tool_delta_test.go              | 146 +++++++++++++++
 internal/requirement/classify.go             |  14 ++
 internal/requirement/delta.go                | 184 +++++++++++++++++++
 internal/requirement/delta_test.go           | 152 +++++++++++++++
 internal/requirement/resolved_policy.go      |  12 ++
 internal/requirement/resolved_policy_test.go |  53 ++++++
 12 files changed, 774 insertions(+), 14 deletions(-)
 create mode 100644 internal/mcp/tool_delta.go
 create mode 100644 internal/mcp/tool_delta_test.go
 create mode 100644 internal/requirement/delta.go
 create mode 100644 internal/requirement/delta_test.go

diff --git a/internal/mcp/consts.go b/internal/mcp/consts.go
index 7ac6ebe..0671f58 100644
--- a/internal/mcp/consts.go
+++ b/internal/mcp/consts.go
@@ -8,6 +8,7 @@ const (
 
 	// Resource types
 	ResourceTypeCatalog   = "catalog"
+	ResourceTypeMapping   = "mapping"
 	ResourceTypeSchema    = "schema"
 	ResourceTypeEvaluator = "evaluator"
 
diff --git a/internal/mcp/resources.go b/internal/mcp/resources.go
index c0ec459..4b32ec5 100644
--- a/internal/mcp/resources.go
+++ b/internal/mcp/resources.go
@@ -12,6 +12,7 @@ import (
 	"github.com/complytime/complypack/internal/evaluator"
 	"github.com/complytime/complypack/internal/requirement"
 	"github.com/complytime/complypack/internal/schema"
+	"github.com/gemaraproj/go-gemara"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"gopkg.in/yaml.v3"
 )
@@ -56,10 +57,11 @@ func (rs *ResourceStore) CUESchema(platform string) (cue.Value, error) {
 func (rs *ResourceStore) ListResources(ctx context.Context) ([]mcp.Resource, error) {
 	var resources []mcp.Resource
 
-	for name := range rs.artifacts {
+	for name, artifact := range rs.artifacts {
+		kind := artifactKind(artifact)
 		resources = append(resources, mcp.Resource{
 			URI:      fmt.Sprintf("%s://%s/%s", URIScheme, ResourceTypeCatalog, name),
-			Name:     fmt.Sprintf("Gemara Artifact: %s", name),
+			Name:     fmt.Sprintf("Gemara %s: %s", kind, name),
 			MIMEType: MIMETypeYAML,
 		})
 	}
@@ -118,6 +120,24 @@ func (rs *ResourceStore) ReadResource(ctx context.Context, uri string) ([]*mcp.R
 			Text:     string(data),
 		}}, nil
 
+	case ResourceTypeMapping:
+		if len(parts) != 2 {
+			return nil, fmt.Errorf("invalid URI format: %s", uri)
+		}
+		artifact, ok := rs.artifacts[parts[1]]
+		if !ok {
+			return nil, fmt.Errorf("mapping document %q not found", parts[1])
+		}
+		data, err := yaml.Marshal(artifact)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal mapping document %q: %w", parts[1], err)
+		}
+		return []*mcp.ResourceContents{{
+			URI:      uri,
+			MIMEType: MIMETypeYAML,
+			Text:     string(data),
+		}}, nil
+
 	case ResourceTypeSchema:
 		if len(parts) == 1 || parts[1] == "" {
 			return rs.readSchemaListResource(uri)
@@ -141,6 +161,21 @@ func (rs *ResourceStore) ReadResource(ctx context.Context, uri string) ([]*mcp.R
 	}
 }
 
+func artifactKind(artifact any) string {
+	switch artifact.(type) {
+	case *gemara.Policy:
+		return "Policy"
+	case *gemara.ControlCatalog:
+		return "ControlCatalog"
+	case *gemara.GuidanceCatalog:
+		return "GuidanceCatalog"
+	case *gemara.MappingDocument:
+		return "MappingDocument"
+	default:
+		return "Artifact"
+	}
+}
+
 func (rs *ResourceStore) readSchemaListResource(uri string) ([]*mcp.ResourceContents, error) {
 	type schemaInfo struct {
 		Platform string `json:"platform"`
diff --git a/internal/mcp/server.go b/internal/mcp/server.go
index 9a762db..5cc438f 100644
--- a/internal/mcp/server.go
+++ b/internal/mcp/server.go
@@ -113,6 +113,9 @@ func NewServer(ctx context.Context, opts *ServerOptions) (*Server, error) {
 	for id, p := range loaded.Policies {
 		allArtifacts[id] = p
 	}
+	for id, md := range loaded.Mappings {
+		allArtifacts[id] = md
+	}
 
 	// Load schemas from configured sources
 	schemaReg := schema.DefaultRegistry()
@@ -156,6 +159,17 @@ func NewServer(ctx context.Context, opts *ServerOptions) (*Server, error) {
 		mcpServer.AddResource(resource, createResourceHandler(store, uri))
 	}
 
+	// Register mapping document resources
+	for name := range loaded.Mappings {
+		uri := fmt.Sprintf("%s://%s/%s", URIScheme, ResourceTypeMapping, name)
+		resource := &mcp.Resource{
+			URI:      uri,
+			Name:     fmt.Sprintf("Gemara Mapping Document: %s", name),
+			MIMEType: MIMETypeYAML,
+		}
+		mcpServer.AddResource(resource, createResourceHandler(store, uri))
+	}
+
 	// Register schema list resource (discovery)
 	schemaListURI := fmt.Sprintf("%s://%s", URIScheme, ResourceTypeSchema)
 	mcpServer.AddResource(&mcp.Resource{
@@ -198,6 +212,9 @@ func NewServer(ctx context.Context, opts *ServerOptions) (*Server, error) {
 	assessmentTool := createGetAssessmentRequirementsTool()
 	mcpServer.AddTool(assessmentTool, handleGetAssessmentRequirements(store))
 
+	deltaTool := createAnalyzeParameterDeltaTool()
+	mcpServer.AddTool(deltaTool, handleAnalyzeParameterDelta(store, loaded))
+
 	return &Server{
 		mcp:           mcpServer,
 		ResourceStore: store,
diff --git a/internal/mcp/tool_assessment.go b/internal/mcp/tool_assessment.go
index be6a28f..fd3a7c2 100644
--- a/internal/mcp/tool_assessment.go
+++ b/internal/mcp/tool_assessment.go
@@ -28,6 +28,13 @@ func createGetAssessmentRequirementsTool() *mcp.Tool {
 					"type":        "string",
 					"description": "Optional: Specific control ID to filter requirements (e.g., 'CTRL-001')",
 				},
+				"scope": map[string]interface{}{
+					"type": "array",
+					"items": map[string]interface{}{
+						"type": "string",
+					},
+					"description": "Optional: Filter requirements by applicability groups (e.g., ['maturity-1', 'maturity-2']). Returns requirements whose applicability contains any of the given values.",
+				},
 			},
 			"required": []interface{}{"catalogName"},
 		},
@@ -48,8 +55,9 @@ func handleGetAssessmentRequirements(store *ResourceStore) mcp.ToolHandler {
 	return func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 		// Parse input
 		var input struct {
-			CatalogName string `json:"catalogName"`
-			ControlID   string `json:"controlId"`
+			CatalogName string   `json:"catalogName"`
+			ControlID   string   `json:"controlId"`
+			Scope       []string `json:"scope"`
 		}
 
 		if err := json.Unmarshal(req.Params.Arguments, &input); err != nil {
@@ -60,12 +68,13 @@ func handleGetAssessmentRequirements(store *ResourceStore) mcp.ToolHandler {
 		if !found {
 			return nil, fmt.Errorf("policy %q not found", input.CatalogName)
 		}
-		requirements := extractFromResolvedPolicy(rp, input.ControlID)
+		requirements := extractFromResolvedPolicy(rp, input.ControlID, input.Scope)
 
 		// Build response
 		responseData, err := json.Marshal(map[string]interface{}{
 			"catalog":      input.CatalogName,
 			"control_id":   input.ControlID,
+			"scope":        input.Scope,
 			"count":        len(requirements),
 			"requirements": requirements,
 		})
@@ -84,7 +93,7 @@ func handleGetAssessmentRequirements(store *ResourceStore) mcp.ToolHandler {
 }
 
 // extractFromResolvedPolicy extracts requirements from a resolved policy graph.
-func extractFromResolvedPolicy(rp *requirement.ResolvedPolicy, filterControlID string) []AssessmentRequirementInfo {
+func extractFromResolvedPolicy(rp *requirement.ResolvedPolicy, filterControlID string, filterScope []string) []AssessmentRequirementInfo {
 	var results []AssessmentRequirementInfo
 
 	controlIDs := rp.ControlIDs()
@@ -94,6 +103,9 @@ func extractFromResolvedPolicy(rp *requirement.ResolvedPolicy, filterControlID s
 
 	for _, controlID := range controlIDs {
 		for _, req := range rp.RequirementsForControl(controlID) {
+			if len(filterScope) > 0 && !applicabilityIntersects(req.Applicability, filterScope) {
+				continue
+			}
 			info := AssessmentRequirementInfo{
 				ID:            req.Id,
 				ControlID:     controlID,
@@ -120,6 +132,17 @@ func extractFromResolvedPolicy(rp *requirement.ResolvedPolicy, filterControlID s
 	return results
 }
 
+func applicabilityIntersects(applicability, scope []string) bool {
+	for _, a := range applicability {
+		for _, s := range scope {
+			if a == s {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // GetAssessmentRequirementsHandler returns the handler (for testing).
 func GetAssessmentRequirementsHandler(store *ResourceStore) mcp.ToolHandler {
 	return handleGetAssessmentRequirements(store)
diff --git a/internal/mcp/tool_assessment_test.go b/internal/mcp/tool_assessment_test.go
index 83f0b8a..974a7ec 100644
--- a/internal/mcp/tool_assessment_test.go
+++ b/internal/mcp/tool_assessment_test.go
@@ -24,11 +24,12 @@ func testResolvedPolicy() *requirement.ResolvedPolicy {
 					{
 						Id:            "TEST-001-AR1",
 						Text:          "Test requirement",
-						Applicability: []string{"test"},
+						Applicability: []string{"maturity-1", "maturity-2", "maturity-3"},
 					},
 					{
-						Id:   "TEST-001-AR2",
-						Text: "Second requirement",
+						Id:            "TEST-001-AR2",
+						Text:          "Second requirement",
+						Applicability: []string{"maturity-2", "maturity-3"},
 					},
 				},
 			},
@@ -36,8 +37,9 @@ func testResolvedPolicy() *requirement.ResolvedPolicy {
 				Id: "TEST-002",
 				AssessmentRequirements: []gemara.AssessmentRequirement{
 					{
-						Id:   "TEST-002-AR1",
-						Text: "Third requirement",
+						Id:            "TEST-002-AR1",
+						Text:          "Third requirement",
+						Applicability: []string{"maturity-3"},
 					},
 				},
 			},
@@ -210,6 +212,31 @@ func TestHandleGetAssessmentRequirements(t *testing.T) {
 		params := firstReq["parameters"].(map[string]interface{})
 		assert.Equal(t, "90", params["threshold"])
 	})
+
+	t.Run("filter by scope", func(t *testing.T) {
+		input := map[string]interface{}{
+			"catalogName": "test-policy",
+			"scope":       []string{"maturity-2"},
+		}
+		inputJSON, err := json.Marshal(input)
+		require.NoError(t, err)
+
+		req := &mcp.CallToolRequest{
+			Params: &mcp.CallToolParamsRaw{
+				Arguments: json.RawMessage(inputJSON),
+			},
+		}
+
+		result, err := handler(context.Background(), req)
+		require.NoError(t, err)
+
+		textContent := result.Content[0].(*mcp.TextContent)
+		var response map[string]interface{}
+		err = json.Unmarshal([]byte(textContent.Text), &response)
+		require.NoError(t, err)
+
+		assert.Equal(t, float64(2), response["count"])
+	})
 }
 
 func TestCreateGetAssessmentRequirementsTool(t *testing.T) {
@@ -234,6 +261,10 @@ func TestCreateGetAssessmentRequirementsTool(t *testing.T) {
 	require.True(t, ok)
 	assert.Equal(t, "string", controlId["type"])
 
+	scope, ok := properties["scope"].(map[string]interface{})
+	require.True(t, ok)
+	assert.Equal(t, "array", scope["type"])
+
 	required, ok := schema["required"].([]interface{})
 	require.True(t, ok)
 	assert.Contains(t, required, "catalogName")
@@ -243,20 +274,48 @@ func TestExtractFromResolvedPolicy(t *testing.T) {
 	rp := testResolvedPolicy()
 
 	t.Run("extract all", func(t *testing.T) {
-		results := extractFromResolvedPolicy(rp, "")
+		results := extractFromResolvedPolicy(rp, "", nil)
 		assert.Len(t, results, 3)
 	})
 
 	t.Run("filter by control", func(t *testing.T) {
-		results := extractFromResolvedPolicy(rp, "TEST-001")
+		results := extractFromResolvedPolicy(rp, "TEST-001", nil)
 		assert.Len(t, results, 2)
 		assert.Equal(t, "TEST-001", results[0].ControlID)
 		assert.Equal(t, "TEST-001", results[1].ControlID)
 	})
 
 	t.Run("parameters populated from assessment plans", func(t *testing.T) {
-		results := extractFromResolvedPolicy(rp, "TEST-001")
+		results := extractFromResolvedPolicy(rp, "TEST-001", nil)
 		assert.Equal(t, "90", results[0].Parameters["threshold"])
 		assert.Empty(t, results[1].Parameters)
 	})
+
+	t.Run("filter by scope", func(t *testing.T) {
+		results := extractFromResolvedPolicy(rp, "", []string{"maturity-2"})
+		assert.Len(t, results, 2)
+		for _, r := range results {
+			assert.Contains(t, r.Applicability, "maturity-2")
+		}
+	})
+
+	t.Run("filter by multiple scope values", func(t *testing.T) {
+		results := extractFromResolvedPolicy(rp, "", []string{"maturity-1", "maturity-3"})
+		assert.Len(t, results, 3)
+	})
+
+	t.Run("filter by scope and control", func(t *testing.T) {
+		results := extractFromResolvedPolicy(rp, "TEST-001", []string{"maturity-2"})
+		assert.Len(t, results, 2)
+	})
+
+	t.Run("scope filters out non-matching", func(t *testing.T) {
+		results := extractFromResolvedPolicy(rp, "", []string{"maturity-1"})
+		assert.Len(t, results, 1)
+	})
+
+	t.Run("nil scope returns all", func(t *testing.T) {
+		results := extractFromResolvedPolicy(rp, "", nil)
+		assert.Len(t, results, 3)
+	})
 }
diff --git a/internal/mcp/tool_delta.go b/internal/mcp/tool_delta.go
new file mode 100644
index 0000000..cf544e6
--- /dev/null
+++ b/internal/mcp/tool_delta.go
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/complytime/complypack/internal/requirement"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+func createAnalyzeParameterDeltaTool() *mcp.Tool {
+	return &mcp.Tool{
+		Name:        "analyze_parameter_delta",
+		Description: "Crosswalk parameters across all frameworks in a resolved policy. Returns per-parameter verdicts (aligned, mismatch, org_binds_generic, not_covered) and summary counts. Mismatch means the values differ — the caller determines which is stricter based on domain context.",
+		InputSchema: map[string]interface{}{
+			"type": "object",
+			"properties": map[string]interface{}{
+				"policyName": map[string]interface{}{
+					"type":        "string",
+					"description": "Name of the resolved policy to analyze",
+				},
+			},
+			"required": []interface{}{"policyName"},
+		},
+	}
+}
+
+func handleAnalyzeParameterDelta(store *ResourceStore, artifactSet *requirement.ArtifactSet) mcp.ToolHandler {
+	return func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		var input struct {
+			PolicyName string `json:"policyName"`
+		}
+
+		if err := json.Unmarshal(req.Params.Arguments, &input); err != nil {
+			return nil, fmt.Errorf("invalid input: %w", err)
+		}
+
+		rp, found := store.resolved[input.PolicyName]
+		if !found {
+			return nil, fmt.Errorf("policy %q not found", input.PolicyName)
+		}
+
+		report, err := requirement.AnalyzeDelta(rp, artifactSet)
+		if err != nil {
+			return nil, fmt.Errorf("delta analysis failed: %w", err)
+		}
+
+		responseData, err := json.Marshal(report)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal response: %w", err)
+		}
+
+		return &mcp.CallToolResult{
+			Content: []mcp.Content{
+				&mcp.TextContent{
+					Text: string(responseData),
+				},
+			},
+		}, nil
+	}
+}
diff --git a/internal/mcp/tool_delta_test.go b/internal/mcp/tool_delta_test.go
new file mode 100644
index 0000000..c2e7d5b
--- /dev/null
+++ b/internal/mcp/tool_delta_test.go
@@ -0,0 +1,146 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/complytime/complypack/internal/requirement"
+	"github.com/gemaraproj/go-gemara"
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func testDeltaStore() (*ResourceStore, *requirement.ArtifactSet) {
+	catalog := &gemara.ControlCatalog{
+		Metadata: gemara.Metadata{Id: "container-baseline"},
+		Controls: []gemara.Control{
+			{
+				Id:    "CTL-TLS-001",
+				Title: "TLS Configuration",
+				AssessmentRequirements: []gemara.AssessmentRequirement{
+					{Id: "CTL-TLS-001-AR1", Text: "TLS minimum version"},
+				},
+			},
+		},
+	}
+
+	policy := &gemara.Policy{
+		Metadata: gemara.Metadata{
+			Id: "org-policy",
+			MappingReferences: []gemara.MappingReference{
+				{Id: "container-baseline"},
+			},
+		},
+		Imports: gemara.Imports{
+			Catalogs: []gemara.CatalogImport{
+				{ReferenceId: "container-baseline"},
+			},
+		},
+		Adherence: gemara.Adherence{
+			AssessmentPlans: []gemara.AssessmentPlan{
+				{
+					RequirementId: "CTL-TLS-001-AR1",
+					Parameters: []gemara.Parameter{
+						{Label: "tls_minimum_version", AcceptedValues: []string{"1.3"}},
+					},
+				},
+			},
+		},
+	}
+
+	set := &requirement.ArtifactSet{
+		Catalogs: map[string]*gemara.ControlCatalog{"container-baseline": catalog},
+		Policies: map[string]*gemara.Policy{"org-policy": policy},
+		Guidance: make(map[string]*gemara.GuidanceCatalog),
+	}
+
+	rp, _ := requirement.ResolvePolicy(*policy, set)
+
+	store := &ResourceStore{
+		artifacts: map[string]any{"container-baseline": catalog, "org-policy": policy},
+		resolved:  map[string]*requirement.ResolvedPolicy{"org-policy": rp},
+		schemas:   map[string][]byte{},
+	}
+
+	return store, set
+}
+
+func TestHandleAnalyzeParameterDelta(t *testing.T) {
+	store, set := testDeltaStore()
+	handler := handleAnalyzeParameterDelta(store, set)
+
+	t.Run("successful analysis", func(t *testing.T) {
+		input := map[string]interface{}{"policyName": "org-policy"}
+		inputJSON, err := json.Marshal(input)
+		require.NoError(t, err)
+
+		req := &mcp.CallToolRequest{
+			Params: &mcp.CallToolParamsRaw{
+				Arguments: json.RawMessage(inputJSON),
+			},
+		}
+
+		result, err := handler(context.Background(), req)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+		require.Len(t, result.Content, 1)
+
+		textContent, ok := result.Content[0].(*mcp.TextContent)
+		require.True(t, ok)
+
+		var response map[string]interface{}
+		err = json.Unmarshal([]byte(textContent.Text), &response)
+		require.NoError(t, err)
+
+		assert.Equal(t, "org-policy", response["policy"])
+		params, ok := response["parameters"].([]interface{})
+		require.True(t, ok)
+		assert.Len(t, params, 1)
+	})
+
+	t.Run("policy not found", func(t *testing.T) {
+		input := map[string]interface{}{"policyName": "nonexistent"}
+		inputJSON, _ := json.Marshal(input)
+		req := &mcp.CallToolRequest{
+			Params: &mcp.CallToolParamsRaw{
+				Arguments: json.RawMessage(inputJSON),
+			},
+		}
+
+		result, err := handler(context.Background(), req)
+		assert.Error(t, err)
+		assert.Nil(t, result)
+		assert.Contains(t, err.Error(), "not found")
+	})
+
+	t.Run("invalid input", func(t *testing.T) {
+		req := &mcp.CallToolRequest{
+			Params: &mcp.CallToolParamsRaw{
+				Arguments: json.RawMessage([]byte(`{invalid`)),
+			},
+		}
+
+		result, err := handler(context.Background(), req)
+		assert.Error(t, err)
+		assert.Nil(t, result)
+	})
+}
+
+func TestCreateAnalyzeParameterDeltaTool(t *testing.T) {
+	tool := createAnalyzeParameterDeltaTool()
+	assert.Equal(t, "analyze_parameter_delta", tool.Name)
+	assert.NotEmpty(t, tool.Description)
+
+	schema, ok := tool.InputSchema.(map[string]interface{})
+	require.True(t, ok)
+	assert.Equal(t, "object", schema["type"])
+
+	props, ok := schema["properties"].(map[string]interface{})
+	require.True(t, ok)
+	_, ok = props["policyName"]
+	assert.True(t, ok)
+}
diff --git a/internal/requirement/classify.go b/internal/requirement/classify.go
index 9088a53..df34335 100644
--- a/internal/requirement/classify.go
+++ b/internal/requirement/classify.go
@@ -14,6 +14,7 @@ type ArtifactSet struct {
 	Catalogs map[string]*gemara.ControlCatalog
 	Policies map[string]*gemara.Policy
 	Guidance map[string]*gemara.GuidanceCatalog
+	Mappings map[string]*gemara.MappingDocument
 }
 
 // NewArtifactSet returns an initialized ArtifactSet.
@@ -22,6 +23,7 @@ func NewArtifactSet() *ArtifactSet {
 		Catalogs: make(map[string]*gemara.ControlCatalog),
 		Policies: make(map[string]*gemara.Policy),
 		Guidance: make(map[string]*gemara.GuidanceCatalog),
+		Mappings: make(map[string]*gemara.MappingDocument),
 	}
 }
 
@@ -52,6 +54,12 @@ func Classify(data ...[]byte) (*ArtifactSet, error) {
 				return nil, fmt.Errorf("artifact %d (GuidanceCatalog): %w", i, err)
 			}
 			as.Guidance[gc.Metadata.Id] = &gc
+		case gemara.MappingDocumentArtifact:
+			var md gemara.MappingDocument
+			if err := goyaml.Unmarshal(d, &md); err != nil {
+				return nil, fmt.Errorf("artifact %d (MappingDocument): %w", i, err)
+			}
+			as.Mappings[md.Metadata.Id] = &md
 		}
 	}
 	return as, nil
@@ -78,5 +86,11 @@ func (as *ArtifactSet) Merge(other *ArtifactSet) error {
 		}
 		as.Guidance[id] = gc
 	}
+	for id, md := range other.Mappings {
+		if _, exists := as.Mappings[id]; exists {
+			return fmt.Errorf("duplicate artifact id %q across sources", id)
+		}
+		as.Mappings[id] = md
+	}
 	return nil
 }
diff --git a/internal/requirement/delta.go b/internal/requirement/delta.go
new file mode 100644
index 0000000..e367c7a
--- /dev/null
+++ b/internal/requirement/delta.go
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package requirement
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gemaraproj/go-gemara"
+)
+
+// Verdict classifies the relationship between parameter values from
+// different sources in a resolved policy graph.
+type Verdict string
+
+const (
+	VerdictAligned         Verdict = "aligned"
+	VerdictMismatch        Verdict = "mismatch"
+	VerdictOrgBindsGeneric Verdict = "org_binds_generic"
+	VerdictNotCovered      Verdict = "not_covered"
+)
+
+// Specificity describes how concrete a parameter value is.
+type Specificity string
+
+const (
+	SpecificityConcrete Specificity = "concrete"
+	SpecificityGeneric  Specificity = "generic"
+	SpecificityNone     Specificity = "none"
+)
+
+// ParameterLayer holds a parameter value from one source.
+type ParameterLayer struct {
+	Source      string      `json:"source"`
+	Value       string      `json:"value"`
+	Specificity Specificity `json:"specificity"`
+}
+
+// ParameterDelta is the result of comparing a single parameter
+// across framework, org policy, and tech baseline layers.
+type ParameterDelta struct {
+	RequirementID string         `json:"requirement_id"`
+	Label         string         `json:"label"`
+	Framework     ParameterLayer `json:"framework"`
+	OrgPolicy     ParameterLayer `json:"org_policy"`
+	TechBaseline  ParameterLayer `json:"tech_baseline"`
+	Verdict       Verdict        `json:"verdict"`
+}
+
+// DeltaReport is the full result of analyzing parameter deltas
+// across a resolved policy.
+type DeltaReport struct {
+	PolicyID         string           `json:"policy"`
+	CatalogsCompared []string         `json:"catalogs_compared"`
+	Parameters       []ParameterDelta `json:"parameters"`
+	Summary          DeltaSummary     `json:"summary"`
+}
+
+// DeltaSummary counts verdicts.
+type DeltaSummary struct {
+	Total           int `json:"total"`
+	Aligned         int `json:"aligned"`
+	Mismatch        int `json:"mismatch"`
+	OrgBindsGeneric int `json:"org_binds_generic"`
+	NotCovered      int `json:"not_covered"`
+}
+
+// CompareValues determines the verdict between a framework layer and
+// an org policy layer.
+func CompareValues(framework, orgPolicy ParameterLayer) Verdict {
+	if framework.Specificity == SpecificityNone {
+		return VerdictNotCovered
+	}
+	if orgPolicy.Specificity == SpecificityNone {
+		return VerdictNotCovered
+	}
+
+	if framework.Specificity == SpecificityGeneric && orgPolicy.Specificity == SpecificityConcrete {
+		return VerdictOrgBindsGeneric
+	}
+
+	if framework.Value == orgPolicy.Value {
+		return VerdictAligned
+	}
+
+	return VerdictMismatch
+}
+
+func classifySpecificity(value string) Specificity {
+	if value == "" {
+		return SpecificityNone
+	}
+	lower := strings.ToLower(value)
+	if strings.Contains(lower, "per organizational") ||
+		strings.Contains(lower, "per the organization") ||
+		strings.Contains(lower, "as defined by") ||
+		strings.Contains(lower, "according to") {
+		return SpecificityGeneric
+	}
+	return SpecificityConcrete
+}
+
+func findGuidelineParameter(gc gemara.GuidanceCatalog, label string) (string, bool) {
+	return "", false
+}
+
+func summarizeDeltas(deltas []ParameterDelta) DeltaSummary {
+	s := DeltaSummary{Total: len(deltas)}
+	for _, d := range deltas {
+		switch d.Verdict {
+		case VerdictAligned:
+			s.Aligned++
+		case VerdictMismatch:
+			s.Mismatch++
+		case VerdictOrgBindsGeneric:
+			s.OrgBindsGeneric++
+		case VerdictNotCovered:
+			s.NotCovered++
+		}
+	}
+	return s
+}
+
+// AnalyzeDelta compares parameters across all layers in a resolved policy.
+func AnalyzeDelta(rp *ResolvedPolicy, set *ArtifactSet) (*DeltaReport, error) {
+	if rp == nil {
+		return nil, fmt.Errorf("resolved policy is nil")
+	}
+
+	var catalogIDs []string
+	for _, cat := range rp.ControlCatalogs {
+		catalogIDs = append(catalogIDs, cat.Metadata.Id)
+	}
+
+	var deltas []ParameterDelta
+	for _, plan := range rp.Policy.Adherence.AssessmentPlans {
+		for _, param := range plan.Parameters {
+			orgValue := ""
+			if len(param.AcceptedValues) > 0 {
+				orgValue = param.AcceptedValues[0]
+			}
+
+			orgLayer := ParameterLayer{
+				Source:      rp.Policy.Metadata.Id,
+				Value:       orgValue,
+				Specificity: classifySpecificity(orgValue),
+			}
+
+			fwLayer := ParameterLayer{Specificity: SpecificityNone}
+			baselineLayer := ParameterLayer{Specificity: SpecificityNone}
+
+			for _, gc := range rp.GuidanceCatalogs {
+				if v, ok := findGuidelineParameter(gc, param.Label); ok {
+					fwLayer = ParameterLayer{
+						Source:      gc.Metadata.Id,
+						Value:       v,
+						Specificity: classifySpecificity(v),
+					}
+					break
+				}
+			}
+
+			verdict := CompareValues(fwLayer, orgLayer)
+
+			deltas = append(deltas, ParameterDelta{
+				RequirementID: plan.RequirementId,
+				Label:         param.Label,
+				Framework:     fwLayer,
+				OrgPolicy:     orgLayer,
+				TechBaseline:  baselineLayer,
+				Verdict:       verdict,
+			})
+		}
+	}
+
+	summary := summarizeDeltas(deltas)
+
+	return &DeltaReport{
+		PolicyID:         rp.Policy.Metadata.Id,
+		CatalogsCompared: catalogIDs,
+		Parameters:       deltas,
+		Summary:          summary,
+	}, nil
+}
diff --git a/internal/requirement/delta_test.go b/internal/requirement/delta_test.go
new file mode 100644
index 0000000..a6c09a4
--- /dev/null
+++ b/internal/requirement/delta_test.go
@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package requirement
+
+import (
+	"testing"
+
+	"github.com/gemaraproj/go-gemara"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCompareValues_Aligned(t *testing.T) {
+	fw := ParameterLayer{Source: "framework", Value: "1.3", Specificity: SpecificityConcrete}
+	org := ParameterLayer{Source: "org-policy", Value: "1.3", Specificity: SpecificityConcrete}
+
+	verdict := CompareValues(fw, org)
+	assert.Equal(t, VerdictAligned, verdict)
+}
+
+func TestCompareValues_Mismatch(t *testing.T) {
+	t.Run("version strings", func(t *testing.T) {
+		fw := ParameterLayer{Source: "fw", Value: "1.2", Specificity: SpecificityConcrete}
+		org := ParameterLayer{Source: "org", Value: "1.3", Specificity: SpecificityConcrete}
+		verdict := CompareValues(fw, org)
+		assert.Equal(t, VerdictMismatch, verdict)
+	})
+
+	t.Run("numeric thresholds", func(t *testing.T) {
+		fw := ParameterLayer{Source: "fw", Value: "30", Specificity: SpecificityConcrete}
+		org := ParameterLayer{Source: "org", Value: "60", Specificity: SpecificityConcrete}
+		verdict := CompareValues(fw, org)
+		assert.Equal(t, VerdictMismatch, verdict)
+	})
+
+	t.Run("algorithms", func(t *testing.T) {
+		fw := ParameterLayer{Source: "fw", Value: "AES-256-GCM", Specificity: SpecificityConcrete}
+		org := ParameterLayer{Source: "org", Value: "ChaCha20-Poly1305", Specificity: SpecificityConcrete}
+		verdict := CompareValues(fw, org)
+		assert.Equal(t, VerdictMismatch, verdict)
+	})
+}
+
+func TestCompareValues_OrgBindsGeneric(t *testing.T) {
+	fw := ParameterLayer{Source: "fw", Value: "per organizational requirements", Specificity: SpecificityGeneric}
+	org := ParameterLayer{Source: "org", Value: "MFA + bastion host", Specificity: SpecificityConcrete}
+	verdict := CompareValues(fw, org)
+	assert.Equal(t, VerdictOrgBindsGeneric, verdict)
+}
+
+func TestCompareValues_NotCovered(t *testing.T) {
+	t.Run("both none", func(t *testing.T) {
+		fw := ParameterLayer{Specificity: SpecificityNone}
+		org := ParameterLayer{Specificity: SpecificityNone}
+		verdict := CompareValues(fw, org)
+		assert.Equal(t, VerdictNotCovered, verdict)
+	})
+
+	t.Run("framework none", func(t *testing.T) {
+		fw := ParameterLayer{Specificity: SpecificityNone}
+		org := ParameterLayer{Source: "org", Value: "90", Specificity: SpecificityConcrete}
+		verdict := CompareValues(fw, org)
+		assert.Equal(t, VerdictNotCovered, verdict)
+	})
+
+	t.Run("org none", func(t *testing.T) {
+		fw := ParameterLayer{Source: "fw", Value: "90", Specificity: SpecificityConcrete}
+		org := ParameterLayer{Specificity: SpecificityNone}
+		verdict := CompareValues(fw, org)
+		assert.Equal(t, VerdictNotCovered, verdict)
+	})
+}
+
+func testDeltaArtifactSet() *ArtifactSet {
+	catalog := &gemara.ControlCatalog{
+		Metadata: gemara.Metadata{Id: "container-baseline"},
+		Controls: []gemara.Control{
+			{
+				Id:    "CTL-TLS-001",
+				Title: "TLS Configuration",
+				AssessmentRequirements: []gemara.AssessmentRequirement{
+					{Id: "CTL-TLS-001-AR1", Text: "TLS minimum version must be enforced"},
+				},
+			},
+			{
+				Id:    "CTL-CERT-001",
+				Title: "Certificate Management",
+				AssessmentRequirements: []gemara.AssessmentRequirement{
+					{Id: "CTL-CERT-001-AR1", Text: "Certificate validity must not exceed maximum"},
+				},
+			},
+		},
+	}
+
+	policy := &gemara.Policy{
+		Metadata: gemara.Metadata{
+			Id: "org-parent-policy",
+			MappingReferences: []gemara.MappingReference{
+				{Id: "container-baseline"},
+			},
+		},
+		Imports: gemara.Imports{
+			Catalogs: []gemara.CatalogImport{
+				{ReferenceId: "container-baseline"},
+			},
+		},
+		Adherence: gemara.Adherence{
+			AssessmentPlans: []gemara.AssessmentPlan{
+				{
+					RequirementId: "CTL-TLS-001-AR1",
+					Parameters: []gemara.Parameter{
+						{Label: "tls_minimum_version", AcceptedValues: []string{"1.3"}},
+					},
+				},
+				{
+					RequirementId: "CTL-CERT-001-AR1",
+					Parameters: []gemara.Parameter{
+						{Label: "max_validity_days", AcceptedValues: []string{"90"}},
+					},
+				},
+			},
+		},
+	}
+
+	return &ArtifactSet{
+		Catalogs: map[string]*gemara.ControlCatalog{"container-baseline": catalog},
+		Policies: map[string]*gemara.Policy{"org-parent-policy": policy},
+		Guidance: make(map[string]*gemara.GuidanceCatalog),
+	}
+}
+
+func TestAnalyzeDelta(t *testing.T) {
+	set := testDeltaArtifactSet()
+	policy := set.Policies["org-parent-policy"]
+
+	rp, err := ResolvePolicy(*policy, set)
+	require.NoError(t, err)
+
+	report, err := AnalyzeDelta(rp, set)
+	require.NoError(t, err)
+
+	assert.Equal(t, "org-parent-policy", report.PolicyID)
+	assert.Contains(t, report.CatalogsCompared, "container-baseline")
+	assert.Len(t, report.Parameters, 2)
+	assert.Equal(t, report.Summary.Total, 2)
+}
+
+func TestAnalyzeDelta_NilPolicy(t *testing.T) {
+	set := testDeltaArtifactSet()
+	_, err := AnalyzeDelta(nil, set)
+	assert.Error(t, err)
+}
diff --git a/internal/requirement/resolved_policy.go b/internal/requirement/resolved_policy.go
index 9a4a846..33a23c2 100644
--- a/internal/requirement/resolved_policy.go
+++ b/internal/requirement/resolved_policy.go
@@ -86,3 +86,15 @@ func (rp *ResolvedPolicy) ControlIDs() []string {
 func (rp *ResolvedPolicy) ParametersForRequirement(reqID string) []gemara.Parameter {
 	return rp.paramIndex[reqID]
 }
+
+// ImportedGuidanceIDs returns the metadata IDs of guidance catalogs
+// imported by this policy. Guidance catalogs loaded in the artifact set
+// but not in this list are "under evaluation" — available for crosswalk
+// but not mandated.
+func (rp *ResolvedPolicy) ImportedGuidanceIDs() []string {
+	ids := make([]string, 0, len(rp.GuidanceCatalogs))
+	for _, gc := range rp.GuidanceCatalogs {
+		ids = append(ids, gc.Metadata.Id)
+	}
+	return ids
+}
diff --git a/internal/requirement/resolved_policy_test.go b/internal/requirement/resolved_policy_test.go
index 57fc835..cb2819e 100644
--- a/internal/requirement/resolved_policy_test.go
+++ b/internal/requirement/resolved_policy_test.go
@@ -5,6 +5,7 @@ package requirement
 import (
 	"testing"
 
+	"github.com/gemaraproj/go-gemara"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -60,3 +61,55 @@ func TestResolvedPolicy_QueryMethods(t *testing.T) {
 		assert.Empty(t, params)
 	})
 }
+
+func TestResolvedPolicy_ImportedGuidanceIDs(t *testing.T) {
+	guidanceCatalog := &gemara.GuidanceCatalog{
+		Metadata: gemara.Metadata{Id: "guidance-1"},
+		Guidelines: []gemara.Guideline{
+			{Id: "GL-001", Title: "Test guideline"},
+		},
+	}
+
+	policy := &gemara.Policy{
+		Metadata: gemara.Metadata{
+			Id: "test-policy",
+			MappingReferences: []gemara.MappingReference{
+				{Id: "test-catalog"},
+				{Id: "guidance-1"},
+			},
+		},
+		Imports: gemara.Imports{
+			Catalogs: []gemara.CatalogImport{
+				{ReferenceId: "test-catalog"},
+			},
+			Guidance: []gemara.GuidanceImport{
+				{ReferenceId: "guidance-1"},
+			},
+		},
+		Adherence: gemara.Adherence{},
+	}
+
+	catalog := &gemara.ControlCatalog{
+		Metadata: gemara.Metadata{Id: "test-catalog"},
+		Controls: []gemara.Control{
+			{
+				Id: "CTRL-001",
+				AssessmentRequirements: []gemara.AssessmentRequirement{
+					{Id: "REQ-001", Text: "Verify"},
+				},
+			},
+		},
+	}
+
+	set := &ArtifactSet{
+		Catalogs: map[string]*gemara.ControlCatalog{"test-catalog": catalog},
+		Policies: map[string]*gemara.Policy{"test-policy": policy},
+		Guidance: map[string]*gemara.GuidanceCatalog{"guidance-1": guidanceCatalog},
+	}
+
+	rp, err := ResolvePolicy(*policy, set)
+	require.NoError(t, err)
+
+	ids := rp.ImportedGuidanceIDs()
+	assert.Equal(t, []string{"guidance-1"}, ids)
+}

From 8e8f3ca05fc963f553c9fe396ea0c7eeee28e500 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Sat, 13 Jun 2026 16:27:18 -0400
Subject: [PATCH 04/16] feat: add /comply plugin with pipeline, pack, and setup
 skills

Add comply pipeline skills (scoping, mapping, adherence) with router
that dispatches sub-stages by filename from the skill base directory.
Add /comply:pack for Rego generation and /comply:setup for workspace
configuration. Skills enforce MCP-grounded control data access via
get_assessment_requirements with scope filter. Update plugin manifests
to register new commands.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 .claude-plugin/plugin.json   |   8 +-
 .cursor-plugin/plugin.json   |   8 +-
 .gitignore                   |   4 +-
 gemini-extension.json        |   4 +-
 skills/complypack/SKILL.md   | 366 -----------------------------------
 skills/complypack/mcp.jsonc  |   8 -
 skills/pack/SKILL.md         |  46 +++++
 skills/pipeline/SKILL.md     |  52 +++++
 skills/pipeline/adherence.md | 100 ++++++++++
 skills/pipeline/mapping.md   | 137 +++++++++++++
 skills/pipeline/scoping.md   | 130 +++++++++++++
 skills/setup/SKILL.md        |  77 ++++++++
 12 files changed, 557 insertions(+), 383 deletions(-)
 delete mode 100644 skills/complypack/SKILL.md
 delete mode 100644 skills/complypack/mcp.jsonc
 create mode 100644 skills/pack/SKILL.md
 create mode 100644 skills/pipeline/SKILL.md
 create mode 100644 skills/pipeline/adherence.md
 create mode 100644 skills/pipeline/mapping.md
 create mode 100644 skills/pipeline/scoping.md
 create mode 100644 skills/setup/SKILL.md

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 23e20fc..8431e91 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,8 +1,8 @@
 {
-  "name": "complypack",
+  "name": "comply",
   "displayName": "ComplyPack",
   "version": "0.1.0",
-  "description": "Generate Rego policies from Gemara catalogs and extract assessment requirements via MCP server",
+  "description": "Gemara compliance pipeline and policy generation via MCP server",
   "author": {
     "name": "ComplyTime Authors",
     "url": "https://github.com/complytime"
@@ -16,6 +16,8 @@
     "opa",
     "gemara",
     "policy",
-    "mcp"
+    "mcp",
+    "audit",
+    "governance"
   ]
 }
diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
index bbc1c40..62c2af4 100644
--- a/.cursor-plugin/plugin.json
+++ b/.cursor-plugin/plugin.json
@@ -1,8 +1,8 @@
 {
-  "name": "complypack",
+  "name": "comply",
   "displayName": "ComplyPack",
   "version": "0.1.0",
-  "description": "Generate Rego policies from Gemara catalogs and extract assessment requirements via MCP server",
+  "description": "Gemara compliance pipeline and policy generation via MCP server",
   "author": {
     "name": "ComplyTime Authors",
     "url": "https://github.com/complytime"
@@ -15,6 +15,8 @@
     "opa",
     "gemara",
     "policy",
-    "mcp"
+    "mcp",
+    "audit",
+    "governance"
   ]
 }
diff --git a/.gitignore b/.gitignore
index adff2f0..35db7f3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,9 +28,11 @@ go.work.sum
 .DS_Store
 Thumbs.db
 
-# Local docs (plans, analysis)
+# Local docs (plans, analysis, specs, demos)
 docs/plans/
 docs/analysis/
+docs/superpowers/
+docs/demo/
 
 # Development tooling
 .opencode/
diff --git a/gemini-extension.json b/gemini-extension.json
index 554c82c..39a3b3d 100644
--- a/gemini-extension.json
+++ b/gemini-extension.json
@@ -1,5 +1,5 @@
 {
-  "name": "complypack",
-  "description": "Generate Rego policies from Gemara catalogs and extract assessment requirements via MCP server",
+  "name": "comply",
+  "description": "Gemara compliance pipeline and policy generation via MCP server",
   "version": "0.1.0"
 }
diff --git a/skills/complypack/SKILL.md b/skills/complypack/SKILL.md
deleted file mode 100644
index 9f8bed8..0000000
--- a/skills/complypack/SKILL.md
+++ /dev/null
@@ -1,366 +0,0 @@
----
-name: complypack
-description: Use when user mentions complypack, wants to generate Rego policies from Gemara catalogs, extract assessment requirements and parameters, or work with compliance validation for Kubernetes, Terraform, Docker, Ansible, or CI platforms
----
-
-# ComplyPack: Gemara Policy Generation and Assessment
-
-## Overview
-
-Generate Rego policies from Gemara control catalogs that enforce compliance requirements. Policies must be written to disk, validated against the target platform schema, and tested with sample inputs.
-
-**Core principle:** Read control definitions from source → Generate platform-specific policy → Write to disk → Verify it works.
-
-## When to Use
-
-Use when:
-- User requests "generate policy for control X"
-- User specifies a Gemara catalog and target platform
-- User mentions Conftest, OPA, or Rego
-- Generating compliance policies from security frameworks
-
-Do NOT use for:
-- Writing arbitrary Rego policies (not from Gemara controls)
-- Generating policies without a source catalog
-- One-off policy snippets that don't need disk storage
-
-## Quick Reference
-
-| Step | Action | Output |
-|------|--------|--------|
-| 1. Read control | Get definition from catalog (MCP/file/API) | Control text, ID, title |
-| 2. Get parameters | Extract assessment requirements with test parameters | Thresholds, values, tools |
-| 3. Read schema | Get platform schema (MCP/file) | JSON Schema or CUE |
-| 4. Choose format | OPA (allow) or Conftest (deny) | Policy structure |
-| 5. Generate policy | Write Rego with control mapping and parameters | .rego file |
-| 6. Write to disk | Save to `policy/` or user-specified path | File on disk |
-| 7. Verify | Test with sample input | Pass/fail results |
-
-## The Process
-
-### Step 1: Read Control Definition from Source
-
-**DO NOT generate from general knowledge.** Always read the actual control text.
-
-**If ComplyPack MCP server available:**
-```
-1. List available catalogs: ListMcpResourcesTool(server="complypack")
-2. Read specific control: ReadMcpResourceTool(server="complypack", uri="complypack://catalog/{name}")
-3. Extract control ID, title, description
-```
-
-**If catalog is a file:**
-```
-1. Read catalog YAML/JSON
-2. Find control by ID
-3. Extract control text
-```
-
-**Critical:** The control definition is your requirements specification. Don't improvise.
-
-### Step 2: Get Assessment Requirements and Parameters
-
-**IMPORTANT:** Assessment requirements contain test parameters, thresholds, and approved tools.
-
-**If ComplyPack MCP server available AND catalog is a Policy:**
-```
-Use get_assessment_requirements tool:
-{
-  "catalogName": "policy-name",
-  "controlId": "CTL-XXX-001"  // optional filter
-}
-
-Returns:
-- Structured parameters from Policy.Adherence.AssessmentPlans
-- Parameter labels, descriptions, accepted values
-- Tool mentions (ToolA, ToolB, etc.)
-- File patterns (.gitlab-ci.yml, Jenkinsfile)
-```
-
-**What you get:**
-- `Parameters` - Structured test values from assessment plans (e.g., {"timeout": "60"})
-- `Tools` - Approved tools mentioned (ToolA, ToolB, ToolC)
-- `TestValues` - Algorithms, config files, permissions patterns
-- `Text` - Full requirement text for context
-
-**Example:**
-```json
-{
-  "id": "CTL-DATA-001-AR3",
-  "control_id": "CTL-DATA-001",
-  "text": "Certificate validity must not exceed maximum",
-  "parameters": {
-    "max_validity_days": "90",
-    "max_validity_days_description": "Maximum certificate lifetime"
-  },
-  "tools": [],
-  "test_values": []
-}
-```
-
-**Use these parameters in your policy:**
-- Thresholds → Use exact values in comparisons
-- Tools → Reference in validation logic
-- Accepted values → Use in allow/deny rules
-
-**If catalog is a ControlCatalog (not Policy):**
-- Assessment requirements exist but parameters are not attached
-- You'll get requirement text and hints (tools, patterns)
-- No structured parameter values
-
-### Step 3: Read Platform Schema
-
-Understand what data structure the policy will evaluate.
-
-**If ComplyPack MCP server available:**
-```
-ReadMcpResourceTool(server="complypack", uri="complypack://schema/{platform}")
-```
-
-**Platforms:** kubernetes, terraform, docker, ansible, ci
-
-**Schema tells you:**
-- Available fields to validate
-- Data types and structure
-- What's actually in the input
-
-### Step 4: Choose Policy Format
-
-**Ask user if unclear**, otherwise use this decision tree:
-
-```dot
-digraph format_choice {
-    "User specified format?" [shape=diamond];
-    "Mentions Conftest?" [shape=diamond];
-    "Use Conftest format (deny)" [shape=box];
-    "Use OPA format (allow)" [shape=box];
-
-    "User specified format?" -> "Use specified format" [label="yes"];
-    "User specified format?" -> "Mentions Conftest?" [label="no"];
-    "Mentions Conftest?" -> "Use Conftest format (deny)" [label="yes"];
-    "Mentions Conftest?" -> "Use OPA format (allow)" [label="no"];
-}
-```
-
-**Conftest format:**
-```rego
-package main
-
-deny[msg] {
-    # Violation condition
-    msg := "Violation message"
-}
-```
-
-**OPA format:**
-```rego
-package platform.controlid
-
-default allow := false
-
-allow {
-    # Compliance conditions
-}
-
-violations[msg] {
-    # Generate violation messages
-}
-```
-
-### Step 5: Generate the Policy
-
-Map control requirements to platform-specific checks:
-
-**Template structure:**
-```rego
-# {Control-ID}: {Control Title}
-# {Control Description}
-
-package {namespace}
-
-import rego.v1
-
-# METADATA
-# custom:
-#   control_id: {ID}
-#   control_title: {Title}
-#   severity: {high|medium|low}
-
-# [Policy logic based on control requirements and platform schema]
-```
-
-**Key requirements:**
-- Reference control ID and title in comments
-- Use fields that exist in platform schema
-- Write clear violation messages
-- Include both positive checks (what must exist) and negative checks (what must not)
-
-### Step 6: Write to Disk
-
-**DO NOT just output to chat.** Policies must be saved to files.
-
-**Default structure for Conftest:**
-```
-policy/
-  {control-id}.rego          # e.g., ac-1.rego
-  {control-id}_test.rego     # Optional: unit tests
-```
-
-**Default structure for OPA:**
-```
-policies/
-  {platform}/
-    {control-id}.rego        # e.g., kubernetes/ac-1.rego
-```
-
-**Ask user for path if:**
-- They have existing policy directory
-- Project structure is unclear
-- Multiple controls being generated
-
-### Step 7: Verify Policy Works
-
-**Critical step - don't skip this.**
-
-Create sample input matching platform schema:
-
-**For Kubernetes:**
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: test-app
-spec:
-  # ... based on schema
-```
-
-**For Terraform:**
-```json
-{
-  "address": "aws_s3_bucket.example",
-  "type": "aws_s3_bucket",
-  "values": {
-    # ... based on schema
-  }
-}
-```
-
-**Test the policy:**
-```bash
-# Conftest
-conftest test input.yaml -p policy/
-
-# OPA
-opa eval --data policy.rego --input input.json "data.{package}.allow"
-```
-
-**Report results:**
-- ✅ Policy syntax valid (opa check)
-- ✅ Compliant input passes
-- ✅ Non-compliant input fails with clear message
-
-## Common Mistakes
-
-| Mistake | Fix |
-|---------|-----|
-| Generated from general knowledge | Always read actual control definition from source |
-| Policy only in chat | Write to disk with proper filename |
-| No verification | Test with sample input before claiming done |
-| Wrong format (allow vs deny) | Ask user or check for "Conftest" mention |
-| Ignoring platform schema | Read schema, use actual fields that exist |
-| Missing violation messages | Every deny/violation needs clear message |
-| Overly complex structure | Start with single .rego file per control |
-
-## Red Flags - Check These Before Claiming Done
-
-- [ ] Did you read the control definition from the actual source?
-- [ ] Did you read the platform schema to know available fields?
-- [ ] Did you write the policy to disk (not just chat)?
-- [ ] Did you test it with sample input?
-- [ ] Does it have clear violation messages?
-- [ ] Is the format correct (Conftest deny vs OPA allow)?
-
-## Example Workflow
-
-User: "Generate policy for CTL-DATA-001-AR3 from my-security-policy targeting Kubernetes"
-
-**Steps:**
-1. ✅ Read control: `ReadMcpResourceTool(server="complypack", uri="complypack://catalog/my-security-policy")`
-2. ✅ Extract CTL-DATA-001 requirements text
-3. ✅ Get parameters: `get_assessment_requirements({catalogName: "my-security-policy", controlId: "CTL-DATA-001"})`
-4. ✅ Extract parameter: `{"max_validity_days": "90"}` from assessment plan
-5. ✅ Read schema: `ReadMcpResourceTool(server="complypack", uri="complypack://schema/kubernetes")`
-6. ✅ Note schema fields: spec.tls.secretName, spec.tls.hosts
-7. ✅ Generate OPA policy using `max_validity_days` parameter
-8. ✅ Write to `policy/ctl-data-001-ar3.rego`
-9. ✅ Create test input (Ingress with cert)
-10. ✅ Run: `conftest test test-ingress.yaml -p policy/`
-11. ✅ Report: "Policy enforces 90-day cert validity. Tested against sample Ingress."
-
-**Example policy using parameters:**
-```rego
-package kubernetes.ctl_data_001_ar3
-
-import rego.v1
-
-# CTL-DATA-001-AR3: Certificate validity
-# Parameters from assessment plan: max_validity_days = 90
-
-deny[msg] {
-    cert := input.spec.tls[_]
-    cert_days := get_cert_validity_days(cert.secretName)
-    
-    # Use parameter from assessment plan
-    max_days := 90
-    cert_days > max_days
-    
-    msg := sprintf("Certificate %s exceeds maximum validity of %d days", 
-                   [cert.secretName, max_days])
-}
-```
-
-**NOT:**
-1. ❌ Generate policy from general knowledge
-2. ❌ Hardcode generic value when parameter is specified
-3. ❌ Skip get_assessment_requirements step
-4. ❌ Output policy in chat only
-5. ❌ Skip testing
-
-## Multi-Control Generation
-
-When generating multiple controls:
-
-**Option 1: Separate files (recommended)**
-```
-policy/
-  ac-1.rego
-  ac-2.rego
-  sc-1.rego
-```
-Easier to maintain, test, and selectively apply.
-
-**Option 2: Combined file**
-```
-policy/
-  all-controls.rego  # Multiple deny[] or multiple packages
-```
-Only if user explicitly requests combined.
-
-**Always:**
-- Process controls one at a time
-- Write each to disk before moving to next
-- Test each independently
-
-## Tool Integration
-
-**Works with any tool that can:**
-- Read structured data (JSON/YAML)
-- Generate Rego code
-- Write files to disk
-
-**Not specific to:**
-- Claude MCP server (catalog could be files, API, etc.)
-- Conftest vs OPA (support both)
-- Specific platforms (works for any with schema)
-
-**The workflow is platform-agnostic** - adapt to your environment.
diff --git a/skills/complypack/mcp.jsonc b/skills/complypack/mcp.jsonc
deleted file mode 100644
index 6b7c259..0000000
--- a/skills/complypack/mcp.jsonc
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "mcpServers": {
-    "complypack": {
-      "command": "complypack",
-      "args": ["mcp", "serve", "--config", "complypack.yaml"]
-    }
-  }
-}
diff --git a/skills/pack/SKILL.md b/skills/pack/SKILL.md
new file mode 100644
index 0000000..210a718
--- /dev/null
+++ b/skills/pack/SKILL.md
@@ -0,0 +1,46 @@
+---
+name: pack
+description: Use when user wants to generate Rego policies from Gemara catalogs, extract assessment requirements and parameters, or work with compliance validation for Kubernetes, Terraform, Docker, Ansible, or CI platforms
+---
+
+# /comply:pack — Rego Policy Generation and Assessment
+
+Generate Rego policies from Gemara Control Catalogs that enforce compliance requirements. Policies must be written to disk, validated against the target platform schema, and tested with sample inputs.
+
+**Core principle:** Read control definitions from source → Generate platform-specific policy → Write to disk → Verify it works.
+
+## When to Use
+
+- User requests "generate policy for control X"
+- User specifies a Gemara catalog and target platform
+- User mentions Conftest, OPA, or Rego
+- Generating compliance policies from security frameworks
+
+Do NOT use for:
+- Writing arbitrary Rego policies (not from Gemara controls)
+- Generating policies without a source catalog
+
+## Quick Reference
+
+| Step | Action | Output |
+|------|--------|--------|
+| 1. Read control | Get definition from catalog (MCP) | Control text, ID, title |
+| 2. Get parameters | Extract assessment requirements | Thresholds, values |
+| 3. Read schema | Get platform schema (MCP) | JSON Schema or CUE |
+| 4. Choose format | OPA (allow) or Conftest (deny) | Policy structure |
+| 5. Generate policy | Write Rego with control mapping | .rego file |
+| 6. Write to disk | Save to `policy/` | File on disk |
+| 7. Verify | Test with sample input | Pass/fail results |
+
+## Safety
+
+**DO NOT generate from general knowledge.** Always read the actual control text from MCP.
+
+## MCP Resources and Tools
+
+- `complypack://catalog/*` — Control Catalogs, Guidance Catalogs, Policies
+- `complypack://schema/*` — Platform schemas
+- `complypack://evaluator` — Available evaluators
+- `get_assessment_requirements` — Extract assessment requirements with parameters
+- `validate_policy` — Validate policy syntax and contract compliance
+- `test_policy` — Run policy tests against sample data
diff --git a/skills/pipeline/SKILL.md b/skills/pipeline/SKILL.md
new file mode 100644
index 0000000..a57be93
--- /dev/null
+++ b/skills/pipeline/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: pipeline
+description: Use when user wants to build Gemara Policy artifacts for audit preparation or compliance program setup
+---
+
+# /comply:pipeline — ComplyTime Audit Pipeline
+
+Guide users through building a Gemara Policy (applicability statement) from their system architecture and governance sources. The Gemara Policy is the formal contract between audit and engineering, functionally equivalent to an ISO 27001 Statement of Applicability or a NIST System Security Plan.
+
+## Safety
+
+**CRITICAL:** Every stage MUST read control IDs, requirement IDs, and parameter values from MCP resources. DO NOT generate these from memory. The MCP server is the source of truth.
+
+## Pipeline Stages
+
+| Stage     | Artifact                          | Purpose                                                          |
+|-----------|-----------------------------------|------------------------------------------------------------------|
+| scoping   | `.complytime/scoping.yaml`        | System profile + Control Catalog scoping + gap analysis          |
+| mapping   | `.complytime/delta-report.yaml`   | Parameter delta analysis + harmonization across framework layers |
+| adherence | `.complytime/child-policy.yaml`   | Compile the child Policy with adherence plan                     |
+
+After adherence, invoke `/comply:pack` to generate assessment logic for use with `complyctl`.
+
+## Router Logic
+
+1. Check if `.complytime/` directory exists and which artifacts are present
+2. Determine pipeline state:
+   - No `.complytime/` directory → start at **scoping**
+   - `scoping.yaml` exists but no `delta-report.yaml` → offer **mapping**
+   - `delta-report.yaml` exists but no `child-policy.yaml` → offer **adherence**
+   - `child-policy.yaml` exists → pipeline complete, offer to re-run any stage or proceed to `/comply:pack`
+3. If the user specified a stage, validate prerequisites:
+   - **mapping** requires `scoping.yaml`
+   - **adherence** requires `delta-report.yaml`
+4. Dispatch to the appropriate stage skill
+
+## Dispatching
+
+Read the stage instructions from this skill's base directory before proceeding:
+
+- **scoping** → `scoping.md`
+- **mapping** → `mapping.md`
+- **adherence** → `adherence.md`
+
+## Status Display
+
+```
+/comply:pipeline status:
+  [done] scoping     — .complytime/scoping.yaml
+  [done] mapping     — .complytime/delta-report.yaml
+  [next] adherence   — not yet run
+```
diff --git a/skills/pipeline/adherence.md b/skills/pipeline/adherence.md
new file mode 100644
index 0000000..0def537
--- /dev/null
+++ b/skills/pipeline/adherence.md
@@ -0,0 +1,100 @@
+---
+name: comply-adherence
+description: Populate a Gemara Policy defining what controls apply, with what parameter values, and how evidence will be collected
+user-invocable: false
+---
+
+# Adherence — Compile Policy
+
+Compile or alter a Gemara Policy artifact. Declares what controls apply, with exact parameter values, and defines the adherence plan: frequency, evaluation method, and evidence requirements.
+
+Evidence collection and Evaluation Logs are produced by `complyctl` at runtime.
+
+## Prerequisites
+
+- `.complytime/scoping.yaml`
+- `.complytime/delta-report.yaml`
+
+Verify all parameters are resolved (no `pending_user_decision`). If unresolved, tell the user to re-run mapping.
+
+## Process
+
+### Step 1: Read Input Artifacts
+
+Read both `.complytime/scoping.yaml` and `.complytime/delta-report.yaml`.
+
+### Step 2: Build Mapping References
+
+From the delta report's `sources`, build `mapping_references`:
+- One for the parent Policy
+- One for each scoped Control Catalog
+- One for each Guidance Catalog for the target framework
+
+### Step 3: Build Imports
+
+- `imports.catalogs` — one per Control Catalog
+- `imports.guidance` — one per mandated Guidance Catalog
+
+### Step 4: Build Assessment Plans
+
+Group by `requirement_id`. Each plan:
+- `requirement_id`
+- `frequency` (e.g., "30d", "90d", "365d")
+- `evaluation_methods` (e.g., "automated", "manual_review", "attestation")
+- `evidence_requirements`
+- `parameters` — frozen values from harmonization
+
+### Step 5: Compile the Policy
+
+```yaml
+gemara: v1alpha1
+kind: Policy
+metadata:
+  id: <system-name>-policy
+  title: "<System Name> Policy"
+  created: "<today>"
+mapping_references:
+  - id: <ref-id>
+    metadata_id: <metadata-id>
+imports:
+  catalogs:
+    - reference_id: <ref-id>
+  guidance:
+    - reference_id: <ref-id>
+adherence:
+  assessment_plans:
+    - requirement_id: "<req-id>"
+      frequency: "<cadence>"
+      evaluation_methods:
+        - method: "<method>"
+      evidence_requirements: "<what>"
+      parameters:
+        - label: "<label>"
+          accepted_values: ["<value>"]
+          description: "<rationale>"
+```
+
+### Step 6: Validate
+
+Write `.complytime/child-policy.yaml`. If the Gemara MCP server is available, validate against the schema.
+
+### Step 7: Present Summary
+
+Show mapping references, imported catalogs/guidance, assessment plans count, and audit strengths.
+
+> "Policy written to `.complytime/child-policy.yaml`. Invoke `/comply:pack` to generate assessment logic."
+
+## MCP Resources and Tools
+
+- `complypack://catalog/*` — Control Catalogs, Guidance Catalogs, Policies
+- `get_assessment_requirements` — get requirement details and parameters for building assessment plans
+
+**DO NOT parse local YAML files to extract control data.** Use `get_assessment_requirements` to get requirement text, parameters, and applicability. All control data MUST come from MCP resources or tools.
+
+## Red Flags
+
+- [ ] Any unresolved parameters?
+- [ ] Every mapping reference has a corresponding import?
+- [ ] Every assessment plan has frequency and evaluation method?
+- [ ] Every value came from MCP or the delta report?
+- [ ] Did you use `get_assessment_requirements`, not parse files?
diff --git a/skills/pipeline/mapping.md b/skills/pipeline/mapping.md
new file mode 100644
index 0000000..03e1df6
--- /dev/null
+++ b/skills/pipeline/mapping.md
@@ -0,0 +1,137 @@
+---
+name: comply-mapping
+description: Crosswalk frameworks and perform parameter harmonization. Parent Policy always sets the floor.
+user-invocable: false
+---
+
+# Mapping — Delta Analysis & Parameter Harmonization
+
+Compare parameters across Guidance Catalogs, the parent Policy, and Control Catalogs. Surface where the organization's values match or differ from each framework. When values differ, interpret which is stricter based on domain context.
+
+**Core invariant:** The parent Policy always sets the floor. Never resolve below it without explicit user acknowledgement.
+
+## Prerequisites
+
+Requires `.complytime/scoping.yaml` from the scoping stage.
+
+## Key Concepts
+
+### Mandated vs. Under Evaluation
+
+The parent Policy's `imports.guidance` determines which frameworks are binding:
+
+- **Mandated:** Guidance Catalogs imported by the parent Policy. Shortfalls MUST be addressed.
+- **Under evaluation:** Guidance Catalogs loaded in MCP but NOT imported. Informational only.
+
+### Verdict Types
+
+| Verdict | Meaning | Action |
+|---------|---------|--------|
+| `aligned` | Values match | No action |
+| `mismatch` | Values differ | Interpret which is stricter based on domain context (e.g., TLS 1.3 > 1.2, shorter timeout = stricter). Present both values and your assessment to the user for confirmation. |
+| `org_binds_generic` | Org provides concrete value for generic language | Document |
+| `not_covered` | Parameter in one source only | Flag |
+
+## Process
+
+### Step 1: Read Scoping Artifacts
+
+Read `.complytime/scoping.yaml`.
+
+### Step 2: Identify Parent Policy
+
+```
+ListMcpResourcesTool(server="complypack")
+```
+
+If a Policy exists, read it. **If no parent Policy exists:** extract minimums from the target framework's Control Catalog requirements. The framework becomes the floor.
+
+### Step 3: Classify Guidance Frameworks
+
+If a parent Policy exists, check `imports.guidance`. If not, all Guidance Catalogs are **under evaluation** unless the user designates one as the target.
+
+### Step 4: Load Mapping Documents
+
+Read any Mapping Documents recorded in scoping:
+
+```
+ReadMcpResourceTool(server="complypack", uri="complypack://mapping/<id>")
+```
+
+Use them to resolve framework crosswalks.
+
+### Step 5: Run Delta Analysis
+
+```
+CallMcpToolTool(server="complypack", tool="analyze_parameter_delta", arguments={"policyName": "<name>"})
+```
+
+### Step 6: Present Results
+
+**Mandated:** Show each non-aligned verdict with values and recommended action.
+
+**Under evaluation:** Same verdicts, framed as "if you pursue this certification..."
+
+### Step 7: Resolve Decisions
+
+Walk the user through `mismatch` items. For each, interpret which value is stricter given the parameter's domain, present your assessment, and let the user decide.
+
+### Step 8: Write Output
+
+Write `.complytime/delta-report.yaml`:
+
+```yaml
+version: "1"
+created: YYYY-MM-DD
+sources:
+  parent_policy: "<policy-id>"
+  guidance:
+    mandated:
+      - id: "<id>"
+        status: imported_by_parent
+    under_evaluation:
+      - id: "<id>"
+        status: loaded_not_imported
+  catalogs: [<ids>]
+
+parameters:
+  - id: "<label>"
+    requirement_id: "<req-id>"
+    layers:
+      framework:
+        source: "<id>"
+        value: "<value>"
+        specificity: <concrete|generic|none>
+      org_policy:
+        source: "<id>"
+        value: "<value>"
+        specificity: <concrete|generic|none>
+      tech_baseline:
+        source: "<id>"
+        value: "<value>"
+        specificity: <concrete|generic|none>
+    verdict: <verdict>
+    resolved_value: "<value>"
+    resolution: <resolution>
+    rationale: "<why>"
+
+summary:
+  total: <N>
+  aligned: <N>
+  mismatch: <N>
+  org_binds_generic: <N>
+  not_covered: <N>
+```
+
+## MCP Resources and Tools
+
+- `complypack://catalog/*` — Control Catalogs, Guidance Catalogs, Policies
+- `complypack://mapping/*` — Mapping Documents
+- `analyze_parameter_delta` — deterministic parameter crosswalk
+
+## Red Flags
+
+- [ ] Did you classify guidance as mandated vs. under evaluation?
+- [ ] Did the user decide every `mismatch`?
+- [ ] Did you ensure no resolution goes below the parent Policy floor?
+- [ ] Did every value come from MCP?
diff --git a/skills/pipeline/scoping.md b/skills/pipeline/scoping.md
new file mode 100644
index 0000000..aa2749b
--- /dev/null
+++ b/skills/pipeline/scoping.md
@@ -0,0 +1,130 @@
+---
+name: comply-scoping
+description: Characterize a system's component stack, scope existing Control Catalogs, and identify coverage gaps
+user-invocable: false
+---
+
+# Scoping
+
+Characterize the system, identify its technology component stack, and scope which existing Control Catalogs apply. Produces `.complytime/scoping.yaml`.
+
+## Modes
+
+- **Conversational:** Ask structured questions one at a time.
+- **Document ingestion:** Extract and normalize from existing SAR, architecture doc, deployment manifest, or IaC.
+- **Hybrid:** Fill gaps with targeted questions.
+
+## Process
+
+### Step 1: Characterize the System
+
+1. **Identity:** Name, description, purpose, criticality
+2. **Data classification:** public, internal, confidential, restricted
+3. **Component stack:** Name, type, runtime/engine, image/version
+4. **Data flows:** Source → destination, protocol, data types
+5. **Deployment:** Cloud/on-prem/hybrid, provider, regions
+6. **Boundaries:** DMZ, internal, external-facing components
+
+### Step 2: Scope Control Catalogs
+
+Query MCP for available Control Catalogs:
+
+```
+ListMcpResourcesTool(server="complypack")
+```
+
+Map each component to an existing Control Catalog. No matching catalog → record as a **gap**.
+
+### Step 3: Filter by Applicability Group
+
+If the user specified a scoping level (e.g., maturity level, risk tier), use `get_assessment_requirements` with the `scope` parameter to get only the requirements that apply.
+
+**Important:** The `catalogName` parameter takes a **policy name**, not a catalog name. The policy resolves its imported catalogs internally. Find the policy name from `ListMcpResourcesTool` output — look for resources with `kind: Policy`.
+
+```
+CallMcpToolTool(server="complypack", tool="get_assessment_requirements", arguments={"catalogName": "<policy-name>", "scope": ["<applicability-group>"]})
+```
+
+For example, for OSPS Baseline at Maturity Level 2 with a policy named `example-foundation-policy`:
+
+```
+CallMcpToolTool(server="complypack", tool="get_assessment_requirements", arguments={"catalogName": "example-foundation-policy", "scope": ["maturity-1", "maturity-2"]})
+```
+
+This returns only the requirements whose applicability includes the target level. Use this filtered set for the rest of the pipeline — do NOT manually read and parse the catalog to determine which controls apply.
+
+### Step 4: Check for Mapping Documents
+
+Ask the user if they have Gemara Mapping Documents. Check MCP:
+
+```
+ListMcpResourcesTool(server="complypack")
+```
+
+Record any available Mapping Documents — the mapping stage will use them.
+
+### Step 5: Identify Gaps
+
+For each component with no matching Control Catalog:
+- Record the component, its type, and engine
+- Recommend: "Control Catalog needed for this technology, or accept risk"
+
+### Step 6: Confirm with User
+
+Present findings. Ask user to confirm or adjust before writing.
+
+### Step 7: Write Output
+
+Write `.complytime/scoping.yaml`:
+
+```yaml
+version: "1"
+created: YYYY-MM-DD
+system:
+  name: "<name>"
+  description: "<description>"
+  criticality: <high|medium|low>
+  data_classification: <public|internal|confidential|restricted>
+  components:
+    - name: "<name>"
+      type: <container|database|cache|api-gateway|model-server|...>
+      runtime: "<runtime>"
+  data_flows:
+    - from: "<source>"
+      to: "<destination>"
+      protocol: <tls|mtls|plaintext>
+      data_types: [<types>]
+  deployment:
+    model: <cloud|on-prem|hybrid>
+    provider: "<provider>"
+    regions: [<regions>]
+
+catalog_scope:
+  covered:
+    - catalog_id: "<id>"
+      components: [<names>]
+      reason: "<why>"
+  gaps:
+    - component: "<name>"
+      type: "<type>"
+      finding: "No Control Catalog available"
+
+mapping_documents:
+  - id: "<id>"
+    source: "<where found>"
+```
+
+## MCP Resources and Tools
+
+- `complypack://catalog/*` — Control Catalogs, Guidance Catalogs, Policies
+- `complypack://mapping/*` — Mapping Documents
+- `get_assessment_requirements` — get requirement details and parameters for a specific control or in batch
+
+**DO NOT parse local YAML files to extract control data.** All control IDs, requirement IDs, requirement text, and parameter values MUST come from MCP resources or tools.
+
+## Red Flags
+
+- [ ] Did you query MCP for catalogs, not assume them?
+- [ ] Did you use `get_assessment_requirements` for requirement details, not parse files?
+- [ ] Did you record gaps?
+- [ ] Did you confirm with the user before writing?
diff --git a/skills/setup/SKILL.md b/skills/setup/SKILL.md
new file mode 100644
index 0000000..d264bef
--- /dev/null
+++ b/skills/setup/SKILL.md
@@ -0,0 +1,77 @@
+---
+name: setup
+description: Configure the Gemara and complypack MCP servers for this project — set up artifact sources, platform schemas, and generate the .mcp.json config
+---
+
+# /comply:setup — Configure MCP Servers
+
+Set up the Gemara MCP server and the complypack MCP server for this project.
+
+## MCP Servers
+
+| Server | Purpose | Provides |
+|--------|---------|----------|
+| **gemara** | Authoring and validation | `gemara://lexicon`, `gemara://schema/definitions`, `validate_gemara_artifact` |
+| **complypack** | Artifact serving, policy validation | `complypack://catalog/*`, `complypack://mapping/*`, `complypack://schema/*`, `validate_policy`, `test_policy`, `get_assessment_requirements`, `analyze_parameter_delta` |
+
+## Process
+
+### Step 1: Check Existing Configuration
+
+Check if `.mcp.json` already exists. Show current config and ask if the user wants to reconfigure.
+
+### Step 2: Configure Sources
+
+Ask for Gemara artifact sources for the complypack server:
+
+- `oci://registry.example.com/gemara/controls:v1`
+- `oci+http://localhost:5001/gemara/controls:v1` (development)
+- `file://path/to/catalog.yaml`
+
+At least one source is required.
+
+### Step 3: Configure Schemas
+
+Ask which platform schemas to load:
+
+- `kubernetes` (embedded)
+- `ci` (embedded)
+- `ci=cue://cue.dev/x/githubactions@v0#Workflow` (CUE registry)
+
+### Step 4: Resolve Versions
+
+Look up latest release versions. Do NOT use `:latest` tags.
+
+- **gemara-mcp**: `gh api repos/gemaraproj/gemara-mcp/releases/latest --jq '.tag_name'`
+- **complypack**: `gh api repos/complytime/complypack/releases/latest --jq '.tag_name'`
+
+If no release exists, ask the user for a version to pin.
+
+### Step 5: Write Configuration
+
+```json
+{
+  "mcpServers": {
+    "gemara": {
+      "command": "docker",
+      "args": ["run", "--rm", "-i",
+               "ghcr.io/gemaraproj/gemara-mcp:<VERSION>",
+               "serve"]
+    },
+    "complypack": {
+      "command": "docker",
+      "args": ["run", "--rm", "-i",
+               "ghcr.io/complytime/complypack:<VERSION>",
+               "mcp", "serve",
+               "--source", "<SOURCE>",
+               "--schema", "<SCHEMA>"]
+    }
+  }
+}
+```
+
+### Step 6: Verify
+
+Check that each server starts and responds. Report loaded catalogs and schemas.
+
+> "MCP servers configured. Use `/comply:pipeline` to start the compliance pipeline or `/comply:pack` to generate assessment logic."

From c28c3f80c73974ef0d62b2fcc15a92c7e6d7ad57 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Sat, 13 Jun 2026 16:28:13 -0400
Subject: [PATCH 05/16] docs: add ADRs 012-015 for container, CLI flags, delta
 engine, and comply pipeline

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 docs/adr/012-container-mcp-distribution.md | 34 +++++++++++++++++++
 docs/adr/013-cli-flags-mcp-serve.md        | 36 ++++++++++++++++++++
 docs/adr/014-parameter-delta-engine.md     | 37 ++++++++++++++++++++
 docs/adr/015-comply-pipeline-plugin.md     | 39 ++++++++++++++++++++++
 4 files changed, 146 insertions(+)
 create mode 100644 docs/adr/012-container-mcp-distribution.md
 create mode 100644 docs/adr/013-cli-flags-mcp-serve.md
 create mode 100644 docs/adr/014-parameter-delta-engine.md
 create mode 100644 docs/adr/015-comply-pipeline-plugin.md

diff --git a/docs/adr/012-container-mcp-distribution.md b/docs/adr/012-container-mcp-distribution.md
new file mode 100644
index 0000000..4e70645
--- /dev/null
+++ b/docs/adr/012-container-mcp-distribution.md
@@ -0,0 +1,34 @@
+# ADR 012: Container-Based MCP Server Distribution
+
+**Status:** Proposed
+
+**Date:** 2026-06-08
+
+**Context:**
+
+ComplyPack's MCP server is a Go binary that users must build locally. Issue #24 requires single-click distribution. Four options were evaluated:
+
+1. **Container image on GHCR** — `docker run --rm -i ghcr.io/complytime/complypack`
+2. **Binary download via plugin SessionStart hook** — download pre-built binaries from GitHub Releases into `~/.claude/plugins/data/`
+3. **`go install`** — users install via Go toolchain
+4. **Homebrew tap** — formula for macOS/Linux
+
+Option 2 was rejected on supply chain grounds: no plugin in the Claude Code ecosystem ships unsigned binaries, and downloading executables into the plugin data directory has no verification standard. The MCP security surface is already a known concern (CVE-2025-59536, CVE-2026-21852).
+
+Option 3 requires the Go toolchain on every user's machine — a non-starter for non-developer users.
+
+Option 4 adds a distribution channel to maintain and doesn't cover Fedora users natively.
+
+Option 1 is the only approach that is both trusted (GHCR handles image distribution, cosign handles signing) and already established in the plugin ecosystem (the Terraform plugin uses `docker` as the MCP command).
+
+**Decision:**
+
+Distribute the MCP server as a multi-arch container image on GHCR (`ghcr.io/complytime/complypack`). Sign images with cosign (keyless/OIDC). Users invoke via `docker run --rm -i` or `podman run --rm -i` in their `.mcp.json`.
+
+**Consequences:**
+
+- Users must have Docker or Podman installed — acceptable for the target audience (macOS and Fedora developers)
+- Container startup adds ~1-2s latency on first invocation (image pull is one-time)
+- OCI registry authentication for pulling Gemara catalogs works from inside the container (standard Docker credential chain)
+- Image size will be ~30-50MB (Go static binary in distroless/alpine)
+- No unsigned binary downloads, no Go toolchain requirement
diff --git a/docs/adr/013-cli-flags-mcp-serve.md b/docs/adr/013-cli-flags-mcp-serve.md
new file mode 100644
index 0000000..6fc771f
--- /dev/null
+++ b/docs/adr/013-cli-flags-mcp-serve.md
@@ -0,0 +1,36 @@
+# ADR 013: CLI Flags for `mcp serve` Configuration
+
+**Status:** Proposed
+
+**Date:** 2026-06-08
+
+**Context:**
+
+`mcp serve` requires a `complypack.yaml` config file. In a containerized deployment, getting a config file into the container requires a volume mount (`-v ./complypack.yaml:/config/complypack.yaml:ro`), which adds friction — the file must exist at a known path before the MCP server starts.
+
+The MCP server only uses two config sections: `gemara.sources` (which OCI artifacts to load) and `schemas` (which platform schemas to serve). Fields like `id`, `evaluator-id`, `policies.dir`, and `output.dir` are only used by `pack` and `scan`.
+
+**Decision:**
+
+Add repeatable `--source` and `--schema` flags to `mcp serve`:
+
+```
+complypack mcp serve \
+  --source oci://registry.example.com/gemara/controls:v1 \
+  --source oci+http://localhost:5001/gemara/guidance:v1 \
+  --schema ci=cue://cue.dev/x/githubactions@v0#Workflow \
+  --schema kubernetes
+```
+
+**`--source`** accepts `oci://` (TLS) or `oci+http://` (plain HTTP) URIs. The `+http` scheme variant provides per-source plain-HTTP control without a global flag.
+
+**`--schema`** accepts either a bare platform name (`kubernetes` — uses embedded schema) or `platform=source` syntax (`ci=cue://cue.dev/x/githubactions@v0#Workflow` — loads from the specified source).
+
+When `--source` flags are present, they replace the config file for source resolution. `--config` remains supported and takes precedence if both are provided.
+
+**Consequences:**
+
+- Containerized MCP servers need no volume mount — all configuration passes through `args` in `.mcp.json`
+- Users edit one file (`.mcp.json`) instead of two (`.mcp.json` + `complypack.yaml`)
+- `pack` and `scan` commands are unaffected — they continue to require `complypack.yaml`
+- The `oci+http://` URI scheme is non-standard but self-documenting and avoids a global `--plain-http` flag that would apply to all sources
diff --git a/docs/adr/014-parameter-delta-engine.md b/docs/adr/014-parameter-delta-engine.md
new file mode 100644
index 0000000..eb35051
--- /dev/null
+++ b/docs/adr/014-parameter-delta-engine.md
@@ -0,0 +1,37 @@
+# ADR 014: Parameter Delta Comparison Engine
+
+**Status:** Proposed
+
+**Date:** 2026-06-10
+
+**Context:**
+
+Gemara Policies bind parameters at the org level (e.g., "session timeout = 15 minutes"), while Guidance Catalogs define framework-level expectations (e.g., "session timeout per organizational policy"). When multiple frameworks apply — say a regulatory framework and an organizational baseline — a single parameter can have values at three layers: framework guidance, org policy, and tech baseline.
+
+Auditors need to see where the org's parameter values align with or differ from framework expectations. Doing this manually across dozens of parameters and multiple catalogs is error-prone and time-consuming.
+
+Three approaches were considered:
+
+1. **String equality only** — flag mismatches without any classification. Simple but loses the distinction between "framework defers to org" and "values genuinely differ."
+2. **Full directional comparison** — classify whether the org exceeds or falls short of the framework by comparing values numerically. Unreliable: "higher is stricter" holds for TLS versions (1.3 > 1.2) but not for session timeouts (15 < 30 means stricter). Algorithm comparisons (AES-256-GCM vs ChaCha20-Poly1305) aren't orderable at all.
+3. **Layer-based crosswalk with mismatch detection** — classify each parameter's specificity (concrete, generic, none), detect whether values match, and produce a verdict per parameter. Leave directional interpretation (which value is stricter) to the LLM in the mapping stage, which has the domain context to judge.
+
+Option 3 was chosen. The deterministic engine handles what it's good at — detecting alignment, mismatches, generic-to-concrete bindings, and coverage gaps. The LLM handles what it's good at — interpreting whether "1.3 vs 1.2" means the org is stricter or more lenient for a given parameter.
+
+**Decision:**
+
+Implement a parameter delta comparison engine (`requirement.AnalyzeDelta`) that crosswalks parameters across framework, org policy, and tech baseline layers. Each parameter receives a verdict:
+
+- `aligned` — values match
+- `mismatch` — values differ; the caller interprets directionality
+- `org_binds_generic` — framework defers to org; org provides a concrete value
+- `not_covered` — no framework value exists for comparison
+
+Expose this as the `analyze_parameter_delta` MCP tool so the `/comply` pipeline's mapping stage can read delta reports directly from the server. The mapping stage LLM interprets each `mismatch` verdict in domain context and presents its assessment to the user for confirmation.
+
+**Consequences:**
+
+- The mapping stage of the comply pipeline consumes delta reports from MCP rather than computing them in-skill — no hallucinated parameter comparisons
+- Directional interpretation ("which is stricter") is the LLM's responsibility, not the engine's — this correctly handles TLS versions, timeouts, algorithms, and any future parameter types without engine changes
+- The `tech_baseline` layer is structurally present but not yet populated from Gemara data — `findGuidelineParameter` is a stub awaiting Guidance Catalog parameter extraction
+- The engine is intentionally simple: no version parsing, no numeric comparison, no type detection — just string equality and specificity classification
diff --git a/docs/adr/015-comply-pipeline-plugin.md b/docs/adr/015-comply-pipeline-plugin.md
new file mode 100644
index 0000000..aefaf17
--- /dev/null
+++ b/docs/adr/015-comply-pipeline-plugin.md
@@ -0,0 +1,39 @@
+# ADR 015: Comply Pipeline as Plugin Skills
+
+**Status:** Proposed
+
+**Date:** 2026-06-11
+
+**Context:**
+
+ComplyPack's MCP server provides compliance data (controls, parameters, resolved policies) but has no opinion on workflow. Users need guided, multi-stage audit preparation: scoping which controls apply, mapping parameter deltas across frameworks, and producing an adherence plan (the applicability statement).
+
+Three approaches were considered:
+
+1. **Hardcoded CLI workflow** — `complypack comply --stage scoping`. Rigid; can't adapt to user context or partial completion.
+2. **Autonomous agent loop** — a single agent prompt that runs all stages. Prone to hallucinating control IDs and parameter values when context windows grow large.
+3. **Plugin skills with MCP grounding** — decompose the pipeline into discrete skills (`/comply:pipeline`, `/comply:pack`, `/comply:setup`), each reading from MCP resources at every step.
+
+Option 2 was rejected on safety grounds: an AI agent hallucinated a control ID in a real evidence registry during testing. The core safety property is that every stage must read control IDs, requirement IDs, and parameter values from MCP resources — never from model memory.
+
+Option 1 was rejected because audit workflows are inherently conversational: auditors need to review scoping decisions, adjust parameter bindings, and approve the applicability statement before it's finalized.
+
+Option 3 was chosen. Skills provide structured guidance while keeping the human in the loop. MCP grounding prevents hallucination. The pipeline router checks `.complytime/` artifact state to resume from the correct stage.
+
+**Decision:**
+
+Implement the comply pipeline as plugin skills:
+
+- **`/comply:pipeline`** — router that inspects `.complytime/` directory state and dispatches to the correct stage (scoping → mapping → adherence)
+- **`/comply:pack`** — generates assessment logic after pipeline completion
+- **`/comply:setup`** — configures `.mcp.json` for the user's environment
+
+Each stage reads exclusively from MCP resources. The pipeline produces Gemara Policy artifacts — functionally equivalent to an ISO 27001 Statement of Applicability or a NIST System Security Plan.
+
+**Consequences:**
+
+- Users interact conversationally with each stage rather than running a batch process — audit decisions are reviewed before being recorded
+- The pipeline is stateless across sessions: `.complytime/` artifacts are the checkpoint, not conversation history
+- Adding new stages (e.g., evidence collection, continuous monitoring) means adding new skill files and updating the router
+- The plugin registers with Claude Code, Cursor, and Gemini via their respective plugin manifests — same skills, three runtimes
+- MCP grounding is a hard constraint: if the MCP server is unreachable, the pipeline fails rather than proceeding with stale or generated data

From 572ca66e0d50304cf031d2c43f300cd742e4c5f6 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Sat, 13 Jun 2026 16:57:10 -0400
Subject: [PATCH 06/16] refactor: simplify delta engine to gatherer, remove
 heuristics
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Strip verdicts, specificity detection, and string-matching heuristics
from the delta engine. The tool now gathers structured L3 parameter
values alongside L1/L2 requirement text and returns them as pairs.
The model interprets the relationship — parsing prose for parameter
values is what AI does well and heuristics do poorly.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 docs/adr/014-parameter-delta-engine.md |  33 ++--
 docs/adr/015-comply-pipeline-plugin.md |   6 +-
 internal/mcp/tool_delta.go             |   2 +-
 internal/mcp/tool_delta_test.go        |   9 +-
 internal/requirement/delta.go          | 210 ++++++++-----------------
 internal/requirement/delta_test.go     |  77 ++-------
 6 files changed, 108 insertions(+), 229 deletions(-)

diff --git a/docs/adr/014-parameter-delta-engine.md b/docs/adr/014-parameter-delta-engine.md
index eb35051..43d8b15 100644
--- a/docs/adr/014-parameter-delta-engine.md
+++ b/docs/adr/014-parameter-delta-engine.md
@@ -1,4 +1,4 @@
-# ADR 014: Parameter Delta Comparison Engine
+# ADR 014: Parameter Delta Gathering Engine
 
 **Status:** Proposed
 
@@ -6,32 +6,31 @@
 
 **Context:**
 
-Gemara Policies bind parameters at the org level (e.g., "session timeout = 15 minutes"), while Guidance Catalogs define framework-level expectations (e.g., "session timeout per organizational policy"). When multiple frameworks apply — say a regulatory framework and an organizational baseline — a single parameter can have values at three layers: framework guidance, org policy, and tech baseline.
+Gemara Policies bind parameters at the org level as structured YAML (L3), while Guidance Catalogs (L1) and Control Catalogs (L2) express parameter expectations in prose — requirement text like "the system MUST require multi-factor authentication" or "builds SHOULD achieve at least SLSA Build Level 1."
 
-Auditors need to see where the org's parameter values align with or differ from framework expectations. Doing this manually across dozens of parameters and multiple catalogs is error-prone and time-consuming.
+When preparing the mapping stage of the comply pipeline, the model needs to see L3 parameter values alongside the L1/L2 requirement text they map to. Without tooling, the model must make many MCP calls and manually cross-reference requirement IDs to build this picture.
 
 Three approaches were considered:
 
-1. **String equality only** — flag mismatches without any classification. Simple but loses the distinction between "framework defers to org" and "values genuinely differ."
-2. **Full directional comparison** — classify whether the org exceeds or falls short of the framework by comparing values numerically. Unreliable: "higher is stricter" holds for TLS versions (1.3 > 1.2) but not for session timeouts (15 < 30 means stricter). Algorithm comparisons (AES-256-GCM vs ChaCha20-Poly1305) aren't orderable at all.
-3. **Layer-based crosswalk with mismatch detection** — classify each parameter's specificity (concrete, generic, none), detect whether values match, and produce a verdict per parameter. Leave directional interpretation (which value is stricter) to the LLM in the mapping stage, which has the domain context to judge.
+1. **No tool** — the model reads policy and catalog resources via MCP and cross-references manually. Works but requires many calls and is error-prone for large catalogs.
+2. **Heuristic comparison engine** — classify parameter specificity (concrete vs generic) via string matching, compute verdicts (aligned, mismatch, org_binds_generic). Rejected: heuristics for detecting generic language are brittle, and interpreting whether values differ meaningfully is what the model does well.
+3. **Gathering engine** — walk the resolved policy graph, pair each structured L3 parameter with the L1/L2 requirement text it maps to, return them side by side. Let the model interpret the relationship.
 
-Option 3 was chosen. The deterministic engine handles what it's good at — detecting alignment, mismatches, generic-to-concrete bindings, and coverage gaps. The LLM handles what it's good at — interpreting whether "1.3 vs 1.2" means the org is stricter or more lenient for a given parameter.
+Option 3 was chosen. The engine handles what it's good at — traversing the resolved policy graph and collecting structured pairs. The model handles what it's good at — interpreting prose and judging parameter relationships.
 
 **Decision:**
 
-Implement a parameter delta comparison engine (`requirement.AnalyzeDelta`) that crosswalks parameters across framework, org policy, and tech baseline layers. Each parameter receives a verdict:
+Implement a parameter gathering engine (`requirement.AnalyzeDelta`) that pairs L3 parameter values with L1/L2 requirement text across the resolved policy graph. Each pair contains:
 
-- `aligned` — values match
-- `mismatch` — values differ; the caller interprets directionality
-- `org_binds_generic` — framework defers to org; org provides a concrete value
-- `not_covered` — no framework value exists for comparison
+- `requirement_id` — which requirement the parameter maps to
+- `label` — the parameter name
+- `policy_value` — the structured value from the L3 Policy
+- `requirement_text` — the prose from the L1/L2 catalog
 
-Expose this as the `analyze_parameter_delta` MCP tool so the `/comply` pipeline's mapping stage can read delta reports directly from the server. The mapping stage LLM interprets each `mismatch` verdict in domain context and presents its assessment to the user for confirmation.
+Expose this as the `analyze_parameter_delta` MCP tool so the `/comply` pipeline's mapping stage can read comparisons directly from the server. The mapping stage model interprets each pair in domain context and presents its assessment to the user.
 
 **Consequences:**
 
-- The mapping stage of the comply pipeline consumes delta reports from MCP rather than computing them in-skill — no hallucinated parameter comparisons
-- Directional interpretation ("which is stricter") is the LLM's responsibility, not the engine's — this correctly handles TLS versions, timeouts, algorithms, and any future parameter types without engine changes
-- The `tech_baseline` layer is structurally present but not yet populated from Gemara data — `findGuidelineParameter` is a stub awaiting Guidance Catalog parameter extraction
-- The engine is intentionally simple: no version parsing, no numeric comparison, no type detection — just string equality and specificity classification
+- The mapping stage consumes structured pairs from MCP rather than manually cross-referencing artifacts
+- Interpretation of parameter relationships (which is stricter, whether values conflict) is the model's responsibility — no heuristics
+- The engine is intentionally simple: traverse the graph, collect pairs, return them
diff --git a/docs/adr/015-comply-pipeline-plugin.md b/docs/adr/015-comply-pipeline-plugin.md
index aefaf17..90a57d9 100644
--- a/docs/adr/015-comply-pipeline-plugin.md
+++ b/docs/adr/015-comply-pipeline-plugin.md
@@ -11,14 +11,14 @@ ComplyPack's MCP server provides compliance data (controls, parameters, resolved
 Three approaches were considered:
 
 1. **Hardcoded CLI workflow** — `complypack comply --stage scoping`. Rigid; can't adapt to user context or partial completion.
-2. **Autonomous agent loop** — a single agent prompt that runs all stages. Prone to hallucinating control IDs and parameter values when context windows grow large.
+2. **Autonomous agent loop** — a single agent prompt that runs all stages. Risk of generating control IDs or parameter values from model memory rather than source data when context windows grow large.
 3. **Plugin skills with MCP grounding** — decompose the pipeline into discrete skills (`/comply:pipeline`, `/comply:pack`, `/comply:setup`), each reading from MCP resources at every step.
 
-Option 2 was rejected on safety grounds: an AI agent hallucinated a control ID in a real evidence registry during testing. The core safety property is that every stage must read control IDs, requirement IDs, and parameter values from MCP resources — never from model memory.
+Option 2 was rejected because the core safety property is that every stage must read control IDs, requirement IDs, and parameter values from MCP resources — never from model memory. A single long-running agent loop makes this harder to enforce.
 
 Option 1 was rejected because audit workflows are inherently conversational: auditors need to review scoping decisions, adjust parameter bindings, and approve the applicability statement before it's finalized.
 
-Option 3 was chosen. Skills provide structured guidance while keeping the human in the loop. MCP grounding prevents hallucination. The pipeline router checks `.complytime/` artifact state to resume from the correct stage.
+Option 3 was chosen. Skills provide structured guidance while keeping the human in the loop. MCP grounding ensures data integrity. The pipeline router checks `.complytime/` artifact state to resume from the correct stage.
 
 **Decision:**
 
diff --git a/internal/mcp/tool_delta.go b/internal/mcp/tool_delta.go
index cf544e6..82ee722 100644
--- a/internal/mcp/tool_delta.go
+++ b/internal/mcp/tool_delta.go
@@ -14,7 +14,7 @@ import (
 func createAnalyzeParameterDeltaTool() *mcp.Tool {
 	return &mcp.Tool{
 		Name:        "analyze_parameter_delta",
-		Description: "Crosswalk parameters across all frameworks in a resolved policy. Returns per-parameter verdicts (aligned, mismatch, org_binds_generic, not_covered) and summary counts. Mismatch means the values differ — the caller determines which is stricter based on domain context.",
+		Description: "Gather parameter comparisons across a resolved policy. Returns structured L3 parameter values alongside the L1/L2 requirement text they map to. The caller interprets the relationship — the tool does not judge.",
 		InputSchema: map[string]interface{}{
 			"type": "object",
 			"properties": map[string]interface{}{
diff --git a/internal/mcp/tool_delta_test.go b/internal/mcp/tool_delta_test.go
index c2e7d5b..09d81b9 100644
--- a/internal/mcp/tool_delta_test.go
+++ b/internal/mcp/tool_delta_test.go
@@ -97,9 +97,14 @@ func TestHandleAnalyzeParameterDelta(t *testing.T) {
 		require.NoError(t, err)
 
 		assert.Equal(t, "org-policy", response["policy"])
-		params, ok := response["parameters"].([]interface{})
+		comparisons, ok := response["comparisons"].([]interface{})
 		require.True(t, ok)
-		assert.Len(t, params, 1)
+		assert.Len(t, comparisons, 1)
+
+		first := comparisons[0].(map[string]interface{})
+		assert.Equal(t, "CTL-TLS-001-AR1", first["requirement_id"])
+		assert.Equal(t, "1.3", first["policy_value"])
+		assert.Equal(t, "TLS minimum version", first["requirement_text"])
 	})
 
 	t.Run("policy not found", func(t *testing.T) {
diff --git a/internal/requirement/delta.go b/internal/requirement/delta.go
index e367c7a..5da929a 100644
--- a/internal/requirement/delta.go
+++ b/internal/requirement/delta.go
@@ -4,124 +4,33 @@ package requirement
 
 import (
 	"fmt"
-	"strings"
 
 	"github.com/gemaraproj/go-gemara"
 )
 
-// Verdict classifies the relationship between parameter values from
-// different sources in a resolved policy graph.
-type Verdict string
-
-const (
-	VerdictAligned         Verdict = "aligned"
-	VerdictMismatch        Verdict = "mismatch"
-	VerdictOrgBindsGeneric Verdict = "org_binds_generic"
-	VerdictNotCovered      Verdict = "not_covered"
-)
-
-// Specificity describes how concrete a parameter value is.
-type Specificity string
-
-const (
-	SpecificityConcrete Specificity = "concrete"
-	SpecificityGeneric  Specificity = "generic"
-	SpecificityNone     Specificity = "none"
-)
-
-// ParameterLayer holds a parameter value from one source.
-type ParameterLayer struct {
-	Source      string      `json:"source"`
-	Value       string      `json:"value"`
-	Specificity Specificity `json:"specificity"`
+// ParameterComparison pairs a structured L3 parameter with the
+// L1/L2 requirement text it maps to. The caller interprets the
+// relationship — the engine does not judge.
+type ParameterComparison struct {
+	RequirementID   string `json:"requirement_id"`
+	Label           string `json:"label"`
+	PolicyValue     string `json:"policy_value"`
+	PolicySource    string `json:"policy_source"`
+	RequirementText string `json:"requirement_text"`
+	CatalogSource   string `json:"catalog_source"`
 }
 
-// ParameterDelta is the result of comparing a single parameter
-// across framework, org policy, and tech baseline layers.
-type ParameterDelta struct {
-	RequirementID string         `json:"requirement_id"`
-	Label         string         `json:"label"`
-	Framework     ParameterLayer `json:"framework"`
-	OrgPolicy     ParameterLayer `json:"org_policy"`
-	TechBaseline  ParameterLayer `json:"tech_baseline"`
-	Verdict       Verdict        `json:"verdict"`
-}
-
-// DeltaReport is the full result of analyzing parameter deltas
+// DeltaReport is the result of gathering parameter comparisons
 // across a resolved policy.
 type DeltaReport struct {
-	PolicyID         string           `json:"policy"`
-	CatalogsCompared []string         `json:"catalogs_compared"`
-	Parameters       []ParameterDelta `json:"parameters"`
-	Summary          DeltaSummary     `json:"summary"`
-}
-
-// DeltaSummary counts verdicts.
-type DeltaSummary struct {
-	Total           int `json:"total"`
-	Aligned         int `json:"aligned"`
-	Mismatch        int `json:"mismatch"`
-	OrgBindsGeneric int `json:"org_binds_generic"`
-	NotCovered      int `json:"not_covered"`
-}
-
-// CompareValues determines the verdict between a framework layer and
-// an org policy layer.
-func CompareValues(framework, orgPolicy ParameterLayer) Verdict {
-	if framework.Specificity == SpecificityNone {
-		return VerdictNotCovered
-	}
-	if orgPolicy.Specificity == SpecificityNone {
-		return VerdictNotCovered
-	}
-
-	if framework.Specificity == SpecificityGeneric && orgPolicy.Specificity == SpecificityConcrete {
-		return VerdictOrgBindsGeneric
-	}
-
-	if framework.Value == orgPolicy.Value {
-		return VerdictAligned
-	}
-
-	return VerdictMismatch
-}
-
-func classifySpecificity(value string) Specificity {
-	if value == "" {
-		return SpecificityNone
-	}
-	lower := strings.ToLower(value)
-	if strings.Contains(lower, "per organizational") ||
-		strings.Contains(lower, "per the organization") ||
-		strings.Contains(lower, "as defined by") ||
-		strings.Contains(lower, "according to") {
-		return SpecificityGeneric
-	}
-	return SpecificityConcrete
-}
-
-func findGuidelineParameter(gc gemara.GuidanceCatalog, label string) (string, bool) {
-	return "", false
+	PolicyID         string                `json:"policy"`
+	CatalogsCompared []string              `json:"catalogs_compared"`
+	Comparisons      []ParameterComparison `json:"comparisons"`
 }
 
-func summarizeDeltas(deltas []ParameterDelta) DeltaSummary {
-	s := DeltaSummary{Total: len(deltas)}
-	for _, d := range deltas {
-		switch d.Verdict {
-		case VerdictAligned:
-			s.Aligned++
-		case VerdictMismatch:
-			s.Mismatch++
-		case VerdictOrgBindsGeneric:
-			s.OrgBindsGeneric++
-		case VerdictNotCovered:
-			s.NotCovered++
-		}
-	}
-	return s
-}
-
-// AnalyzeDelta compares parameters across all layers in a resolved policy.
+// AnalyzeDelta gathers L3 parameter values alongside the L1/L2
+// requirement text they map to. Returns structured pairs for the
+// caller to interpret — no verdicts or heuristics.
 func AnalyzeDelta(rp *ResolvedPolicy, set *ArtifactSet) (*DeltaReport, error) {
 	if rp == nil {
 		return nil, fmt.Errorf("resolved policy is nil")
@@ -132,53 +41,68 @@ func AnalyzeDelta(rp *ResolvedPolicy, set *ArtifactSet) (*DeltaReport, error) {
 		catalogIDs = append(catalogIDs, cat.Metadata.Id)
 	}
 
-	var deltas []ParameterDelta
+	reqTextIndex := buildRequirementTextIndex(rp)
+
+	var comparisons []ParameterComparison
 	for _, plan := range rp.Policy.Adherence.AssessmentPlans {
 		for _, param := range plan.Parameters {
-			orgValue := ""
+			policyValue := ""
 			if len(param.AcceptedValues) > 0 {
-				orgValue = param.AcceptedValues[0]
+				policyValue = param.AcceptedValues[0]
 			}
 
-			orgLayer := ParameterLayer{
-				Source:      rp.Policy.Metadata.Id,
-				Value:       orgValue,
-				Specificity: classifySpecificity(orgValue),
-			}
+			reqText, catalogSource := reqTextIndex.lookup(plan.RequirementId)
 
-			fwLayer := ParameterLayer{Specificity: SpecificityNone}
-			baselineLayer := ParameterLayer{Specificity: SpecificityNone}
-
-			for _, gc := range rp.GuidanceCatalogs {
-				if v, ok := findGuidelineParameter(gc, param.Label); ok {
-					fwLayer = ParameterLayer{
-						Source:      gc.Metadata.Id,
-						Value:       v,
-						Specificity: classifySpecificity(v),
-					}
-					break
-				}
-			}
-
-			verdict := CompareValues(fwLayer, orgLayer)
-
-			deltas = append(deltas, ParameterDelta{
-				RequirementID: plan.RequirementId,
-				Label:         param.Label,
-				Framework:     fwLayer,
-				OrgPolicy:     orgLayer,
-				TechBaseline:  baselineLayer,
-				Verdict:       verdict,
+			comparisons = append(comparisons, ParameterComparison{
+				RequirementID:   plan.RequirementId,
+				Label:           param.Label,
+				PolicyValue:     policyValue,
+				PolicySource:    rp.Policy.Metadata.Id,
+				RequirementText: reqText,
+				CatalogSource:   catalogSource,
 			})
 		}
 	}
 
-	summary := summarizeDeltas(deltas)
-
 	return &DeltaReport{
 		PolicyID:         rp.Policy.Metadata.Id,
 		CatalogsCompared: catalogIDs,
-		Parameters:       deltas,
-		Summary:          summary,
+		Comparisons:      comparisons,
 	}, nil
 }
+
+type requirementTextIndex struct {
+	texts   map[string]string
+	sources map[string]string
+}
+
+func buildRequirementTextIndex(rp *ResolvedPolicy) requirementTextIndex {
+	idx := requirementTextIndex{
+		texts:   make(map[string]string),
+		sources: make(map[string]string),
+	}
+	for _, cat := range rp.ControlCatalogs {
+		for _, ctrl := range cat.Controls {
+			for _, ar := range ctrl.AssessmentRequirements {
+				idx.texts[ar.Id] = ar.Text
+				idx.sources[ar.Id] = cat.Metadata.Id
+			}
+		}
+	}
+	for _, gc := range rp.GuidanceCatalogs {
+		for _, gl := range gc.Guidelines {
+			idx.texts[gl.Id] = gl.Objective
+			idx.sources[gl.Id] = gc.Metadata.Id
+		}
+	}
+	return idx
+}
+
+func (idx requirementTextIndex) lookup(reqID string) (text, source string) {
+	return idx.texts[reqID], idx.sources[reqID]
+}
+
+// findGuidelineParameter is unused but kept for interface compatibility.
+func findGuidelineParameter(_ gemara.GuidanceCatalog, _ string) (string, bool) {
+	return "", false
+}
diff --git a/internal/requirement/delta_test.go b/internal/requirement/delta_test.go
index a6c09a4..a6a8253 100644
--- a/internal/requirement/delta_test.go
+++ b/internal/requirement/delta_test.go
@@ -10,67 +10,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestCompareValues_Aligned(t *testing.T) {
-	fw := ParameterLayer{Source: "framework", Value: "1.3", Specificity: SpecificityConcrete}
-	org := ParameterLayer{Source: "org-policy", Value: "1.3", Specificity: SpecificityConcrete}
-
-	verdict := CompareValues(fw, org)
-	assert.Equal(t, VerdictAligned, verdict)
-}
-
-func TestCompareValues_Mismatch(t *testing.T) {
-	t.Run("version strings", func(t *testing.T) {
-		fw := ParameterLayer{Source: "fw", Value: "1.2", Specificity: SpecificityConcrete}
-		org := ParameterLayer{Source: "org", Value: "1.3", Specificity: SpecificityConcrete}
-		verdict := CompareValues(fw, org)
-		assert.Equal(t, VerdictMismatch, verdict)
-	})
-
-	t.Run("numeric thresholds", func(t *testing.T) {
-		fw := ParameterLayer{Source: "fw", Value: "30", Specificity: SpecificityConcrete}
-		org := ParameterLayer{Source: "org", Value: "60", Specificity: SpecificityConcrete}
-		verdict := CompareValues(fw, org)
-		assert.Equal(t, VerdictMismatch, verdict)
-	})
-
-	t.Run("algorithms", func(t *testing.T) {
-		fw := ParameterLayer{Source: "fw", Value: "AES-256-GCM", Specificity: SpecificityConcrete}
-		org := ParameterLayer{Source: "org", Value: "ChaCha20-Poly1305", Specificity: SpecificityConcrete}
-		verdict := CompareValues(fw, org)
-		assert.Equal(t, VerdictMismatch, verdict)
-	})
-}
-
-func TestCompareValues_OrgBindsGeneric(t *testing.T) {
-	fw := ParameterLayer{Source: "fw", Value: "per organizational requirements", Specificity: SpecificityGeneric}
-	org := ParameterLayer{Source: "org", Value: "MFA + bastion host", Specificity: SpecificityConcrete}
-	verdict := CompareValues(fw, org)
-	assert.Equal(t, VerdictOrgBindsGeneric, verdict)
-}
-
-func TestCompareValues_NotCovered(t *testing.T) {
-	t.Run("both none", func(t *testing.T) {
-		fw := ParameterLayer{Specificity: SpecificityNone}
-		org := ParameterLayer{Specificity: SpecificityNone}
-		verdict := CompareValues(fw, org)
-		assert.Equal(t, VerdictNotCovered, verdict)
-	})
-
-	t.Run("framework none", func(t *testing.T) {
-		fw := ParameterLayer{Specificity: SpecificityNone}
-		org := ParameterLayer{Source: "org", Value: "90", Specificity: SpecificityConcrete}
-		verdict := CompareValues(fw, org)
-		assert.Equal(t, VerdictNotCovered, verdict)
-	})
-
-	t.Run("org none", func(t *testing.T) {
-		fw := ParameterLayer{Source: "fw", Value: "90", Specificity: SpecificityConcrete}
-		org := ParameterLayer{Specificity: SpecificityNone}
-		verdict := CompareValues(fw, org)
-		assert.Equal(t, VerdictNotCovered, verdict)
-	})
-}
-
 func testDeltaArtifactSet() *ArtifactSet {
 	catalog := &gemara.ControlCatalog{
 		Metadata: gemara.Metadata{Id: "container-baseline"},
@@ -141,8 +80,20 @@ func TestAnalyzeDelta(t *testing.T) {
 
 	assert.Equal(t, "org-parent-policy", report.PolicyID)
 	assert.Contains(t, report.CatalogsCompared, "container-baseline")
-	assert.Len(t, report.Parameters, 2)
-	assert.Equal(t, report.Summary.Total, 2)
+	assert.Len(t, report.Comparisons, 2)
+
+	tls := report.Comparisons[0]
+	assert.Equal(t, "CTL-TLS-001-AR1", tls.RequirementID)
+	assert.Equal(t, "tls_minimum_version", tls.Label)
+	assert.Equal(t, "1.3", tls.PolicyValue)
+	assert.Equal(t, "org-parent-policy", tls.PolicySource)
+	assert.Equal(t, "TLS minimum version must be enforced", tls.RequirementText)
+	assert.Equal(t, "container-baseline", tls.CatalogSource)
+
+	cert := report.Comparisons[1]
+	assert.Equal(t, "CTL-CERT-001-AR1", cert.RequirementID)
+	assert.Equal(t, "90", cert.PolicyValue)
+	assert.Equal(t, "Certificate validity must not exceed maximum", cert.RequirementText)
 }
 
 func TestAnalyzeDelta_NilPolicy(t *testing.T) {

From ed67ab56a0d70f60013aec2c164ba9fabaaf6b26 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Sat, 13 Jun 2026 17:14:54 -0400
Subject: [PATCH 07/16] fix: updates gemara version in adherence skill

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 skills/pipeline/adherence.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/skills/pipeline/adherence.md b/skills/pipeline/adherence.md
index 0def537..c50aa85 100644
--- a/skills/pipeline/adherence.md
+++ b/skills/pipeline/adherence.md
@@ -47,7 +47,7 @@ Group by `requirement_id`. Each plan:
 ### Step 5: Compile the Policy
 
 ```yaml
-gemara: v1alpha1
+gemara: v1.0.0
 kind: Policy
 metadata:
   id: <system-name>-policy

From f26f877e21b04c01fc01f28562c305a1feecf2df Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Sat, 13 Jun 2026 17:23:43 -0400
Subject: [PATCH 08/16] fix: update mapping skill to match gatherer-based delta
 engine

Remove verdict types, specificity layers, and heuristic references.
Mapping skill now instructs the model to interpret parameter
comparisons using domain context rather than relying on engine
verdicts. Output schema uses comparisons with interpretation field.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 skills/pipeline/mapping.md | 81 +++++++++++++++++---------------------
 1 file changed, 36 insertions(+), 45 deletions(-)

diff --git a/skills/pipeline/mapping.md b/skills/pipeline/mapping.md
index 03e1df6..c02f613 100644
--- a/skills/pipeline/mapping.md
+++ b/skills/pipeline/mapping.md
@@ -6,7 +6,7 @@ user-invocable: false
 
 # Mapping — Delta Analysis & Parameter Harmonization
 
-Compare parameters across Guidance Catalogs, the parent Policy, and Control Catalogs. Surface where the organization's values match or differ from each framework. When values differ, interpret which is stricter based on domain context.
+Compare parameters across Guidance Catalogs, the parent Policy, and Control Catalogs. Surface where the organization's values match or differ from each framework. Interpret the relationship using domain context — the tool gathers, the model judges.
 
 **Core invariant:** The parent Policy always sets the floor. Never resolve below it without explicit user acknowledgement.
 
@@ -23,15 +23,6 @@ The parent Policy's `imports.guidance` determines which frameworks are binding:
 - **Mandated:** Guidance Catalogs imported by the parent Policy. Shortfalls MUST be addressed.
 - **Under evaluation:** Guidance Catalogs loaded in MCP but NOT imported. Informational only.
 
-### Verdict Types
-
-| Verdict | Meaning | Action |
-|---------|---------|--------|
-| `aligned` | Values match | No action |
-| `mismatch` | Values differ | Interpret which is stricter based on domain context (e.g., TLS 1.3 > 1.2, shorter timeout = stricter). Present both values and your assessment to the user for confirmation. |
-| `org_binds_generic` | Org provides concrete value for generic language | Document |
-| `not_covered` | Parameter in one source only | Flag |
-
 ## Process
 
 ### Step 1: Read Scoping Artifacts
@@ -44,7 +35,7 @@ Read `.complytime/scoping.yaml`.
 ListMcpResourcesTool(server="complypack")
 ```
 
-If a Policy exists, read it. **If no parent Policy exists:** extract minimums from the target framework's Control Catalog requirements. The framework becomes the floor.
+Look for resources with "Policy" in the name. If a Policy exists, read it. **If no parent Policy exists:** extract minimums from the target framework's Control Catalog requirements. The framework becomes the floor.
 
 ### Step 3: Classify Guidance Frameworks
 
@@ -60,21 +51,35 @@ ReadMcpResourceTool(server="complypack", uri="complypack://mapping/<id>")
 
 Use them to resolve framework crosswalks.
 
-### Step 5: Run Delta Analysis
+### Step 5: Gather Parameter Comparisons
 
 ```
-CallMcpToolTool(server="complypack", tool="analyze_parameter_delta", arguments={"policyName": "<name>"})
+CallMcpToolTool(server="complypack", tool="analyze_parameter_delta", arguments={"policyName": "<policy-name>"})
 ```
 
+This returns structured L3 parameter values from the Policy alongside the L1/L2 requirement text they map to. Each comparison contains:
+- `requirement_id` — which requirement the parameter maps to
+- `label` — the parameter name
+- `policy_value` — the structured value from the Policy
+- `requirement_text` — the prose from the catalog
+
+**The tool does not judge the relationship.** You interpret each pair using domain context.
+
 ### Step 6: Present Results
 
-**Mandated:** Show each non-aligned verdict with values and recommended action.
+For each comparison, interpret the relationship:
+- Do the values align?
+- Does the requirement text express a concrete expectation the policy value satisfies?
+- Does the policy set a stricter threshold than the requirement implies?
+- Is the requirement generic ("per organizational requirements") and the policy provides a concrete binding?
+
+**Mandated frameworks:** present your interpretation and recommended action.
 
-**Under evaluation:** Same verdicts, framed as "if you pursue this certification..."
+**Under evaluation:** same analysis, framed as "if you pursue this certification..."
 
 ### Step 7: Resolve Decisions
 
-Walk the user through `mismatch` items. For each, interpret which value is stricter given the parameter's domain, present your assessment, and let the user decide.
+Walk the user through items where values differ. For each, present both the policy value and the requirement text, explain your interpretation, and let the user decide.
 
 ### Step 8: Write Output
 
@@ -94,44 +99,30 @@ sources:
         status: loaded_not_imported
   catalogs: [<ids>]
 
-parameters:
-  - id: "<label>"
-    requirement_id: "<req-id>"
-    layers:
-      framework:
-        source: "<id>"
-        value: "<value>"
-        specificity: <concrete|generic|none>
-      org_policy:
-        source: "<id>"
-        value: "<value>"
-        specificity: <concrete|generic|none>
-      tech_baseline:
-        source: "<id>"
-        value: "<value>"
-        specificity: <concrete|generic|none>
-    verdict: <verdict>
-    resolved_value: "<value>"
-    resolution: <resolution>
-    rationale: "<why>"
-
-summary:
-  total: <N>
-  aligned: <N>
-  mismatch: <N>
-  org_binds_generic: <N>
-  not_covered: <N>
+comparisons:
+  - requirement_id: "<req-id>"
+    label: "<label>"
+    policy_value: "<value>"
+    policy_source: "<policy-id>"
+    requirement_text: "<text>"
+    catalog_source: "<catalog-id>"
+    interpretation: "<your assessment>"
+    resolution: "<user decision>"
 ```
 
 ## MCP Resources and Tools
 
 - `complypack://catalog/*` — Control Catalogs, Guidance Catalogs, Policies
 - `complypack://mapping/*` — Mapping Documents
-- `analyze_parameter_delta` — deterministic parameter crosswalk
+- `analyze_parameter_delta` — gather L3 parameter values alongside L1/L2 requirement text
+- `get_assessment_requirements` — get requirement details, supports scope filtering
+
+**DO NOT parse local YAML files to extract control data.** All control IDs, requirement IDs, requirement text, and parameter values MUST come from MCP resources or tools.
 
 ## Red Flags
 
 - [ ] Did you classify guidance as mandated vs. under evaluation?
-- [ ] Did the user decide every `mismatch`?
+- [ ] Did the user decide every item where values differ?
 - [ ] Did you ensure no resolution goes below the parent Policy floor?
 - [ ] Did every value come from MCP?
+- [ ] Did you use `analyze_parameter_delta` to gather comparisons, not parse files?

From 8b80d4b0818751b07a84b03fd55553d18a71a0c9 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 15 Jun 2026 17:53:59 -0400
Subject: [PATCH 09/16] fix: allow get_assessment_requirements to accept
 catalog names

The tool previously only looked up resolved policies by name. When a
catalog name was passed, it failed with "policy not found". Now falls
back to wrapping a bare catalog in a synthetic ResolvedPolicy so the
tool works with both policy and catalog names.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 internal/mcp/tool_assessment.go      | 39 +++++++++++++++++++++-
 internal/mcp/tool_assessment_test.go | 48 ++++++++++++++++++++++++++++
 2 files changed, 86 insertions(+), 1 deletion(-)

diff --git a/internal/mcp/tool_assessment.go b/internal/mcp/tool_assessment.go
index fd3a7c2..c8b2c60 100644
--- a/internal/mcp/tool_assessment.go
+++ b/internal/mcp/tool_assessment.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/complytime/complypack/internal/requirement"
+	"github.com/gemaraproj/go-gemara"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 )
 
@@ -66,7 +67,10 @@ func handleGetAssessmentRequirements(store *ResourceStore) mcp.ToolHandler {
 
 		rp, found := store.resolved[input.CatalogName]
 		if !found {
-			return nil, fmt.Errorf("policy %q not found", input.CatalogName)
+			rp, found = resolveFromCatalog(store, input.CatalogName)
+			if !found {
+				return nil, fmt.Errorf("policy or catalog %q not found", input.CatalogName)
+			}
 		}
 		requirements := extractFromResolvedPolicy(rp, input.ControlID, input.Scope)
 
@@ -92,6 +96,39 @@ func handleGetAssessmentRequirements(store *ResourceStore) mcp.ToolHandler {
 	}
 }
 
+// resolveFromCatalog wraps a bare catalog in a synthetic ResolvedPolicy so
+// get_assessment_requirements works with catalog names, not just policy names.
+func resolveFromCatalog(store *ResourceStore, name string) (*requirement.ResolvedPolicy, bool) {
+	art, ok := store.artifacts[name]
+	if !ok {
+		return nil, false
+	}
+	cat, ok := art.(*gemara.ControlCatalog)
+	if !ok {
+		return nil, false
+	}
+	set := &requirement.ArtifactSet{
+		Catalogs: map[string]*gemara.ControlCatalog{name: cat},
+		Policies: make(map[string]*gemara.Policy),
+		Guidance: make(map[string]*gemara.GuidanceCatalog),
+		Mappings: make(map[string]*gemara.MappingDocument),
+	}
+	syntheticPolicy := gemara.Policy{
+		Metadata: gemara.Metadata{
+			Id:                name + "-synthetic",
+			MappingReferences: []gemara.MappingReference{{Id: name}},
+		},
+		Imports: gemara.Imports{
+			Catalogs: []gemara.CatalogImport{{ReferenceId: name}},
+		},
+	}
+	rp, err := requirement.ResolvePolicy(syntheticPolicy, set)
+	if err != nil {
+		return nil, false
+	}
+	return rp, true
+}
+
 // extractFromResolvedPolicy extracts requirements from a resolved policy graph.
 func extractFromResolvedPolicy(rp *requirement.ResolvedPolicy, filterControlID string, filterScope []string) []AssessmentRequirementInfo {
 	var results []AssessmentRequirementInfo
diff --git a/internal/mcp/tool_assessment_test.go b/internal/mcp/tool_assessment_test.go
index 974a7ec..6748042 100644
--- a/internal/mcp/tool_assessment_test.go
+++ b/internal/mcp/tool_assessment_test.go
@@ -127,6 +127,54 @@ func TestHandleGetAssessmentRequirements(t *testing.T) {
 		assert.Len(t, requirements, 3)
 	})
 
+	t.Run("catalog name fallback", func(t *testing.T) {
+		catalog := &gemara.ControlCatalog{
+			Metadata: gemara.Metadata{Id: "bare-catalog"},
+			Controls: []gemara.Control{
+				{
+					Id: "CAT-001",
+					AssessmentRequirements: []gemara.AssessmentRequirement{
+						{Id: "CAT-001-AR1", Text: "Catalog requirement", Applicability: []string{"maturity-1"}},
+					},
+				},
+			},
+		}
+		catalogStore := &ResourceStore{
+			artifacts: map[string]any{"bare-catalog": catalog},
+			resolved:  map[string]*requirement.ResolvedPolicy{},
+			schemas:   map[string][]byte{},
+		}
+		catalogHandler := handleGetAssessmentRequirements(catalogStore)
+
+		input := map[string]interface{}{
+			"catalogName": "bare-catalog",
+		}
+		inputJSON, err := json.Marshal(input)
+		require.NoError(t, err)
+
+		req := &mcp.CallToolRequest{
+			Params: &mcp.CallToolParamsRaw{
+				Arguments: json.RawMessage(inputJSON),
+			},
+		}
+
+		result, err := catalogHandler(context.Background(), req)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+
+		textContent, ok := result.Content[0].(*mcp.TextContent)
+		require.True(t, ok)
+
+		var response map[string]interface{}
+		err = json.Unmarshal([]byte(textContent.Text), &response)
+		require.NoError(t, err)
+
+		assert.Equal(t, float64(1), response["count"])
+		requirements := response["requirements"].([]interface{})
+		firstReq := requirements[0].(map[string]interface{})
+		assert.Equal(t, "CAT-001-AR1", firstReq["id"])
+	})
+
 	t.Run("policy not found", func(t *testing.T) {
 		input := map[string]interface{}{
 			"catalogName": "nonexistent",

From f13f578dfc0ff3bf995b40959f95d82865aec609 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 15 Jun 2026 19:20:40 -0400
Subject: [PATCH 10/16] docs: refine working on new ADRs

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 docs/adr/012-container-mcp-distribution.md | 6 ++----
 docs/adr/015-comply-pipeline-plugin.md     | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/docs/adr/012-container-mcp-distribution.md b/docs/adr/012-container-mcp-distribution.md
index 4e70645..1606ac6 100644
--- a/docs/adr/012-container-mcp-distribution.md
+++ b/docs/adr/012-container-mcp-distribution.md
@@ -8,7 +8,7 @@
 
 ComplyPack's MCP server is a Go binary that users must build locally. Issue #24 requires single-click distribution. Four options were evaluated:
 
-1. **Container image on GHCR** — `docker run --rm -i ghcr.io/complytime/complypack`
+1. **Container image** — `docker run --rm -i ghcr.io/complytime/complypack`
 2. **Binary download via plugin SessionStart hook** — download pre-built binaries from GitHub Releases into `~/.claude/plugins/data/`
 3. **`go install`** — users install via Go toolchain
 4. **Homebrew tap** — formula for macOS/Linux
@@ -19,11 +19,9 @@ Option 3 requires the Go toolchain on every user's machine — a non-starter for
 
 Option 4 adds a distribution channel to maintain and doesn't cover Fedora users natively.
 
-Option 1 is the only approach that is both trusted (GHCR handles image distribution, cosign handles signing) and already established in the plugin ecosystem (the Terraform plugin uses `docker` as the MCP command).
-
 **Decision:**
 
-Distribute the MCP server as a multi-arch container image on GHCR (`ghcr.io/complytime/complypack`). Sign images with cosign (keyless/OIDC). Users invoke via `docker run --rm -i` or `podman run --rm -i` in their `.mcp.json`.
+Distribute the MCP server as a multi-arch container image (`ghcr.io/complytime/complypack`). Sign images with cosign (keyless/OIDC). Users invoke via `docker run --rm -i` or `podman run --rm -i` in their `.mcp.json`.
 
 **Consequences:**
 
diff --git a/docs/adr/015-comply-pipeline-plugin.md b/docs/adr/015-comply-pipeline-plugin.md
index 90a57d9..b1720f3 100644
--- a/docs/adr/015-comply-pipeline-plugin.md
+++ b/docs/adr/015-comply-pipeline-plugin.md
@@ -28,7 +28,7 @@ Implement the comply pipeline as plugin skills:
 - **`/comply:pack`** — generates assessment logic after pipeline completion
 - **`/comply:setup`** — configures `.mcp.json` for the user's environment
 
-Each stage reads exclusively from MCP resources. The pipeline produces Gemara Policy artifacts — functionally equivalent to an ISO 27001 Statement of Applicability or a NIST System Security Plan.
+Each stage reads exclusively from MCP resources. The pipeline produces Gemara Policy artifacts.
 
 **Consequences:**
 

From 47609780babb7d85edf83843423dc61b499050e6 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 15 Jun 2026 19:29:39 -0400
Subject: [PATCH 11/16] fix: update Policy snippet in adherence skills to
 schema valid example

Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 skills/pipeline/adherence.md | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/skills/pipeline/adherence.md b/skills/pipeline/adherence.md
index c50aa85..d536dff 100644
--- a/skills/pipeline/adherence.md
+++ b/skills/pipeline/adherence.md
@@ -47,15 +47,28 @@ Group by `requirement_id`. Each plan:
 ### Step 5: Compile the Policy
 
 ```yaml
-gemara: v1.0.0
-kind: Policy
+title: "<System> Policy"
 metadata:
-  id: <system-name>-policy
-  title: "<System Name> Policy"
-  created: "<today>"
-mapping_references:
-  - id: <ref-id>
-    metadata_id: <metadata-id>
+  id: <id>
+  gemara-version: v1.0.0
+  type: Policy
+  description: <system description>
+  author:
+    id: <user id>
+    name: <user name>
+    type: Software Assisted
+  mapping_references:
+    - id: <ref-id>
+      metadata_id: <metadata-id>
+contacts:
+  responsible:
+    - name: <contact name>
+  accountable:
+    - name: <contact name>
+scope:
+  in:
+    technologies:
+      - <system profile>
 imports:
   catalogs:
     - reference_id: <ref-id>
@@ -76,7 +89,7 @@ adherence:
 
 ### Step 6: Validate
 
-Write `.complytime/child-policy.yaml`. If the Gemara MCP server is available, validate against the schema.
+Write `.complytime/child-policy.yaml`. If the Gemara MCP server is available, validate against the schema with the Policy definition.
 
 ### Step 7: Present Summary
 

From b9c33e9f10b8555541dae2208a7f5072a7893025 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 15 Jun 2026 19:35:25 -0400
Subject: [PATCH 12/16] fix: correct adherence skill Policy snippet to match
 Gemara schema

Use hyphenated field names (mapping-references, assessment-plans,
evaluation-methods, accepted-values, reference-id). Add required
fields: title (top-level), metadata.author, contacts, scope with
applicability groups. Fix evaluation-methods to use id/type/mode
structure. Add id fields to assessment plans and parameters.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 skills/pipeline/adherence.md | 58 +++++++++++++++++++++---------------
 1 file changed, 34 insertions(+), 24 deletions(-)

diff --git a/skills/pipeline/adherence.md b/skills/pipeline/adherence.md
index d536dff..2275487 100644
--- a/skills/pipeline/adherence.md
+++ b/skills/pipeline/adherence.md
@@ -37,56 +37,66 @@ From the delta report's `sources`, build `mapping_references`:
 
 ### Step 4: Build Assessment Plans
 
-Group by `requirement_id`. Each plan:
-- `requirement_id`
+Group by `requirement-id`. Each plan:
+- `id` — unique plan identifier
+- `requirement-id` — the assessment requirement this plan addresses
 - `frequency` (e.g., "30d", "90d", "365d")
-- `evaluation_methods` (e.g., "automated", "manual_review", "attestation")
-- `evidence_requirements`
-- `parameters` — frozen values from harmonization
+- `evaluation-methods` — list of `{id, type: Behavioral|Intent, mode: Automated|Manual}`
+- `evidence-requirements` — what evidence is collected
+- `parameters` — frozen values from harmonization, each with `id`, `label`, `accepted-values`, `description`
 
 ### Step 5: Compile the Policy
 
 ```yaml
-title: "<System> Policy"
+title: "<System Name> Policy"
 metadata:
-  id: <id>
+  id: <system-name>-policy
   gemara-version: v1.0.0
   type: Policy
-  description: <system description>
+  description: "<system description>"
   author:
-    id: <user id>
-    name: <user name>
+    id: <author-id>
+    name: <author-name>
     type: Software Assisted
-  mapping_references:
+  mapping-references:
     - id: <ref-id>
-      metadata_id: <metadata-id>
+      title: "<reference title>"
+      version: "<version>"
 contacts:
   responsible:
-    - name: <contact name>
+    - name: "<contact name>"
   accountable:
-    - name: <contact name>
+    - name: "<contact name>"
 scope:
   in:
     technologies:
-      - <system profile>
+      - <technology from system profile>
+    groups:
+      - <applicability group, e.g. maturity-1, maturity-2>
 imports:
   catalogs:
-    - reference_id: <ref-id>
+    - reference-id: <ref-id>
   guidance:
-    - reference_id: <ref-id>
+    - reference-id: <ref-id>
 adherence:
-  assessment_plans:
-    - requirement_id: "<req-id>"
+  assessment-plans:
+    - id: <plan-id>
+      requirement-id: "<req-id>"
       frequency: "<cadence>"
-      evaluation_methods:
-        - method: "<method>"
-      evidence_requirements: "<what>"
+      evaluation-methods:
+        - id: <method-id>
+          type: Behavioral
+          mode: Automated
+      evidence-requirements: "<what>"
       parameters:
-        - label: "<label>"
-          accepted_values: ["<value>"]
+        - id: <param-id>
+          label: "<label>"
+          accepted-values: ["<value>"]
           description: "<rationale>"
 ```
 
+Use `scope.in.groups` for applicability groups from the scoping stage (e.g., maturity levels, risk tiers). This scopes the policy to only the controls that match those groups.
+
 ### Step 6: Validate
 
 Write `.complytime/child-policy.yaml`. If the Gemara MCP server is available, validate against the schema with the Policy definition.

From b315548e6dfac8cbc79ec70eb6bce3f6e7c320e3 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Mon, 15 Jun 2026 19:47:32 -0400
Subject: [PATCH 13/16] fix: remove unused findGuidelineParameter function

Fixes golangci-lint unused finding.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 internal/requirement/delta.go | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/internal/requirement/delta.go b/internal/requirement/delta.go
index 5da929a..3470edd 100644
--- a/internal/requirement/delta.go
+++ b/internal/requirement/delta.go
@@ -2,11 +2,7 @@
 
 package requirement
 
-import (
-	"fmt"
-
-	"github.com/gemaraproj/go-gemara"
-)
+import "fmt"
 
 // ParameterComparison pairs a structured L3 parameter with the
 // L1/L2 requirement text it maps to. The caller interprets the
@@ -100,9 +96,4 @@ func buildRequirementTextIndex(rp *ResolvedPolicy) requirementTextIndex {
 
 func (idx requirementTextIndex) lookup(reqID string) (text, source string) {
 	return idx.texts[reqID], idx.sources[reqID]
-}
-
-// findGuidelineParameter is unused but kept for interface compatibility.
-func findGuidelineParameter(_ gemara.GuidanceCatalog, _ string) (string, bool) {
-	return "", false
-}
+}
\ No newline at end of file

From dc4e63d4b3017efbdf49e4589ebe03b204503ac6 Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Tue, 16 Jun 2026 17:44:23 -0400
Subject: [PATCH 14/16] fix: add pull-requests read permission for reusable CI
 workflow

The updated reusable_ci.yml in org-infra added pull-requests: read to
its megalinter job, causing a startup_failure when the caller didn't
grant that permission.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7580aef..c0b3fa0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,6 +55,7 @@ jobs:
     permissions:
       contents: read
       issues: read
+      pull-requests: read
 
   call_reusable_security:
     name: Security Scan

From 5cc65ad40544de7e965b6feee12cf2f4029a9fda Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Tue, 16 Jun 2026 18:50:11 -0400
Subject: [PATCH 15/16] fix: resolve megalinter goimports and markdown lint
 errors

Add missing newline at EOF in delta.go, add language specifiers to
fenced code blocks, and fix table pipe alignment in skill docs.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 docs/adr/013-cli-flags-mcp-serve.md | 2 +-
 internal/requirement/delta.go       | 2 +-
 skills/pack/SKILL.md                | 2 +-
 skills/pipeline/SKILL.md            | 2 +-
 skills/pipeline/mapping.md          | 6 +++---
 skills/pipeline/scoping.md          | 8 ++++----
 skills/setup/SKILL.md               | 8 ++++----
 7 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/docs/adr/013-cli-flags-mcp-serve.md b/docs/adr/013-cli-flags-mcp-serve.md
index 6fc771f..e6474d1 100644
--- a/docs/adr/013-cli-flags-mcp-serve.md
+++ b/docs/adr/013-cli-flags-mcp-serve.md
@@ -14,7 +14,7 @@ The MCP server only uses two config sections: `gemara.sources` (which OCI artifa
 
 Add repeatable `--source` and `--schema` flags to `mcp serve`:
 
-```
+```shell
 complypack mcp serve \
   --source oci://registry.example.com/gemara/controls:v1 \
   --source oci+http://localhost:5001/gemara/guidance:v1 \
diff --git a/internal/requirement/delta.go b/internal/requirement/delta.go
index 3470edd..3108054 100644
--- a/internal/requirement/delta.go
+++ b/internal/requirement/delta.go
@@ -96,4 +96,4 @@ func buildRequirementTextIndex(rp *ResolvedPolicy) requirementTextIndex {
 
 func (idx requirementTextIndex) lookup(reqID string) (text, source string) {
 	return idx.texts[reqID], idx.sources[reqID]
-}
\ No newline at end of file
+}
diff --git a/skills/pack/SKILL.md b/skills/pack/SKILL.md
index 210a718..bf8fa52 100644
--- a/skills/pack/SKILL.md
+++ b/skills/pack/SKILL.md
@@ -23,7 +23,7 @@ Do NOT use for:
 ## Quick Reference
 
 | Step | Action | Output |
-|------|--------|--------|
+| ---- | ------ | ------ |
 | 1. Read control | Get definition from catalog (MCP) | Control text, ID, title |
 | 2. Get parameters | Extract assessment requirements | Thresholds, values |
 | 3. Read schema | Get platform schema (MCP) | JSON Schema or CUE |
diff --git a/skills/pipeline/SKILL.md b/skills/pipeline/SKILL.md
index a57be93..ee43bcd 100644
--- a/skills/pipeline/SKILL.md
+++ b/skills/pipeline/SKILL.md
@@ -44,7 +44,7 @@ Read the stage instructions from this skill's base directory before proceeding:
 
 ## Status Display
 
-```
+```text
 /comply:pipeline status:
   [done] scoping     — .complytime/scoping.yaml
   [done] mapping     — .complytime/delta-report.yaml
diff --git a/skills/pipeline/mapping.md b/skills/pipeline/mapping.md
index c02f613..e2c1fb8 100644
--- a/skills/pipeline/mapping.md
+++ b/skills/pipeline/mapping.md
@@ -31,7 +31,7 @@ Read `.complytime/scoping.yaml`.
 
 ### Step 2: Identify Parent Policy
 
-```
+```text
 ListMcpResourcesTool(server="complypack")
 ```
 
@@ -45,7 +45,7 @@ If a parent Policy exists, check `imports.guidance`. If not, all Guidance Catalo
 
 Read any Mapping Documents recorded in scoping:
 
-```
+```text
 ReadMcpResourceTool(server="complypack", uri="complypack://mapping/<id>")
 ```
 
@@ -53,7 +53,7 @@ Use them to resolve framework crosswalks.
 
 ### Step 5: Gather Parameter Comparisons
 
-```
+```text
 CallMcpToolTool(server="complypack", tool="analyze_parameter_delta", arguments={"policyName": "<policy-name>"})
 ```
 
diff --git a/skills/pipeline/scoping.md b/skills/pipeline/scoping.md
index aa2749b..2633e32 100644
--- a/skills/pipeline/scoping.md
+++ b/skills/pipeline/scoping.md
@@ -29,7 +29,7 @@ Characterize the system, identify its technology component stack, and scope whic
 
 Query MCP for available Control Catalogs:
 
-```
+```text
 ListMcpResourcesTool(server="complypack")
 ```
 
@@ -41,13 +41,13 @@ If the user specified a scoping level (e.g., maturity level, risk tier), use `ge
 
 **Important:** The `catalogName` parameter takes a **policy name**, not a catalog name. The policy resolves its imported catalogs internally. Find the policy name from `ListMcpResourcesTool` output — look for resources with `kind: Policy`.
 
-```
+```text
 CallMcpToolTool(server="complypack", tool="get_assessment_requirements", arguments={"catalogName": "<policy-name>", "scope": ["<applicability-group>"]})
 ```
 
 For example, for OSPS Baseline at Maturity Level 2 with a policy named `example-foundation-policy`:
 
-```
+```text
 CallMcpToolTool(server="complypack", tool="get_assessment_requirements", arguments={"catalogName": "example-foundation-policy", "scope": ["maturity-1", "maturity-2"]})
 ```
 
@@ -57,7 +57,7 @@ This returns only the requirements whose applicability includes the target level
 
 Ask the user if they have Gemara Mapping Documents. Check MCP:
 
-```
+```text
 ListMcpResourcesTool(server="complypack")
 ```
 
diff --git a/skills/setup/SKILL.md b/skills/setup/SKILL.md
index d264bef..90917d8 100644
--- a/skills/setup/SKILL.md
+++ b/skills/setup/SKILL.md
@@ -9,10 +9,10 @@ Set up the Gemara MCP server and the complypack MCP server for this project.
 
 ## MCP Servers
 
-| Server | Purpose | Provides |
-|--------|---------|----------|
-| **gemara** | Authoring and validation | `gemara://lexicon`, `gemara://schema/definitions`, `validate_gemara_artifact` |
-| **complypack** | Artifact serving, policy validation | `complypack://catalog/*`, `complypack://mapping/*`, `complypack://schema/*`, `validate_policy`, `test_policy`, `get_assessment_requirements`, `analyze_parameter_delta` |
+| Server         | Purpose                              | Provides                                                                                                                                                                    |
+| -------------- | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **gemara**     | Authoring and validation             | `gemara://lexicon`, `gemara://schema/definitions`, `validate_gemara_artifact`                                                                                               |
+| **complypack** | Artifact serving, policy validation  | `complypack://catalog/*`, `complypack://mapping/*`, `complypack://schema/*`, `validate_policy`, `test_policy`, `get_assessment_requirements`, `analyze_parameter_delta`       |
 
 ## Process
 

From 810885e5dc8caf13f973f3f428dc8d24fd00840c Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Thu, 18 Jun 2026 20:12:15 -0400
Subject: [PATCH 16/16] fix: initialize Mappings field in test ArtifactSet
 fixtures

Address PR #40 review comments: add missing Mappings field to all
test ArtifactSet literals for consistency with NewArtifactSet(), and
add GoDoc comments to ParameterComparison exported fields.

Assisted-by: Claude (Anthropic, Claude Opus 4.6)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 internal/mcp/tool_delta_test.go              |  1 +
 internal/requirement/delta.go                | 16 +++++++++++-----
 internal/requirement/delta_test.go           |  1 +
 internal/requirement/resolve_test.go         |  1 +
 internal/requirement/resolved_policy_test.go |  1 +
 5 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/internal/mcp/tool_delta_test.go b/internal/mcp/tool_delta_test.go
index 09d81b9..fb205ca 100644
--- a/internal/mcp/tool_delta_test.go
+++ b/internal/mcp/tool_delta_test.go
@@ -56,6 +56,7 @@ func testDeltaStore() (*ResourceStore, *requirement.ArtifactSet) {
 		Catalogs: map[string]*gemara.ControlCatalog{"container-baseline": catalog},
 		Policies: map[string]*gemara.Policy{"org-policy": policy},
 		Guidance: make(map[string]*gemara.GuidanceCatalog),
+		Mappings: make(map[string]*gemara.MappingDocument),
 	}
 
 	rp, _ := requirement.ResolvePolicy(*policy, set)
diff --git a/internal/requirement/delta.go b/internal/requirement/delta.go
index 3108054..2ddb1f9 100644
--- a/internal/requirement/delta.go
+++ b/internal/requirement/delta.go
@@ -8,12 +8,18 @@ import "fmt"
 // L1/L2 requirement text it maps to. The caller interprets the
 // relationship — the engine does not judge.
 type ParameterComparison struct {
-	RequirementID   string `json:"requirement_id"`
-	Label           string `json:"label"`
-	PolicyValue     string `json:"policy_value"`
-	PolicySource    string `json:"policy_source"`
+	// RequirementID is the assessment requirement this comparison targets (e.g. "CTL-TLS-001-AR1").
+	RequirementID string `json:"requirement_id"`
+	// Label is the parameter name from the policy's assessment plan (e.g. "tls_minimum_version").
+	Label string `json:"label"`
+	// PolicyValue is the concrete value the L3 policy sets for this parameter.
+	PolicyValue string `json:"policy_value"`
+	// PolicySource is the ID of the policy that provides the parameter value.
+	PolicySource string `json:"policy_source"`
+	// RequirementText is the L1/L2 assessment requirement text from the catalog.
 	RequirementText string `json:"requirement_text"`
-	CatalogSource   string `json:"catalog_source"`
+	// CatalogSource is the ID of the catalog that defines the requirement.
+	CatalogSource string `json:"catalog_source"`
 }
 
 // DeltaReport is the result of gathering parameter comparisons
diff --git a/internal/requirement/delta_test.go b/internal/requirement/delta_test.go
index a6a8253..1004a36 100644
--- a/internal/requirement/delta_test.go
+++ b/internal/requirement/delta_test.go
@@ -65,6 +65,7 @@ func testDeltaArtifactSet() *ArtifactSet {
 		Catalogs: map[string]*gemara.ControlCatalog{"container-baseline": catalog},
 		Policies: map[string]*gemara.Policy{"org-parent-policy": policy},
 		Guidance: make(map[string]*gemara.GuidanceCatalog),
+		Mappings: make(map[string]*gemara.MappingDocument),
 	}
 }
 
diff --git a/internal/requirement/resolve_test.go b/internal/requirement/resolve_test.go
index 43fc82f..1dfa37d 100644
--- a/internal/requirement/resolve_test.go
+++ b/internal/requirement/resolve_test.go
@@ -59,6 +59,7 @@ func testArtifactSet() *ArtifactSet {
 		Catalogs: map[string]*gemara.ControlCatalog{"test-catalog": catalog},
 		Policies: map[string]*gemara.Policy{"test-policy": policy},
 		Guidance: make(map[string]*gemara.GuidanceCatalog),
+		Mappings: make(map[string]*gemara.MappingDocument),
 	}
 }
 
diff --git a/internal/requirement/resolved_policy_test.go b/internal/requirement/resolved_policy_test.go
index cb2819e..e8d05fa 100644
--- a/internal/requirement/resolved_policy_test.go
+++ b/internal/requirement/resolved_policy_test.go
@@ -105,6 +105,7 @@ func TestResolvedPolicy_ImportedGuidanceIDs(t *testing.T) {
 		Catalogs: map[string]*gemara.ControlCatalog{"test-catalog": catalog},
 		Policies: map[string]*gemara.Policy{"test-policy": policy},
 		Guidance: map[string]*gemara.GuidanceCatalog{"guidance-1": guidanceCatalog},
+		Mappings: make(map[string]*gemara.MappingDocument),
 	}
 
 	rp, err := ResolvePolicy(*policy, set)