OpenCMMC v1.0.0-rc.9 | Browser Origin Metadata Correction

OpenCMMC v1.0.0-rc.9 | Browser Origin Metadata Correction

Release status: Free open-source prerelease, not CMMC certification, an official CMMC assessment or an SPRS submission.

Fix

• Correct a specific contradictory check: previously an allowlisted local HTTP Origin could be rejected only because Sec-Fetch-Site was same-site or none. These categories no longer veto a known local Origin with a valid port-specific session cookie and exact form CSRF token.
• Sec-Fetch-Site: cross-site, other unrecognized metadata, hostile/unknown Origins, unauthorized sessions, stale CSRF tokens, and unsupported form encodings remain blocked.
• On ORIGIN_MISMATCH, show a Safe request classification with enum labels for Origin category and Fetch Metadata, never raw untrusted headers, tokens, URLs, cookies, evidence or assessment content.
• Add regression tests for form submissions with local Origin and same-origin, same-site, none, and missing Fetch Metadata, with negative tests for explicit cross-site and hostile requests.

Upgrade Chromebook

Stop the old OpenCMMC process (Ctrl+C in its terminal). Extract the rc.9 Linux x64 archive over ~/OpenCMMC without deleting private-assessment; verify ./opencmmc version prints rc.9. Open the freshly printed private URL on the same computer and submit a form.

If it still fails, share only the new Safe request classification line and build version. Never share the private URL (including access code), form tokens, cookies, HAR captures, file paths or assessment evidence.

CI passing does not confirm real-device ChromeOS success. Issue #49 remains open until a successful browser form submission is observed by the user. Local files are not encrypted at rest by OpenCMMC; use approved storage and avoid introducing CUI without authorization.

OpenCMMC v1.0.0-rc.8 | ChromeOS Forwarded Same-Origin Forms

OpenCMMC v1.0.0-rc.8 | ChromeOS Forwarded Same-Origin Forms

Public release candidate, free, offline local CMMC readiness only. Not a certification, an official CMMC assessment, or SPRS submission.

Browser form rejection repair

After rc.7, a Chromebook user continued to report ORIGIN_MISMATCH. A fixed list of browser Origin hostnames was inadequate for the actual ChromeOS forwarding path.

• The server now also accepts a browser-attested HTML form navigation with Sec-Fetch-Site: same-origin, Sec-Fetch-Mode: navigate, and Sec-Fetch-Dest: document when textual Origin differs from the container-received Host.
• Browsers generate those Fetch Metadata headers. Web scripts cannot modify them.
• This path still requires a valid port-scoped private session cookie, matching hidden CSRF token, safe form encoding and server Host bound to 127.0.0.1 with the designated port.
• cross-site, same-site, none, HTTPS, opaque, invalid-origin and forged/incomplete metadata form requests are blocked.
• Automated regression tests cover legitimate forwarded POSTs and hostile form attempts without private data disclosure.

Upgrade and verify

Stop previously running OpenCMMC processes. Extract the Linux archive over the application directory without deleting private-assessment. Check ./opencmmc version returns v1.0.0-rc.8. Start ./start-cmmc-ui.sh, open the freshly printed private loopback URL in the browser and submit a form.

If the error persists, share only the rejected POST's Origin, Sec-Fetch-Site, Sec-Fetch-Mode, and Sec-Fetch-Dest values. Do not disclose cookies, tokens, assessment evidence, private URLs or file paths.

Release CI does not establish success on every physical Chromebook. Local evidence is not encrypted by the application. Obtain organizational authorization before using CUI.

OpenCMMC v1.0.0-rc.7 | ChromeOS Local Origin Compatibility

OpenCMMC v1.0.0-rc.7 | ChromeOS Local Origin Compatibility

Release class: Free, public release candidate. Not official CMMC assessment, certification, or validated SPRS score.

Targeted ORIGIN_MISMATCH repair

OpenCMMC rc.6 correctly reported the remaining browser issue as ORIGIN_MISMATCH. ChromeOS automatically forwards local Linux server connections into host Chrome and documents localhost and penguin.linux.test browser addresses. Requests that arrive at OpenCMMC's 127.0.0.1 listener can still carry one of those browser-visible origins.

• Accept only exact local HTTP Origin hostnames on the listener's port: 127.0.0.1, localhost, penguin.linux.test, and IPv6 loopback ::1.
• Keep the incoming Host restricted to 127.0.0.1 on that same port; do not accept wildcard domains, remote hosts, HTTPS origins, wrong ports, origin paths, userinfo or opaque origins.
• Require the existing port-specific local session cookie and an exact CSRF form token for every state-changing request.
• Regression tests exercise all three browser forwarding cases against the real POST handler, reject hostile and malformed origins, and verify free local assessment exports still work.
• Retain visible build version and distinct diagnostics for rejected browser requests.

Chromebook update

Stop the old local OpenCMMC process. Verify the downloaded rc.7 Linux archive and extract it into the existing ~/OpenCMMC directory without deleting private-assessment. Verify ./opencmmc version is rc.7. Start ./start-cmmc-ui.sh and open the complete new private local URL printed by the terminal.

Google's ChromeOS documentation: https://developers.google.com/chromeos/app-development/develop/web-environment.

The fix is tested in CI, not confirmed on this customer's Chromebook until a fresh browser form succeeds. Local files are not encrypted by the application; obtain proper authorization before storing any CUI.

OpenCMMC v1.0.0-rc.6 | Session Isolation and Form Diagnostics

OpenCMMC v1.0.0-rc.6 | Local Session Isolation and Form Diagnostics

Release class: Public release candidate, not general availability or any form of CMMC certification.

Security and ChromeOS usability hotfix

• Port-scoped session cookies. Browsers share cookies across ports on the same host. Two local instances previously used the identical oc_session cookie name. Different listeners now use distinct names such as oc_session_p8765, preventing cross-port session collisions.
• Actionable error causes. Instead of one invalid form token or request origin message, the workbench clearly identifies FORM_TOKEN_EXPIRED, ORIGIN_MISMATCH, or UNSUPPORTED_FORM_TYPE, with a safe recovery path for each.
• Visible application version. Both the terminal startup banner and the browser workbench show the running version to detect old or conflicting processes.
• Security checks retained. Session authorization, exact Origin equality, anti-CSRF token checks, loopback-only binding, no-referrer response and offline data handling remain enforced. Rejected POSTs cannot update assessment data or reveal tokens.
• Regression tests cover simultaneous instances on distinct ports, private session creation, valid submissions, origin mismatch, missing/expired token, unsupported form type and no user-data reflection.

Chromebook update

Stop old OpenCMMC instances, unpack the rc.6 Linux x64 archive into your existing app directory without deleting private-assessment, and run ./start-cmmc-ui.sh. Open the newly printed private URL from the same computer. Verify ./opencmmc version reports v1.0.0-rc.6.

No claim of hardware validation on every Chromebook. If a form still fails, the new diagnostic class will identify the remaining condition without sharing sensitive data.

OpenCMMC remains free for offline CMMC readiness review. Optional local planning requests for CortexTrace, BlockSiFr Control and BLAKE do not activate paid services or transfer assessment contents. Local evidence is not encrypted by OpenCMMC.

OpenCMMC v1.0.0-rc.5 | Chromebook Session Repair

OpenCMMC v1.0.0-rc.5 | Chromebook Session Repair

Release class: Public, free OpenCMMC release candidate. Not general availability, CMMC certification, SPRS scoring or an official government submission.

Session repair

• Adjust the loopback browser-session cookie to SameSite=Lax, addressing a Chromium/ChromeOS cross-context launch scenario in which a new Strict cookie may be omitted from the first redirect.
• Keep the private access-code handshake, loopback-only Host checking, HttpOnly cookie, exact-Origin check on POST, and antiforgery token. This change does not allow unauthenticated access or bypass security checks.
• When a browser has no valid session, show a clear Reconnect OpenCMMC page with instructions for opening the newly issued private URL from the local terminal. The server never displays the access code in an error response.
• Add regression coverage for the bootstrap cookie, redirect, recovered workbench session, hostile Origin and missing CSRF.
• Update the README and installation troubleshooting specifically for Chromebook users.

Existing capabilities

Offline local CMMC Level 1/2 readiness review and evidence capture remain free, with optional user-approved local planning requests for CortexTrace, BlockSiFr Control and BLAKE. No assessment content is submitted by these requests; they do not activate paid services.

Security and data

Your browser must be on the same computer as the local OpenCMMC process. Do not share or bookmark the private URL or disable security protections. Local evidence is not encrypted at rest by the application. Before using CUI, obtain your organization's authorization and use an approved encrypted device.

For verified archives, SHA256SUMS, SPDX metadata, supported platform downloads and extraction instructions, see Installation.

OpenCMMC v1.0.0-rc.4 | Private Service Requests

OpenCMMC v1.0.0-rc.4 | Private Service Requests

Release class: Free, open-source release candidate. Not feature-complete general availability or an official CMMC assessment.

What's new

• Users with a local CMMC assessment may now choose Prepare a private request for CortexTrace, BlockSiFr Control or BLAKE.
• The service-specific screen explains the intended next step, retains the local session boundary and requires the user to confirm before generating an optional file.
• The downloaded JSON intent contains an allowlisted service choice, predefined purpose, random local request ID and timestamp. It contains no assessment findings, CUI, scope, evidence, repository data, file paths or credentials.
• Preparing the file does not create an account, call a remote API, activate runtime controls, start a coding session or launch a scan.
• Original CMMC assessment functions and JSON readiness export remain free, independent and offline.
• Tests cover expired form tokens, origin restrictions, missing consent, unknown services, extra form fields and absence of assessment-data leakage.

Install

Download the correct Windows ARM64/x64 or Linux ARM64/x64 archive, check its SHA-256 against the supplied manifest, extract, then run START-CMMC-UI.cmd on Windows or start-cmmc-ui.sh on Linux. See installation.

Next integration stage

Actual customer-authorized commercial service activation remains a separate milestone. It requires tenant authentication, scope and ownership proof, explicit data inventory and consent, policy enforcement, and valid service-side receipts. See Issue #42.

This candidate provides no government certification, independent CMMC assessment, validated SPRS score or official submission. Windows binaries are portable and not claimed to carry a publisher Authenticode signature.

OpenCMMC v1.0.0-rc.3 | Veterans Day 2026 Release Candidate

OpenCMMC v1.0.0-rc.3 | Optional Services and Release Integrity

Release type: Public release candidate; not v1.0 general availability, official CMMC certification or a verified government scoring/submission system.

Added

• Optional, clearly labeled next-step cards in the local browser after an assessment is created:
  • CortexTrace for AI coding-session governance and change-impact evidence.
  • BlockSiFr Control for runtime authority, step-up and execution receipts.
  • BLAKE for deeper consequence-focused vulnerability discovery.
• Each link opens a publicly available BlockSiFr information page only when a user clicks it. No scope, file, report, evidence, tokens, credentials or CUI are uploaded or attached to the link. The link itself does not activate paid services.
• Automated checks reject retired-brand text in active tracked source, and validate package names, contents, manifest and checksums.
• All local CMMC readiness functions, offline behavior, and JSON report export remain free and unaffected.

Delivery conditions

The packages for Windows ARM64, Windows x64, Linux ARM64 and Linux x64 are published only after native smoke tests and checksums pass. SHA-256 and SPDX are not publisher code-signing or government approval.

Installation guide | Optional service privacy details | Security policy

OpenCMMC v1.0.0-rc.2 | Veterans Day 2026 Release Candidate

OpenCMMC v1.0.0-rc.2 | Single-Name Release Candidate

Status: Public prerelease candidate, not v1.0 general availability.

What's new

• The sole public product name, CLI executable, archive filename, Go module, browser identity, and package metadata are OpenCMMC.
• CLI source is located at cmd/opencmmc.
• Legacy command aliases and retired preview publishing workflow were removed from the active source tree.
• Version-1 assessment/workspace structure remains readable across namespace changes; output uses OpenCMMC schema identifiers.
• Windows ARM64, Windows x64, Linux ARM64, and Linux x64 archives are built and smoke-tested before publication.
• SHA-256 file manifests and an SPDX module inventory accompany the download.

Installation

Download the appropriate opencmmc-v1.0.0-rc.2 archive, verify it with SHA256SUMS, extract it and run START-CMMC-UI.cmd (Windows) or ./start-cmmc-ui.sh (Linux).

The new package contains only opencmmc as its CLI executable. Update local shell scripts that invoke an older executable name before using this release. Previously published archives are not modified.

Scope and limitations

OpenCMMC provides local readiness and evidence workspaces, not government certification, an accredited assessment, or a validated SPRS submission. Official objective-source mapping requires independent review. The software does not supply fully validated enterprise SSP/POA&M, multi-user security boundaries or application-level storage encryption. Do not handle CUI without organization-specific approval.

This release is conditioned on successful pipeline checks and has no implied government endorsement.

OpenCMMC v1.0.0-rc.1 | Veterans Day 2026 Release Candidate

OpenCMMC v1.0.0-rc.1 | Veterans Day 2026 Release Candidate

Status: Public prerelease, not v1.0 general availability.

On Veterans Day 2026, BlockSiFr is publishing the OpenCMMC-branded candidate of its free, Apache-2.0, local-first CMMC evidence-readiness toolkit.

What is included

• OpenCMMC-branded command-line utility and loopback-only browser UI.
• Offline Level 1 and Level 2 readiness workspaces, local evidence references and SHA-256 integrity checks.
• Separately sourced NIST SP 800-171A CSV assessment-objective ingestion and draft-only scoring utilities.
• Portable Windows ARM64, Windows x64, Linux ARM64, and Linux x64 packages.
• Backward-compatible freecompliance executable aliases for earlier launch scripts.
• SHA-256 manifests and SPDX Go module inventory.

Validation basis

This prerelease is published only when CI package generation, unit tests, race checks, static analysis, checksum validation, and native-architecture smoke tests pass. Test evidence is in the GitHub Actions run for the release branch. Tests exercise packaged binaries, workspace initialization and readiness export. These results do not establish comprehensive software security, government approval or CMMC certification.

Limitations

This is a candidate, not a feature-complete enterprise CMMC assessment platform. It does not claim complete SSP/POA&M workflows, enterprise multi-user isolation, encrypted-at-rest evidence storage, independently reconciled current official assessment methodology, approved OSCAL export, validated SPRS scoring, automatic official submission, accredited C3PAO assessment or government endorsement. Evidence and reviewer assertions require independent evaluation.

The existing v0.5.0-preview.4 artifact names and schema identities remain unchanged for existing users.

Read installation instructions and current release gates. Do not bypass organizational software deployment or CUI security controls.

FreeCompliance v0.5.0 Preview 4 | Provenance and Offline CMMC Evaluation

FreeCompliance v0.5.0 Preview 4 | Supply-chain hardening

Release candidate: Public preview. Official Veterans Day service initiative launch is November 11, 2026.

This update

• Retains the existing offline CMMC browser workbench and all four portable platforms (Windows/Linux, amd64/arm64).
• Corrects stale and conflicting documentation for the Preview 3 interface.
• Adds a substantive security disclosure policy and enterprise evaluation checklist.
• Generates and publishes a source-commit-linked SPDX 2.3 Go-module inventory, with negative tests and an SHA-256 manifest entry.
• Creates signed GitHub/Sigstore build provenance attestations for each release archive and the software composition inventory, with online verification gating publication.

Publication and provenance claims apply only if the actual Preview 4 GitHub Release exists and its attestation verifier passed. Publishing these notes or landing the workflow does not constitute a signed release.

What this does not grant

• Windows Authenticode code signing or an independently controlled offline release signing root.
• A government authorization to operate or authority to host CUI.
• An independently performed security assessment or penetration test.
• Complete official CMMC assessment procedure coverage, validated SPRS scoring/submission, third-party C3PAO accreditation, or government endorsement.

Go module SPDX metadata is a supply-chain inventory, not a vulnerability-free certificate, full product SBOM, or a NIST compliance assessment.

For approval and offline verification use Release integrity guidance. Keep CUI within approved customer controls.

Free forever. Built in gratitude. Given in service.