v1.0.0 — Continuous compliance

Added

• Continuous compliance (compliance-as-code). Findings may carry an executable re-audit
  criterion (check: a shell command that passes once the finding is fixed;
  schemas/finding.schema.json); scripts/verify-checks.mjs runs them against a checkout and
  writes checks-report.json / CHECKS-REPORT.md (exit 3 while a finding is open, --strict
  counts checkless findings as open).
• Run-to-run diff. scripts/diff-runs.mjs baseline current writes audit-diff.json /
  AUDIT-DIFF.md — added, fixed, persisting with severity changes (renumbered ids matched by
  audit + title), deal-blocker, readiness, scorecard and control deltas — and gates with
  --fail-on new-p0p1,deal-blocker,regression,score-drop (exit 2).
• GitHub Action .github/actions/verify (composite, no third-party actions): validates the
  run, exports every deliverable, writes the executive report and the diff into the job summary,
  runs the checks, uploads findings.sarif to Code Scanning via gh api; outputs
  readiness-score, deal-blockers, diff-conditions.
• Trust center. --format trust-center writes an aggregate-only trust-center.html
  (readiness score, control status counts, frameworks mapped, deal-blocker count, the
  readiness-not-certification sentence — no finding detail).
• MCP tools get_readiness_checklist(target) and list_control_themes(audit?), parsed live
  from CONTROL-CROSSWALK.md (34 themes, prefixed control IDs, organisational controls, audits to
  run).

Changed

• Version 1.0.0: the prompt structure, the finding schema (eleven required fields), the canonical
  run file, the crosswalk ID conventions and the exporter's file names are now a stable contract;
  breaking changes to any of them bump the major version.

v0.12.0 — Sales accelerators

Added

• Vendor questionnaire pre-fill. scripts/export-findings.mjs --format questionnaire writes
  caiq-answers.csv: one pre-filled answer per CSA CCM v4 domain (the grouping CAIQ v4 and SIG
  use), derived from the run's control statuses, with "Not assessed by this run" where the audits
  were silent — never a Yes the run cannot back.
• Accessibility Conformance Report. --format acr writes acr-wcag22.csv: every WCAG 2.2
  Level A/AA criterion with a VPAT 2.5 conformance level, read from WCAG:<SC> controls and the
  wcag field; "Supports" only when the accessibility audit ran. Covers eCH-0059 v3 too.
• Sector overlays. SECTOR: finance | health | swiss in the orchestrator adds overlay control
  IDs from a new crosswalk table — PCI DSS 4.0.1 requirements, EU-DORA articles, FINMA-RS 2023/1
  chapters, HIPAA Security Rule sections, the Swiss ISG reporting duty, the BWL ICT minimum
  standard and eCH-0059 — mapped to all 34 themes; fine-exposure vocabulary extended accordingly.
  The security, infrastructure, compliance-privacy, accessibility and frontend prompts
  name the overlays in their principles or schema examples.

v0.11.0 — Business output

Added

• Business output. REPORT-OUTPUT-STANDARD.md — the contract for
  everything that leaves the audit besides issues: one canonical auditor-out/audit-run.json
  (schemas/audit-run.schema.json,
  schemas/finding.schema.json) from which
  scripts/export-findings.mjs derives, dependency-free and deterministically, the executive
  report (Markdown → DOCX/PDF via pandoc), SARIF 2.1.0 for GitHub Code Scanning, OSCAL 1.1.2
  assessment results for GRC tools, gap-matrix.csv / findings.csv for Vanta, Drata,
  Secureframe and Jira, and an evidence manifest with sha256 per cited artifact (hashes only, no
  content). The script validates the run file (--validate), ships with node:test coverage, and
  runs in the prompts CI workflow.
• Issue targets beyond GitHub. ISSUE_TARGET accepts github:owner/repo, jira:KEY,
  linear:TEAM and servicenow:<url>, with a field mapping (severity → priority, finding ID in the
  title, auditor label, tracker as Epic / Project / Problem) in the report-output standard.
• Orchestrator Step 5b — Business exports (write, validate, export, hand over auditor-out/);
  MCP get_standard("report-output"); a fourth yardstick card on the landing page.

Changed

• Output language is chosen per run. OUTPUT_LANG no longer defaults to German (or English —
  the 13 prompts disagreed); every prompt now asks when unset and treats English and de-CH German as
  equally first-class. ISSUE-OUTPUT-STANDARD.md 1.3.0 records the rule, the issue targets and the
  canonical-source requirement.
• CONTROL-CROSSWALK.md and REPORT-OUTPUT-STANDARD.md are part of the checksummed trust anchor.

v0.10.0 — Certification readiness

Added

• Certification readiness. The orchestrator gains READINESS_TARGET with four targets —
  soc2, iso27001, iso42001-ai-act, nis2-cra — and a Step 4b that inverts the findings into
  a control-by-control gap matrix (status implemented / partial / missing / not-assessable
  / n/a), classifies nonconformities as Major / Minor / OFI, computes a technical control
  readiness score with a time-to-audit-ready estimate, and produces the target's deliverables
  (Statement of Applicability draft, risk-register seed, AI-system inventory with risk tier,
  reporting-capability check, evidence register).
• CONTROL-CROSSWALK.md — one theme-based mapping (34 themes) from findings to the control
  IDs of SOC 2 TSC, ISO/IEC 27001:2022 Annex A, ISO/IEC 42001:2023 Annex A + EU AI Act, NIS2
  Art. 21/23, CRA Annex I / Art. 14, and the Swiss revDSG (GDPR alongside), with the organisational
  controls listed as not assessable from code, a fine-exposure vocabulary, and the scoring rules.
  It is part of the checksummed trust anchor and exposed by the MCP server as
  get_standard("control-crosswalk").
• FRAMEWORK-VERSIONS.md — a dated register of every framework edition the prompts cite, with
  a quarterly review procedure.
• Three business fields in every finding schema — controls, deal_blocker, fine_exposure —
  enforced across all 13 audits by the prompts CI gate; ISSUE-OUTPUT-STANDARD.md 1.2.0 adds
  the matching control:<Framework>-<ID> and deal-blocker labels, the business view and the
  readiness section of the tracking issue.
• Swiss revDSG in the compliance-privacy audit (jurisdiction CH, Art. 6–9, 12, 16–17,
  19–25, 28, 32, personal fines under Art. 60–63, FDPIC breach notification) alongside GDPR;
  ISO 42001 / EU AI Act control view in the ai-llm audit; ISO 27001 / SOC 2 control view
  in the security and infrastructure audits.
• Landing page: a "Certification readiness" section with the four targets and a third yardstick
  card for the crosswalk; llms.txt documents the readiness protocol.
• Legal pages (/privacy, /imprint and the German mirrors) and the analytics consent gate
  (audit findings #168–#170); the "Audit Orchestrator" hero artwork with the emerald particle field.

Changed

• Dependabot no longer groups major version bumps into the weekly groups.
• .gitattributes normalises every text file to LF so the byte-for-byte checksums verify on
  Windows checkouts too.

Fixed

• Stale references: TTDSG → TDDDG (renamed May 2024), OWASP A01:2021 → A01:2025, OWASP LLM
  LLM02 → LLM05:2025, and "DORA" disambiguated as DevOps Research and Assessment metrics, not
  the EU Digital Operational Resilience Act.
• CONTRIBUTING.md named a hand-run sha256sum command whose output format differs from what CI
  verifies (#174); it now points at node scripts/checksums.mjs.

v0.9.1

[0.9.1] - 2026-06-26

Changed

• content audit — formalized the localisation control inputs. LOCALISATION_MODE gains a
  third value translate-and-rewrite (produce target copy from the source when no usable target
  draft exists, held to the same native-first bar), and both LOCALISATION_MODE and
  TERMINOLOGY_POLICY now have an explicit "control effect" spec defining what each value does — so
  a run's localisation behaviour is unambiguous rather than inferred. No structural change; the gate
  stays green (13/13).

v0.9.0

[0.9.0] - 2026-06-26

Added

• MCP server (mcp/) — a dependency-light stdio Model Context Protocol server that exposes the
  verified, version-pinned audit prompts as native agent tools (list_audits, get_audit_prompt,
  get_orchestrator, get_standard) for Claude Desktop, Claude Code, Cursor, and any MCP-capable
  agent. Mirrors the canonical AUDITS catalogue and reads prompts live from audit-prompts/.
• Per-audit detail pages — /audits/<key> (German mirror /de/audits/<key>) with long-form
  copy, an audit-specific activation prompt, and per-audit Open Graph images, for deep-linking and
  SEO. Short vanity slugs (e.g. /security-audit, /a11y-audit) 308-redirect to the canonical path.
• Sample-report gallery — /reports and /reports/<slug> rendering the real #97 self-audit run
  (scorecard, not-applicable reasons, headline findings, and the cross-audit dedup exhibit), every
  field mapped to a verifiable GitHub artifact and localized EN/DE.
• Per-audit photographic hero images ("Verified Systems Lab") shown on the audit detail pages and
  the homepage audit cards, auto-detected via the public/<key>.webp convention.
• Native-language & locale integrity (C15) in the content audit — a localization lens with a
  locale input contract (LOCALE/SOURCE_LANGUAGE/LOCALISATION_MODE/TERMINOLOGY_POLICY), a
  Phase-0 language brief + terminology matrix, a "Native Reader" blind-back-translation skeptic
  (Phase 3), a mode-dependent scorecard dimension, and de-CH definition-of-done checks, so an audit
  yields original-sounding copy in the target locale rather than translated source. de-CH (Swiss)
  defaults to ss, never ß.
• TERMINOLOGY.md — a bilingual EN/de-CH glossary (Binding + Advisory tiers) that serves as the
  content audit's STYLE_REFERENCE; linked from CONTRIBUTING.md.

Changed

• The landing page is now a multi-route site (home, per-audit details, reports) sharing a common
  header/footer/nav chrome, rather than a single page.
• Vercel deploys are git-connected and automatic (production on push to main, previews per branch),
  with the monorepo build unblocked (Root Directory = web).
• Cross-cutting de-CH locale rule in ISSUE-OUTPUT-STANDARD.md (Swiss orthography, German
  quotation marks, terminology consistency) inherited by all 13 audits, and the issue-label axis
  canonicalized to dimension:/effort: (with locale:de-CH); DOCUMENTATION-STANDARD.md
  orthography aligned to Swiss ss.
• Native Swiss-German site copy — the entire German site (web/lib/i18n.ts and all 13 audit
  detail pages) re-modeled into original de-CH by dogfooding the new C15 lens on this repo:
  English sentence architecture and Denglish removed, terminology unified, every protected technical
  term preserved. Locked in by a web/lib/locale-de-ch.test.ts regression guard (no ß, a
  morphology-aware Denglish denylist) and a corrected principle-translation assertion.

Fixed

• CI/release hardening — automated CHECKSUMS.txt regeneration and verification, a version-pin
  verification gate so release pins can't silently drift, an ESLint / jsx-a11y gate for web/, and a
  CI workflow for the mcp/ package.
• Dropped dead exports in reports.ts flagged by the lean audit.

v0.8.0

Added

• lean audit — the 13th template: a repo-leanness / anti-AI-slop / dependency-transparency audit that challenges dead code, redundancy, unused/phantom dependencies, and bloat, makes the full dependency surface transparent (SBOM), and proposes a safe strip-down gated against over-deletion — a Phase-0 Protected/Load-Bearing Manifest, Chesterton's Fence, a four-class removal register, and a "Resurrector"/"Fence-Keeper" adversarial pass. Maps to Software Engineering at Google (deprecation/dependency management), OWASP Component Analysis, SLSA, and YAGNI. Dogfooded against this repo — see #125.

Changed

• Landing-page overhaul (from a dogfooded content audit and follow-up non-design reviews): a Proof section with the real #97 self-audit backlog exhibit, scorecard, and a filed finding; copy-to-clipboard activation CTAs; grounded claims and a Trust/FAQ block; a visual "input → six-phase pipeline → GitHub issues" process diagram in "How it works"; inline jargon tooltips; plus accessibility (EN og:image, hreflang), performance, SEO and German-copy fixes. All 23 content-audit findings (#100–#122) closed.

v0.7.0

Adds the content & messaging audit — the 12th template.

Added

• content audit: goes beyond prose polish. It challenges the thesis (steelmans the strongest counter-argument), measures information gain against best-in-class references, audits audience/awareness-stage fit, evidence & originality, structure, voice, persuasion, and ethics — and ships concrete before/after rewrites, filed as GitHub issues per ISSUE-OUTPUT-STANDARD.
• Built on the canonical house skeleton (Phase 0–5, P0–P3, shared finding schema, definition of done) with a 0–100 content scorecard; passes the prompt-structure gate 12/12.
• Wired into the orchestrator menu + machine index, llms.txt, the landing page (audit count auto-updates to 12), the README library table, ARCHITECTURE.md, and the new-audit issue template.

Full changelog: https://github.com/marcelrapold/auditor/blob/main/CHANGELOG.md

v0.6.0

First published release. Resolves the full-repo orchestrator self-audit backlog (#97) and hardens the release/supply-chain surface.

Added

• Per-locale root layouts (route groups (en)/(de)) so /de serves <html lang="de">; a German Open Graph image and per-route Twitter/OG metadata.
• scripts/bump-version.mjs + RELEASING.md: single-source the release tag pinned in the orchestrator and llms.txt; a CHECKSUMS.txt verification gate (sha256sum -c) in CI.
• Escape-to-close + focus-return on the mobile menu; reduced-motion handling for smooth scrolling.

Changed

• English copy/metadata now say "GitHub issues in German or English"; audit count derived from AUDIT_COUNT.
• CI hardening: GitHub Actions pinned to commit SHAs, concurrency + timeout-minutes on every workflow, prompts Node sourced from .nvmrc; Dependabot grouping/labels; engines.node aligned to >=22; vitest 4 (0 vulnerabilities); HSTS response header.
• Fixed the check-prompts.mjs legacy-severity guard and added a self-test.

Full changelog: https://github.com/marcelrapold/auditor/blob/main/CHANGELOG.md