audit-labs/control-coverage

Control coverage and blind-spot analysis for audit evidence.

clone: git clone https://gitbay.org/audit-labs/control-coverage.git

3b24b70d6909abc3462876e7ad3b3058cbee2f11

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-08-08T03:52:46Z

Release v1.0.0

Bump version to 1.0.0, add CHANGELOG, and document the stability commitment.

 CHANGELOG.md                 | 31 +++++++++++++++++++++++++++++++
 README.md                    |  7 +++++++
 control_coverage/__init__.py |  2 +-
 pyproject.toml               |  2 +-
 4 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..aa8fe6a
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
+to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-08-07
+
+First stable release. The bundled catalogs, the coverage / Statement of
+Applicability / JSON output schemas, and the `--fail-under` gate are committed
+under semantic versioning. Reads
+[audit-report](https://github.com/audit-labs/audit-report)'s v1 JSON contract.
+
+## [0.1.0] - 2026-08-06
+
+### Added
+
+- Control-first coverage and blind-spot analysis over a corpus of audit-report
+  JSON, producing a true coverage percentage and an unaddressed-control (blind-spot)
+  list from the framework's full control catalog.
+- Bundled catalogs: SOC 2 (61 controls across all five Trust Services categories),
+  ISO 27001:2022 Annex A (93), NIST SP 800-53 Moderate baseline (177).
+- Statement of Applicability generation from a scope file (exclusions + reasons),
+  with `exclude_families` to drop a whole category/theme/family from the denominator.
+- Trend mode (`--baseline`) and crosswalk mode (`--crosswalk`, greedy minimal
+  evidence set); md/html/json output.
+- `--fail-under N` coverage gate for CI.
+- PyPI trusted-publishing release workflow.
+
+[1.0.0]: https://github.com/audit-labs/control-coverage/releases/tag/v1.0.0
+[0.1.0]: https://github.com/audit-labs/control-coverage/releases/tag/v0.1.0
diff --git a/README.md b/README.md
index 711addd..325d3aa 100644
--- a/README.md
+++ b/README.md
@@ -169,6 +169,13 @@ audit-tools ──► CSV package ──► evidence-seal (seal + verify)
                                                     trend over time, evidence crosswalk
 ```
 
+## Stability
+
+`control-coverage` is stable as of **v1.0.0** and follows [semantic versioning](https://semver.org).
+It reads [audit-report](https://github.com/audit-labs/audit-report)'s v1 JSON
+contract; the bundled catalogs, the coverage / Statement of Applicability / JSON
+output schemas, and the `--fail-under` gate are committed within the 1.x line.
+
 ## Development
 
 ```bash
diff --git a/control_coverage/__init__.py b/control_coverage/__init__.py
index b067b16..3eff2e0 100644
--- a/control_coverage/__init__.py
+++ b/control_coverage/__init__.py
@@ -1,3 +1,3 @@
 """control-coverage — control-first coverage and blind-spot analysis over an evidence corpus."""
 
-__version__ = "0.1.0"
+__version__ = "1.0.0"
diff --git a/pyproject.toml b/pyproject.toml
index f6c8761..8ee0659 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "control-coverage"
-version = "0.1.0"
+version = "1.0.0"
 description = "Control-first coverage and blind-spot analysis over an evidence corpus, with a Statement of Applicability."
 readme = "README.md"
 requires-python = ">=3.10"