Publish PKIMM generic assessment profile and release contract

.github/README.md

@@ -10,10 +10,11 @@ This repository holds the PKI Maturity Model maintained by the PKI Consortium PK
 
 ## For contributors
 
-The authoritative content lives in two places:
+The authoritative machine-readable content uses three versioned contracts:
 
 - `data/pkimm-model-<version>.yaml` — the machine-readable model (modules, categories, requirements, levels). This is the source of truth for downstream tooling.
 - `data/pkimm-references.yaml` — the shared catalog of standards, regulations, and publications cited from the model. Independently versioned so reference-metadata updates do not require a model release.
+- `data/pkimm-self-assessment-profile-<version>.yaml` — versioned, declarative runtime configuration for the web assessment tool. It references a released model and defines the weighted scoring strategy, subject fields, assurance boundary, and report/signing policy without adding PKIMM-specific application code.
 
 The per-category markdown under `categories/` and the references summary at `model/references/_index.md` are **generated** from the YAML files. Edit the YAML, run the generator, commit both.
 
@@ -42,12 +43,13 @@ pip install -r scripts/requirements-dev.txt
 4. Run the consistency validator until it passes:
    ```sh
    python scripts/check_model_docs_consistency.py --repo-root .
+   python scripts/validate_assessment_profile.py
    ```
 5. Commit. The same checks run on every PR via [`.github/workflows/check-consistency.yml`](workflows/check-consistency.yml).
 
 ### Repository layout
 
-- `data/` — versioned model YAML files and their JSON schemas, plus the references catalog and its schema.
+- `data/` — versioned model and assessment-profile YAML files and their JSON schemas, plus the references catalog and its schema.
 - `categories/` — generated per-category markdown (one folder per category, named by stable kebab-case id).
 - `model/` — narrative pages: vocabulary, modules, categories overview, references summary.
 - `release-notes/` — per-version release notes. Each version subdirectory uses the template at `release-notes/templates/_index.md`.
@@ -57,6 +59,16 @@ pip install -r scripts/requirements-dev.txt
 - Excel-based assessment tools have been retired in favor of the web self-assessment; the last Excel tools remain available under the `1.0.0` tag / website section.
 - `scripts/` — authoring scripts (generator, validator) and their tests.
 
+### Assessment-tool compatibility
+
+The model and assessment profile are intentionally separate. The released model remains the normative source for modules, categories, levels, requirements, and weights. The profile selects the generic `weighted-maturity` experience and `weighted-average` strategy and provides tool and report policy. The web tool can therefore load PKIMM through the same model/profile interfaces used by other assessments, with no PKIMM-specific scoring branch.
+
+The browser profile exposes only self-assessment. Qualified third-party assessment and PKI Consortium certification remain external workflow states and cannot be self-selected in the browser. The profile declares optional executive and security-executive PAdES fields, permits additional signatures, and leaves actual signer identity and authority to the signing workflow.
+
+### Releases
+
+Semantic model tags use the existing `<model-version>` convention, for example `2.0.0`. The release workflow validates the model, generated pages, and assessment profile before publishing individual model/profile/schema assets, checksums, and complete `.tar.gz` and `.zip` source packages. Downstream builds should use a pinned GitHub release asset rather than an unversioned file from `main`.
+
 ### Conventions
 
 - **Stable identifiers**: category and requirement `id` fields are kebab-case strings (`strategy-and-vision`, `sponsor-support`), not positional numbers. Ordering is expressed via the YAML array position and Hugo's `weight:` front-matter field.

.github/workflows/check-consistency.yml

@@ -1,18 +1,47 @@
 name: Check model/docs consistency
 
 on:
+  workflow_call:
   pull_request:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"
+  cancel-in-progress: true
+
 jobs:
   consistency:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
-      - run: pip install -r scripts/requirements-dev.txt
-      - run: pytest scripts/ -q
-      - run: python scripts/check_model_docs_consistency.py --repo-root .
+
+      - name: Install validation dependencies
+        run: pip install -r scripts/requirements-dev.txt
+
+      - name: Run positive and negative tests
+        run: pytest scripts/ -q
+
+      - name: Validate data schemas
+        run: |
+          check-jsonschema --schemafile data/pkimm-model.schema-1.0.0.json data/pkimm-model-1.0.0.yaml
+          check-jsonschema --schemafile data/pkimm-model.schema-2.0.0.json data/pkimm-model-2.0.0.yaml
+          check-jsonschema --schemafile data/pkimm-references.schema-1.0.0.json data/pkimm-references.yaml
+
+      - name: Validate model and generated documentation
+        run: python scripts/check_model_docs_consistency.py --repo-root .
+
+      - name: Validate assessment profile compatibility
+        run: python scripts/validate_assessment_profile.py
+
+      - name: Check whitespace errors
+        run: git diff --check

.github/workflows/release.yml

@@ -0,0 +1,81 @@
+name: Publish model release
+
+on:
+  push:
+    tags: ["[0-9]*.[0-9]*.[0-9]*"]
+
+permissions:
+  contents: write
+
+jobs:
+  validate:
+    uses: ./.github/workflows/check-consistency.yml
+
+  release:
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Build release package
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          test -f "data/pkimm-model-${RELEASE_TAG}.yaml"
+          test -f "data/pkimm-model.schema-${RELEASE_TAG}.json"
+          PACKAGE_DIR="dist/pkimm-${RELEASE_TAG}"
+          mkdir -p "${PACKAGE_DIR}"
+          cp -R assessment categories data extensions model release-notes "${PACKAGE_DIR}/"
+          cp _index.md LICENSE "${PACKAGE_DIR}/"
+          cp .github/README.md "${PACKAGE_DIR}/README.md"
+          cp "data/pkimm-model-${RELEASE_TAG}.yaml" dist/
+          cp "data/pkimm-model.schema-${RELEASE_TAG}.json" dist/
+          cp data/pkimm-references.yaml dist/
+          cp data/pkimm-references.schema-1.0.0.json dist/
+          cp data/pkimm-self-assessment-profile-1.0.0.yaml dist/
+          cp data/assessment-profile.schema-1.0.0.json dist/
+          SOURCE_DATE_EPOCH="$(git show -s --format=%ct)"
+          find "${PACKAGE_DIR}" -exec touch -d "@${SOURCE_DATE_EPOCH}" {} +
+          tar \
+            --sort=name \
+            --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 \
+            --group=0 \
+            --numeric-owner \
+            -C dist \
+            -cf - \
+            "pkimm-${RELEASE_TAG}" \
+            | gzip -n > "dist/pkimm-${RELEASE_TAG}.tar.gz"
+          cd dist
+          find "pkimm-${RELEASE_TAG}" -type f -print \
+            | LC_ALL=C sort \
+            | zip -Xq "pkimm-${RELEASE_TAG}.zip" -@
+          sha256sum \
+            assessment-profile.schema-1.0.0.json \
+            "pkimm-model-${RELEASE_TAG}.yaml" \
+            "pkimm-model.schema-${RELEASE_TAG}.json" \
+            pkimm-references.schema-1.0.0.json \
+            pkimm-references.yaml \
+            pkimm-self-assessment-profile-1.0.0.yaml \
+            "pkimm-${RELEASE_TAG}.tar.gz" \
+            "pkimm-${RELEASE_TAG}.zip" > SHA256SUMS
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: >-
+          gh release create "${RELEASE_TAG}"
+          dist/assessment-profile.schema-1.0.0.json
+          "dist/pkimm-model-${RELEASE_TAG}.yaml"
+          "dist/pkimm-model.schema-${RELEASE_TAG}.json"
+          dist/pkimm-references.schema-1.0.0.json
+          dist/pkimm-references.yaml
+          dist/pkimm-self-assessment-profile-1.0.0.yaml
+          "dist/pkimm-${RELEASE_TAG}.tar.gz"
+          "dist/pkimm-${RELEASE_TAG}.zip"
+          dist/SHA256SUMS
+          --verify-tag
+          --generate-notes
+          --title "PKI Maturity Model ${RELEASE_TAG}"

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this repository is
 
-Content repository for the **PKI Maturity Model (PKIMM)**, maintained by the PKI Consortium PKIMM working group. The content is rendered at https://pkic.org/pkimm by an external Hugo-based site — this repo holds the source markdown, the canonical model data, and the assessment methodology pages. There is **no build system, no test suite, and no application code** here. Treat changes as documentation/data edits, not software changes.
+Content repository for the **PKI Maturity Model (PKIMM)**, maintained by the PKI Consortium PKIMM working group. The content is rendered at https://pkic.org/pkimm by an external Hugo-based site — this repo holds the source markdown, canonical model data, assessment runtime profile, and assessment methodology pages. There is no runtime application code here; Python scripts and tests validate authored data and generated documentation.
 
 ## Repository layout
 
@@ -19,6 +19,8 @@ Content repository for the **PKI Maturity Model (PKIMM)**, maintained by the PKI
 - `data/pkimm-model.schema-1.0.0.json` — JSON Schema for the 1.0.0 YAML shape (retroactively renamed from `pkimm-model.schema.json`).
 - `data/pkimm-references.yaml` — **independently-versioned references catalog**. Per-requirement `references` fields in the 2.0.0 model contain arrays of IDs from this catalog. Edit here to update reference metadata without touching the model YAML.
 - `data/pkimm-references.schema-1.0.0.json` — JSON Schema for the references catalog.
+- `data/pkimm-self-assessment-profile-1.0.0.yaml` — versioned generic assessment runtime configuration for PKIMM 2.0.0. It selects weighted-maturity behavior, subject fields, assurance states, and report/signing policy without introducing PKIMM-specific application logic.
+- `data/assessment-profile.schema-1.0.0.json` — shared JSON Schema for assessment runtime profiles.
 - `extensions/` — extension framework: schema (`extension.schema-1.0.0.json`), structure and scoring documentation. The extension framework defines the non-destructive, composable overlay/relevance model (schema/structure/scoring); the catalog of published extension YAML definitions now lives in the separate `pkimm-extensions` repository, rendered at https://pkic.org/wg/pkimm/extensions/.
 - `scripts/` — authoring and validation scripts (see "Authoring workflow" below).
 - Integration converters (e.g., the Eramba CSV package generators) now live in the separate `pkimm-integrations` repository, rendered at https://pkic.org/wg/pkimm/integrations/.
@@ -43,9 +45,10 @@ The markdown category pages and `data/pkimm-model-2.0.0.yaml` describe the same
 2. **Regenerate markdown**: run `python scripts/generate_category_docs.py` to regenerate all category pages under `categories/` from the updated YAML.
 3. **Update narrative docs**: manually update `model/` pages, `_index.md` mindmap, and `release-notes/` notes if the change is consumer-facing.
 4. **Validate**: run `python scripts/check_model_docs_consistency.py --repo-root .` — must exit `0 error(s), 0 warning(s)` before committing.
-5. **Tag**: when releasing, bump `version` in `data/pkimm-model-2.0.0.yaml`, copy the file to `data/pkimm-model-<new>.yaml`, add a schema file for the new shape, and author release notes under `release-notes/<new>/`.
+5. **Validate the assessment profile**: run `python scripts/validate_assessment_profile.py` and confirm that the profile still references the model version and a supported generic methodology.
+6. **Tag**: when releasing, bump `version` in `data/pkimm-model-2.0.0.yaml`, copy the file to `data/pkimm-model-<new>.yaml`, add a schema file for the new shape, and author release notes under `release-notes/<new>/`.
 
-CI runs the validator on every PR and push to main (`.github/workflows/check-consistency.yml`).
+CI runs the tests and both validators on every PR and push to main (`.github/workflows/check-consistency.yml`). Model-version tags publish pinned release assets through `.github/workflows/release.yml`.
 
 **Key scripts in `scripts/`:**
 - `generate_category_docs.py` — regenerates `categories/` markdown from YAML.