- README rewritten: Docker and native quickstarts, try-it flow, gate
commands, promote-a-stub steps.
- CONTRIBUTING rules 9-13 (pii_read on PII reads, __audit_redact__ for
encrypted columns, retention policy per table, models.py registry,
vendored-code change discipline); PR checklist updated.
- docs/nist-mapping.md: per-control file:line evidence and remaining gap.
- NIST_800_53_CONTROL_MAPPING.md v0.3: Phase 0 notes on 28 rows
(12 implemented, 12 partial, 4 progress notes on hybrid/tailored rows)
plus a status-shift table.
- PHASE0_PLAN: 0.9 complete; Definition of Done 12/14 checked with how
each was verified. Open: first green Gitea CI run, Docker/Postgres boot.
- POA&M and status handoff updated; status TL;DR no longer claims an
unverified Docker boot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
