thothctl 0.28.1__tar.gz → 0.30.0__tar.gz

{thothctl-0.28.1 → thothctl-0.30.0}/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to ThothCTL are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.29.0] - 2026-09-15
+
+### Added
+
+- **Agent Autonomy Model** (Phase 2.5.1) — a graduated 4-level governance framework
+  for AI agents, aligned with the industry-standard "4 Levels of Agentic Development"
+  (Weave Intelligence), replacing the previous binary auto-decision switch.
+  - New `services/ai_review/config/autonomy.py`: `AutonomyLevel` / `AutonomyConfig`,
+    `.thothcf.toml [agent.autonomy]` loader with per-level tool allow/deny lists
+  - **Deny-beats-allow** tool resolution with `*` wildcard support
+  - Action-to-level gating (read-only → L1, PR decisions → L2, auto-merge → L3,
+    apply/destroy → L4)
+  - **Safe-by-default**: Level 1 (read-only) when unconfigured; malformed config
+    never escalates privilege
+  - Enforced as the first check in `SafetyGuard.can_take_action` (optional
+    `autonomy_level` param — fully backward compatible)
+  - New `--autonomy [suggest|draft|validate|execute]` flag on `ai-review decide`
+  - 27 unit tests; design spec at `docs/framework/specs/phase2.5.1_autonomy_model.md`
+
+### Documentation
+
+- Aligned the GitHub README with the current v0.28 state (Intent-to-IaC, workflow
+  engine, MCP v2.0, security-platform publishing, Kiro provider) and pointed docs
+  to the official ReadTheDocs site
+- Added an **Agent Autonomy Levels** section to the AI Review command docs
+
 ## [0.28.0] - 2026-08-23
 
 ### Added
@@ -25,6 +51,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Deduplication and close-old-findings support
   - Config via env vars (`DEFECTDOJO_URL`, `DEFECTDOJO_TOKEN`) or `.thothcf.toml`
   - 21 unit tests covering all paths
+- **SecObserve SBOM + scan publishing** (`--publish-sbom secobserve` / `--publish-to secobserve`)
+  - CycloneDX SBOM → license component tracking via `/api/import/file_upload_sbom_by_name/`
+  - Scan findings → observations via SARIF through `/api/import/file_upload_observations_by_name/`
+  - APIToken authentication (SecObserve's custom format)
+  - Auto-creates product, .localhost domain resolution for Traefik setups
+  - Supports all scanners: Checkov, Trivy, KICS, OPA/Conftest (all via SARIF)
+  - Config via env vars (`SECOBSERVE_URL`, `SECOBSERVE_API_TOKEN`) or `.thothcf.toml`
 - **Kiro CLI as AI provider** for Intent-to-IaC generation (`--provider kiro`)
   - Uses Kiro headless mode (`kiro-cli chat --no-interactive --trust-all-tools`)
   - Tool-augmented generation: reads project files, searches docs, validates output

{thothctl-0.28.1 → thothctl-0.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: thothctl
-Version: 0.28.1
+Version: 0.30.0
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl
@@ -48,7 +48,7 @@ Requires-Dist: opentelemetry-sdk>=1.20.0; extra == 'telemetry'
 Description-Content-Type: text/markdown
 
 [![Publish Python Package](https://github.com/thothforge/thothctl/actions/workflows/python-publish.yml/badge.svg)](https://github.com/thothforge/thothctl/actions/workflows/python-publish.yml)
-[![Documentation](https://github.com/thothforge/thothctl/actions/workflows/docs.yml/badge.svg)](https://thothforge.github.io/thothctl/)
+[![Documentation Status](https://readthedocs.org/projects/thothctl/badge/?version=latest)](https://thothctl.readthedocs.io/en/latest/)
 [![PyPI version](https://img.shields.io/pypi/v/thothctl)](https://pypi.org/project/thothctl/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green)](LICENSE)
@@ -57,15 +57,18 @@ Description-Content-Type: text/markdown
 
 **AI-Powered Infrastructure Lifecycle CLI** for DevSecOps, Platform Engineering, and IaC governance.
 
-![ThothCTL](./docs/img/framework/thothctl_mcp.png)
+![ThothCTL](./docs/img/framework/thothfr.png)
 
-ThothCTL accelerates the adoption of Internal Developer Platforms by combining security scanning, inventory management, cost analysis, AI-driven code review, and organizational policy enforcement into a single CLI.
+ThothCTL accelerates the adoption of Internal Developer Platforms by combining natural-language IaC generation, security scanning, inventory management, cost analysis, AI-driven code review, and organizational policy enforcement into a single CLI.
 
 ## Quick Start
 
 ```bash
 pip install --upgrade thothctl
 
+# Generate governed IaC from natural language (dry-run by default)
+thothctl generate iac -i "VPC with 3 private subnets, NAT gateway, and flow logs"
+
 # Scan for security issues
 thothctl scan iac -t checkov -t trivy -t opa
 
@@ -81,6 +84,29 @@ thothctl ai-review analyze -d ./terraform -p ollama
 
 ## Key Features
 
+### 🧠 Intent-to-IaC Generation
+
+Generate governed Infrastructure as Code from natural language. Organizational conventions (`.thothcf.toml`, steering docs, existing patterns) are injected into the AI context, and output is validated by Checkov + OPA with self-correction:
+
+```bash
+# Single stack (dry-run shows code without writing)
+thothctl generate iac -i "S3 bucket with versioning and encryption"
+
+# Multi-stack composition, written to disk
+thothctl generate iac -i "EKS cluster with VPC, RDS PostgreSQL, and S3 for artifacts" \
+  --composition full --apply
+
+# Tool-augmented generation with Kiro CLI (reads docs, validates, self-corrects)
+thothctl generate iac -i "RDS Aurora cluster with read replicas and failover" -p kiro
+```
+
+- **Multi-provider**: Ollama (local), AWS Bedrock, OpenAI, Azure OpenAI, and **Kiro CLI** (tool-augmented)
+- **Blueprint vs Project modes**: `--mode blueprint` for IDP/Backstage templates, `--mode project` for ready-to-deploy output
+- **Composition-aware**: `single`, `full` (multi-stack), or `incremental` (add to existing project)
+- **Policy at generation time**: `.thothcf.toml` rules and OPA policies evaluated inside the loop
+- **Plan validation**: optional `terragrunt plan` validation with self-correction (`--plan-validation`)
+- **Multi-format**: `terraform`, `terraform-terragrunt`, `terragrunt`, `cloudformation`, `cdkv2`
+
 ### 🔒 Security Scanning
 
 Multi-tool scanning with unified HTML reports and enforcement:
@@ -88,12 +114,16 @@ Multi-tool scanning with unified HTML reports and enforcement:
 ```bash
 # All scanners with hard enforcement (fails pipeline on violations)
 thothctl scan iac -t checkov -t trivy -t kics -t opa -t terraform-compliance --enforcement hard
+
+# Publish findings to a vulnerability management platform
+thothctl scan iac -t checkov -t trivy --publish-to defectdojo
 ```
 
 - **5 integrated tools**: Checkov, Trivy, KICS, OPA/Conftest, Terraform-compliance
 - **Unified HTML reports** with severity badges, per-stack breakdown
 - **Non-compliance findings table** on enforcement failure
 - **SARIF output** for GitHub Code Scanning integration
+- **Platform publishing**: push findings to **DefectDojo** or **SecObserve**
 - **Organization policy repos** via `THOTH_ORG_POLICY` env var (HCL + CloudFormation)
 - **Scan trend tracking** with local SQLite history
 
@@ -103,14 +133,39 @@ CycloneDX 1.6 compliant Software Bill of Materials:
 
 ```bash
 thothctl inventory iac --check-versions
+
+# Publish the SBOM to a supply-chain platform
+thothctl inventory iac --check-versions --publish-sbom dependency-track
 ```
 
 - **Module & provider version tracking** with staleness detection
 - **CycloneDX 1.6 SBOM** with formulation, evidence, standards, attestations, dependency graph, hashes, and licenses
+- **SBOM publishing**: push to **Dependency-Track**, **DefectDojo**, or **SecObserve** (auto-creates project/product)
+- **CDK v2 support**: dependency tracking for AWS CDK projects
 - **Technical debt scoring** with risk levels and recommendations
 - **Schema compatibility analysis** for safe upgrades
 - **Professional HTML reports** with collapsible stack groups
 
+### 🔁 DevSecOps Workflow Engine
+
+Orchestrated SDLC pipeline plus custom YAML DAG workflows:
+
+```bash
+# Built-in 7-phase pipeline (Plan → Develop → Build → Test → Secure → Deploy → Monitor)
+thothctl workflow devsecops --phase all --enforcement hard
+
+# Composite phase, only changed directories
+thothctl workflow devsecops --phase pre-deploy --changed-only
+
+# Custom composable pipeline (declarative YAML DAG)
+thothctl workflow run --file .thothcf_workflow.yaml
+```
+
+- **7 SDLC phases** with composite `all` and `pre-deploy` shortcuts
+- **Custom YAML DAG engine** with `depends_on`, topological ordering, variable interpolation (`{{changed_stacks}}`, `{{branch}}`, `{{project}}`, `{{space}}`), and per-stage failure handling (`block`/`warn`/`skip`)
+- **Enforcement modes**: `soft` (warn) or `hard` (block on violations)
+- **Git-aware** `--changed-only` scoping and dry-run plan visualization
+
 ### 📊 Web Dashboard
 
 Modern FastAPI-based dashboard with dark mode:
@@ -122,6 +177,7 @@ thothctl dashboard launch
 - **Security findings viewer** — filter by tool/severity/search, pagination, inline report iframe
 - **SBOM details browser** — CycloneDX metadata, dependency graph, formulation, attestations
 - **Inventory explorer** — collapsible stacks, module/provider tabs, version comparison
+- **Generation history** — track all intent-to-IaC runs
 - **Cost analysis** — service breakdown, monthly/annual projections
 - **Drift detection** — severity-classified drifted resources
 - **AI usage tracking** — token counts, costs per request
@@ -137,9 +193,9 @@ thothctl ai-review decide -d ./terraform --pr-number 42 --dry-run
 
 - **4 specialized agents**: Security, Architecture, Fix, Decision
 - **Multi-provider**: OpenAI, AWS Bedrock, Azure OpenAI, Ollama (local)
+- **Two orchestration modes**: parallel agents (ThreadPoolExecutor) and Strands SDK deterministic pipeline
 - **Auto-decisions** with confidence thresholds and safety controls
 - **Adaptive memory**: filesystem or S3 (auto-detects runtime)
-- **MCP integration** for AI assistant interoperability
 
 ### 💰 Cost Analysis & Risk Assessment
 
@@ -164,20 +220,37 @@ thothctl init project -p my-infra --project-type terraform
 - **Backstage integration** for self-service consumption
 - **Template upgrade workflow** to keep projects in sync
 
+### 🔌 MCP Integration
+
+Model Context Protocol (v2.0+) server exposing ThothCTL as tools for AI assistants:
+
+```bash
+thothctl mcp
+```
+
+- **26 tools exposed** including `generate iac`, `scan iac`, `inventory iac`, and workflow commands
+- **HTTP + stdio** transport modes
+- **Recursion protection** when thothctl is used as an MCP tool inside an agent
+
 ## All Commands
 
 | Command | Description |
 |---------|-------------|
-| `scan iac` | Multi-tool security scanning with enforcement |
-| `inventory iac` | Infrastructure SBOM with version tracking |
+| `generate iac` | Generate governed IaC from natural language intent |
+| `generate stacks` | Generate infrastructure stacks from configuration |
+| `scan iac` | Multi-tool security scanning with enforcement and platform publishing |
+| `inventory iac` | Infrastructure SBOM with version tracking and SBOM publishing |
 | `check iac` | Cost analysis, blast radius, drift detection, structure validation |
+| `workflow devsecops` | Orchestrated 7-phase DevSecOps SDLC pipeline |
+| `workflow run` | Execute a custom YAML DAG workflow |
 | `ai-review` | AI-powered security analysis and PR decisions |
 | `dashboard launch` | Web dashboard for all reports |
 | `document iac` | Auto-generate documentation |
 | `project convert` | Template ↔ project conversion |
 | `init project` | Scaffold new IaC projects |
-| `mcp` | Model Context Protocol server |
-| `generate` | Generate IaC from rules and components |
+| `space` | Manage spaces (activate, update, configure conventions) |
+| `quickstart` | Guided onboarding for new projects |
+| `mcp` | Model Context Protocol server (v2.0+) |
 
 ## Installation
 
@@ -208,15 +281,19 @@ devcontainer up --workspace-folder .
 
 ## Documentation
 
-📖 **Full docs**: [thothforge.github.io/thothctl](https://thothforge.github.io/thothctl/)
+📖 **Full docs**: [thothctl.readthedocs.io](https://thothctl.readthedocs.io/)
 
+- [What's New](docs/whats_new.md)
 - [Quick Start](docs/quick_start.md)
+- [Generate IaC (Intent-to-IaC)](docs/framework/commands/generate/generate_iac.md)
 - [DevSecOps SDLC Guide](docs/framework/use_cases/devsecops_sdlc.md)
+- [Workflow Command](docs/framework/commands/workflow/workflow_overview.md)
 - [Scan Command Reference](docs/framework/commands/scan/scan_overview.md)
 - [Inventory & SBOM](docs/framework/commands/inventory/inventory_overview.md)
 - [Dashboard](docs/dashboard/README.md)
 - [AI Review](docs/framework/commands/ai-review/README.md)
 - [Template Engine](docs/template_engine/template_engine.md)
+- [MCP Server](docs/framework/commands/mcp/mcp.md)
 - [Dev Container Setup](docs/installation/devcontainer_setup.md)
 
 ## CI/CD Integration
@@ -232,18 +309,27 @@ devcontainer up --workspace-folder .
 
 ## Roadmap
 
+Shipped:
+
 - [x] Multi-tool security scanning with unified reports
 - [x] AI Agent for IaC Security (multi-agent, auto-decisions)
 - [x] CycloneDX 1.6 SBOM with full supply chain metadata
 - [x] Organization policy engine (OPA/Rego, HCL + CloudFormation)
 - [x] Web Dashboard with findings viewer and SBOM browser
-- [ ] Intent-to-IaC generation (natural language → governed Terraform)
-- [ ] Composable workflow engine (declarative YAML DAG pipelines)
+- [x] Intent-to-IaC generation (natural language → governed IaC)
+- [x] Composable workflow engine (declarative YAML DAG pipelines)
+- [x] MCP v2.0 server (HTTP + stdio, 26 tools)
+- [x] Security platform integrations (Dependency-Track, DefectDojo, SecObserve)
+- [x] Kiro CLI provider for tool-augmented generation
+
+In progress / planned:
+
+- [ ] App-to-Infra inference (generate stacks from application source code)
 - [ ] Graph-aware state visibility (tfstate → queryable resource graph)
-- [ ] Architecture diagram generation (Mermaid/Graphviz from IaC)
-- [ ] Strands Agents SDK integration
+- [ ] Continuous reconciliation (align live infra with intent)
+- [ ] Agent governance & MCP gateway
 
-📖 [Full Roadmap](docs/framework/roadmap_fdi.md)
+📖 The active planning document is the **2026 Roadmap** (`thothctl_roadmap_2026.md` in the ThothForge root). The [FdI roadmap](docs/framework/roadmap_fdi.md) is preserved for historical context only.
 
 ## Contributing
 

{thothctl-0.28.1 → thothctl-0.30.0}/README.md

@@ -1,5 +1,5 @@
 [![Publish Python Package](https://github.com/thothforge/thothctl/actions/workflows/python-publish.yml/badge.svg)](https://github.com/thothforge/thothctl/actions/workflows/python-publish.yml)
-[![Documentation](https://github.com/thothforge/thothctl/actions/workflows/docs.yml/badge.svg)](https://thothforge.github.io/thothctl/)
+[![Documentation Status](https://readthedocs.org/projects/thothctl/badge/?version=latest)](https://thothctl.readthedocs.io/en/latest/)
 [![PyPI version](https://img.shields.io/pypi/v/thothctl)](https://pypi.org/project/thothctl/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green)](LICENSE)
@@ -8,15 +8,18 @@
 
 **AI-Powered Infrastructure Lifecycle CLI** for DevSecOps, Platform Engineering, and IaC governance.
 
-![ThothCTL](./docs/img/framework/thothctl_mcp.png)
+![ThothCTL](./docs/img/framework/thothfr.png)
 
-ThothCTL accelerates the adoption of Internal Developer Platforms by combining security scanning, inventory management, cost analysis, AI-driven code review, and organizational policy enforcement into a single CLI.
+ThothCTL accelerates the adoption of Internal Developer Platforms by combining natural-language IaC generation, security scanning, inventory management, cost analysis, AI-driven code review, and organizational policy enforcement into a single CLI.
 
 ## Quick Start
 
 ```bash
 pip install --upgrade thothctl
 
+# Generate governed IaC from natural language (dry-run by default)
+thothctl generate iac -i "VPC with 3 private subnets, NAT gateway, and flow logs"
+
 # Scan for security issues
 thothctl scan iac -t checkov -t trivy -t opa
 
@@ -32,6 +35,29 @@ thothctl ai-review analyze -d ./terraform -p ollama
 
 ## Key Features
 
+### 🧠 Intent-to-IaC Generation
+
+Generate governed Infrastructure as Code from natural language. Organizational conventions (`.thothcf.toml`, steering docs, existing patterns) are injected into the AI context, and output is validated by Checkov + OPA with self-correction:
+
+```bash
+# Single stack (dry-run shows code without writing)
+thothctl generate iac -i "S3 bucket with versioning and encryption"
+
+# Multi-stack composition, written to disk
+thothctl generate iac -i "EKS cluster with VPC, RDS PostgreSQL, and S3 for artifacts" \
+  --composition full --apply
+
+# Tool-augmented generation with Kiro CLI (reads docs, validates, self-corrects)
+thothctl generate iac -i "RDS Aurora cluster with read replicas and failover" -p kiro
+```
+
+- **Multi-provider**: Ollama (local), AWS Bedrock, OpenAI, Azure OpenAI, and **Kiro CLI** (tool-augmented)
+- **Blueprint vs Project modes**: `--mode blueprint` for IDP/Backstage templates, `--mode project` for ready-to-deploy output
+- **Composition-aware**: `single`, `full` (multi-stack), or `incremental` (add to existing project)
+- **Policy at generation time**: `.thothcf.toml` rules and OPA policies evaluated inside the loop
+- **Plan validation**: optional `terragrunt plan` validation with self-correction (`--plan-validation`)
+- **Multi-format**: `terraform`, `terraform-terragrunt`, `terragrunt`, `cloudformation`, `cdkv2`
+
 ### 🔒 Security Scanning
 
 Multi-tool scanning with unified HTML reports and enforcement:
@@ -39,12 +65,16 @@ Multi-tool scanning with unified HTML reports and enforcement:
 ```bash
 # All scanners with hard enforcement (fails pipeline on violations)
 thothctl scan iac -t checkov -t trivy -t kics -t opa -t terraform-compliance --enforcement hard
+
+# Publish findings to a vulnerability management platform
+thothctl scan iac -t checkov -t trivy --publish-to defectdojo
 ```
 
 - **5 integrated tools**: Checkov, Trivy, KICS, OPA/Conftest, Terraform-compliance
 - **Unified HTML reports** with severity badges, per-stack breakdown
 - **Non-compliance findings table** on enforcement failure
 - **SARIF output** for GitHub Code Scanning integration
+- **Platform publishing**: push findings to **DefectDojo** or **SecObserve**
 - **Organization policy repos** via `THOTH_ORG_POLICY` env var (HCL + CloudFormation)
 - **Scan trend tracking** with local SQLite history
 
@@ -54,14 +84,39 @@ CycloneDX 1.6 compliant Software Bill of Materials:
 
 ```bash
 thothctl inventory iac --check-versions
+
+# Publish the SBOM to a supply-chain platform
+thothctl inventory iac --check-versions --publish-sbom dependency-track
 ```
 
 - **Module & provider version tracking** with staleness detection
 - **CycloneDX 1.6 SBOM** with formulation, evidence, standards, attestations, dependency graph, hashes, and licenses
+- **SBOM publishing**: push to **Dependency-Track**, **DefectDojo**, or **SecObserve** (auto-creates project/product)
+- **CDK v2 support**: dependency tracking for AWS CDK projects
 - **Technical debt scoring** with risk levels and recommendations
 - **Schema compatibility analysis** for safe upgrades
 - **Professional HTML reports** with collapsible stack groups
 
+### 🔁 DevSecOps Workflow Engine
+
+Orchestrated SDLC pipeline plus custom YAML DAG workflows:
+
+```bash
+# Built-in 7-phase pipeline (Plan → Develop → Build → Test → Secure → Deploy → Monitor)
+thothctl workflow devsecops --phase all --enforcement hard
+
+# Composite phase, only changed directories
+thothctl workflow devsecops --phase pre-deploy --changed-only
+
+# Custom composable pipeline (declarative YAML DAG)
+thothctl workflow run --file .thothcf_workflow.yaml
+```
+
+- **7 SDLC phases** with composite `all` and `pre-deploy` shortcuts
+- **Custom YAML DAG engine** with `depends_on`, topological ordering, variable interpolation (`{{changed_stacks}}`, `{{branch}}`, `{{project}}`, `{{space}}`), and per-stage failure handling (`block`/`warn`/`skip`)
+- **Enforcement modes**: `soft` (warn) or `hard` (block on violations)
+- **Git-aware** `--changed-only` scoping and dry-run plan visualization
+
 ### 📊 Web Dashboard
 
 Modern FastAPI-based dashboard with dark mode:
@@ -73,6 +128,7 @@ thothctl dashboard launch
 - **Security findings viewer** — filter by tool/severity/search, pagination, inline report iframe
 - **SBOM details browser** — CycloneDX metadata, dependency graph, formulation, attestations
 - **Inventory explorer** — collapsible stacks, module/provider tabs, version comparison
+- **Generation history** — track all intent-to-IaC runs
 - **Cost analysis** — service breakdown, monthly/annual projections
 - **Drift detection** — severity-classified drifted resources
 - **AI usage tracking** — token counts, costs per request
@@ -88,9 +144,9 @@ thothctl ai-review decide -d ./terraform --pr-number 42 --dry-run
 
 - **4 specialized agents**: Security, Architecture, Fix, Decision
 - **Multi-provider**: OpenAI, AWS Bedrock, Azure OpenAI, Ollama (local)
+- **Two orchestration modes**: parallel agents (ThreadPoolExecutor) and Strands SDK deterministic pipeline
 - **Auto-decisions** with confidence thresholds and safety controls
 - **Adaptive memory**: filesystem or S3 (auto-detects runtime)
-- **MCP integration** for AI assistant interoperability
 
 ### 💰 Cost Analysis & Risk Assessment
 
@@ -115,20 +171,37 @@ thothctl init project -p my-infra --project-type terraform
 - **Backstage integration** for self-service consumption
 - **Template upgrade workflow** to keep projects in sync
 
+### 🔌 MCP Integration
+
+Model Context Protocol (v2.0+) server exposing ThothCTL as tools for AI assistants:
+
+```bash
+thothctl mcp
+```
+
+- **26 tools exposed** including `generate iac`, `scan iac`, `inventory iac`, and workflow commands
+- **HTTP + stdio** transport modes
+- **Recursion protection** when thothctl is used as an MCP tool inside an agent
+
 ## All Commands
 
 | Command | Description |
 |---------|-------------|
-| `scan iac` | Multi-tool security scanning with enforcement |
-| `inventory iac` | Infrastructure SBOM with version tracking |
+| `generate iac` | Generate governed IaC from natural language intent |
+| `generate stacks` | Generate infrastructure stacks from configuration |
+| `scan iac` | Multi-tool security scanning with enforcement and platform publishing |
+| `inventory iac` | Infrastructure SBOM with version tracking and SBOM publishing |
 | `check iac` | Cost analysis, blast radius, drift detection, structure validation |
+| `workflow devsecops` | Orchestrated 7-phase DevSecOps SDLC pipeline |
+| `workflow run` | Execute a custom YAML DAG workflow |
 | `ai-review` | AI-powered security analysis and PR decisions |
 | `dashboard launch` | Web dashboard for all reports |
 | `document iac` | Auto-generate documentation |
 | `project convert` | Template ↔ project conversion |
 | `init project` | Scaffold new IaC projects |
-| `mcp` | Model Context Protocol server |
-| `generate` | Generate IaC from rules and components |
+| `space` | Manage spaces (activate, update, configure conventions) |
+| `quickstart` | Guided onboarding for new projects |
+| `mcp` | Model Context Protocol server (v2.0+) |
 
 ## Installation
 
@@ -159,15 +232,19 @@ devcontainer up --workspace-folder .
 
 ## Documentation
 
-📖 **Full docs**: [thothforge.github.io/thothctl](https://thothforge.github.io/thothctl/)
+📖 **Full docs**: [thothctl.readthedocs.io](https://thothctl.readthedocs.io/)
 
+- [What's New](docs/whats_new.md)
 - [Quick Start](docs/quick_start.md)
+- [Generate IaC (Intent-to-IaC)](docs/framework/commands/generate/generate_iac.md)
 - [DevSecOps SDLC Guide](docs/framework/use_cases/devsecops_sdlc.md)
+- [Workflow Command](docs/framework/commands/workflow/workflow_overview.md)
 - [Scan Command Reference](docs/framework/commands/scan/scan_overview.md)
 - [Inventory & SBOM](docs/framework/commands/inventory/inventory_overview.md)
 - [Dashboard](docs/dashboard/README.md)
 - [AI Review](docs/framework/commands/ai-review/README.md)
 - [Template Engine](docs/template_engine/template_engine.md)
+- [MCP Server](docs/framework/commands/mcp/mcp.md)
 - [Dev Container Setup](docs/installation/devcontainer_setup.md)
 
 ## CI/CD Integration
@@ -183,18 +260,27 @@ devcontainer up --workspace-folder .
 
 ## Roadmap
 
+Shipped:
+
 - [x] Multi-tool security scanning with unified reports
 - [x] AI Agent for IaC Security (multi-agent, auto-decisions)
 - [x] CycloneDX 1.6 SBOM with full supply chain metadata
 - [x] Organization policy engine (OPA/Rego, HCL + CloudFormation)
 - [x] Web Dashboard with findings viewer and SBOM browser
-- [ ] Intent-to-IaC generation (natural language → governed Terraform)
-- [ ] Composable workflow engine (declarative YAML DAG pipelines)
+- [x] Intent-to-IaC generation (natural language → governed IaC)
+- [x] Composable workflow engine (declarative YAML DAG pipelines)
+- [x] MCP v2.0 server (HTTP + stdio, 26 tools)
+- [x] Security platform integrations (Dependency-Track, DefectDojo, SecObserve)
+- [x] Kiro CLI provider for tool-augmented generation
+
+In progress / planned:
+
+- [ ] App-to-Infra inference (generate stacks from application source code)
 - [ ] Graph-aware state visibility (tfstate → queryable resource graph)
-- [ ] Architecture diagram generation (Mermaid/Graphviz from IaC)
-- [ ] Strands Agents SDK integration
+- [ ] Continuous reconciliation (align live infra with intent)
+- [ ] Agent governance & MCP gateway
 
-📖 [Full Roadmap](docs/framework/roadmap_fdi.md)
+📖 The active planning document is the **2026 Roadmap** (`thothctl_roadmap_2026.md` in the ThothForge root). The [FdI roadmap](docs/framework/roadmap_fdi.md) is preserved for historical context only.
 
 ## Contributing
 

{thothctl-0.28.1 → thothctl-0.30.0}/docs/framework/commands/ai-review/README.md

@@ -243,8 +243,17 @@ thothctl ai-review decide \
   --repository owner/repo \
   --provider bedrock_agent \
   --platform github
+
+# Restrict what the agent may do with an autonomy level
+thothctl ai-review decide -d ./terraform --pr-number 123 \
+  --repository owner/repo --autonomy draft
 ```
 
+**Autonomy:** `--autonomy [suggest|draft|validate|execute]` (default `suggest`)
+gates which actions the agent may perform (see
+[Agent Autonomy Levels](#agent-autonomy-levels) below). At `suggest` (Level 1)
+the agent is read-only and cannot post PR decisions.
+
 ### `thothctl ai-review serve`
 
 Start the REST API server for CI/CD and external integrations.
@@ -347,6 +356,61 @@ thothctl ai-review override --repository owner/repo --pr-number 42 --action appr
 thothctl ai-review override --repository owner/repo --pr-number 42 --action approve --publish
 ```
 
+## Agent Autonomy Levels
+
+*(v0.28.1+ — Phase 2.5.1)*
+
+Autonomy levels are a **graduated trust dial** for the agent, aligned with the
+industry-standard 4 Levels of Agentic Development. Instead of a binary "AI on/off",
+each level defines which actions the agent may perform. The `--autonomy` flag on
+`ai-review decide` selects the level (default `suggest`):
+
+| Level | CLI value | Human role | Agent may... |
+|-------|-----------|-----------|-------------|
+| 1 | `suggest` (default) | Execution engine | Analyze, scan, report — **read-only** |
+| 2 | `draft` | Verifier | Post approve/reject/request-changes, create PRs; **not** apply/destroy |
+| 3 | `validate` | Orchestrator | Auto-merge low-risk changes (subject to gates) |
+| 4 | `execute` | System designer | Self-initiate remediation within guardrails (break-glass) |
+
+At Level 1 an auto-`approve`/`reject` is blocked by the autonomy gate before any
+other safety check runs, so a `suggest`-level run never posts a PR decision.
+
+### Configuration (`.thothcf.toml`)
+
+Levels and their per-level tool allow/deny lists are configurable. If the
+`[agent.autonomy]` table is absent, the agent runs at **Level 1** (safe by default);
+a malformed config never escalates privilege.
+
+```toml
+[agent.autonomy]
+default_level = 1                    # 1=suggest 2=draft 3=validate 4=execute
+
+[agent.autonomy.levels.2]            # Human-on-the-loop
+allowed_tools = ["read-file", "write-file", "scan", "git-commit", "git-push", "create-pr"]
+denied_tools  = ["terraform-apply", "terraform-destroy"]
+
+[agent.autonomy.levels.3]            # Human-as-orchestrator
+allowed_tools = ["*"]
+denied_tools  = ["terraform-apply", "terraform-destroy"]
+requires_validation = true
+auto_merge_risk_max = 20             # auto-merge only when risk score <= 20
+
+[agent.autonomy.levels.4]            # Autonomous
+allowed_tools = ["*"]
+requires_approval = ["named-approver"]
+max_blast_radius = 10                # enforced with the Phase 5 resource graph
+```
+
+**Resolution rules:**
+
+- **deny-beats-allow** — a tool in both lists is denied; `"*"` allows everything not explicitly denied.
+- **safe-by-default** — no config → Level 1; parse errors fall back to built-in safe defaults.
+- **action gating** — each action has a minimum level (read-only → 1, PR decisions → 2, auto-merge → 3, apply/destroy → 4).
+
+> **Note:** `--autonomy` currently governs the `ai-review decide` action gate. MCP
+> tool-call enforcement (via the MCP Gateway) and Level 3/4 gate wiring land in
+> subsequent Phase 2.5 tasks.
+
 ## AI Providers
 
 | Provider | Model | Mode | Use Case |