=== Proofwright ===
Contributors: sirahama
Tags: cra, cyber-resilience-act, sbom, compliance, security
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 0.23.8
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

EU Cyber Resilience Act toolkit: component inventory, SPDX & CycloneDX SBOM, hash-chained snapshots, a posture score, and a CRA document generator.

== Description ==

Proofwright is the on-site agent for the EU Cyber Resilience Act (CRA). It builds the **provable evidence** behind a CRA due-diligence posture — and the foundation is free: a rigorous Software Bill of Materials, a deterministic readiness score, and the CRA paperwork.

**Inventory & SBOM.** Inventories every component — core, plugins, must-use plugins, drop-ins, themes (and parents), the PHP runtime, and Composer dependencies (direct vs transitive) — and emits a machine-readable Software Bill of Materials in both **SPDX 2.3** and **CycloneDX 1.5**, with package URLs (PURLs).

**Immutable, hash-chained snapshots.** Each SBOM is stored as a dated, tamper-evident snapshot with diff-over-time, so you can prove how your component graph changed.

**CRA readiness, in your dashboard.** A deterministic posture score; an on-site readiness engine mapped to CRA Annex I (no external calls — no data leaves your server); a scope-classification wizard; a CRA document generator (Vulnerability Disclosure Policy, EU Declaration of Conformity, risk assessment, technical-documentation outline); a consolidated compliance calendar with iCal export; a cross-framework crosswalk (ISO/IEC 27001, SOC 2, NIS2); and a `/.well-known/security.txt` + Vulnerability Disclosure Policy publisher.

**Tamper-evident evidence log.** An append-only, cryptographically verifiable log of the material actions taken on your site.

**Not legal advice.** A "not legal advice" disclaimer appears on every generated document and report.

= Related plugin =

This plugin is complete and fully functional on its own. Some further capabilities — continuous vulnerability monitoring, the SRP incident workflow, the supplier-conformity register, exportable evidence packs, a cross-site fleet console and team review — are provided by a **separate** plugin, Proofwright Pro, available from proofwright.eu. They are not part of, and not required by, the plugin in this directory.

== Disclaimer ==

**Proofwright is a workflow and evidence tool, not legal advice and not a guarantee of compliance.** It helps you build and maintain the documentation and evidence that support a Cyber Resilience Act due-diligence posture; it does not make any product or site compliant. Consult qualified counsel for your obligations under Regulation (EU) 2024/2847.

== Frequently Asked Questions ==

= Does this make my site CRA-compliant? =
No. Proofwright provides the workflow and the provable evidence; compliance is your legal responsibility. The "not legal advice" disclaimer appears on every generated document and report.

= What does this plugin include? =
Everything it needs to be useful on its own: component inventory, the SPDX 2.3 / CycloneDX 1.5 SBOM, immutable hash-chained snapshots with diff, the posture score and on-site readiness engine, the scope wizard, the CRA document generator, the compliance calendar, the cross-framework crosswalk, the security.txt / VDP publisher, and the tamper-evident evidence log — all fully functional, with no restrictions. Continuous vulnerability monitoring, the SRP incident workflow, the supplier register, exportable evidence packs and a cross-site fleet console are provided by a separate plugin, Proofwright Pro (see "Related plugin").

= Does the plugin send my data anywhere? =
No. This plugin runs entirely on your server — the readiness engine and SBOM make no external calls, and there is no licence check or phone-home of any kind.

== Changelog ==

= 0.23.8 =
* The posture-score breakdown, the SBOM change-since-last-snapshot view, and the attestation-renewal check now run on every install with no restrictions. Served pages load their stylesheet via the WordPress style API.

= 0.23.7 =
* Minor packaging fix.

= 0.23.6 =
* Housekeeping: removed unused image files from the package.

= 0.23.5 =
* Pages the plugin serves now link a packaged stylesheet instead of embedding CSS; documents you download keep their styles inline so the saved file works on its own.

= 0.23.4 =
* The plugin is fully functional with no restrictions of any kind: all feature gating removed, no licence checks, and the plugin no longer defines global WordPress constants. Further capabilities are provided by a separate plugin.

= 0.23.3 =
* Packaging refresh for the plugin directory; no functional changes since 0.23.2.

= 0.23.2 =
* Every feature in the plugin is fully functional, with no restrictions of any kind.

= 0.23.0 =
* CRA readiness roadmap, a compliance calendar with iCal export, a cross-framework control crosswalk (ISO/IEC 27001, SOC 2, NIS2), and the on-site readiness engine mapped to CRA Annex I.

= 0.20.0 =
* Annex II "Information and Instructions to the User" document generator; front-end (npm/yarn) dependency scanning folded into the SBOM.

= 0.13.0 =
* Readiness engine: deterministic, on-site security-posture detection mapped to CRA Annex I (no external calls). Detected controls are shown as evidence; gaps are shown with copy-paste remediation guidance.

= 0.9.0 =
* Inventory + SBOM (SPDX 2.3 / CycloneDX 1.5) with PURLs and direct/transitive depth; immutable, hash-chained SBOM snapshots with diff-over-time and EOL flagging; deterministic posture score; scope wizard; CRA document generator; tamper-evident evidence log. Pre-flight secret + PII scan on every export.

= 0.1.0 =
* Initial release: SBOM spine + compliance posture score.
