Adr on ComplyTime

001 Mcp As CLI Subcommand

Fri, 21 Aug 2026 09:48:50 +0000

Date: 2026-05-30
Status: Accepted
Deciders: Jennifer Power

Context#

We need to implement an MCP server for complypack to enable LLM-assisted policy generation. The question is whether to create a standalone binary (like gemara-mcp) or integrate it as a subcommand of the existing complypack CLI.

002 Cue As Schema Source

Fri, 21 Aug 2026 09:48:50 +0000

Date: 2026-05-30
Status: Accepted
Deciders: Jennifer Power

Context#

Platform input schemas define the structure of data that policies evaluate (Kubernetes manifests, Terraform plans, etc.). We need to decide what format to use as the source of truth and what format to expose to LLMs via the MCP server.

003 Extensible Platform Schemas

Fri, 21 Aug 2026 09:48:50 +0000

Date: 2026-05-30
Status: Superseded by ADR 017
Deciders: Jennifer Power

Context#

The initial design hardcoded support for five platforms (kubernetes, terraform, docker, ansible, ci). This is too restrictive - users may need to generate policies for custom platforms or infrastructure not covered by the built-ins.

004 Fail Fast Server Startup

Fri, 21 Aug 2026 09:48:50 +0000

Date: 2026-05-30
Status: Accepted
Deciders: Jennifer Power

Context#

The MCP server needs to pull catalogs from OCI registries, load schemas, and validate configuration at startup. We need to decide how to handle errors during this initialization phase.

005 Evaluator Interface Pattern

Fri, 21 Aug 2026 09:48:50 +0000

Status: Accepted

Date: 2026-06-01

Context:

ComplyPack needs to validate, test, and package policies across multiple policy languages (OPA Rego, CEL, Kyverno, etc.). Hard-coding OPA-specific logic throughout the codebase would:

006 Cue Schema Contract Validation

Fri, 21 Aug 2026 09:48:50 +0000

Status: Accepted

Date: 2026-06-01

Context:

Rego policies reference input.* paths (e.g., input.metadata.name, input.spec.containers[*].image) based on the structure of resources they evaluate. If a policy references input.nonexistent.field for a platform that doesn’t have that field, the policy:

007 Opa SDK In Process

Fri, 21 Aug 2026 09:48:50 +0000

Status: Accepted

Date: 2026-06-01

Context:

ComplyPack needs to validate, test, and evaluate OPA Rego policies. There are two architectural approaches:

008 Pack Validation Gates

Fri, 21 Aug 2026 09:48:50 +0000

Status: Accepted

Date: 2026-06-03

Context:

Two architectural issues required a combined fix:

Pack shipped unvalidated content. complypack pack tarballed policy content and pushed to an OCI registry with zero quality checks. Broken Rego, invalid schema references, and failing tests all got published. For a compliance tool, this undermines trust in the artifact.

009 Definition Fragment Syntax

Fri, 21 Aug 2026 09:48:50 +0000

Status: Accepted

Date: 2026-06-03

Context:

CUE registry modules (e.g., cue.dev/x/githubactions@v0) expose definitions (#Workflow, #Job) at the top level rather than regular fields. The contract validator receives a cue.Value with no traversable fields, causing all input.* paths to fail validation.

010 Lookuppath Traversal

Fri, 21 Aug 2026 09:48:50 +0000

Status: Superseded by ADR 016

Date: 2026-06-03

Context:

The contract validator’s pathExistsInSchema function uses Fields(cue.All()) to iterate fields and match path segments by label. This approach has three blind spots: