Split runs imported from several scanners into one source per file scanner
and pair several sources of one scanner by verified scope. On user decisions:
the timeslot order is the time basis (a stated report or backup time only
blocks when B is not newer), a PingCastle rule absent from a complete report
of the same domain and engine version counts as remediated (profile contract
1.1.0), and one report per scanner and timeslot without a stated scope uses
the client as scope. Detail-link and sanitizing diagnostics no longer block;
the scanner score delta uses the engine's verified source pairs.
Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
Adapted pick of fdd46e8: recognition, source extractor, domain model and
tool profile for Defender for IoT alert exports, the common-description
first read with its AGENTS.md rule, and the shared markdown, recognition,
status-outcome and scan-sequence changes.
Also brings forward two fixes Defender needs on this base: the title
fallback in recordTitleFor (from 210bbc0) and the Source Rule ID
exception for ID columns that are the finding title (from 21a6266).
Product version 2.12.0 for the Defender series.
Adapted pick of fe71246. Adds the vulnerability_finding result type,
missingStatusOutcome for sources whose rows are the finding, and Defender
profile 1.1.0. The Work deviation filter uses the canonical predicate
through isDeviationRecord; Michael's GPO status logic and status cache
stay in front of it.
The constraint migration is renumbered from 022 to 027. The CVE
enrichment commit e048295 is skipped for now.
Partial pick of 5fbbda2. One finding per CVE with an Affected Devices
table and device count; the Finding Reader hides the raw Source
Observations field.
Left out: the Affected Devices label in the Result DB row detail, since
the disclosure policy withholds affectedAsset for every row.
Adapted pick of 7d3ef5f. The profile declares the now mandatory
securityScoring, priorityBasis and timeslotComparison. Client Info adds
Defender as a third tab beside Overview and AI Overview, and a
Defender-only timeslot starts in the Defender view. recordTitleFor only
replaces the title candidate; the Maester and CIS title rules stay.
Left out: the .gitignore entry, --tile-inset, the stored-profile
precedence Michael's fileProfile already has, and the old processing
version assertion.
policy-evaluation rows map like scanner findings in the Finding Reader and the filtered Result DB batch. The query is built after the Result DB disclosure projection, so the customer value never reaches retrieval or the mapper. The global rule key is the technical setting ID; Work GPO rows carry their current comparison ID. Raw GPO and environment observations stay excluded. Retrieval version unchanged.
- Result DB is checked and stored on creation (migration 024, assessor_result_db_rows)
with a content-free per-row trace, per-client identity guard and Open original in Work
- Disclosure policy 3.4.0: review state no longer revealed via withheld-field trace,
per-finding scanner scores withheld, CIS numbers keep all seven levels
- Less over-redaction: "Limited" is no legal form, attached versions (Tls1.2, v1.0),
Windows 95, 2012-R2, step/option/page references, documented Microsoft GUIDs and
documented vendor values in the recommendation field stay
- Maester first read shows the native result statement verbatim
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth