- Client Info: Defender, Compliance and AI Overview move into Michael's
ClientInfoTabs (Overview, Security, Defender, Compliance, AI Overview);
engine tabs are lazy so hidden tabs start no requests.
- Drop the old client-info-tabs nav styles; compliance switches use the
shared defender-tabs segmented style.
- Port the derived-forest note into client-info-facts.ts; tolerate
observations without attributes.
- Risk register ring opens the matched record (recordId is optional for
scoped acceptances).
- Import gate: additive synthetic Defender vulnerability and alert contracts.
PingCastle snapshots stay unchanged pending review.
- Version 2.25.0; AGENTS engine list names the Remediation Engine.
Compliance tab layout (user corrections 2026-10-12):
- Overview row is only as tall as its taller tile; Mapping coverage is no longer forced square and both tiles share the row height.
- Annex A and BSI Kernel footprint cells grow with the tile up to 64px (5:3, 14px numbers); each Annex A theme column is as wide as its six cells and the columns spread across the tile. BSI requirements fill an auto-fill grid of the same cell size, also in the Show all window.
- Kernel footprint tile shows only the practice with the most findings.
- BSI Grundschutz++ framework tile shows 4 to 10 practices, as many as its square fits (container queries on the inner width).
Fixes from 2026-10-09:
- Compliance tab signals changed coverage or mapping history so Work reloads its assignments; `Mapping failed` no longer opens Work without its filter value.
- Hybrid ISO retrieval counts hits in rank order against the 8,000 character cap per control and always keeps the best hit, so large mappings no longer fail with regulatory_mapping_prompt_too_large.
Governance (Core-Freigabe: Governance): AGENTS.md BSI tile rule updated to the content-fitted practice count. Engine code only otherwise.
Release 2.23.0 (Phase 13F, BSI Grundschutz++ stage 2).
- Map rules directly to BSI Kernel requirements from a dedicated BSI
corpus in Qdrant; mappings and decisions carry a framework
(migration 029, verified backup before applying).
- Compare directly accepted BSI requirements with those derived from
accepted ISO controls (Consistent / Inconsistent / No ISO reference)
in a new "ISO <-> BSI review" tile in the Client Info Compliance tab,
with Accept/Reject and "Mark reviewed" per fingerprint.
- Hybrid retrieval for ISO and BSI: German restatement of the public
query, dense English + dense German + German BM25 fused by
reciprocal rank; BSI skips BES/DLS/GEB/PERS and sends 16 candidates.
- ISO prompt 1.3.0 gives the model the full ISO/IEC 27002 control text
(never sent to the browser).
- Auto-accept only the first two strong proposals (primary, high or
medium confidence).
- Recognize Purple Knight scoped tool ids and SI indicator ids in the
mapping query.
- Rename Result DB "Map all ISO controls" to "Compliance mapping" with
ISO and BSI batches; "Mapping history" lists ISO and BSI runs.
- Data Hub BSI tile shows the BSI search index state and can build or
rebuild it.
- Update AGENTS.md and the implementation plan with these decisions.
Client Info now loads the Compliance tab overview when a timeslot opens, so the first switch to the tab shows it at once.
AI overview fixes:
- drop references to IDs that are not in the input instead of failing the run
- keep source IDs when chunked analyses are consolidated (prompt version 1.3.0)
- allow CIS rule numbers and other address-like values from the input in the email/IP check
- remove the count limit for questions and assumptions; the panel shows ten with a Show all toggle
- label AI overview requests as Compliance Engine in the activity log and keep one Generating AI overview entry open for the whole run
The product version stays unchanged.
Core-Release: Platform, Presentation
- Client Info Compliance tab: overview row above the framework tiles with an
ISO/BSI switch. Mapping coverage (square donut, per mapping state) and the
Annex A footprint (all 93 controls, titles from the active corpus) or the
BSI Kernel footprint (top two practices, Show all window with all 901
requirements, unreachable ones marked, pinned detail line).
- Mapping failed and ISO control without BSI requirement open Work through
the new Compliance Engine facet ISO mapping; Client and Assessment context
row in the tab (Core release Presentation for the DashboardPanel drilldown
and context row).
- Fix: an ISO control accepted by an earlier run can be decided again after a
remap of the same pipeline version no longer proposes it.
- Overview response adds coverage, bsiFootprint and annexATitles; Work
assignments add failedFindings. Product version unchanged pending Platform release.
Compliance Engine stage 1 for BSI Grundschutz++ (Kernel requirements only):
- Pinned snapshots of the BSI Kernel catalog and the official ISO 27001
Annex A -> Grundschutz++ mapping with source URL, SHA-256 and CC BY-SA
attribution, generated by server/compliance/update-bsi-assets.mjs.
- Requirements are derived from accepted ISO controls, never stored as
decisions; missing mapping targets are reported.
- Client Info Compliance tab: BSI Grundschutz++ tile and Results window.
- Finding Reader: collapsed BSI requirements section grouped by ISO control.
- Work: BSI requirement and BSI practice facets.
- Data Hub: BSI catalog tile with Update from BSI and Use bundled catalog;
new outbound target documented in SECURITY.md.
The Compliance row moves from the Client Info Overview into its own
Compliance tab (before AI Overview). The framework tile row and its
Results button stay unchanged so later frameworks add a tile.
The tab heading carries a Last mapping button. Its window lists up to 50
mapping batches and single finding mappings of all clients, because
mappings are global per rule. Each entry shows its trigger (Automatic,
Manual, Single finding), where it came from relative to the shown
timeslot (This timeslot, Other timeslot, Other client, Unknown), status
and content-free counts. Mapping runs now record their trigger, and
single mappings their origin as SHA-256 tokens only, since runs are
exported with every client. The tab refreshes while a mapping runs and
shows the last overview at once when returning to it.
Also: history table keeps the 14px table role in every column, and the
flaky sheet-selection-cost test uses 300 instead of 2,537 sheets.
Core changes (released Presentation, Governance, Platform, Core Tests):
DashboardPanel Compliance tab, AGENTS.md decisions, product version
2.20.0 -> 2.21.0, sheet-selection-cost test.
The Compliance Engine maps newly uploaded scans and GPO evaluations to
ISO controls while the new Data Hub switch "Map new scans automatically"
is on (default off). An engine-side watcher reads only through
ComplianceReadPort: active scan runs and, for GPOs, the deviation rows of
each timeslot as filtered Result DB pages. It starts the existing ISO
batch per new scan run or per timeslot with new GPO rows; already mapped
rules are reused, so only new rules reach the model. Existing data forms
the baseline and is not mapped retroactively.
The switch lives in the engine's own settings file, not a Core table.
Switching the Compliance Engine off in the Engines popup also switches
automatic mapping off server-wide.
Core changes (released Platform, Core Tests, Presentation, Governance):
PUT /reference-data/iso-corpus/auto-mapping route, setIsoAutoMapping API
client method, subscribeEnginePreferences export, AGENTS.md decision and
product version 2.19.1 -> 2.20.0.
- Refactor compliance CSS to enhance layout and styling for the new Compliance row.
- Update RESULT_DB_DISCLOSURE_POLICY_VERSION to 3.8.0 for consistency across modules.
- Implement rollup logic for policy comparisons in result DB materialization.
- Enhance DashboardPanel to support theme filtering alongside control filtering.
- Introduce new ClientTileParts component for shared dashboard elements.
- Add tests for result DB materialization to ensure correct handling of GPO comparisons.
- Update existing tests to reflect changes in compliance logic and UI.
- Move AI overview and privacy-safe JSON export into Compliance Engine
- Add ISO control and theme facets to Work, including GPO settings
- Enrich ISO queries with baseline context, Windows code meanings and technical explanations
- Count GPO settings once and preserve editable decisions across mapping runs
- Fix GPO mapping version conflicts and backup domain identity resolution
- Add regression coverage and update architecture and reimport documentation
Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
Binh