Register src/features/comparison as the Comparison Engine UI path and wire its
extension points: the Engines popup entry, the Client Info Compare tab (A/B
selection, score delta over comparable sources, change counts, source table),
the Work Change facet before Source: Scan (only after the tab loaded a
comparison of the open timeslot) and a collapsed Finding Reader Compare
section with both states and the retained GPO values side by side. The engine
now carries those values. The Data Flow diagram shows the engine; product
version 2.26.0.
Move compareScanRuns, comparison normalization and local comparison rules
unchanged to src/evaluation/scan-run-comparison so src/comparison can become
the Comparison Engine; only import paths change. Register the engine paths,
document it in AGENTS.md and onboarding, extend the boundary test and add the
permanent on/off invariance test. Record the decision and staging in the plan.
Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
Projekt-Hooks fuer die Core/Engine-Regel aus AGENTS.md: core-release.mjs
liest "Core-Freigabe: <Bereich>" aus der Nutzernachricht, core-guard.mjs
sperrt Schreibzugriffe auf Core-Pfade ohne Freigabe, core-areas.mjs
ordnet Pfade den Bereichen zu. Tests, Builds und Lesebefehle werden nicht
gesperrt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth