- Compare tab: Work-style change list with a detail pane (Problem, Next step and
an A/B Compare section), Open in Work and Open in timeslot A.
- Security Domains A -> B over the sources compared in both timeslots, with
resolved against new-plus-regressed bars.
- Value changes for scanner findings: the Finding Reader's Problem values of
A and B (Result, Affected, Results rows, Expected, Found), shown side by side
and marked red or green like GPO configured values.
- GPO settings matched by Scope and Technical Identity; regressions carry their
passing A occurrence.
- Loading: shared reads per repository revision and a revision-bound report,
workspace and GPO overview cache in the comparison route.
Split runs imported from several scanners into one source per file scanner
and pair several sources of one scanner by verified scope. On user decisions:
the timeslot order is the time basis (a stated report or backup time only
blocks when B is not newer), a PingCastle rule absent from a complete report
of the same domain and engine version counts as remediated (profile contract
1.1.0), and one report per scanner and timeslot without a stated scope uses
the client as scope. Detail-link and sanitizing diagnostics no longer block;
the scanner score delta uses the engine's verified source pairs.
Register src/features/comparison as the Comparison Engine UI path and wire its
extension points: the Engines popup entry, the Client Info Compare tab (A/B
selection, score delta over comparable sources, change counts, source table),
the Work Change facet before Source: Scan (only after the tab loaded a
comparison of the open timeslot) and a collapsed Finding Reader Compare
section with both states and the retained GPO values side by side. The engine
now carries those values. The Data Flow diagram shows the engine; product
version 2.26.0.
- Client Info: Defender, Compliance and AI Overview move into Michael's
ClientInfoTabs (Overview, Security, Defender, Compliance, AI Overview);
engine tabs are lazy so hidden tabs start no requests.
- Drop the old client-info-tabs nav styles; compliance switches use the
shared defender-tabs segmented style.
- Port the derived-forest note into client-info-facts.ts; tolerate
observations without attributes.
- Risk register ring opens the matched record (recordId is optional for
scoped acceptances).
- Import gate: additive synthetic Defender vulnerability and alert contracts.
PingCastle snapshots stay unchanged pending review.
- Version 2.25.0; AGENTS engine list names the Remediation Engine.
Die Client-Info-Aktion Management Report erzeugt den faktenbasierten
HTML-Bericht aus der gemeinsamen Reportprojektion: erfasste DC,
bewertete und abweichende Ergebnisse, Heatmap des Abweichungsanteils
und Pass-/Abweichungsbalken je Security Domain. Kein Mixed-Method-Score,
keine Scannerlisten, keine LLM-, Internet- oder Risikoableitung.
Report B bleibt technisch. Keine Projektions-, API- oder Persistenz-
aenderung.
Verifiziert: Vollsuite 1645 bestanden, 14 uebersprungen; 7 bestehende
Fehler in 6 Dateien identisch auf dem vorherigen Commit. Beide
Produktionsbuilds bestanden. Visuelle Browserabnahme offen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Result DB is checked and stored on creation (migration 024, assessor_result_db_rows)
with a content-free per-row trace, per-client identity guard and Open original in Work
- Disclosure policy 3.4.0: review state no longer revealed via withheld-field trace,
per-finding scanner scores withheld, CIS numbers keep all seven levels
- Less over-redaction: "Limited" is no legal form, attached versions (Tls1.2, v1.0),
Windows 95, 2012-R2, step/option/page references, documented Microsoft GUIDs and
documented vendor values in the recommendation field stay
- Maester first read shows the native result statement verbatim
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth