Split runs imported from several scanners into one source per file scanner
and pair several sources of one scanner by verified scope. On user decisions:
the timeslot order is the time basis (a stated report or backup time only
blocks when B is not newer), a PingCastle rule absent from a complete report
of the same domain and engine version counts as remediated (profile contract
1.1.0), and one report per scanner and timeslot without a stated scope uses
the client as scope. Detail-link and sanitizing diagnostics no longer block;
the scanner score delta uses the engine's verified source pairs.
Separate new from regressed scanner deviations and accept a timeslot without
scanner runs on one side. Pair rolled-up GPO Work verdicts by scope and
technical identity with a newer backup set and the same baselines; a changed
value of a still deviating setting stays neutral. compareTimeslots yields the
change categories for the UI and a score delta over comparable sources only.
Move compareScanRuns, comparison normalization and local comparison rules
unchanged to src/evaluation/scan-run-comparison so src/comparison can become
the Comparison Engine; only import paths change. Register the engine paths,
document it in AGENTS.md and onboarding, extend the boundary test and add the
permanent on/off invariance test. Record the decision and staging in the plan.
Binh
Michael