Compliance Engine stage 1 for BSI Grundschutz++ (Kernel requirements only):
- Pinned snapshots of the BSI Kernel catalog and the official ISO 27001
Annex A -> Grundschutz++ mapping with source URL, SHA-256 and CC BY-SA
attribution, generated by server/compliance/update-bsi-assets.mjs.
- Requirements are derived from accepted ISO controls, never stored as
decisions; missing mapping targets are reported.
- Client Info Compliance tab: BSI Grundschutz++ tile and Results window.
- Finding Reader: collapsed BSI requirements section grouped by ISO control.
- Work: BSI requirement and BSI practice facets.
- Data Hub: BSI catalog tile with Update from BSI and Use bundled catalog;
new outbound target documented in SECURITY.md.
- Move AI overview and privacy-safe JSON export into Compliance Engine
- Add ISO control and theme facets to Work, including GPO settings
- Enrich ISO queries with baseline context, Windows code meanings and technical explanations
- Count GPO settings once and preserve editable decisions across mapping runs
- Fix GPO mapping version conflicts and backup domain identity resolution
- Add regression coverage and update architecture and reimport documentation
Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth