- Compare tab: Work-style change list with a detail pane (Problem, Next step and
an A/B Compare section), Open in Work and Open in timeslot A.
- Security Domains A -> B over the sources compared in both timeslots, with
resolved against new-plus-regressed bars.
- Value changes for scanner findings: the Finding Reader's Problem values of
A and B (Result, Affected, Results rows, Expected, Found), shown side by side
and marked red or green like GPO configured values.
- GPO settings matched by Scope and Technical Identity; regressions carry their
passing A occurrence.
- Loading: shared reads per repository revision and a revision-bound report,
workspace and GPO overview cache in the comparison route.
Split runs imported from several scanners into one source per file scanner
and pair several sources of one scanner by verified scope. On user decisions:
the timeslot order is the time basis (a stated report or backup time only
blocks when B is not newer), a PingCastle rule absent from a complete report
of the same domain and engine version counts as remediated (profile contract
1.1.0), and one report per scanner and timeslot without a stated scope uses
the client as scope. Detail-link and sanitizing diagnostics no longer block;
the scanner score delta uses the engine's verified source pairs.
Register src/features/comparison as the Comparison Engine UI path and wire its
extension points: the Engines popup entry, the Client Info Compare tab (A/B
selection, score delta over comparable sources, change counts, source table),
the Work Change facet before Source: Scan (only after the tab loaded a
comparison of the open timeslot) and a collapsed Finding Reader Compare
section with both states and the retained GPO values side by side. The engine
now carries those values. The Data Flow diagram shows the engine; product
version 2.26.0.
Add the Comparison Engine read port, a Core-owned adapter that loads each
timeslot as Work reads it (scoped scanner runs, rolled-up GPO verdicts, backup
creation time only) and GET /projects/:id/timeslot-comparison with validation,
a concurrent-change guard and an off switch. The API client gains an
engine-free getTimeslotComparison and the activity label.
Separate new from regressed scanner deviations and accept a timeslot without
scanner runs on one side. Pair rolled-up GPO Work verdicts by scope and
technical identity with a newer backup set and the same baselines; a changed
value of a still deviating setting stays neutral. compareTimeslots yields the
change categories for the UI and a score delta over comparable sources only.
Move compareScanRuns, comparison normalization and local comparison rules
unchanged to src/evaluation/scan-run-comparison so src/comparison can become
the Comparison Engine; only import paths change. Register the engine paths,
document it in AGENTS.md and onboarding, extend the boundary test and add the
permanent on/off invariance test. Record the decision and staging in the plan.
Binh
Michael
Tronth