- Move AI overview and privacy-safe JSON export into Compliance Engine
- Add ISO control and theme facets to Work, including GPO settings
- Enrich ISO queries with baseline context, Windows code meanings and technical explanations
- Count GPO settings once and preserve editable decisions across mapping runs
- Fix GPO mapping version conflicts and backup domain identity resolution
- Add regression coverage and update architecture and reimport documentation
Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
Device part of 95ec322: scoped risk targets are derived from the source
rows of each occurrence, so a device-finding cannot target a device that
the selected occurrence does not list.
Adapted pick of fdd46e8: recognition, source extractor, domain model and
tool profile for Defender for IoT alert exports, the common-description
first read with its AGENTS.md rule, and the shared markdown, recognition,
status-outcome and scan-sequence changes.
Also brings forward two fixes Defender needs on this base: the title
fallback in recordTitleFor (from 210bbc0) and the Source Rule ID
exception for ID columns that are the finding title (from 21a6266).
Product version 2.12.0 for the Defender series.
Adapted pick of d9ff6a8: device-finding and device-snapshot targets with
immutable snapshots, migration 028, repositories, API, Defender panel,
Finding Reader and the Accepted Risks register.
Unlike the original, the register keeps the base rule for its current
count, and a scoped decision covers only the occurrences it captured.
After a reimport it stays with its full history, shows Review required
and covers nothing, like a whole-finding acceptance.
- Result DB is checked and stored on creation (migration 024, assessor_result_db_rows)
with a content-free per-row trace, per-client identity guard and Open original in Work
- Disclosure policy 3.4.0: review state no longer revealed via withheld-field trace,
per-finding scanner scores withheld, CIS numbers keep all seven levels
- Less over-redaction: "Limited" is no legal form, attached versions (Tls1.2, v1.0),
Windows 95, 2012-R2, step/option/page references, documented Microsoft GUIDs and
documented vendor values in the recommendation field stay
- Maester first read shows the native result statement verbatim
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth