policy-evaluation rows map like scanner findings in the Finding Reader and the filtered Result DB batch. The query is built after the Result DB disclosure projection, so the customer value never reaches retrieval or the mapper. The global rule key is the technical setting ID; Work GPO rows carry their current comparison ID. Raw GPO and environment observations stay excluded. Retrieval version unchanged.
- Result DB is checked and stored on creation (migration 024, assessor_result_db_rows)
with a content-free per-row trace, per-client identity guard and Open original in Work
- Disclosure policy 3.4.0: review state no longer revealed via withheld-field trace,
per-finding scanner scores withheld, CIS numbers keep all seven levels
- Less over-redaction: "Limited" is no legal form, attached versions (Tls1.2, v1.0),
Windows 95, 2012-R2, step/option/page references, documented Microsoft GUIDs and
documented vendor values in the recommendation field stay
- Maester first read shows the native result statement verbatim
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth