Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
policy-evaluation rows map like scanner findings in the Finding Reader and the filtered Result DB batch. The query is built after the Result DB disclosure projection, so the customer value never reaches retrieval or the mapper. The global rule key is the technical setting ID; Work GPO rows carry their current comparison ID. Raw GPO and environment observations stay excluded. Retrieval version unchanged.
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael