Release 2.23.0 (Phase 13F, BSI Grundschutz++ stage 2).
- Map rules directly to BSI Kernel requirements from a dedicated BSI
corpus in Qdrant; mappings and decisions carry a framework
(migration 029, verified backup before applying).
- Compare directly accepted BSI requirements with those derived from
accepted ISO controls (Consistent / Inconsistent / No ISO reference)
in a new "ISO <-> BSI review" tile in the Client Info Compliance tab,
with Accept/Reject and "Mark reviewed" per fingerprint.
- Hybrid retrieval for ISO and BSI: German restatement of the public
query, dense English + dense German + German BM25 fused by
reciprocal rank; BSI skips BES/DLS/GEB/PERS and sends 16 candidates.
- ISO prompt 1.3.0 gives the model the full ISO/IEC 27002 control text
(never sent to the browser).
- Auto-accept only the first two strong proposals (primary, high or
medium confidence).
- Recognize Purple Knight scoped tool ids and SI indicator ids in the
mapping query.
- Rename Result DB "Map all ISO controls" to "Compliance mapping" with
ISO and BSI batches; "Mapping history" lists ISO and BSI runs.
- Data Hub BSI tile shows the BSI search index state and can build or
rebuild it.
- Update AGENTS.md and the implementation plan with these decisions.
Adapted pick of d9ff6a8: device-finding and device-snapshot targets with
immutable snapshots, migration 028, repositories, API, Defender panel,
Finding Reader and the Accepted Risks register.
Unlike the original, the register keeps the base rule for its current
count, and a scoped decision covers only the occurrences it captured.
After a reimport it stays with its full history, shows Review required
and covers nothing, like a whole-finding acceptance.
Adapted pick of fe71246. Adds the vulnerability_finding result type,
missingStatusOutcome for sources whose rows are the finding, and Defender
profile 1.1.0. The Work deviation filter uses the canonical predicate
through isDeviationRecord; Michael's GPO status logic and status cache
stay in front of it.
The constraint migration is renumbered from 022 to 027. The CVE
enrichment commit e048295 is skipped for now.
- Result DB is checked and stored on creation (migration 024, assessor_result_db_rows)
with a content-free per-row trace, per-client identity guard and Open original in Work
- Disclosure policy 3.4.0: review state no longer revealed via withheld-field trace,
per-finding scanner scores withheld, CIS numbers keep all seven levels
- Less over-redaction: "Limited" is no legal form, attached versions (Tls1.2, v1.0),
Windows 95, 2012-R2, step/option/page references, documented Microsoft GUIDs and
documented vendor values in the recommendation field stay
- Maester first read shows the native result statement verbatim
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth