Release 2.23.0 (Phase 13F, BSI Grundschutz++ stage 2).
- Map rules directly to BSI Kernel requirements from a dedicated BSI
corpus in Qdrant; mappings and decisions carry a framework
(migration 029, verified backup before applying).
- Compare directly accepted BSI requirements with those derived from
accepted ISO controls (Consistent / Inconsistent / No ISO reference)
in a new "ISO <-> BSI review" tile in the Client Info Compliance tab,
with Accept/Reject and "Mark reviewed" per fingerprint.
- Hybrid retrieval for ISO and BSI: German restatement of the public
query, dense English + dense German + German BM25 fused by
reciprocal rank; BSI skips BES/DLS/GEB/PERS and sends 16 candidates.
- ISO prompt 1.3.0 gives the model the full ISO/IEC 27002 control text
(never sent to the browser).
- Auto-accept only the first two strong proposals (primary, high or
medium confidence).
- Recognize Purple Knight scoped tool ids and SI indicator ids in the
mapping query.
- Rename Result DB "Map all ISO controls" to "Compliance mapping" with
ISO and BSI batches; "Mapping history" lists ISO and BSI runs.
- Data Hub BSI tile shows the BSI search index state and can build or
rebuild it.
- Update AGENTS.md and the implementation plan with these decisions.
Compliance Engine stage 1 for BSI Grundschutz++ (Kernel requirements only):
- Pinned snapshots of the BSI Kernel catalog and the official ISO 27001
Annex A -> Grundschutz++ mapping with source URL, SHA-256 and CC BY-SA
attribution, generated by server/compliance/update-bsi-assets.mjs.
- Requirements are derived from accepted ISO controls, never stored as
decisions; missing mapping targets are reported.
- Client Info Compliance tab: BSI Grundschutz++ tile and Results window.
- Finding Reader: collapsed BSI requirements section grouped by ISO control.
- Work: BSI requirement and BSI practice facets.
- Data Hub: BSI catalog tile with Update from BSI and Use bundled catalog;
new outbound target documented in SECURITY.md.
Binh