37 lines
2.9 KiB
Markdown
37 lines
2.9 KiB
Markdown
# Reimport policy
|
|
|
|
ASSESSOR treats a reimport as a new, auditable interpretation of the unchanged original scanner source. The previous scan run remains stored and is linked to its replacement. Scanner-derived records may change; client-owned work must survive.
|
|
|
|
## When a reimport is required
|
|
|
|
A processing-profile version must be added and existing affected imports must be marked for reimport whenever a change can alter one or more of these persisted facts:
|
|
|
|
- scanner or report recognition;
|
|
- parser or extractor coverage, including newly readable sections, native scores, counters, details, evidence, attributes, or context;
|
|
- rule identity, finding boundaries, affected-asset identity, or duplicate handling;
|
|
- field-role mapping, status, outcome, severity, IOE, normalization, or canonical projection;
|
|
- report completeness diagnostics or security fixes that change which source records are accepted;
|
|
- scoring inputs that were not retained by the earlier import.
|
|
|
|
Presentation-only changes, labels, layout, filtering over already retained fields, and score-formula changes over already retained inputs do not require a source reimport. They must not be disguised as processing changes.
|
|
|
|
Every scanner profile, including future profiles, declares its current processing contract. Historical contracts remain append-only. A material import change increments the relevant parser, extractor, profile, mapping, normalization, or presentation version and records `reimportRequired` plus the affected dimensions in `PROCESSING_VERSION_MANIFESTS`. Data Hub derives its warning from that persisted contract. A generic fallback remains visibly review-required until a scanner-specific profile can interpret the source.
|
|
|
|
## Preservation contract
|
|
|
|
Reimport replaces scanner-derived data only. The following client-owned values are preserved as one object and transferred to the replacement finding when the identity is unique:
|
|
|
|
- workflow status and custom label;
|
|
- priority and action-plan inclusion;
|
|
- owner and due date;
|
|
- comments, prerequisites, required access, next step, and acceptance evidence;
|
|
- markers, including accepted-risk state;
|
|
- future additional review fields carried in the same record.
|
|
|
|
The match uses scanner identity, native rule ID, and affected asset. It succeeds only for one old and one new occurrence. A stable definition-level review remains attached without copying. ASSESSOR never falls back to title-only or positional matching.
|
|
|
|
When a match is absent or ambiguous, the old review remains on the retained previous scan. The replacement records an unresolved count and Data Hub shows a persistent review-required state. The reimport is still auditable and does not silently discard or guess customer data.
|
|
|
|
Both direct reimport and adoption of an already imported byte-identical replacement execute review transfer and scan supersession in the same repository transaction. The exact source SHA-256 multiset, assessment, and scanner must match before replacement is accepted.
|
|
|