Assessor_2.0/src/reporting/MANAGEMENT_REPORT_TEMPLATE.md

Approved ASSESSOR Management Report template

Status: binding user-approved template, confirmed 2026-10-02.

The implemented template is context-management-report.ts, delivered through management-overview-report.ts (renderer 3.2.3). This implementation, rather than a copied historical HTML export, is the reference for future Management Reports. The user approved its layout and requested that it be retained inside Report Engine. Future changes must preserve this agreement unless the user explicitly revises it.

Visual contract

• White report sheets; existing ASSESSOR logo and wordmark in header and footer.
• Orange headings, dark table headers, alternating light table rows, subtle separators.
• Two-column explanatory and evidence sections; compact factual tables and bar charts.
• Embedded existing Inter font and ASSESSOR logo; no remote assets, scripts, LLM or Internet requests.
• Readable 16px prose and 14px structured data. Flat square heatmap tiles, no decorative effects.
• Footer includes product version, client name and logical report-sheet numbering.
• Explicit correction 2026-10-04: every sheet carries Streng vertraulich in its header and footer. Management occurs only in the header's report label. Body headings use Summary and Themen; no scanner names, scanner-origin tables, scanner citations or source-composition/confidence breakdowns are shown.
• Responsive single-column reading and existing A4 print rules; logical sheet numbers do not assert physical PDF page numbers.

This is the explicit export-only style exception based on the user-supplied Huntsman report reference. It does not change the Core application's design language.

Content sequence

1. Summary: assessment overview, published counts, populated themes, the authoritative ASSESSOR Overall Score as a full-circle donut, recorded work decisions, and comparison only where a comparison snapshot exists. Explicit correction 2026-10-04: both first-sheet summary labels read Summary; Handlungsfelder is a heading followed by bullet points for the evidenced themes. The introductory prose uses Angaben instead of Blätter. Omit the technical sentence about findings without a cluster assignment from Summary.
2. Theme overview: six themes and Möglicher Business Impact, with one simple finding count per theme and a matching horizontal bar chart. No impact rating, category-composition explanation in the count column or financial amount. Explicit correction 2026-10-04: omit the technical note beneath this overview about overlapping findings, summed counts and absent evidence. Counting semantics remain unchanged; areas without evidence still state no derivable impact. Omit the explanatory count/overlap note beneath the theme bar chart as well. Omit the sentence about automatic assignments and possible consequences being an approach requiring specialist review from the theme sheets.
3. One sheet for each theme: Betriebsfähigkeit, Finanzielle Auswirkungen, Informationen & Daten, Kontrolle & Vertrauen, Compliance & Haftung, Widerstandsfähigkeit & Wiederanlauf. Each shows possible impact, observation, action, evidence counts and limits. Evidence tables use Problemfeld, Beobachteter Zusammenhang and Anzahl, without scanner/GPO or confidence breakdowns. Themes without mapped evidence explicitly state that no impact statement is derivable.
4. Complete Context heatmap: category Base Severity, category name and finding count; unique overall finding count, neutral categories without evidence, overlap explanation and overlap explanation.
5. Scope and method appendix: available environment facts and observation times, technical domain counts, Context categories without a business-impact mapping, source limitations and version provenance.

The explicit user decision 2026-10-04 supersedes the earlier category-first content sequence and the prohibition on any business-consequence wording only for clearly labelled possible consequences. It does not authorize actual client-impact, exploitability, compliance verdicts, impact grades or monetary estimates. Governance is addressed through recorded decisions and action guidance across the themes.

The later explicit screenshot correction 2026-10-04 supersedes the earlier source coverage, source-count chart, printed source attribution and confidence-detail requirements for this report's visible content. Retained report projection, provenance and technical evidence are unchanged. The overall-score diagram reads projection.overallScore directly, with no new calculation. Zero is valid; missing or invalid scores are explicitly unavailable. Theme bars show finding counts only, never a business-risk rating. Both charts remain entirely offline SVG/HTML/CSS.

Text revision 2026-10-04 (renderer 3.3.0, Textbausteine 1.0.0)

Explicit user request supersedes the generic per-row wording: every Context category has a fixed German reading name with Sachverhalt, Einordnung and Ansatzpunkt in management-report-texts.ts. Theme sheets open with a data-derived Kernaussage (count, share, strongest category), the possible impact, an evidence table (Problemfeld, Anzahl, Anteil) and one block per category ordered by count. Base Severity stays out of theme sheets; it appears in the heatmap and as one factual Summary sentence. The Summary derives its statements from published counts only: deviation rate, Overall Score, largest themes, strongest categories, Critical categories, the Security Domain with the highest deviation rate and unexecuted checks. General disclaimers are stated once under Lesehinweise und Aussagegrenzen; observation times are summarised as count and date range. No scanner names, owners, deadlines, stages or impact grades.

Layout correction 2026-10-04: every table outside the Summary spans the full sheet width; theme evidence tables sit below the two-column text. Count and share columns are narrow, right-aligned and never wrapped; text wraps only at word boundaries. On phone widths wide tables scroll horizontally.

Data and security contract

Explicit correction 2026-10-04 supersedes overlapping theme counts in the overview: the table and Abweichungen nach Hauptthema chart form an exclusive partition of the authoritative Work deviation population. A finding is counted once in its primary theme using a versioned category-to-primary-theme mapping. Conflicting or missing assignments appear as Nicht eindeutig zugeordnet. Out-of-scope keys never enter named bars. Financial and compliance impacts remain possible downstream consequences in the prose, without duplicating the finding count. Complete original Context associations remain available in the evidence detail and technical report. The displayed counts including the unassigned row must sum exactly to the stated total.

Decision 2026-10-04 (mapping 2.0.0) supersedes the six themes and the conflict case above: four disjoint themes (Kontrolle & Vertrauen, Informationen & Daten, Betriebsfähigkeit, Widerstandsfähigkeit & Wiederanlauf); every Context category belongs to exactly one, and the Context Engine publishes exactly one category per finding. Financial and compliance consequences are one prose note, never a counted theme. Findings without a category appear as Ohne Problemkategorie.

Counting correction 2026-10-04: theme totals deduplicate published findingKeys, using one scanner occurrence or rolled-up GPO scope/setting identity as the unit. Technical resultIds remain evidence, never multiple findings for one GPO setting. Historical publications without findingKeys retain their existing ID interpretation. Summary totals use the shared Core workspace summary with current GPO evaluations, matching Work's rollup, when available. Cross-theme membership is retained without summing theme counts. Technical rows and historical evaluation evidence remain separate.

Consume the published Context results and the same frozen Core report projection. Do not reclassify findings, reinterpret verdicts, invent metrics or sum overlapping clusters into a total. Base Severity is category significance, not an enterprise score, probability or proven exploit. Work status and risk acceptance do not prove remediation. GPO evidence describes backup configuration, not effective host state.

Never fabricate time series, scores, affected endpoints, actual business consequences, owners, deadlines or effort to fill the reference layout. Technical identifiers, individual evidence and original recommendations remain in the separate Technical Report. Core disclosure rules continue to govern all content. Historical archived reports remain unchanged; this template is applied to newly generated reports.

Possible impact is generated entirely offline from a versioned Report Engine table (management-business-impact.ts, 1.0.0), fixed German text and the published Context results. No Internet calls, LLM, similarity matching or new Context assignment. Per-theme counts deduplicate published result IDs; overlapping theme counts are not summed. Unknown categories receive no implicit business-impact mapping. Context Base Severity remains in its evidence appendix and never becomes an impact rating.

Acceptance references

tests/reporting/context-management-report.test.ts verifies offline assets, layout structure, counts, confidence, technical-evidence separation and input invariance. The permanent Report Engine invariance and boundary checks remain applicable. tests/reporting/management-report-preview.ts generates explicitly synthetic example data through the production renderer; it is a preview, not the template's data source.

Approved assignment labels (2026-10-02)

Historical decision; superseded for this report's visible confidence details by the 2026-10-04 count-only correction above. Stored confidence values and historical archived reports remain unchanged.

Use Nach Katalog, Nach Befundmerkmalen and Thematisch eingeordnet consistently in the German Management Report's reading key, assignment-count tables and summaries. Internal catalogued/recognized/estimated fields and their counts remain unchanged. The thematic tier describes an automatic assignment based on content clues and explicitly states that professional confirmation remains pending. Do not use Geschätzt or geschätzt as report-authored wording. Historical archived reports remain unchanged.