feat: Compliance Maximizer — Regulatory Optimization Engine

Neues Modul das den regulatorischen Spielraum fuer KI-Use-Cases
deterministisch berechnet und optimale Konfigurationen vorschlaegt.

Kernfeatures:
- 13-Dimensionen Constraint-Space (DSGVO + AI Act)
- 3-Zonen-Analyse: Verboten / Eingeschraenkt / Erlaubt
- Deterministische Optimizer-Engine (kein LLM im Kern)
- 28 Constraint-Regeln aus DSGVO, AI Act, EDPB Guidelines
- 28 Tests (Golden Suite + Meta-Tests)
- REST API: /sdk/v1/maximizer/* (9 Endpoints)
- Frontend: 3-Zonen-Visualisierung, Dimension-Form, Score-Gauges

[migration-approved]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ai-compliance-sdk/internal/maximizer/evaluator_test.go

@@ -0,0 +1,229 @@
+package maximizer
+
+import (
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func loadTestRules(t *testing.T) *ConstraintRuleSet {
+	t.Helper()
+	_, filename, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("cannot determine test file location")
+	}
+	// Walk up from internal/maximizer/ to ai-compliance-sdk/
+	dir := filepath.Dir(filename) // internal/maximizer
+	dir = filepath.Dir(dir)       // internal
+	dir = filepath.Dir(dir)       // ai-compliance-sdk
+	path := filepath.Join(dir, "policies", "maximizer_constraints_v1.json")
+	rules, err := LoadConstraintRules(path)
+	if err != nil {
+		t.Fatalf("LoadConstraintRules: %v", err)
+	}
+	return rules
+}
+
+func TestLoadConstraintRules(t *testing.T) {
+	rules := loadTestRules(t)
+	if rules.Version != "1.0.0" {
+		t.Errorf("expected version 1.0.0, got %s", rules.Version)
+	}
+	if len(rules.Rules) < 20 {
+		t.Errorf("expected at least 20 rules, got %d", len(rules.Rules))
+	}
+}
+
+func TestEvalCompliantConfig(t *testing.T) {
+	rules := loadTestRules(t)
+	eval := NewEvaluator(rules)
+
+	config := &DimensionConfig{
+		AutomationLevel:      AutoAssistive,
+		DecisionBinding:      BindingHumanReview,
+		DecisionImpact:       ImpactLow,
+		Domain:               DomainGeneral,
+		DataType:             DataNonPersonal,
+		HumanInLoop:          HILRequired,
+		Explainability:       ExplainBasic,
+		RiskClassification:   RiskMinimal,
+		LegalBasis:           LegalContract,
+		TransparencyRequired: false,
+		LoggingRequired:      false,
+		ModelType:            ModelRuleBased,
+		DeploymentScope:      ScopeInternal,
+	}
+
+	result := eval.Evaluate(config)
+	if !result.IsCompliant {
+		t.Errorf("expected compliant, got violations: %+v", result.Violations)
+	}
+	// All dimensions should be SAFE
+	for dim, zi := range result.ZoneMap {
+		if zi.Zone != ZoneSafe {
+			t.Errorf("dimension %s: expected SAFE, got %s", dim, zi.Zone)
+		}
+	}
+}
+
+func TestEvalHRFullAutomationBlocked(t *testing.T) {
+	rules := loadTestRules(t)
+	eval := NewEvaluator(rules)
+
+	config := &DimensionConfig{
+		AutomationLevel:      AutoFull,
+		DecisionBinding:      BindingFullyBinding,
+		DecisionImpact:       ImpactHigh,
+		Domain:               DomainHR,
+		DataType:             DataPersonal,
+		HumanInLoop:          HILNone,
+		Explainability:       ExplainNone,
+		RiskClassification:   RiskMinimal,
+		LegalBasis:           LegalContract,
+		TransparencyRequired: false,
+		LoggingRequired:      false,
+		ModelType:            ModelBlackboxLLM,
+		DeploymentScope:      ScopeExternal,
+	}
+
+	result := eval.Evaluate(config)
+	if result.IsCompliant {
+		t.Error("expected non-compliant for HR full automation")
+	}
+	if len(result.Violations) == 0 {
+		t.Error("expected at least one violation")
+	}
+
+	// automation_level should be FORBIDDEN
+	zi := result.ZoneMap["automation_level"]
+	if zi.Zone != ZoneForbidden {
+		t.Errorf("automation_level: expected FORBIDDEN, got %s", zi.Zone)
+	}
+}
+
+func TestEvalProhibitedClassification(t *testing.T) {
+	rules := loadTestRules(t)
+	eval := NewEvaluator(rules)
+
+	config := &DimensionConfig{
+		RiskClassification: RiskProhibited,
+		DeploymentScope:    ScopePublic,
+	}
+
+	result := eval.Evaluate(config)
+	if result.IsCompliant {
+		t.Error("expected non-compliant for prohibited classification")
+	}
+
+	found := false
+	for _, v := range result.Violations {
+		if v.RuleID == "MC-AIA-PROHIBITED-001" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("expected MC-AIA-PROHIBITED-001 violation")
+	}
+}
+
+func TestEvalSensitiveDataRequiresConsent(t *testing.T) {
+	rules := loadTestRules(t)
+	eval := NewEvaluator(rules)
+
+	config := &DimensionConfig{
+		DataType:   DataSensitive,
+		LegalBasis: LegalLegitimateInterest, // wrong basis for sensitive
+	}
+
+	result := eval.Evaluate(config)
+	if result.IsCompliant {
+		t.Error("expected non-compliant: sensitive data without consent")
+	}
+
+	// Should require consent
+	found := false
+	for _, r := range result.Restrictions {
+		if val, ok := r.Required["legal_basis"]; ok && val == "consent" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("expected restriction requiring legal_basis=consent")
+	}
+}
+
+func TestEvalHighRiskRequiresLogging(t *testing.T) {
+	rules := loadTestRules(t)
+	eval := NewEvaluator(rules)
+
+	config := &DimensionConfig{
+		RiskClassification:   RiskHigh,
+		LoggingRequired:      false,
+		TransparencyRequired: false,
+		HumanInLoop:          HILNone,
+		Explainability:       ExplainNone,
+	}
+
+	result := eval.Evaluate(config)
+	if result.IsCompliant {
+		t.Error("expected non-compliant: high risk without logging/transparency/hil")
+	}
+
+	// Check logging_required is RESTRICTED
+	zi := result.ZoneMap["logging_required"]
+	if zi.Zone != ZoneRestricted {
+		t.Errorf("logging_required: expected RESTRICTED, got %s", zi.Zone)
+	}
+}
+
+func TestEvalTriggeredRulesHaveObligationRefs(t *testing.T) {
+	rules := loadTestRules(t)
+	eval := NewEvaluator(rules)
+
+	config := &DimensionConfig{
+		AutomationLevel: AutoFull,
+		DecisionImpact:  ImpactHigh,
+		Domain:          DomainHR,
+		DataType:        DataPersonal,
+	}
+
+	result := eval.Evaluate(config)
+	for _, tr := range result.TriggeredRules {
+		if tr.RuleID == "" {
+			t.Error("triggered rule missing RuleID")
+		}
+		if tr.ObligationID == "" {
+			t.Error("triggered rule missing ObligationID")
+		}
+		if tr.ArticleRef == "" {
+			t.Error("triggered rule missing ArticleRef")
+		}
+	}
+}
+
+func TestConditionSetMatchesExact(t *testing.T) {
+	config := &DimensionConfig{
+		Domain:         DomainHR,
+		DecisionImpact: ImpactHigh,
+	}
+
+	tests := []struct {
+		name    string
+		cond    ConditionSet
+		matches bool
+	}{
+		{"exact match", ConditionSet{"domain": "hr", "decision_impact": "high"}, true},
+		{"partial match fails", ConditionSet{"domain": "hr", "decision_impact": "low"}, false},
+		{"unknown value", ConditionSet{"domain": "finance"}, false},
+		{"empty condition", ConditionSet{}, true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tc.cond.Matches(config)
+			if got != tc.matches {
+				t.Errorf("expected %v, got %v", tc.matches, got)
+			}
+		})
+	}
+}