Use-Case-Mapping-Filter für Master Controls + Mapper-Präzisionsfix
CI / detect-changes (push) Successful in 14s
CI / branch-name (push) Has been skipped
CI / guardrail-integrity (push) Has been skipped
CI / secret-scan (push) Has been skipped
CI / dep-audit (push) Has been skipped
CI / sbom-scan (push) Has been skipped
CI / build-sha-integrity (push) Failing after 7s
CI / validate-canonical-controls (push) Successful in 13s
CI / loc-budget (push) Failing after 15s
CI / go-lint (push) Has been skipped
CI / test-go (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / nodejs-build (push) Successful in 2m23s
CI / iace-gt-coverage (push) Has been skipped
CI / test-python-backend (push) Successful in 34s
CI / test-python-document-crawler (push) Has been skipped
CI / test-python-dsms-gateway (push) Has been skipped

Phase 2: Live-Filter an /sdk/master-controls (Use Case, Quell-Regulierung,
Verifikations-Methode, Coverage, Primärzweck-Toggle, category via Member-EXISTS).
API mit EXISTS-Filtern + gecachten Meta-Counts in master-controls/route.ts.

Phase A: neue UseCase telekommunikation + Fix der Impressum-Fehlrouten im
Register (TKG/AT-TKG->telekommunikation, telemedien->dse, GewO->handelsrecht);
echte Impressum-Quellen (TMG/Mediengesetz) bleiben impressum. Deterministischer
Seed aus source_regulation; Tests grün.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-06-09 23:19:56 +02:00
parent c4d9b1426f
commit 372e1fe9e9
10 changed files with 434 additions and 45 deletions
@@ -55,6 +55,11 @@ _USE_CASES: tuple[UseCase, ...] = (
doc_types=("impressum",), scope_tokens=("impressum",),
categories=("compliance",),
keyword_tokens=("impressum", "anbieterkennzeichnung")),
UseCase("telekommunikation", "Telekommunikation (TKG)", "product",
regulations=("TKG",),
verification_methods=("document", "it_process"),
categories=("compliance", "governance"),
keyword_tokens=("telekommunikation", "tkg")),
UseCase("dse", "Datenschutzerklärung", "document",
regulations=("DSGVO",),
verification_methods=("document",),
@@ -270,12 +275,18 @@ _REGULATION_RULES: tuple[tuple[str, str], ...] = (
# Website / Telemedien / Recht (User-Domaene)
("tdddg", "cookie_banner"),
("eprivacy", "cookie_banner"),
("telemedien", "impressum"),
("telekommunikationsgesetz", "impressum"),
("tkg", "impressum"),
# Telemediengesetz (das echte Impressumsrecht) VOR der "telemedien"-
# Leitlinien-Regel — longest-first, sonst faengt "telemedien" es ab.
("telemediengesetz", "impressum"),
# "DSK OH Telemedien" ist eine Datenschutz-Leitlinie, kein Impressumsrecht.
("telemedien", "dse"),
# TKG / AT-TKG sind Telekommunikationsrecht, NICHT Website-Impressum.
("telekommunikationsgesetz", "telekommunikation"),
("tkg", "telekommunikation"),
("tmg", "impressum"),
("mediengesetz", "impressum"),
("gewerbeordnung", "impressum"),
# Gewerbeordnung ist Gewerbe-/Handelsrecht, kein Impressum.
("gewerbeordnung", "handelsrecht"),
("e-commerce", "agb"),
("digitale-inhalte", "agb"),
("konsumentenschutz", "verbraucherschutz"),
@@ -125,7 +125,7 @@ async def run_seed(conn, limit: int = 0) -> dict:
await conn.execute(
"""INSERT INTO compliance.mc_use_case_sync_state
(registry_hash, stage, total_mappings, mcs_classified)
VALUES ($1,'seed_source_regulation',$2,$3)""",
VALUES ($1,'seed_regulation',$2,$3)""",
reg.registry_hash(), total, n_mc)
return {"mcs_mapped": n_mc, "regulation_rows": n_reg,
"use_case_rows": n_uc, "verification_rows": n_v}
@@ -122,7 +122,8 @@ def test_regulation_mapper_known():
"Cyber Resilience Act (CRA)": "cra",
"DSGVO (EU) 2016/679": "dse",
"EDPB Facial Recognition": "dse", # Leitlinie → Datenschutz
"TKG": "impressum",
"TKG": "telekommunikation", # Telekom-Recht, NICHT Impressum
"TMG": "impressum", # echtes Impressumsrecht
"TDDDG": "cookie_banner",
"Markets in Crypto-Assets (MiCA)": "mica",
"BGB": "agb",
@@ -131,6 +132,19 @@ def test_regulation_mapper_known():
assert reg.use_case_for_regulation(reg_str) == expected, reg_str
def test_regulation_mapper_impressum_misroutes_fixed():
# Phase A: Telekom-/Datenschutz-/Gewerbe-Gesetze duerfen NICHT mehr als
# Impressum durchgehen (Korpus enthaelt kein echtes Impressumsrecht ausser
# TMG/MStV). Siehe Audit 2026-06-09.
assert reg.use_case_for_regulation("Telekommunikationsgesetz Oesterreich") \
== "telekommunikation"
assert reg.use_case_for_regulation("DSK OH Telemedien") == "dse"
assert reg.use_case_for_regulation("Gewerbeordnung (GewO)") == "handelsrecht"
# Die echten Impressum-Quellen bleiben Impressum:
assert reg.use_case_for_regulation("TMG") == "impressum"
assert reg.use_case_for_regulation("AT Mediengesetz") == "impressum"
def test_regulation_mapper_abgb_before_bgb():
# 'ABGB' enthaelt 'bgb' — die abgb-Regel MUSS zuerst greifen.
assert reg.use_case_for_regulation("AT ABGB") == "handelsrecht"