feat: Control Library UI, dedup migration, QA tooling, docs

- Control Library: parent control display, ObligationTypeBadge,
  GenerationStrategyBadge variants, evidence string fallback
- API: expose parent_control_uuid/id/title in canonical controls
- Fix: DSFA SQLAlchemy 2.0 Row._mapping compatibility
- Migration 074: control_parent_links + control_dedup_reviews tables
- QA scripts: benchmark, gap analysis, OSCAL import, OWASP cleanup,
  phase5 normalize, phase74 gap fill, sync_db, run_job
- Docs: dedup engine, RAG benchmark, lessons learned, pipeline docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin-compliance/app/sdk/control-library/components/ControlDetail.tsx

@@ -9,6 +9,7 @@ import {
 import {
   CanonicalControl, EFFORT_LABELS, BACKEND_URL,
   SeverityBadge, StateBadge, LicenseRuleBadge, VerificationMethodBadge, CategoryBadge, TargetAudienceBadge,
+  ObligationTypeBadge, GenerationStrategyBadge,
   VERIFICATION_METHODS, CATEGORY_OPTIONS,
 } from './helpers'
 
@@ -125,6 +126,8 @@ export function ControlDetail({
               <VerificationMethodBadge method={ctrl.verification_method} />
               <CategoryBadge category={ctrl.category} />
               <TargetAudienceBadge audience={ctrl.target_audience} />
+              <GenerationStrategyBadge strategy={ctrl.generation_strategy} />
+              <ObligationTypeBadge type={ctrl.generation_metadata?.obligation_type as string} />
             </div>
             <h2 className="text-lg font-semibold text-gray-900 mt-1">{ctrl.title}</h2>
           </div>
@@ -239,6 +242,32 @@ export function ControlDetail({
           </section>
         )}
 
+        {/* Parent Control (atomare Controls) */}
+        {ctrl.parent_control_uuid && (
+          <section className="bg-violet-50 border border-violet-200 rounded-lg p-4">
+            <div className="flex items-center gap-2 mb-1">
+              <GitMerge className="w-4 h-4 text-violet-600" />
+              <h3 className="text-sm font-semibold text-violet-900">Atomares Control</h3>
+              <ObligationTypeBadge type={ctrl.generation_metadata?.obligation_type as string} />
+            </div>
+            <p className="text-sm text-violet-800">
+              Abgeleitet aus Eltern-Control{' '}
+              <span className="font-mono font-semibold text-purple-700 bg-purple-100 px-1.5 py-0.5 rounded">
+                {ctrl.parent_control_id || ctrl.parent_control_uuid}
+              </span>
+              {ctrl.parent_control_title && (
+                <span className="text-violet-700 ml-1">— {ctrl.parent_control_title}</span>
+              )}
+            </p>
+            {ctrl.generation_metadata?.obligation_text && (
+              <p className="text-xs text-violet-600 mt-2 bg-violet-100/50 rounded p-2">
+                Obligation: {String(ctrl.generation_metadata.obligation_text).slice(0, 300)}
+                {String(ctrl.generation_metadata.obligation_text).length > 300 ? '...' : ''}
+              </p>
+            )}
+          </section>
+        )}
+
         {/* Impliziter Gesetzesbezug (Rule 3 — reformuliert, kein Originaltext) */}
         {!ctrl.source_citation && ctrl.open_anchors.length > 0 && (
           <section className="bg-amber-50 border border-amber-200 rounded-lg p-3">
@@ -297,7 +326,7 @@ export function ControlDetail({
           </section>
         )}
 
-        {/* Evidence */}
+        {/* Evidence — handles both {type, description} objects and plain strings */}
         {ctrl.evidence.length > 0 && (
           <section>
             <h3 className="text-sm font-semibold text-gray-900 mb-2">Nachweise</h3>
@@ -305,7 +334,11 @@ export function ControlDetail({
               {ctrl.evidence.map((ev, i) => (
                 <div key={i} className="flex items-start gap-2 text-sm text-gray-700">
                   <FileText className="w-4 h-4 text-gray-400 flex-shrink-0 mt-0.5" />
-                  <div><span className="font-medium">{ev.type}:</span> {ev.description}</div>
+                  {typeof ev === 'string' ? (
+                    <div>{ev}</div>
+                  ) : (
+                    <div><span className="font-medium">{ev.type}:</span> {ev.description}</div>
+                  )}
                 </div>
               ))}
             </div>
@@ -359,7 +392,18 @@ export function ControlDetail({
               <h3 className="text-sm font-semibold text-gray-700">Generierungsdetails (intern)</h3>
             </div>
             <div className="text-xs text-gray-600 space-y-1">
-              <p>Pfad: {String(ctrl.generation_metadata.processing_path || '-')}</p>
+              {ctrl.generation_metadata.processing_path && (
+                <p>Pfad: {String(ctrl.generation_metadata.processing_path)}</p>
+              )}
+              {ctrl.generation_metadata.decomposition_method && (
+                <p>Methode: {String(ctrl.generation_metadata.decomposition_method)}</p>
+              )}
+              {ctrl.generation_metadata.pass0b_model && (
+                <p>LLM: {String(ctrl.generation_metadata.pass0b_model)}</p>
+              )}
+              {ctrl.generation_metadata.obligation_type && (
+                <p>Obligation-Typ: {String(ctrl.generation_metadata.obligation_type)}</p>
+              )}
               {ctrl.generation_metadata.similarity_status && (
                 <p className="text-red-600">Similarity: {String(ctrl.generation_metadata.similarity_status)}</p>
               )}

admin-compliance/app/sdk/control-library/components/helpers.tsx

@@ -30,7 +30,7 @@ export interface CanonicalControl {
   }
   requirements: string[]
   test_procedure: string[]
-  evidence: EvidenceItem[]
+  evidence: (EvidenceItem | string)[]
   severity: string
   risk_score: number | null
   implementation_effort: string | null
@@ -47,6 +47,10 @@ export interface CanonicalControl {
   target_audience: string | string[] | null
   generation_metadata?: Record<string, unknown> | null
   generation_strategy?: string | null
+  parent_control_uuid?: string | null
+  parent_control_id?: string | null
+  parent_control_title?: string | null
+  decomposition_method?: string | null
   created_at: string
   updated_at: string
 }
@@ -275,7 +279,26 @@ export function GenerationStrategyBadge({ strategy }: { strategy: string | null
   if (strategy === 'document_grouped') {
     return <span className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium bg-emerald-100 text-emerald-700">v2</span>
   }
-  return null
+  if (strategy === 'phase74_gap_fill') {
+    return <span className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium bg-blue-100 text-blue-700">v5 Gap</span>
+  }
+  if (strategy === 'pass0b_atomic') {
+    return <span className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium bg-violet-100 text-violet-700">Atomar</span>
+  }
+  return <span className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium bg-gray-100 text-gray-500">{strategy}</span>
+}
+
+export const OBLIGATION_TYPE_CONFIG: Record<string, { bg: string; label: string }> = {
+  pflicht: { bg: 'bg-red-100 text-red-700', label: 'Pflicht' },
+  empfehlung: { bg: 'bg-amber-100 text-amber-700', label: 'Empfehlung' },
+  kann: { bg: 'bg-green-100 text-green-700', label: 'Kann' },
+}
+
+export function ObligationTypeBadge({ type }: { type: string | null | undefined }) {
+  if (!type) return null
+  const config = OBLIGATION_TYPE_CONFIG[type]
+  if (!config) return null
+  return <span className={`inline-flex items-center px-2 py-0.5 rounded text-xs font-medium ${config.bg}`}>{config.label}</span>
 }
 
 export function getDomain(controlId: string): string {

admin-compliance/app/sdk/control-library/page.tsx

@@ -9,7 +9,7 @@ import {
 import {
   CanonicalControl, Framework, BACKEND_URL, EMPTY_CONTROL,
   SeverityBadge, StateBadge, LicenseRuleBadge, VerificationMethodBadge, CategoryBadge, TargetAudienceBadge,
-  GenerationStrategyBadge,
+  GenerationStrategyBadge, ObligationTypeBadge,
   VERIFICATION_METHODS, CATEGORY_OPTIONS, TARGET_AUDIENCE_OPTIONS,
 } from './components/helpers'
 import { ControlForm } from './components/ControlForm'
@@ -762,6 +762,7 @@ export default function ControlLibraryPage() {
                     <CategoryBadge category={ctrl.category} />
                     <TargetAudienceBadge audience={ctrl.target_audience} />
                     <GenerationStrategyBadge strategy={ctrl.generation_strategy} />
+                    <ObligationTypeBadge type={ctrl.generation_metadata?.obligation_type as string} />
                     {ctrl.risk_score !== null && (
                       <span className="text-xs text-gray-400">Score: {ctrl.risk_score}</span>
                     )}