feat(cra): Befund-Detail aufgeräumt + Rechts-Anker (source_article) sichtbar

Frontend (CRA/Cyber-Tab):
- Erklär-Zwischensätze je Ebene (Befund -> CRA-Anforderung -> Best-Practice-
  Standard -> Maßnahmen) + "So liest du einen Befund"-Legende.
- Kuratierte M-Maßnahmen und atom-grain "Regulatorische Breite" in EINE Sektion
  "Maßnahmen (wählbar)" zusammengeführt (statt zwei konkurrierender Listen).
- Standalone "Empfohlene Maßnahmen (Sollzustand)" entfernt (jetzt je Befund).

Backend:
- Atom-Controls-Query liefert jetzt cpl.source_article (Artikel/Anhang/Erwägungs-
  grund-Anker) zusätzlich zu source_regulation; via LATERAL-Join.
- enrich_findings_with_breadth trägt source_article in regulatory_breadth.
- Daten waren schon ingestiert (682/691 CRA-Atome haben source_article) — wurden
  nur nicht selektiert/angezeigt.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

admin-compliance/app/sdk/iace/[projectId]/cra/_components/CRACyberView.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { Fragment, useState } from 'react'
-import { CRADemo, CRAFinding } from '../_hooks/useCRADemo'
+import { CRADemo, CRAFinding, Measure } from '../_hooks/useCRADemo'
 
 const RISK_BADGE: Record<string, string> = {
   CRITICAL: 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300',
@@ -59,7 +59,7 @@ function EvidenceTag({ et }: { et?: string }) {
   )
 }
 
-function FindingsTable({ findings }: { findings: CRAFinding[] }) {
+function FindingsTable({ findings, measuresById }: { findings: CRAFinding[]; measuresById: Record<string, Measure> }) {
   const [open, setOpen] = useState<Record<string, boolean>>({})
   const toggle = (id: string) => setOpen((o) => ({ ...o, [id]: !o[id] }))
   return (
@@ -101,14 +101,19 @@ function FindingsTable({ findings }: { findings: CRAFinding[] }) {
                     onClick={() => toggle(f.id)}
                     className="text-[11px] text-purple-600 hover:underline whitespace-nowrap"
                   >
-                    NIST/OWASP {open[f.id] ? '▲' : '▼'}
+                    Standard &amp; Maßnahmen {open[f.id] ? '▲' : '▼'}
                   </button>
                 </td>
               </tr>
               {open[f.id] && (
                 <tr className="border-b border-gray-100 dark:border-gray-700/50 bg-gray-50/60 dark:bg-gray-900/30">
-                  <td colSpan={6} className="px-4 py-2">
+                  <td colSpan={6} className="px-4 py-3 space-y-3">
-                    <p className="text-[10px] text-gray-400 mb-1">Best-Practice-Tiefe (Golden-Set-Crosswalk)</p>
+                    {/* Best-Practice-Standard — der Maßstab (kein Code-Rezept) */}
+                    <div>
+                      <p className="text-[10px] text-gray-500 mb-1">
+                        <span className="font-semibold text-gray-600 dark:text-gray-300">Best-Practice-Standard</span>
+                        {' '}— woran „erfüllt" gemessen wird (Kontroll-Frameworks, noch kein Code-Rezept):
+                      </p>
                       <div className="flex flex-wrap gap-1 items-center">
                         <span className="text-[10px] text-gray-500 mr-1">NIST 800-53:</span>
                         {f.nist_refs.map((n) => (
@@ -127,24 +132,48 @@ function FindingsTable({ findings }: { findings: CRAFinding[] }) {
                           </>
                         )}
                       </div>
-                    {f.regulatory_breadth && f.regulatory_breadth.length > 0 && (
+                    </div>
-                      <div className="mt-2">
+
-                        <p className="text-[10px] text-gray-400 mb-1">
+                    {/* Maßnahmen (wählbar) — kuratierte Kern-Maßnahme + belegte Optionen, zusammengeführt */}
-                          Regulatorische Breite{f.sub_topic ? ` — ${f.sub_topic}` : ''} (CRA + NIST/OWASP/ENISA-Quellen)
+                    <div>
+                      <p className="text-[10px] text-gray-500 mb-1">
+                        <span className="font-semibold text-gray-600 dark:text-gray-300">Maßnahmen (wählbar)</span>
+                        {' '}— passend kombinieren, nicht alle abhaken. Das Risiko ist geschlossen, wenn die Pflicht real erfüllt ist.
                       </p>
+                      {f.measures.length > 0 && (
+                        <ul className="space-y-1 mb-1.5">
+                          {f.measures.map((mid) => {
+                            const m = measuresById[mid]
+                            return (
+                              <li key={mid} className="text-[10px] text-gray-600 dark:text-gray-300">
+                                <span className="inline-block rounded bg-purple-100 text-purple-700 dark:bg-purple-900/40 dark:text-purple-300 px-1 py-0.5 text-[9px] mr-1">kuratiert</span>
+                                <span className="font-medium text-gray-700 dark:text-gray-200">{m ? m.name : mid}</span>
+                                {m && m.description ? <span className="text-gray-500"> — {m.description}</span> : null}
+                                {m && m.norm_refs && m.norm_refs.length > 0 ? <span className="text-gray-400"> · {m.norm_refs.join(', ')}</span> : null}
+                              </li>
+                            )
+                          })}
+                        </ul>
+                      )}
+                      {f.regulatory_breadth && f.regulatory_breadth.length > 0 && (
                         <ul className="space-y-0.5">
                           {f.regulatory_breadth.map((c) => (
                             <li key={c.control_id} className="text-[10px] text-gray-600 dark:text-gray-300">
-                              {c.use_case && (
+                              <span className="inline-block rounded bg-gray-200 text-gray-600 dark:bg-gray-600 dark:text-gray-200 px-1 py-0.5 text-[9px] mr-1">{c.use_case || 'Option'}</span>
-                                <span className="inline-block rounded bg-gray-200 text-gray-600 dark:bg-gray-600 dark:text-gray-200 px-1 py-0.5 text-[9px] mr-1">{c.use_case}</span>
-                              )}
                               <span className="font-mono text-gray-500">{c.control_id}</span> {c.title}
-                              <span className="text-gray-400"> · {c.source_regulation}</span>
+                              <span className="text-gray-400"> · {c.source_regulation}{c.source_article ? `, ${c.source_article}` : ''}</span>
                             </li>
                           ))}
                         </ul>
-                      </div>
                       )}
+                      {f.measures.length === 0 && (!f.regulatory_breadth || f.regulatory_breadth.length === 0) && (
+                        <p className="text-[10px] text-gray-400">Keine kuratierte Maßnahme hinterlegt — Standard (oben) + Code-Fix aus dem Scan nutzen.</p>
+                      )}
+                    </div>
+
+                    <p className="text-[10px] text-gray-400 italic">
+                      Konkreter Code-Fix (Patch, z. B. Verschlüsselungsverfahren/Schlüssel) folgt aus dem Repo-Scan, sobald das Repository angebunden ist.
+                    </p>
                   </td>
                 </tr>
               )}
@@ -157,6 +186,9 @@ function FindingsTable({ findings }: { findings: CRAFinding[] }) {
 }
 
 export function CRACyberView({ data }: { data: CRADemo }) {
+  const measuresById: Record<string, Measure> = Object.fromEntries(
+    data.open_measures.map((m) => [m.id, m]),
+  )
   return (
     <div className="space-y-6">
       {/* Co-Pilot framing — advisory, not alarmist */}
@@ -224,8 +256,15 @@ export function CRACyberView({ data }: { data: CRADemo }) {
       <div className="rounded-xl border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800">
         <div className="px-4 py-3 border-b border-gray-100 dark:border-gray-700">
           <h2 className="text-sm font-semibold text-gray-800 dark:text-gray-200">Befunde → CRA-Anforderung</h2>
+          <p className="text-[11px] text-gray-500 mt-1 leading-relaxed">
+            So liest du einen Befund: <span className="font-medium text-gray-600 dark:text-gray-300">Cyber-Befund</span> (was der Scan sah)
+            {' → '}<span className="font-medium text-gray-600 dark:text-gray-300">CRA-Anforderung</span> (was das Gesetz verlangt)
+            {' → '}<span className="font-medium text-gray-600 dark:text-gray-300">Best-Practice-Standard</span> (woran „erfüllt" gemessen wird)
+            {' → '}<span className="font-medium text-gray-600 dark:text-gray-300">Maßnahmen</span> (mögliche Umsetzungen — passend wählen, nicht alle).
+            Klick „Standard &amp; Maßnahmen" für die Details je Befund.
+          </p>
         </div>
-        <FindingsTable findings={data.findings} />
+        <FindingsTable findings={data.findings} measuresById={measuresById} />
       </div>
 
       {/* Quick wins — high impact, low effort (second view) */}
@@ -247,33 +286,6 @@ export function CRACyberView({ data }: { data: CRADemo }) {
         </div>
       )}
 
-      {/* Recommended measures — full curated text + norm references */}
-      <div className="rounded-xl border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800 p-4">
-        <h2 className="text-sm font-semibold text-gray-800 dark:text-gray-200 mb-1">Empfohlene Maßnahmen (Sollzustand)</h2>
-        <p className="text-[11px] text-gray-400 mb-3">
-          Kuratierte CRA-Maßnahmen mit Normverweisen — sie beschreiben den <span className="font-medium">umzubauenden Prozess / das Sollziel</span>,
-          kein Auto-Fix. Konkrete Code-Fixes entstehen separat, wenn der Repo-Scan ein Source-Code-Risiko an einer
-          Stelle sieht (Findings mit <span className="text-emerald-600 dark:text-emerald-400">„Code-nah"</span>).
-        </p>
-        <div className="space-y-3">
-          {data.open_measures.map((me) => (
-            <div key={me.id} className="rounded-lg border border-gray-100 dark:border-gray-700/60 p-3">
-              <p className="text-sm font-medium text-gray-800 dark:text-gray-200">
-                <span className="font-mono text-purple-600 dark:text-purple-400">{me.id}</span> — {me.name}
-              </p>
-              <p className="text-xs text-gray-600 dark:text-gray-300 mt-1">{me.description}</p>
-              <div className="flex flex-wrap gap-1 mt-2">
-                {me.norm_refs.map((nr) => (
-                  <span key={nr} className="inline-block rounded bg-gray-100 text-gray-500 dark:bg-gray-700 dark:text-gray-300 px-1.5 py-0.5 text-[10px]">
-                    {nr}
-                  </span>
-                ))}
-              </div>
-            </div>
-          ))}
-        </div>
-      </div>
-
       {/* CRA deadlines */}
       <div className="rounded-xl border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800 p-4">
         <h2 className="text-sm font-semibold text-gray-800 dark:text-gray-200 mb-2">CRA-Fristen</h2>

admin-compliance/app/sdk/iace/[projectId]/cra/_hooks/useCRADemo.ts

@@ -30,7 +30,7 @@ export interface CRAFinding {
   evidence_type?: string  // code | process | hybrid | document — drives the remediation-class badge
   // regulatory breadth (atom-grain shared Controls-API: cra + code/network_security), live only
   sub_topic?: string
-  regulatory_breadth?: { control_id: string; title: string; source_regulation: string; severity?: string; use_case?: string }[]
+  regulatory_breadth?: { control_id: string; title: string; source_regulation: string; source_article?: string; severity?: string; use_case?: string }[]
   // priority layer (set live by the backend prioritizer; optional in the static fallback)
   priority_tier?: string
   priority_score?: number

backend-compliance/compliance/services/cra_use_case_controls.py

@@ -76,6 +76,7 @@ def enrich_findings_with_breadth(mapped: list, db, per_use_case: int = 3) -> Non
                     cache[key] = [
                         {"control_id": c.get("control_id"), "title": c.get("title"),
                          "source_regulation": c.get("source_regulation"),
+                         "source_article": c.get("source_article"),
                          "severity": c.get("severity"), "use_case": uc}
                         for c in res.get("controls", [])
                     ]

backend-compliance/compliance/services/use_case_controls.py

@@ -78,10 +78,14 @@ _LIST_SQL = text("""
 _ATOM_LIST_SQL = text("""
     SELECT ac.control_uuid, ac.sub_topic, ac.canonical_obligation,
            cc.control_id, cc.title, cc.objective, cc.severity,
-           (SELECT cpl.source_regulation FROM control_parent_links cpl
+           cpl.source_regulation, cpl.source_article
-              WHERE cpl.control_uuid = ac.control_uuid LIMIT 1) AS source_regulation
     FROM atom_classification ac
     JOIN canonical_controls cc ON cc.id = ac.control_uuid
+    LEFT JOIN LATERAL (
+        SELECT cpl.source_regulation, cpl.source_article
+        FROM control_parent_links cpl
+        WHERE cpl.control_uuid = ac.control_uuid LIMIT 1
+    ) cpl ON true
     WHERE ac.use_case = :uc AND ac.relevant = true
       AND (:sub IS NULL OR ac.sub_topic = :sub)
     ORDER BY ac.sub_topic NULLS LAST,
@@ -228,6 +232,7 @@ class UseCaseControlsService:
                 "sub_topic": r.sub_topic,
                 "canonical_obligation": r.canonical_obligation,
                 "source_regulation": r.source_regulation,
+                "source_article": r.source_article,
             }
             for r in rows
         ]

backend-compliance/tests/test_cra_use_case_controls.py

@@ -1,5 +1,9 @@
 """Pin the CRA-AI -> network_security sub_topic map (DB enrichment verified live)."""
-from compliance.services.cra_use_case_controls import subtopic_for
+from compliance.services import cra_use_case_controls
+from compliance.services.cra_use_case_controls import (
+    enrich_findings_with_breadth,
+    subtopic_for,
+)
 from compliance.api.cra_annex_i_data import ANNEX_I_REQUIREMENTS
 
 # Exact atom-grain sub_topic keys (verified against the live atom_classification).
@@ -14,3 +18,32 @@ def test_every_requirement_maps_to_a_valid_subtopic():
     for req in ANNEX_I_REQUIREMENTS:
         st = subtopic_for(req["req_id"])
         assert st in _VALID, "{} -> {}".format(req["req_id"], st)
+
+
+class _FakeControlsService:
+    """Stands in for UseCaseControlsService: returns one atom control per call,
+    carrying the legal anchor (source_article) the real atom query now selects."""
+
+    def __init__(self, db):
+        pass
+
+    def controls_for_use_case(self, use_case, sub_topic=None, limit=3):
+        return {"controls": [{
+            "control_id": "AI-{}-{}".format(use_case, sub_topic),
+            "title": "Test obligation",
+            "source_regulation": "Cyber Resilience Act (CRA)",
+            "source_article": "Artikel 13",
+            "severity": "high",
+        }]}
+
+
+def test_breadth_carries_source_article(monkeypatch):
+    monkeypatch.setattr(
+        cra_use_case_controls, "UseCaseControlsService", _FakeControlsService,
+    )
+    mapped = [{"primary_requirement": "CRA-AI-8"}]  # -> authentication sub_topic
+    enrich_findings_with_breadth(mapped, db=None)
+    breadth = mapped[0]["regulatory_breadth"]
+    assert breadth, "expected breadth controls"
+    assert all("source_article" in c for c in breadth)
+    assert any(c["source_article"] == "Artikel 13" for c in breadth)