feat(ai-sdk): source_role control-pool (controls != only technical_standard) (#38)
CI / detect-changes (push) Successful in 4s
CI / branch-name (push) Has been skipped
CI / guardrail-integrity (push) Has been skipped
CI / secret-scan (push) Has been skipped
CI / dep-audit (push) Has been skipped
CI / sbom-scan (push) Has been skipped
CI / build-sha-integrity (push) Successful in 6s
CI / validate-canonical-controls (push) Successful in 3s
CI / loc-budget (push) Successful in 19s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / nodejs-build (push) Has been skipped
CI / test-go (push) Successful in 57s
CI / iace-gt-coverage (push) Successful in 15s
CI / test-python-backend (push) Has been skipped
CI / test-python-document-crawler (push) Has been skipped
CI / test-python-dsms-gateway (push) Has been skipped

This commit was merged in pull request #38.
This commit is contained in:
2026-06-24 11:12:22 +00:00
parent df7966656a
commit 9cfe6f83b1
4 changed files with 166 additions and 34 deletions
@@ -96,20 +96,21 @@ func TestQueryWantsControls(t *testing.T) {
}
}
func TestRerank_ControlQuestion_StandardMayWin(t *testing.T) {
// Explicit implementation intent + standard semantically competitive → standard wins.
func TestRerank_ControlQuestion_OperationalReqTop(t *testing.T) {
// User priority for implementation questions: operational_requirement (binding concrete,
// CRA Anhang I) > control_standard (NIST). Both are in the control-pool; op_req wins.
results := []LegalSearchResult{
intentRes("NIST SP 800-82", "technical_standard", 0.62, 80),
intentRes("CRA", "binding_law", 0.58, 100),
{RegulationShort: "NIST SP 800-82r3", ArticleLabel: "AU-8", SourceClass: "technical_standard", AuthorityWeight: 80, Jurisdiction: "EU", Score: 0.60},
{RegulationShort: "CRA", ArticleLabel: "CRA Anhang I", Category: "regulation", Score: 0.58},
}
out := rerankByAuthority("Welche Controls passen zu Security Updates?", results)
if out[0].SourceClass != "technical_standard" {
t.Errorf("control question: technical_standard should win Top-1, got %s", out[0].SourceClass)
out := rerankByAuthority("Welche Controls und Massnahmen passen zu Security Updates?", results)
if out[0].RegulationShort != "CRA" {
t.Errorf("operational_requirement (CRA Anhang I) should be Top-1 over control_standard, got %q", out[0].RegulationShort)
}
}
func TestRerank_NormQuestion_BindingOverStandard(t *testing.T) {
// "Anforderungen" → no control intent → binding stays Top-1 over the standard.
// "Anforderungen" → no control intent → binding obligation stays Top-1 over the standard.
results := []LegalSearchResult{
intentRes("NIST SP 800-82", "technical_standard", 0.62, 80),
intentRes("CRA", "binding_law", 0.58, 100),
@@ -120,29 +121,15 @@ func TestRerank_NormQuestion_BindingOverStandard(t *testing.T) {
}
}
func TestRerank_OffTopicStandard_BlockedByGuard(t *testing.T) {
// Control intent present, but the standard is semantically far below binding →
// the margin guard keeps binding Top-1 (no off-topic standard override).
func TestRerank_ControlQuestion_PoolBeatsBareObligation(t *testing.T) {
// A control-pool source (NIST control_standard) outranks an abstract obligation with no
// domain/topic advantage, because the implementation intent boosts the control-pool.
results := []LegalSearchResult{
intentRes("NIST SP 800-82", "technical_standard", 0.40, 80),
intentRes("CRA", "binding_law", 0.58, 100),
{RegulationShort: "NIST SP 800-82r3", ArticleLabel: "AU-8", SourceClass: "technical_standard", AuthorityWeight: 80, Jurisdiction: "EU", Score: 0.55},
{RegulationShort: "XYZ", ArticleLabel: "Art. 5 XYZ", Category: "regulation", Score: 0.58},
}
out := rerankByAuthority("Welche Controls passen zu Security Updates?", results)
if out[0].SourceClass != "binding_law" {
t.Errorf("off-topic standard must not win even with control intent, got %s", out[0].SourceClass)
}
}
func TestRerank_ControlQuestion_UntaggedNISTLifted(t *testing.T) {
// The existing NIST corpus is UNtagged (no source_class). It must still be classified
// technical_standard via markers and lifted on a control question — the whole reason
// the lift path classifies instead of trusting the raw payload field.
results := []LegalSearchResult{
{RegulationShort: "NIST SP 800-82r3", ArticleLabel: "AU-8", Score: 0.62},
{RegulationShort: "CRA", ArticleLabel: "Art. 13 CRA", Category: "regulation", Score: 0.58},
}
out := rerankByAuthority("Welche Controls passen zu Security Updates?", results)
out := rerankByAuthority("Welche Controls und Massnahmen passen zu Security Updates?", results)
if out[0].RegulationShort != "NIST SP 800-82r3" {
t.Errorf("untagged NIST should be lifted Top-1 on a control question, got %q", out[0].RegulationShort)
t.Errorf("control_standard should beat a bare abstract obligation on a control question, got %q", out[0].RegulationShort)
}
}