diff --git a/backend-compliance/compliance/api/agent_compliance_check_routes.py b/backend-compliance/compliance/api/agent_compliance_check_routes.py
index d33e28ea..5d312061 100644
--- a/backend-compliance/compliance/api/agent_compliance_check_routes.py
+++ b/backend-compliance/compliance/api/agent_compliance_check_routes.py
@@ -1486,6 +1486,23 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
except Exception as e:
logger.warning("P71 jc_avv_decision skipped: %s", e)
+ # P6/P53/P55 — Branchen-Kontext + Site-History
+ industry_ctx_html = ""
+ try:
+ from compliance.services.industry_library import (
+ build_industry_context_block_html, load_site_profile,
+ )
+ from database import SessionLocal as _SLib
+ _ind_db = _SLib()
+ try:
+ ind = (req.scan_context or {}).get("industry") if req.scan_context else None
+ site_prof = load_site_profile(_ind_db, domain_for_exec or "")
+ industry_ctx_html = build_industry_context_block_html(ind, site_prof)
+ finally:
+ _ind_db.close()
+ except Exception as e:
+ logger.warning("industry context skipped: %s", e)
+
# P85 — Banner-Screenshot fuer visuellen Beweis (zwischen
# GF-1-Pager und Detail-Bloecken)
banner_shot_html = ""
@@ -1596,6 +1613,7 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
+ critical_html + scope_disclaimer_html + exec_summary_html
+ cookie_arch_html + summary_html + scanned_html + profile_html
+ scorecard_html + redundancy_html
+ + industry_ctx_html
+ banner_shot_html
+ providers_html + banner_deep_html
+ cookie_audit_html
diff --git a/backend-compliance/compliance/data/ecall_regulation.json b/backend-compliance/compliance/data/ecall_regulation.json
new file mode 100644
index 00000000..1ae0bc51
--- /dev/null
+++ b/backend-compliance/compliance/data/ecall_regulation.json
@@ -0,0 +1,50 @@
+{
+ "source": "Verordnung (EU) 2015/758 - eCall",
+ "official_url": "https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32015R0758",
+ "ingest_for": "RAG-Korpus (Compliance fuer Automotive-OEMs)",
+ "chunks": [
+ {
+ "id": "ecall-art-3-1",
+ "title": "Art. 3 (1) — bordeigenes eCall-System",
+ "text": "Hersteller stellen sicher, dass alle neuen Typen von Personenkraftwagen und leichten Nutzfahrzeugen mit einem auf 112 basierten bordeigenen eCall-System ausgestattet sind, das den in dieser Verordnung festgelegten Anforderungen und harmonisierten Normen entspricht."
+ },
+ {
+ "id": "ecall-art-6-1",
+ "title": "Art. 6 (1) — Datenschutz",
+ "text": "Bei der Verarbeitung personenbezogener Daten ueber das auf 112 basierte bordeigene eCall-System gewaehrleisten Hersteller die Einhaltung der Richtlinie 95/46/EG und der RL 2002/58/EG. Insbesondere muessen Fahrzeughalter darueber informiert werden, dass das System dauerhaft im Standby-Modus ist und im Falle eines schweren Unfalls automatisch ausgeloest wird."
+ },
+ {
+ "id": "ecall-art-6-2",
+ "title": "Art. 6 (2) — Datenverarbeitung",
+ "text": "Die Verarbeitung personenbezogener Daten ueber das auf 112 basierte bordeigene eCall-System darf nur zum Zwecke der Bearbeitung von Notrufen erfolgen. Diese Daten sind unmittelbar nach Bearbeitung des Notrufs ohne automatisierte Speicherung zu loeschen, soweit nicht anders gesetzlich vorgesehen."
+ },
+ {
+ "id": "ecall-art-6-3",
+ "title": "Art. 6 (3) — Standortdaten",
+ "text": "Die Standortdaten des Fahrzeugs werden zur Behandlung des Notrufes uebermittelt. Eine permanente Standortueberwachung ausserhalb von Notfaellen ist nicht zulaessig."
+ },
+ {
+ "id": "ecall-art-6-4",
+ "title": "Art. 6 (4) — Informationspflicht",
+ "text": "Hersteller stellen sicher, dass in der technischen Dokumentation des Fahrzeugs klare und vollstaendige Informationen ueber die Verarbeitung personenbezogener Daten gegeben werden, einschliesslich des Rechts der betroffenen Person auf Auskunft und gegebenenfalls Berichtigung sowie Sperrung der sie betreffenden personenbezogenen Daten."
+ },
+ {
+ "id": "ecall-art-6-5",
+ "title": "Art. 6 (5) — Mehrwertdienste",
+ "text": "Mehrwertdienste (z.B. private Pannenruf-Apps) duerfen nur mit ausdruecklicher Einwilligung des Fahrzeughalters in Anspruch genommen werden. Das auf 112 basierte bordeigene eCall-System darf nicht von diesen Mehrwertdiensten beeintraechtigt werden und muss kostenlos und fuer alle Fahrzeughalter verfuegbar sein."
+ },
+ {
+ "id": "ecall-art-7",
+ "title": "Art. 7 — Datenfluss",
+ "text": "Der Mindestdatensatz (MSD) umfasst Fahrzeug-ID (VIN), Ausloesungsart, Zeitstempel, Standort, Fahrtrichtung, Antriebsenergie, Anzahl angeschnallter Insassen. Diese Daten gehen an die naechste oeffentliche Notrufabfragestelle (PSAP)."
+ }
+ ],
+ "compliance_implications": {
+ "automotive_oem": [
+ "Hersteller MUSS in der DSE den eCall-Datenfluss erklaeren (Art. 6 (4)).",
+ "Standortdaten ausserhalb von Notfaellen sind UNZULAESSIG (Art. 6 (3)).",
+ "Mehrwertdienste brauchen separate ausdrueckliche Einwilligung (Art. 6 (5)).",
+ "Daten nach Notruf-Bearbeitung SOFORT zu loeschen (Art. 6 (2))."
+ ]
+ }
+}
diff --git a/backend-compliance/compliance/services/check_replay.py b/backend-compliance/compliance/services/check_replay.py
index c34c7924..2447c558 100644
--- a/backend-compliance/compliance/services/check_replay.py
+++ b/backend-compliance/compliance/services/check_replay.py
@@ -85,6 +85,28 @@ def replay_from_snapshot(
section_sizes: dict[str, int] = {}
parts: list[str] = []
+ # P80 v2 — Quality-Checks aus dem aktuellen Code auf Snapshot-Daten
+ # anwenden. Wir replayen NICHT die MC-Pipeline (zu schwer ohne
+ # rag_document_checker re-run), aber alle nachgelagerten Findings-
+ # Generatoren (audit_quality, cookie_compliance_audit, vendor_normalizer,
+ # entropy, network-trace) bekommen Snapshot-Daten und liefern den
+ # aktuellen Stand.
+ try:
+ from compliance.services.audit_quality_checks import (
+ run_all as run_aq,
+ )
+ cookie_t = doc_texts.get("cookie") or doc_texts.get("dse") or ""
+ aq = run_aq(banner_result, cookie_t, cmp_vendors, doc_entries)
+ if aq:
+ from compliance.services.audit_quality_checks import (
+ build_audit_quality_block_html,
+ )
+ aq_html = build_audit_quality_block_html(aq)
+ parts.append(aq_html)
+ section_sizes["audit_quality_v2"] = len(aq_html)
+ except Exception as e:
+ logger.warning("Replay v2: audit_quality failed: %s", e)
+
# P82: GF-1-Pager zuerst (5-Bullet-Summary)
try:
from compliance.services.gf_one_pager import build_gf_one_pager_html
diff --git a/backend-compliance/compliance/services/consent_diff_for_user.py b/backend-compliance/compliance/services/consent_diff_for_user.py
new file mode 100644
index 00000000..f9578289
--- /dev/null
+++ b/backend-compliance/compliance/services/consent_diff_for_user.py
@@ -0,0 +1,125 @@
+"""
+P54 — Diff-Banner fuer End-User (USP-Feature).
+
+USP-Idee: bei wiederkehrenden Besuchern zeigt das Banner NICHT die
+Standard-Frage, sondern eine Diff-Mitteilung:
+ "Seit deiner letzten Zustimmung haben wir hinzugefuegt:
+ * Microsoft Bing (Werbung)
+ * TikTok Pixel (Marketing)
+ Bitte erneut zustimmen oder anpassen."
+
+Backend-Seite (hier): liefert pro Snapshot eine 'diff_for_user'-Struktur
+die zum Embedden in eigenen Banner / Hinweistext genutzt werden kann.
+Frontend-Banner-Lib (separate consent-sdk) konsumiert das.
+
+Vergleicht Vendor-Listen zwischen aktuellem Snapshot und dem letzten
+Snapshot mit gleicher site_domain.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Iterable
+
+from sqlalchemy import text as sa_text
+from sqlalchemy.orm import Session
+
+logger = logging.getLogger(__name__)
+
+
+def _norm_vendor_set(vendors: Iterable) -> set[str]:
+ out: set[str] = set()
+ for v in (vendors or []):
+ if isinstance(v, dict):
+ n = (v.get("name") or "").strip()
+ elif isinstance(v, str):
+ n = v.strip()
+ else:
+ continue
+ if n:
+ out.add(n)
+ return out
+
+
+def compute_user_facing_diff(
+ db: Session,
+ site_domain: str,
+ current_check_id: str,
+ current_cmp_vendors: list,
+) -> dict | None:
+ """Vergleicht aktuelle vs letzte cmp_vendors-Liste fuer die gleiche
+ site_domain. Liefert {prev_at, added_vendors, removed_vendors,
+ new_high_risk_categories} oder None wenn kein vorheriger Lauf."""
+ if not site_domain:
+ return None
+ try:
+ row = db.execute(sa_text(
+ """
+ SELECT cmp_vendors, created_at
+ FROM compliance.compliance_check_snapshots
+ WHERE site_domain = :dom AND check_id != :ex
+ ORDER BY created_at DESC LIMIT 1
+ """
+ ), {"dom": site_domain, "ex": current_check_id}).fetchone()
+ except Exception as e:
+ logger.warning("diff lookup failed: %s", e)
+ return None
+ if not row:
+ return None
+
+ prev_vendors = row[0] or []
+ prev_at = row[1]
+ curr_set = _norm_vendor_set(current_cmp_vendors)
+ prev_set = _norm_vendor_set(prev_vendors)
+
+ added = sorted(curr_set - prev_set)
+ removed = sorted(prev_set - curr_set)
+ if not added and not removed:
+ return None
+
+ # High-risk Kategorien aus added Vendors: Marketing / Tracking
+ new_marketing: list[str] = []
+ for v in current_cmp_vendors:
+ if not isinstance(v, dict):
+ continue
+ n = (v.get("name") or "").strip()
+ cat = (v.get("category") or "").lower()
+ if n in added and cat in ("marketing", "tracking", "advertising"):
+ new_marketing.append(n)
+
+ return {
+ "prev_at": prev_at.isoformat() if prev_at else None,
+ "added_vendors": added,
+ "removed_vendors": removed,
+ "new_marketing_vendors": new_marketing,
+ "requires_reconsent": bool(new_marketing),
+ }
+
+
+def build_diff_banner_snippet(diff: dict) -> str:
+ """Liefert HTML-Snippet das der Site-Betreiber in seinen eigenen
+ Cookie-Banner einbauen kann (z.B. via consent-sdk)."""
+ if not diff or not diff.get("added_vendors"):
+ return ""
+ added = diff.get("added_vendors", [])
+ n_marketing = len(diff.get("new_marketing_vendors") or [])
+ items = "".join(f"{v}" for v in added[:8])
+ reconsent_note = ""
+ if diff.get("requires_reconsent"):
+ reconsent_note = (
+ f''
+ f'{n_marketing} neue{"r" if n_marketing == 1 else ""} '
+ f'Marketing-Anbieter seit Ihrer letzten Zustimmung — '
+ 'bitte erneut bestaetigen.'
+ '
'
+ )
+ return (
+ ''
+ '
Seit Ihrer letzten Zustimmung haben wir hinzugefuegt:'
+ f'
'
+ + reconsent_note +
+ '
'
+ f'
'
+ f'Branchen-Kontext: {industry}
'
+ f'
'
+ f'Geltende Spezial-Regulierungen: {regs}'
+ f'
'
+ f'
Worauf '
+ f'wir bei dieser Branche besonders schauen:
'
+ f'
'
+ '
'
+ f'Wir haben diese Site bereits {site_profile["historical_runs"]}× '
+ f'analysiert. Bekannter CMP-Provider: '
+ f'{site_profile["common_provider"]}, '
+ f'historische Vendor-Zahl: ~{site_profile["avg_vendor_count"]}.'
+ '
'
+ )
+ return "".join(parts)
diff --git a/backend-compliance/compliance/services/llm_cascade.py b/backend-compliance/compliance/services/llm_cascade.py
new file mode 100644
index 00000000..d7541f04
--- /dev/null
+++ b/backend-compliance/compliance/services/llm_cascade.py
@@ -0,0 +1,229 @@
+"""
+P31 — Tiered LLM-Cascade mit Confidence + Valkey-Cache.
+
+Bisherige LLM-Calls (vendor_llm_extractor, mc_solution_generator):
+* gehen direkt an Qwen lokal → bei kompliziertem Input lange Latenz
+* fallen bei Fail manuell auf OVH 120B zurueck
+* Kein Cache → gleiche Eingabe kostet x-mal Zeit
+
+Diese Modul vereinheitlicht:
+1. Cache-Lookup (md5(prompt) → cached response, TTL 7d)
+2. Qwen-Aufruf mit kurzem Timeout (90s)
+3. Wenn fail/leer ODER confidence < threshold → OVH 120B (45s)
+4. Wenn auch fail → Anthropic Claude (last resort)
+5. Response wird gecached
+
+confidence-Heuristik:
+* parsed JSON erfolgreich + non-empty → 0.8
+* JSON-Parse failed → 0.0
+* JSON ok aber nur 1 Item bei >5000 chars input → 0.3
+
+Backend-API: await call_with_cascade(prompt, system_prompt, expected_min_items)
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import os
+from typing import Any
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+# In-process Cache wenn kein Valkey verfuegbar
+_LOCAL_CACHE: dict[str, dict] = {}
+_LOCAL_CACHE_MAX = 200
+
+
+def _cache_key(system: str, user: str, model_hint: str = "") -> str:
+ blob = f"{system}\n---\n{user}\n---\n{model_hint}"
+ return "llm:" + hashlib.md5(blob.encode()).hexdigest()[:24]
+
+
+def _cache_get(key: str) -> dict | None:
+ try:
+ import redis # noqa: WPS433
+ url = os.getenv("VALKEY_URL", "redis://bp-core-valkey:6379")
+ r = redis.Redis.from_url(url, socket_timeout=2.0,
+ decode_responses=True)
+ v = r.get(key)
+ if v:
+ return json.loads(v)
+ except Exception:
+ pass
+ return _LOCAL_CACHE.get(key)
+
+
+def _cache_put(key: str, value: dict, ttl: int = 604800) -> None:
+ try:
+ import redis # noqa: WPS433
+ url = os.getenv("VALKEY_URL", "redis://bp-core-valkey:6379")
+ r = redis.Redis.from_url(url, socket_timeout=2.0,
+ decode_responses=True)
+ r.setex(key, ttl, json.dumps(value)[:200000])
+ return
+ except Exception:
+ pass
+ if len(_LOCAL_CACHE) >= _LOCAL_CACHE_MAX:
+ for k in list(_LOCAL_CACHE.keys())[:50]:
+ _LOCAL_CACHE.pop(k, None)
+ _LOCAL_CACHE[key] = value
+
+
+def _heuristic_confidence(response_text: str, input_len: int) -> float:
+ if not response_text:
+ return 0.0
+ try:
+ obj = json.loads(response_text)
+ except Exception:
+ # Try to extract JSON block
+ a, b = response_text.find("{"), response_text.rfind("}")
+ if 0 <= a < b:
+ try:
+ obj = json.loads(response_text[a:b + 1])
+ except Exception:
+ return 0.1
+ else:
+ return 0.1
+ n_items = 0
+ if isinstance(obj, dict):
+ for v in obj.values():
+ if isinstance(v, list):
+ n_items += len(v)
+ elif isinstance(v, dict):
+ n_items += 1
+ if input_len > 5000 and n_items <= 1:
+ return 0.3
+ if n_items >= 5:
+ return 0.9
+ return 0.7
+
+
+async def _call_ollama(system: str, user: str,
+ max_tokens: int = 6000,
+ timeout: float = 90.0) -> str:
+ base = os.getenv("OLLAMA_URL", "http://host.docker.internal:11434")
+ model = os.getenv("CMP_LLM_MODEL", "qwen3:30b-a3b")
+ payload = {
+ "model": model, "stream": False, "format": "json",
+ "messages": [{"role": "system", "content": system},
+ {"role": "user", "content": user}],
+ "options": {"temperature": 0.05, "num_predict": max_tokens},
+ }
+ try:
+ async with httpx.AsyncClient(timeout=timeout) as c:
+ r = await c.post(f"{base.rstrip('/')}/api/chat", json=payload)
+ r.raise_for_status()
+ return (r.json().get("message") or {}).get("content", "") or ""
+ except Exception as e:
+ logger.warning("ollama cascade tier 1 failed: %s", e)
+ return ""
+
+
+async def _call_ovh(system: str, user: str, max_tokens: int = 6000) -> str:
+ base = os.getenv("OVH_LLM_URL", "").strip()
+ key = os.getenv("OVH_LLM_KEY", "").strip()
+ model = os.getenv("OVH_LLM_MODEL", "").strip()
+ if not base or not model:
+ return ""
+ headers = {"Content-Type": "application/json"}
+ if key:
+ headers["Authorization"] = f"Bearer {key}"
+ payload = {
+ "model": model, "temperature": 0.05, "max_tokens": max_tokens,
+ "messages": [{"role": "system", "content": system},
+ {"role": "user", "content": user}],
+ "response_format": {"type": "json_object"},
+ }
+ try:
+ async with httpx.AsyncClient(timeout=45.0) as c:
+ r = await c.post(f"{base.rstrip('/')}/v1/chat/completions",
+ json=payload, headers=headers)
+ r.raise_for_status()
+ choice = (r.json().get("choices") or [{}])[0]
+ return (choice.get("message") or {}).get("content", "") or ""
+ except Exception as e:
+ logger.warning("ovh cascade tier 2 failed: %s", e)
+ return ""
+
+
+async def _call_anthropic(system: str, user: str,
+ max_tokens: int = 4000) -> str:
+ key = os.getenv("ANTHROPIC_API_KEY", "").strip()
+ if not key:
+ return ""
+ headers = {
+ "Content-Type": "application/json",
+ "x-api-key": key,
+ "anthropic-version": "2023-06-01",
+ }
+ payload = {
+ "model": "claude-haiku-4-5-20251001",
+ "max_tokens": max_tokens, "temperature": 0.05,
+ "system": system,
+ "messages": [{"role": "user", "content": user}],
+ }
+ try:
+ async with httpx.AsyncClient(timeout=30.0) as c:
+ r = await c.post("https://api.anthropic.com/v1/messages",
+ json=payload, headers=headers)
+ r.raise_for_status()
+ blocks = r.json().get("content") or []
+ return "".join(b.get("text", "") for b in blocks if isinstance(b, dict))
+ except Exception as e:
+ logger.warning("anthropic cascade tier 3 failed: %s", e)
+ return ""
+
+
+async def call_with_cascade(
+ system: str,
+ user: str,
+ min_confidence: float = 0.6,
+ max_tokens: int = 6000,
+) -> dict:
+ """Returns {'text': str, 'confidence': float, 'source': str,
+ 'cached': bool}."""
+ key = _cache_key(system, user)
+ cached = _cache_get(key)
+ if cached:
+ cached["cached"] = True
+ return cached
+
+ input_len = len(user)
+ # Tier 1: Qwen lokal
+ text = await _call_ollama(system, user, max_tokens=max_tokens)
+ conf = _heuristic_confidence(text, input_len)
+ if text and conf >= min_confidence:
+ out = {"text": text, "confidence": conf,
+ "source": "qwen", "cached": False}
+ _cache_put(key, out)
+ return out
+
+ # Tier 2: OVH 120B
+ text2 = await _call_ovh(system, user, max_tokens=max_tokens)
+ conf2 = _heuristic_confidence(text2, input_len)
+ if text2 and conf2 >= min_confidence:
+ out = {"text": text2, "confidence": conf2,
+ "source": "ovh_120b", "cached": False}
+ _cache_put(key, out)
+ return out
+
+ # Tier 3: Anthropic Claude (Notnagel)
+ text3 = await _call_anthropic(system, user, max_tokens=max_tokens // 2)
+ conf3 = _heuristic_confidence(text3, input_len)
+ if text3 and conf3 >= min_confidence:
+ out = {"text": text3, "confidence": conf3,
+ "source": "anthropic_claude", "cached": False}
+ _cache_put(key, out)
+ return out
+
+ # Nichts hat geliefert — beste Variante wenigstens zurueckgeben
+ best_text = text or text2 or text3 or ""
+ best_conf = max(conf, conf2, conf3)
+ best_source = "qwen" if text else ("ovh_120b" if text2 else "anthropic")
+ return {"text": best_text, "confidence": best_conf,
+ "source": best_source, "cached": False,
+ "below_threshold": True}
diff --git a/backend-compliance/compliance/services/reverse_audit.py b/backend-compliance/compliance/services/reverse_audit.py
new file mode 100644
index 00000000..d4f65cad
--- /dev/null
+++ b/backend-compliance/compliance/services/reverse_audit.py
@@ -0,0 +1,173 @@
+"""
+P68 — Reverse-Audit: eigene Templates gegen alle MCs pruefen.
+
+Statt 'gegeben einen Kunden-Text → welche MCs fail' machen wir den
+umgekehrten Test: 'gegeben unseren BreakPilot-Standard-Template-Pool
+(95 Templates) → welche MCs werden NICHT abgedeckt? Wo sind Luecken?'
+
+Liefert einen Coverage-Report:
+ - Total MCs in DB: ~1800
+ - MCs abgedeckt durch min. 1 unserer Templates: X
+ - MCs ohne Coverage: Y (Liste)
+ - Templates ohne MC-Wirkung: Z (Liste)
+
+Zweck: Audit unserer eigenen Code-Base. Wenn ein Customer einen Lauf
+macht und 50 Findings produziert sind, sollten 90%+ davon durch unsere
+Template-Bibliothek korrigierbar sein. Wenn nicht → Templates fehlen.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+
+from sqlalchemy import text as sa_text
+from sqlalchemy.orm import Session
+
+logger = logging.getLogger(__name__)
+
+
+def run_reverse_audit(db: Session) -> dict:
+ """Hauptfunktion. Returns coverage-report dict."""
+ # 1) Alle MCs aus doc_check_controls laden
+ mc_rows = db.execute(sa_text(
+ """
+ SELECT id::text, control_id, doc_type, title, check_question,
+ pass_criteria, severity
+ FROM compliance.doc_check_controls
+ ORDER BY doc_type, severity DESC
+ """
+ )).fetchall()
+
+ # 2) Templates aus DB (doc_templates oder legal_templates oder analog)
+ try:
+ tpl_rows = db.execute(sa_text(
+ """
+ SELECT id::text, doc_type, title, body
+ FROM compliance.doc_templates
+ WHERE active = TRUE
+ """
+ )).fetchall()
+ except Exception:
+ # Fallback auf evtl. andere Template-Tabelle
+ try:
+ tpl_rows = db.execute(sa_text(
+ """
+ SELECT id::text, doc_type, name AS title, content AS body
+ FROM compliance.legal_templates
+ """
+ )).fetchall()
+ except Exception as e:
+ logger.warning("template table not found: %s", e)
+ tpl_rows = []
+
+ # 3) Coverage-Matrix: pro MC, ob ein Template sie abdeckt
+ templates_by_doctype: dict[str, list[dict]] = {}
+ for tid, dt, title, body in tpl_rows:
+ templates_by_doctype.setdefault(dt or "other", []).append({
+ "id": tid, "title": title, "body": (body or "")[:50000],
+ })
+
+ covered_mc_ids: set[str] = set()
+ uncovered: list[dict] = []
+ for mc_id, ctrl_id, dt, title, q, pc, sev in mc_rows:
+ tpls = templates_by_doctype.get(dt or "other") or []
+ if not tpls:
+ uncovered.append({
+ "mc_id": ctrl_id, "doc_type": dt, "title": title,
+ "severity": sev, "reason": "no_template_for_doctype",
+ })
+ continue
+ # Heuristik: pass_criteria sind Pattern. Wenn IRGENDEIN Template
+ # die Pattern enthaelt → covered.
+ criteria = _extract_patterns_from_pc(pc)
+ if not criteria:
+ # ohne klare Pattern: per Title-Keywords pruefen
+ criteria = _title_keywords(title or "")
+ ok = False
+ for tpl in tpls:
+ body = tpl["body"].lower()
+ hits = sum(1 for p in criteria if p and p.lower() in body)
+ if hits >= max(1, len(criteria) // 2):
+ ok = True
+ break
+ if ok:
+ covered_mc_ids.add(mc_id)
+ else:
+ uncovered.append({
+ "mc_id": ctrl_id, "doc_type": dt, "title": title,
+ "severity": sev, "reason": "no_template_match",
+ "criteria_sample": criteria[:5],
+ })
+
+ # 4) Templates ohne MC-Wirkung
+ used_template_ids: set[str] = set()
+ for mc_id, ctrl_id, dt, title, q, pc, sev in mc_rows:
+ if mc_id not in covered_mc_ids:
+ continue
+ tpls = templates_by_doctype.get(dt or "other") or []
+ criteria = _extract_patterns_from_pc(pc) or _title_keywords(title or "")
+ for tpl in tpls:
+ body = tpl["body"].lower()
+ hits = sum(1 for p in criteria if p and p.lower() in body)
+ if hits >= max(1, len(criteria) // 2):
+ used_template_ids.add(tpl["id"])
+ break
+ all_template_ids = {t["id"] for tpls in templates_by_doctype.values()
+ for t in tpls}
+ unused_templates = all_template_ids - used_template_ids
+
+ return {
+ "total_mcs": len(mc_rows),
+ "total_templates": len(all_template_ids),
+ "covered_mcs": len(covered_mc_ids),
+ "uncovered_mcs": len(uncovered),
+ "coverage_pct": round(len(covered_mc_ids) / max(1, len(mc_rows)) * 100, 1),
+ "unused_templates": sorted(unused_templates),
+ "top_uncovered_high": [u for u in uncovered if u.get("severity") == "HIGH"][:30],
+ "by_doctype": _summarize_by_doctype(mc_rows, covered_mc_ids),
+ }
+
+
+def _extract_patterns_from_pc(pc) -> list[str]:
+ """pc ist jsonb mit z.B. {required_phrases: [...]}, {keywords: [...]}"""
+ if not pc:
+ return []
+ if isinstance(pc, str):
+ try:
+ import json as _j
+ pc = _j.loads(pc)
+ except Exception:
+ return [pc[:50]]
+ if isinstance(pc, dict):
+ out: list[str] = []
+ for k in ("required_phrases", "keywords", "must_contain",
+ "patterns", "phrases"):
+ v = pc.get(k)
+ if isinstance(v, list):
+ out.extend([str(x)[:80] for x in v if x])
+ return out
+ if isinstance(pc, list):
+ return [str(x)[:80] for x in pc if x]
+ return []
+
+
+def _title_keywords(title: str) -> list[str]:
+ """Fallback wenn pass_criteria leer: extrahiere Substantive aus Title."""
+ if not title:
+ return []
+ # primitive: alle Worte > 4 Buchstaben
+ return [w for w in re.findall(r"\b\w{5,}\b", title)][:5]
+
+
+def _summarize_by_doctype(mc_rows, covered_mc_ids: set[str]) -> dict:
+ out: dict[str, dict] = {}
+ for mc_id, ctrl_id, dt, title, q, pc, sev in mc_rows:
+ dt = dt or "other"
+ d = out.setdefault(dt, {"total": 0, "covered": 0})
+ d["total"] += 1
+ if mc_id in covered_mc_ids:
+ d["covered"] += 1
+ for dt, d in out.items():
+ d["pct"] = round(d["covered"] / max(1, d["total"]) * 100, 1)
+ return out