Benjamin_Boenisch/breakpilot-compliance
1
1
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(knowledge): Reference Transition Scenarios (RTS-001..003) + ISO9001->CRA pattern

Browse Source 
Three ANONYMIZED reference transition scenarios (no real company names stored) = canonical
regression scenarios that test the KNOWLEDGE, not just the engine. Each pins an Expected
Outcome (expected_likely_covered + expected_delta); every commit must reproduce it (identical
or better).

- RTS-001 automotive supplier (TISAX+ISO27001) -> CRA: mature ISMS, standard CRA delta.
- RTS-002 classic machine builder (ISO9001) -> CRA: only process discipline -> MUCH larger delta
  (10 missing vs 3 covered). New TP-ISO9001-CRA-v1 pattern (different shape).
- RTS-003 networked machine builder (ISMS) -> CRA: highlights the Data Act.

Data Act is modelled as UNCERTAIN (a hypothesis), never a fixed gilt/gilt-nicht: the generator
checks the engine SURFACES the uncertainty + the deciding question (generates_usage_data) and
never wrongly ASSERTS applicability. All three RTS PASS.

Non-runtime knowledge + reference harness -> no deploy (ADR-001). Names deliberately absent.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-06-27 08:46:20 +02:00
parent 5412864705
commit f78e03bd0a
6 changed files with 349 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend-compliance/reference_scenarios/reference_scenario_suite_v1.md
+39 -2
View File
@@ -161,14 +161,51 @@ _Genericity-Beweis: derselbe Algorithmus trägt jeden Transition Knowledge Patte
- vermutlich abgedeckt: incident_management, technical_vulnerability_management, supplier_security, access_control_and_authentication, cryptography, security_logging_and_monitoring, secure_development_lifecycle, asset_and_configuration_management
- Pattern getragen: **ja** (17 caps → 17 coverage + 17 requests)
**ISO 9001 → Cyber Resilience Act** _(TP-ISO9001-CRA-v1, status=draft)_
> 13 zu klären, 0 bereits abgedeckt, 3 vermutlich vorhanden, 10 fehlt, 0 n/a, 0 nicht im Korpus.
- Delta zuerst (HIGH): access_control_and_authentication, ce_conformity_assessment_and_technical_documentation, coordinated_vulnerability_disclosure, exploited_vuln_and_incident_reporting, product_cyber_risk_assessment, sbom_creation, secure_development_lifecycle, secure_signed_update_distribution, security_update_support_period, technical_vulnerability_management
- vermutlich abgedeckt: document_and_change_control, supplier_evaluation, release_and_approval_process
- Pattern getragen: **ja** (13 caps → 13 coverage + 13 requests)
**Architecture Coverage**
| Layer | Status | Hinweis |
|---|---|---|
| Transition ISOIEC27001→TISAX | **PASS** | draft · 5 HIGH-Delta + 8 zu bestätigen |
| Transition ISOIEC27001→Cyber Resilience Act | **PASS** | reviewed · 9 HIGH-Delta + 8 zu bestätigen |
| Transition ISO9001→Cyber Resilience Act | **PASS** | draft · 10 HIGH-Delta + 3 zu bestätigen |
| RS-005.1 Renderer (Fragetext) | **TODO** | verschoben — Engine liefert nur Requests |
## Reference Transition Scenarios (RTS) — kanonische Regression (Soll/Ist)
_Anonymisierte Archetypen (KEINE Firmennamen). Jeder RTS pinnt ein Expected Outcome; jeder Commit muss es reproduzieren (identisch oder besser). Data Act = `uncertain`, nie fix „gilt/gilt-nicht"._
**RTS-001** — Automotive supplier with a mature ISMS — embedded electronics + software, CE products, OEM supply chain
> Start TISAX+ISO27001 → CRA. 17 zu klären, 0 bereits abgedeckt, 8 vermutlich vorhanden, 9 fehlt, 0 n/a, 0 nicht im Korpus.
- Expected Delta erfüllt: **ja** (7/7 Soll-Delta in der Ist-Lücke)
- Expected likely_covered erfüllt: **ja**
- Data Act: Engine sagt **uncertain** (Soll: uncertain; nie asserted) → ok
**RTS-002** — Classic machine builder with only a QMS — precision systems, CE products, no ISMS
> Start ISO9001 → CRA. 13 zu klären, 0 bereits abgedeckt, 3 vermutlich vorhanden, 10 fehlt, 0 n/a, 0 nicht im Korpus.
- Expected Delta erfüllt: **ja** (9/9 Soll-Delta in der Ist-Lücke)
- Expected likely_covered erfüllt: **ja**
- Data Act: Engine sagt **uncertain** (Soll: uncertain; nie asserted) → ok
**RTS-003** — Machine builder with an ISMS and networked products — connected machines that may generate usage data
> Start ISO27001 → CRA. 17 zu klären, 0 bereits abgedeckt, 8 vermutlich vorhanden, 9 fehlt, 0 n/a, 0 nicht im Korpus.
- Expected Delta erfüllt: **ja** (7/7 Soll-Delta in der Ist-Lücke)
- Expected likely_covered erfüllt: **ja**
- Data Act: Engine sagt **uncertain** (Soll: uncertain; nie asserted) → ok
**Architecture Coverage**
| Layer | Status | Hinweis |
|---|---|---|
| RTS-001 (TISAX→CRA) | **PASS** | 7/7 Delta-Soll · likely_covered ok · DataAct=uncertain |
| RTS-002 (ISO9001→CRA) | **PASS** | 9/9 Delta-Soll · likely_covered ok · DataAct=uncertain |
| RTS-003 (ISO27001→CRA) | **PASS** | 7/7 Delta-Soll · likely_covered ok · DataAct=uncertain |
## Gaps → Epics (Backlog — nur erfasst, NICHT implementiert)
| Epic | Titel | schliesst Coverage-Luecke |
@@ -180,6 +217,6 @@ _Genericity-Beweis: derselbe Algorithmus trägt jeden Transition Knowledge Patte
## Suite-Status (Roll-up)
- Coverage-Zellen gesamt: **23**
- PASS: **15** · PARTIAL: 3 · UNSUPPORTED: 1 · TODO: 3 · N/A: 1 · NEEDS_FACTS: 0
- Coverage-Zellen gesamt: **27**
- PASS: **19** · PARTIAL: 3 · UNSUPPORTED: 1 · TODO: 3 · N/A: 1 · NEEDS_FACTS: 0
- Fortschritt = PASS-Anteil steigt, wenn Epics RS-001…004 landen (objektiver Maßstab, kein LOC).