2 Commits

Author	SHA1	Message	Date
Benjamin Admin	d6b8bf87c2	fix: 4 Bugs gemeinsam — B22 PDF + B17 Walk-Fallback + company_name + Plausibility-Fallback ... (1) B22 Cross-Domain (fix #59): Elli-Test fand AGB auf logpay.de NICHT obwohl URL in doc_entries korrekt. Vermutete Ursache: Discovery-Phase A drops/überschreibt Original-URL bei PDF-Fetch-Fail (word_count=0). Fix: _collect_audit_urls() iteriert über state.doc_entries + rejected_url + req.documents — Cross-Domain-Hosting ist unabhängig vom Text-Inhalt. Plus Trace-Logging für künftige Diagnose. Dedup per (doc_type, host_sld). (2) B17 Audit-Walk-Fail-Fallback (fix #60): BMW v5 hatte audit_walk=None ohne Mail-Hinweis. Vermutlich 180s-Timeout bei OneTrust-CMP-Banner-Tour. Fix: Timeout 180s → 300s. Plus: Bei Fail wird ein Hinweis- Stub mit error-Grund in state["audit_walk"] + HTML-Block geschrieben — Reviewer sieht den Fail statt silent-skip. (3) company_name + origin_domain im Backend (fix #61): Frontend sendet seit ec03317 die zwei Felder — Backend ignorierte sie. Fix: ComplianceCheckRequest-Schema um company_name + origin_domain erweitert. phase_e_email priorisiert User-Input vor URL-Heuristik für site_name. Bei origin_domain ohne ableitbare doc_entries-domain wird der User-Input als domain übernommen. (4) Plausibility-LLM Fallback-Modell (fix #62): qwen3:30b-a3b liefert auf großen DSEs (BMW 122 FAIL) gehäuft leere format='json'-Responses — Circuit-Breaker griff aber Phase blieb nutzlos. Fix: Default-Modell auf qwen2.5:7b umgestellt (4× kleiner, zuverlässiger bei format=json, ausreichendes Reasoning für PASS/MODIFY/DROP-Klassifikation). Plus Strategy-C eingeführt — Fallback-Modell (llama3.2:3b) wenn primary leer bleibt. BATCH_SIZE 4 → 3. ENV-Switches PLAUSIBILITY_LLM_MODEL + PLAUSIBILITY_FALLBACK_MODEL für Tuning. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-08 16:39:33 +02:00
Benjamin Admin	c2c8783fee	refactor(agent-check): split routes file (2692→347 LOC) + wire B1/B3/A1 [guardrail-change] ... Phase-5 split of agent_compliance_check_routes.py — the 2700-line monolith was decomposed into 19 modules in compliance/api/agent_check/: - Phase A-F: resolve / profile+check / banner+TCF / vendors raw+finalize / HTML blocks top+mid+bot / email / persist - Helpers: _constants, _helpers, _fetch, _discovery, _single_check - Schemas + State + thin _orchestrator A1 ZIP-Anhang nativ in _phase_e_email: evidence_zip_builder.py bundles slices + manifest.json + audit_metadata.json (SHA256 per slice + build_sha + source_url). smtp_sender.py erweitert um attachments-Parameter. B1 COOKIE-CONSENT-UX-001 (Mobile Reachability): consent_reachability_check.py parses footer anchors, classifies intent (reopen_cmp / info_only / browser_deflect) + target (same_page_cmp / new_tab / external). _b1_wiring.py fetches homepage with iPhone-UA + renders Art-7-Abs-3 severity-coloured block. B3 TH-RETENTION (Cross-Doc Speicherdauer): retention_comparator.py compares DSI claim ↔ cookie-table duration ↔ actual Max-Age/expires with 5% tolerance + severity hierarchy (dsi_under_actual HIGH, table_under_actual HIGH, dsi_vs_table MEDIUM, actual_under_table LOW Safari-ITP-Hint). _b3_wiring.py + Top-10 mismatches table in mail. Side-effects: - Fixed silent UnboundLocalError in original Step 5 (gf_one_pager used audit_quality_findings before declaration, caught by surrounding except → block never rendered). New _phase_d3_blocks_bot.py runs audit-quality FIRST. - agent_compliance_check_routes.py removed from loc-exceptions.txt ("Phase 5 split target" — done). Tests: 55/55 grün (B1 22 + B3 27 + saving_scan 6). E2E: smoke against Elli DSE+Cookie produced HIGH/missing B1 finding, TH-RETENTION table (17 cookies / 3 ✓ / 3 ✗ / 11 ?), evidence-zip with 2 slices + manifest + audit_metadata (12089B, SHA256-chained, source verified), email sent (attachments=1). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-06 14:47:25 +02:00