breakpilot-compliance

Author	SHA1	Message	Date
Benjamin Admin	9e0a9ccef4	Add obligation_id join-key contract (cross-session bridge) CI / detect-changes (push) Successful in 5s Details CI / branch-name (push) Has been skipped Details CI / guardrail-integrity (push) Has been skipped Details CI / secret-scan (push) Has been skipped Details CI / dep-audit (push) Has been skipped Details CI / sbom-scan (push) Has been skipped Details CI / build-sha-integrity (push) Successful in 8s Details CI / validate-canonical-controls (push) Successful in 7s Details CI / loc-budget (push) Successful in 19s Details CI / go-lint (push) Has been skipped Details CI / python-lint (push) Has been skipped Details CI / nodejs-lint (push) Has been skipped Details CI / nodejs-build (push) Has been skipped Details CI / test-go (push) Has been skipped Details CI / iace-gt-coverage (push) Has been skipped Details CI / test-python-backend (push) Has been skipped Details CI / test-python-document-crawler (push) Has been skipped Details CI / test-python-dsms-gateway (push) Has been skipped Details Macht meine Seite des Cross-Session-Vertrags konkret: obligation_id ist der stabile Join-Key zwischen Legal Knowledge Graph (citation_spans -> obligation_id) und Compliance Execution Graph (control_mapping.source_norm -> obligation_id). Export aller 47 obligation_ids (CRA: 11 sbom + 7 vuln + 29 auth) mit citation_units als Interim-Brücke. Disziplin: obligation_id nie neu vergeben (re-link, Pendant zu span_id/control_uuid). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-25 10:29:29 +02:00
Benjamin Admin	e5cce9caff	Extend advisor proof with procedure→evidence chain Vollständige Begründungskette aus der Registry: Rechtsgrundlage → Obligation → Procedure → Controls → Evidence → Antwort. Join cra.json × cra_procedures.json, deterministisch, kein LLM. SBOM-Beweis: 7 Pflichten je mit CRA-Rechtsgrundlage + Procedure (wie umgesetzt) + Controls (Prüfung) + aggregierte Required Evidence; 4 Best-Practice (Guidance OWASP/NIST/ENISA); Beziehung sbom_*→supports→vuln_identification; citation 7/7 pending_span_anchor. Der Unterschied zu RAG sichtbar: RAG beantwortet — BreakPilot begründet UND operationalisiert. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-25 09:44:27 +02:00
Benjamin Admin	db2fd9d8e9	Add obligation advisor proof (P3) Demonstriert den Produktnutzen der Registry: obligation-basierte Antwort statt RAG-Text. Frage → Pflicht (LEGAL_MINIMUM + Rechtsgrundlage + Applicability) ⊥ Best Practice (guidance_basis) ⊥ Nachweise (evidence_facets + member controls) + Beziehungen, deterministisch aus obligations/cra.json (kein LLM, zitierfähig). Beleg (SBOM, Maschinenbauer): JA — 7 CRA-Mindestpflichten + 4 Best-Practice (OWASP/NIST/ENISA); sbom_* supports vuln_identification_inventory. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-25 09:06:34 +02:00
Benjamin Admin	e1b270c36e	Add obligation discovery pipeline tooling Sichert die validierte Obligation Discovery Pipeline aus /tmp als dauerhaftes, committetes Tooling (scripts/obligation_discovery/) — der eigentliche Vermögenswert. Stufen: precluster (Embedding-Cache + Mikro-Cluster) → meta_cluster (Review Units, Skalierungs-Fix) → synthesize_obligations (Opus, Key aus ENV, Streaming, harte Tier-Regel, Provenance) → validate_registry → merge_review_diff. Reine Helfer in _core.py, 16 Unit-Tests. Doku docs-src/development/obligation_discovery_pipeline_v1.md mit Meilensteinen (SBOM/Vuln reproduziert, Auth 4408→170 Review Units→54→kuriert 29) und der Architekturregel: Runtime deterministisch, Discovery LLM-gestützt. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-25 07:41:45 +02:00

4 Commits