2 Commits

Author	SHA1	Message	Date
Benjamin Admin	4e761c1363	feat: #5b materialize capability layer (Modell C) — capabilities.json + cra_core.json ... User-Entscheidung Modell C + objective_tags-Safeguard (Tags, keine Klasse). Deterministisch via materialize_capabilities.py: - obligations/capabilities.json: 5 Capabilities (multi_factor_authentication/session_management/ transport_encryption/code_signing/security_monitoring_alerting), realized_by (n:m) + guidance_basis KANONISCH hochgezogen. access_control gedroppt (OVERLAP). - obligations/cra_core.json: 2 CORE-Sicherheitsziele (attack_surface_minimization (2)(j)/CM-7 + software_integrity_protection (2)(f)/SI-7) -> fuellt den #4-NIST-Gap. - DOMAIN specializes->CORE (remote_access_attack_surface_min, component_remote_interface_security, signed_update_integrity, firmware_software_authentication) + objective_tags. - Merge: vuln_remediation_patching -> deprecated_alias von provide_security_updates. - remote_access_data_export_protection bleibt BEST_PRACTICE (pending Data-Act-Scope). - join_keys 93->95 (core 2). Bidirektional validiert. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-26 00:54:23 +02:00
Benjamin Admin	1584b8fb2f	feat(bridge): remote-access obligation cut (CRA Annex I) — 18 obligations ... - obligations/cra_remote_access.json: 18 (5 LEGAL_MINIMUM outcomes + 13 BEST_PRACTICE), 15 Beziehungen. Two-stage clustering 445->209 micro->27 review-units -> Opus-Synthese. Synthese vergab 14 LM -> key-free re-tier nach Auth-Regel (Mechanismen MFA/Session/VPN/ insecure-protocol/OT/Wartungs-Governance/temp/data-export/component -> BEST_PRACTICE + supports-Kante zur Eltern-LM). out_of_scope M5/M11 = physische Maschinen-Fernsteuerung (MaschinenVO 2023/1230). Anker approximativ (siehe curation.anchor_quality). - obligation_join_keys.json: 66 -> 84 (remote_access 18). - precluster.py: remote_access-Scope. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-25 18:37:10 +02:00