Comparing e50892a2aa..576063515b - breakpilot-compliance - Gitea: Git with a cup of tea

Benjamin_Boenisch/breakpilot-compliance

Author	SHA1	Message	Date
Benjamin Admin	576063515b	feat(ai-sdk): searchControls — deep dense pull recalls control sources on implementation questions CI / detect-changes (pull_request) Successful in 8s Details CI / branch-name (pull_request) Successful in 2s Details CI / guardrail-integrity (pull_request) Successful in 6s Details CI / secret-scan (pull_request) Successful in 8s Details CI / dep-audit (pull_request) Failing after 55s Details CI / sbom-scan (pull_request) Failing after 1m1s Details CI / build-sha-integrity (pull_request) Successful in 11s Details CI / validate-canonical-controls (pull_request) Successful in 5s Details CI / loc-budget (pull_request) Successful in 16s Details CI / go-lint (pull_request) Successful in 50s Details CI / python-lint (pull_request) Failing after 15s Details CI / nodejs-lint (pull_request) Failing after 1m8s Details CI / nodejs-build (pull_request) Successful in 3m1s Details CI / test-go (pull_request) Successful in 59s Details CI / iace-gt-coverage (pull_request) Successful in 15s Details CI / test-python-backend (pull_request) Successful in 27s Details CI / test-python-document-crawler (pull_request) Successful in 13s Details CI / test-python-dsms-gateway (pull_request) Successful in 10s Details Measured (raw dense, top-500, "Welche Controls passen zu Security Updates?"): NIST at dense rank 9 (115 chunks), CRA Annex at rank 8 — both shallow, just below the client's small top-K, so the rank layer (#38) never saw them. OWASP: absent from the corpus (separate ingest). Add searchControls: on an explicit implementation question (queryWantsControls) pull a deep dense pool (depth 60, no filter), classify each hit's role in code, and keep only the four control-pool roles (operational/procedural requirement, control standard, implementation guidance) — no source_role tagging of the corpus. Merge-dedup into the pool; the existing rerank + applyControlRoles then order them (op_req > procedural > standard > guidance). So CRA Annex I (operational_requirement) lands Top-1 and NIST (control_standard) enters Top-3/5, while ENISA stays visible. Norm questions (no control intent) are untouched. Tested: isControlPoolRole, controlRoleOf payload classification (NIST/CRA-Annex/DORA). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-24 14:03:45 +02:00

Diff Content Not Available