feat(ai-sdk): source_role control-pool (controls != only technical_standard) #38

Merged

Benjamin_Boenisch merged 1 commits from feat/control-role into main 2026-06-24 11:12:22 +00:00

Conversation 0 Commits 1 Files Changed 4

+166 -34

Benjamin_Boenisch commented 2026-06-24 11:07:30 +00:00

Owner

Copy Link

Copy Source

Finalized control-corpus model (User 2026-06-24). Adds source_role (function) orthogonal to source_class (authority). classifyRole derives 7 roles from markers (no re-tag). Control-intent boosts the control-pool (op_req > procedural > control_standard > impl_guidance) over the abstract obligation — CRA Annex I beats NIST for implementation questions, ENISA enters the pool while staying guidance. Step 1/2; searchControls (recall of non-retrieved NIST) = step 2.

Finalized control-corpus model (User 2026-06-24). Adds source_role (function) orthogonal to source_class (authority). classifyRole derives 7 roles from markers (no re-tag). Control-intent boosts the control-pool (op_req > procedural > control_standard > impl_guidance) over the abstract obligation — CRA Annex I beats NIST for implementation questions, ENISA enters the pool while staying guidance. Step 1/2; searchControls (recall of non-retrieved NIST) = step 2.

Benjamin_Boenisch added 1 commit 2026-06-24 11:07:31 +00:00

feat(ai-sdk): source_role control-pool — controls are not only technical_standard ... 659b37cc21

Live gate test showed control-intent (#36/#37) was inert for the EU cyber corpus:
"Welche Controls passen zu Security Updates?" recalls ENISA good-practices
(relevant measures, but source_class=supervisory_guidance) + binding regs, never
NIST — so lifting technical_standard above binding did nothing.

Per the finalized control-corpus model (User 2026-06-24): add source_role
(functional role) ORTHOGONAL to source_class (legal authority). source_class still
decides rank; source_role decides CONTROL-POOL membership. classifyRole derives 7
roles from markers (no re-tagging): obligation / operational_requirement /
procedural_requirement / control_standard / implementation_guidance /
interpretation / definition.

Control-intent now boosts the control-pool (operational/procedural requirement,
control standard, implementation guidance) over the abstract obligation, soft-
ordered op_req > procedural > standard > guidance (controlPoolGain + role bonus) —
replacing "lift technical_standard above binding". So CRA Annex I
(operational_requirement) wins over NIST (control_standard) for "which measures",
and ENISA (implementation_guidance) enters the pool while staying guidance.

Recall of not-retrieved standards (NIST) for generic control queries = next step
(searchControls). Tested: classifyRole table, role-preference, op_req-Top-1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Benjamin_Boenisch merged commit 9cfe6f83b1 into main 2026-06-24 11:12:22 +00:00

Benjamin_Boenisch referenced this issue from a commit 2026-06-24 12:03:51 +00:00

feat(ai-sdk): searchControls — deep dense pull recalls control sources on implementation questions

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

config

Env vars, secrets management, startup validation

data-integrity

Transactions, indexes, pagination

frontend

Next.js, client-side concerns

observability

Logging, audit trails, health checks

reliability

Error handling, retries, circuit breakers

security

Auth, secrets, injection, tenant isolation

severity: critical

System-level risk, data breach or full outage

severity: high

Significant risk, must fix before go-live

severity: medium

Important but not blocking go-live

testing

Test coverage, integration tests

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

sharang (Sharang Parnerkar) Benjamin_Boenisch

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Benjamin_Boenisch/breakpilot-compliance#38