feat(ai-sdk): searchControls — recall control sources (NIST/CRA-Annex) on implementation questions #39

Merged

Benjamin_Boenisch merged 1 commits from feat/control-recall into main 2026-06-24 12:08:31 +00:00

Conversation 0 Commits 1 Files Changed 4

+95

Benjamin_Boenisch commented 2026-06-24 12:03:50 +00:00

Owner

Copy Link

Copy Source

Stage 2. Measured NIST at dense rank 9 / CRA Annex rank 8 (shallow, below the small top-K). searchControls: on queryWantsControls, deep dense pull (depth 60, no filter) + in-code classifyRole, keep only control-pool roles, merge-dedup. Existing applyControlRoles orders them → CRA Annex I (op_req) Top-1, NIST (control_standard) Top-3/5, ENISA visible. Norm questions untouched. OWASP absent from corpus → separate StandardIngester ingest.

Stage 2. Measured NIST at dense rank 9 / CRA Annex rank 8 (shallow, below the small top-K). searchControls: on queryWantsControls, deep dense pull (depth 60, no filter) + in-code classifyRole, keep only control-pool roles, merge-dedup. Existing applyControlRoles orders them → CRA Annex I (op_req) Top-1, NIST (control_standard) Top-3/5, ENISA visible. Norm questions untouched. OWASP absent from corpus → separate StandardIngester ingest.

Benjamin_Boenisch added 1 commit 2026-06-24 12:03:52 +00:00

feat(ai-sdk): searchControls — deep dense pull recalls control sources on implementation questions ... 576063515b

Measured (raw dense, top-500, "Welche Controls passen zu Security Updates?"):
NIST at dense rank 9 (115 chunks), CRA Annex at rank 8 — both shallow, just below
the client's small top-K, so the rank layer (#38) never saw them. OWASP: absent from
the corpus (separate ingest).

Add searchControls: on an explicit implementation question (queryWantsControls) pull a
deep dense pool (depth 60, no filter), classify each hit's role in code, and keep only
the four control-pool roles (operational/procedural requirement, control standard,
implementation guidance) — no source_role tagging of the corpus. Merge-dedup into the
pool; the existing rerank + applyControlRoles then order them (op_req > procedural >
standard > guidance). So CRA Annex I (operational_requirement) lands Top-1 and NIST
(control_standard) enters Top-3/5, while ENISA stays visible. Norm questions (no control
intent) are untouched.

Tested: isControlPoolRole, controlRoleOf payload classification (NIST/CRA-Annex/DORA).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Benjamin_Boenisch merged commit e50892a2aa into main 2026-06-24 12:08:31 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

config

Env vars, secrets management, startup validation

data-integrity

Transactions, indexes, pagination

frontend

Next.js, client-side concerns

observability

Logging, audit trails, health checks

reliability

Error handling, retries, circuit breakers

security

Auth, secrets, injection, tenant isolation

severity: critical

System-level risk, data breach or full outage

severity: high

Significant risk, must fix before go-live

severity: medium

Important but not blocking go-live

testing

Test coverage, integration tests

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

sharang (Sharang Parnerkar) Benjamin_Boenisch

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Benjamin_Boenisch/breakpilot-compliance#39