'use client' // ETO / Onboarding-Advisor — thin operator surface over POST /api/compliance/onboarding/advisor-start. // Certifications + target + scanner findings -> Silent Pass -> Advisor. NOT the regulation gap engine // (/sdk/gap-analysis is a different flow: product -> applicable regulations). This tests the cert->delta // case: "TISAX/ISO27001 -> CRA, what is auto-detected, what stays an open question?". No new backend. import React, { useEffect, useState } from 'react' const CERTS = ['ISO27001', 'TISAX', 'ISO9001', 'IEC62443', 'ISO13485', 'ISO14001', 'ASPICE', 'IATF16949'] // label -> {signal_id, source_type} — demonstrates all three signal KINDS (observation / partial / requirement) const FINDINGS: Array<{ label: string; signal_id: string; source_type: string; kind: string }> = [ { label: 'SBOM im Repo (CycloneDX/SPDX)', signal_id: 'cyclonedx_found', source_type: 'repository', kind: 'observation' }, { label: 'security.txt / CVD-Policy veröffentlicht', signal_id: 'security_txt', source_type: 'website', kind: 'observation' }, { label: 'Signierte Releases', signal_id: 'signed_releases', source_type: 'repository', kind: 'observation' }, { label: 'Produkt-Risikobewertung (Dokument)', signal_id: 'risk_assessment_pdf', source_type: 'document', kind: 'observation' }, { label: 'CI-Pipeline vorhanden (nur Indikation)', signal_id: 'github_actions_ci', source_type: 'repository', kind: 'partial' }, { label: 'Cloud-/vernetztes Produkt', signal_id: 'cloud_hosted', source_type: 'product', kind: 'observation' }, { label: 'Ausschreibung FORDERT SBOM (Requirement)', signal_id: 'requires_sbom', source_type: 'tender', kind: 'requirement' }, { label: 'OEM FORDERT PSIRT (Requirement)', signal_id: 'supplier_requires_psirt', source_type: 'oem', kind: 'requirement' }, ] interface Question { capability_id: string; question_intent: string; why: string; information_value: number; priority: string } interface Inferred { certification: string; capabilities: string[]; statement: string } interface Rejected { certification?: string; statement: string; reason: string } interface Measure { capability_id: string; leverage: number; closes: string[] } interface AdvisorResponse { silent_intake_summary: string; headline: string; auto_detected: string[]; indications: string[] inferred_assumptions: Inferred[]; rejected_assumptions: Rejected[]; top_5_questions: Question[] capability_delta: string[]; top_measures: Measure[]; evidence_requests: string[] unsupported_domains: string[]; completeness_summary: string } const PROXY = '/api/sdk/v1/compliance/onboarding' function Chips({ items, tone }: { items: string[]; tone: string }) { if (!items.length) return — return (
{hint}
}Zertifikate + Ziel + Scanner-Signale → Silent Pass → Capability-Delta + nächste beste Fragen. Welt-1: ein Zertifikat legt nahe, beweist nichts (Verifikation erforderlich).