e6201d5239
Implement full evidence integrity pipeline to prevent compliance theater: - Confidence levels (E0-E4), truth status tracking, assertion engine - Four-Eyes approval workflow, audit trail, reject endpoint - Evidence distribution dashboard, LLM audit routes - Traceability matrix (backend endpoint + Compliance Hub UI tab) - Anti-fake badges, control status machine, normative patterns - 2 migrations, 4 test suites, MkDocs documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
109 lines
3.1 KiB
Markdown
109 lines
3.1 KiB
Markdown
# Nachweise / Evidence (CP-NAC)
|
||
|
||
Verknüpft Prüfnachweise mit Controls. Unterstützt manuelle Uploads sowie CI/CD-Automatisierung.
|
||
|
||
**Prefix:** `CP-NAC` · **Frontend:** `https://macmini:3007/sdk/evidence`
|
||
**Proxy:** `/api/sdk/v1/compliance/[[...path]]` → `backend-compliance:8002/compliance/...`
|
||
|
||
---
|
||
|
||
## Features
|
||
|
||
- Manuelle Nachweis-Uploads (PDF, ZIP, ...)
|
||
- CI/CD-Integration: Nachweise automatisch via Pipeline erfassen
|
||
- Automatischer Control-Status-Update nach Nachweis-Ingest (`AutoRiskUpdater`)
|
||
- CI-Nachweisstand-Abfrage pro Control
|
||
|
||
---
|
||
|
||
## Nachweistypen
|
||
|
||
`test_results` · `audit_report` · `penetration_test` · `sast` · `dependency_scan` · `sbom` · `container_scan` · `secret_scan` · `code_review`
|
||
|
||
---
|
||
|
||
## Rechtsgrundlage
|
||
|
||
| Artikel | Bezug |
|
||
|---------|-------|
|
||
| Art. 5 Abs. 2 DSGVO | Rechenschaftspflicht |
|
||
| Art. 24 DSGVO | Nachweis der Compliance |
|
||
| Art. 32 DSGVO | Sicherheitsmaßnahmen dokumentieren |
|
||
|
||
---
|
||
|
||
## API Endpoints
|
||
|
||
| Methode | Pfad | Beschreibung |
|
||
|---------|------|--------------|
|
||
| `GET` | `/evidence` | Liste (`control_id`, `evidence_type`, `status`, `page`, `limit`) |
|
||
| `POST` | `/evidence` | Nachweis manuell anlegen |
|
||
| `DELETE` | `/evidence/{id}` | Nachweis löschen |
|
||
| `POST` | `/evidence/upload` | Datei hochladen (PDF, ZIP, ...) |
|
||
| `POST` | `/evidence/collect` | CI/CD-Nachweis automatisch erfassen |
|
||
| `GET` | `/evidence/ci-status` | CI-Nachweisstand für eine Kontrolle |
|
||
|
||
### CI/CD-Integration
|
||
|
||
```json
|
||
POST /evidence/collect
|
||
{
|
||
"control_id": "SDLC-001",
|
||
"evidence_type": "test_results",
|
||
"title": "Pytest Run 2026-03-05",
|
||
"ci_job_id": "gh-actions-12345",
|
||
"artifact_url": "https://github.com/.../artifacts/report.xml"
|
||
}
|
||
```
|
||
|
||
Nach dem Collect wird automatisch der Control-Status aktualisiert (`AutoRiskUpdater`).
|
||
|
||
---
|
||
|
||
## Frontend
|
||
|
||
**URL:** `https://macmini:3007/sdk/evidence`
|
||
|
||
Tabelle mit Nachweis-Einträgen, filterbar nach Control und Typ. Upload-Button für manuelle Nachweise. CI-Status-Badge zeigt automatisierungsgrad pro Control.
|
||
|
||
---
|
||
|
||
## Datenbankschema
|
||
|
||
```sql
|
||
compliance_evidence (
|
||
id UUID PRIMARY KEY,
|
||
control_id VARCHAR REFERENCES compliance_controls(control_id),
|
||
evidence_type VARCHAR, -- test_results/audit_report/...
|
||
title TEXT,
|
||
description TEXT,
|
||
artifact_path TEXT,
|
||
artifact_url TEXT,
|
||
ci_job_id VARCHAR,
|
||
status VARCHAR DEFAULT 'pending',
|
||
collected_at TIMESTAMP,
|
||
created_at TIMESTAMP
|
||
)
|
||
```
|
||
|
||
---
|
||
|
||
## Anti-Fake-Evidence
|
||
|
||
Seit Phase 1 (2026-03-23) werden Nachweise automatisch mit **Confidence Levels** (E0–E4) und **Truth Status** klassifiziert. Details: [Anti-Fake-Evidence Architektur](anti-fake-evidence.md)
|
||
|
||
---
|
||
|
||
## Tests
|
||
|
||
**Testdatei:** `backend-compliance/tests/test_evidence_routes.py`
|
||
**Anzahl Tests:** 11 · **Status:** ✅ alle bestanden (Stand 2026-03-05)
|
||
|
||
**Anti-Fake-Evidence Tests:** `backend-compliance/tests/test_anti_fake_evidence.py`
|
||
**Anzahl Tests:** ~45 · Confidence-Klassifikation, State Machine, Multi-Score, LLM Audit
|
||
|
||
```bash
|
||
cd backend-compliance
|
||
python3 -m pytest tests/test_evidence_routes.py tests/test_anti_fake_evidence.py -v
|
||
```
|