Benjamin Admin
77459d06d6
Two reviewed knowledge decisions (2026-06-28) + the deferred cosmetic counter, before #59. 1. ISO13485 removed from the incident_management hypothesis. ISO 13485 CAPA / quality-safety incident handling is NOT security incident management — the mapping was too broad and would seed false hypotheses for the empirical loop. A dedicated manage_quality_and_safety_incidents capability can come later IF a target needs it; not forced now. (ISO27001/TISAX/IEC62443 keep incident_management.) 2. patch_policy_doc -> secure_signed_update_distribution stays `partial`, but the curated rationale is sharpened: "indicates update governance, does not evidence signed distribution" (a patch policy is not proof of SIGNED distribution). New optional SignalMapping.rationale field carries the curated note. (github_actions_ci -> SDL and dependency_scanning -> vuln-mgmt reviewed and APPROVED as-is.) 3. Cosmetic (folded in since we touched the file): the silent-intake summary now counts detected and indications SEPARATELY ("N automatisch erkannt, M Indikation(en)") instead of lumping partial signals into "automatisch erkannt" — consistent with the three-state model just shipped. Tests: ISO13485 no longer resolves to incident_management; summary counts split correctly. 29 onboarding tests pass, mypy --strict clean, demo runs, check-loc 0. Runtime-visible (hypothesis resolution + summary text) -> deploy + smoke.
102 lines
5.6 KiB
Python
102 lines
5.6 KiB
Python
"""Silent Knowledge Pass — recognise before asking (Phase 0).
|
|
|
|
Pins the deterministic signal->capability/product-fact mapping and the product effect that matters: when
|
|
the Silent Pass feeds detected capabilities into the Advisor, the delta shrinks and the number of
|
|
next-best questions DROPS — "we already recognised X, only these few remain" instead of a question wall.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
import yaml
|
|
|
|
from compliance.onboarding import (
|
|
IntakeSignal,
|
|
OnboardingInput,
|
|
SignalMapping,
|
|
advisor_start,
|
|
resolve_for_certifications,
|
|
silent_intake,
|
|
)
|
|
from compliance.onboarding import CapabilityHypothesis
|
|
from compliance.transition_reasoning import TargetRequirement
|
|
|
|
_DIR = os.path.dirname(__file__)
|
|
_MAP = [SignalMapping(**m) for m in yaml.safe_load(
|
|
open(os.path.join(_DIR, "..", "knowledge", "onboarding", "intake_signal_map.yaml"), encoding="utf-8"))["mappings"]]
|
|
_LIB = [CapabilityHypothesis(**h) for h in yaml.safe_load(
|
|
open(os.path.join(_DIR, "..", "knowledge", "certification_hypotheses", "hypotheses.yaml"), encoding="utf-8"))["hypotheses"]]
|
|
_CRA = yaml.safe_load(open(os.path.join(_DIR, "..", "knowledge", "transition_patterns",
|
|
"transition_pattern_iso27001_to_cra_maschinenvo_v1.yaml"), encoding="utf-8"))
|
|
_REQ = [TargetRequirement(capability_id=a["capability"]) for a in _CRA["likely_covered"]]
|
|
_REQ += [TargetRequirement(capability_id=d["capability"], expected_evidence=d.get("expected_evidence", []))
|
|
for d in _CRA["delta_requirements"]]
|
|
|
|
# scanner findings (injected): a machine builder with a public CVD policy, an SBOM + signed releases in
|
|
# the repo, a product risk-assessment doc, and a cloud-connected PLC product.
|
|
_SIGNALS = [
|
|
IntakeSignal(source="website", signal="cvd_policy_present", detail="/.well-known/security.txt"),
|
|
IntakeSignal(source="repository", signal="sbom_present", detail="sbom.cdx.json"),
|
|
IntakeSignal(source="repository", signal="signed_releases"),
|
|
IntakeSignal(source="document", signal="product_risk_assessment_doc"),
|
|
IntakeSignal(source="product", signal="cloud_connectivity"),
|
|
IntakeSignal(source="product", signal="plc_sps"),
|
|
]
|
|
|
|
|
|
def test_silent_intake_is_deterministic_signal_mapping():
|
|
res = silent_intake(_SIGNALS, _MAP)
|
|
caps = set(res.capability_ids())
|
|
assert {"coordinated_vulnerability_disclosure", "sbom_creation", "secure_signed_update_distribution",
|
|
"product_cyber_risk_assessment"} <= caps
|
|
assert "sbom" in res.evidence_found # evidence already in hand -> no upload needed
|
|
facts = {f.key for f in res.product_facts}
|
|
assert "connected_to_internet" in facts and "is_machine" in facts
|
|
|
|
|
|
def test_silent_pass_reduces_the_questions():
|
|
inp = OnboardingInput(company="x", certifications=["ISO27001", "ISO9001"], target=["CRA"])
|
|
hyp = resolve_for_certifications(inp.certifications, _LIB)
|
|
without = advisor_start(inp, hyp, _REQ, target_id="CRA", corpus_status={"CRA": "validated"})
|
|
detected = silent_intake(_SIGNALS, _MAP).capability_ids()
|
|
with_pass = advisor_start(inp, hyp, _REQ, target_id="CRA", corpus_status={"CRA": "validated"},
|
|
detected_capabilities=detected)
|
|
# the whole point: recognising things automatically leaves FEWER open questions
|
|
assert len(with_pass.capability_delta) < len(without.capability_delta)
|
|
assert len(with_pass.next_best_questions) <= len(without.next_best_questions)
|
|
assert with_pass.auto_detected # recognised without asking
|
|
assert "automatisch erkannt (Intake)" in with_pass.headline
|
|
|
|
|
|
def test_detected_capabilities_are_not_asked_again():
|
|
inp = OnboardingInput(company="x", certifications=["ISO27001"], target=["CRA"])
|
|
hyp = resolve_for_certifications(inp.certifications, _LIB)
|
|
detected = silent_intake(_SIGNALS, _MAP).capability_ids()
|
|
res = advisor_start(inp, hyp, _REQ, target_id="CRA", corpus_status={"CRA": "validated"},
|
|
detected_capabilities=detected)
|
|
asked = {q.capability_id for q in res.next_best_questions}
|
|
assert "sbom_creation" not in asked and "sbom_creation" not in res.capability_delta
|
|
|
|
|
|
def test_partial_signal_is_indicative_not_detected():
|
|
# a PARTIAL signal (CI present -> secure dev lifecycle) raises assumption strength but is NOT a
|
|
# detected capability: it must NOT shrink the delta the way a concrete artifact does.
|
|
res = silent_intake([IntakeSignal(source="repository", signal="github_actions_ci")], _MAP)
|
|
assert "secure_development_lifecycle" not in res.capability_ids() # not counted as present
|
|
assert res.indicative_capability_ids() == ["secure_development_lifecycle"] # surfaced as an indication
|
|
# the summary counts detected and indications SEPARATELY (no over-claim of "automatisch erkannt")
|
|
assert "0 Fähigkeit(en) automatisch erkannt, 1 Indikation(en)" in res.summary
|
|
|
|
|
|
def test_partial_indication_does_not_remove_the_question():
|
|
inp = OnboardingInput(company="x", certifications=["ISO27001"], target=["CRA"])
|
|
hyp = resolve_for_certifications(inp.certifications, _LIB)
|
|
si = silent_intake([IntakeSignal(source="repository", signal="github_actions_ci")], _MAP)
|
|
res = advisor_start(inp, hyp, _REQ, target_id="CRA", corpus_status={"CRA": "validated"},
|
|
detected_capabilities=si.capability_ids(),
|
|
indicative_capabilities=si.indicative_capability_ids())
|
|
assert "secure_development_lifecycle" not in res.auto_detected # partial != detected
|
|
assert "secure_development_lifecycle" in res.indications # strength shown
|
|
assert "secure_development_lifecycle" in res.capability_delta # gap still open / asked
|