Benjamin Admin
d987e4fde6
Versioned JSONL store + Go model for Regulation->Control mappings, per the A-decision: the retriever only PROPOSES candidates; the curated mapping is the audited truth the Advisor uses at runtime, never re-invented per query. - ControlMapping struct (source_norm/source_role/target_framework/target_control/ mapping_type/confidence/provenance/rationale/version) - enum validation (rule layer), fail-closed loader, forward+reverse index, curated-only filter (IsCurated) - seed: 2 retriever_candidate rows CRA Annex I -> OWASP ASVS (not yet curated) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
6 lines
1.2 KiB
JSON
6 lines
1.2 KiB
JSON
// Control-Mapping: CRA Annex I -> OWASP ASVS 5.0. Eine Zeile = ein Mapping (Schema: ControlMapping).
|
|
// provenance=retriever_candidate sind Vorschlaege des Control-Intent-Retrievers, NOCH NICHT kuratiert.
|
|
// Erst nach Human/Rule-Review wird provenance=human_curated/rule_based gesetzt (= Audit-Wahrheit).
|
|
{"source_norm":"CRA Annex I Part I (2)(d) — Schutz der Vertraulichkeit / Verschluesselung","source_role":"operational_requirement","target_framework":"OWASP ASVS","target_control":"V11.1.1","mapping_type":"supports","confidence":"medium","provenance":"retriever_candidate","rationale":"CRA-Vertraulichkeits-/Verschluesselungsanforderung deckt sich mit ASVS Cryptographic Inventory and Documentation (V11.1.1). Retriever-Kandidat, Review noetig.","version":"2026-06-25"}
|
|
{"source_norm":"CRA Annex I Part II — Vulnerability Handling","source_role":"operational_requirement","target_framework":"OWASP ASVS","target_control":"V6.2.4","mapping_type":"related","confidence":"low","provenance":"retriever_candidate","rationale":"User-Beispielzeile (Schema-Illustration). Part II ist Prozess-Pflicht (Schwachstellenbehandlung), V6.2.4 ist Passwort-Control — semantisch schwacher Kandidat, klarer Review-Fall.","version":"2026-06-25"}
|