Evaluation follow-ups #2: SoA evidence linkage, whiteboard field-merge, screen splits - #25
Merged
Merged
Conversation
The SoA previously started every control blank. Now the ~20 ISO 27001 Annex A controls that the Atlas platform satisfies by construction carry a standing evidence note mapped to the concrete mechanism — RBAC → A.5.15/A.5.18/A.8.3, append-only audit log → A.8.15, backups → A.8.13, OpenTelemetry → A.8.16, CI SAST/SCA/DAST → A.8.8/A.8.25/A.8.28/A.8.29, secret redaction → A.8.11, TLS/CSP → A.8.20/A.8.24, Entra SSO → A.5.16/A.5.17/A.8.5 — so a review starts from what the product provides. - server/Soa.cs: PlatformEvidence map; GET attaches per-control autoEvidence + an autoEvidenced coverage count; PUT echoes it. - web: a "Platform-evidenced" KPI + a per-row evidence chip. - tests: assert the evidence surfaces (>=15), a known control (A.8.15 → audit log) carries it, and a control with no platform mechanism (A.7.1) does not. - ADR-0066 updated (this was previously listed as a gap there). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F1g44VLAeYdf3FAoXsXRu7
Evaluated a full CRDT/OT upgrade and declined it as disproportionate for a bounded brainstorming canvas (heavy dep, would replace the typed rows with an opaque CRDT doc + binary protocol, for a sub-RTT same-field race that already self-heals). Implemented the proportionate step instead: field-level merge. - Co-editing node ops now send only the changed properties (WbNodePatch): a move sends geometry, a recolour sends the colour, a text edit sends the text. The server merges per field onto the existing row, so two people editing different aspects of one node (A moves, B recolours) both survive — no cross-field last-write-wins clobber. Create still sends a full node; only same-field edits remain LWW. - server/Whiteboards.cs: WbNodePatch + merge-on-existing node upsert (backward compatible — a full-node body still creates/replaces). - web: patchNode() for move/resize/recolour/text/keyboard-nudge. - tests: color-only then move-only patches both persist and don't revert each other or the untouched size (444 API, 111 web green). - ADR-0064 updated (convergence addendum + consequence). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F1g44VLAeYdf3FAoXsXRu7
…ce out of Admin.tsx Continues the ADR-0041 large-screen decomposition to the two biggest remaining screens. - Project.tsx (1617 → 1361): the Governance tab (stage-gate rail, review checkpoints, decision log + its modals) moves to project/Governance.tsx; Project.tsx imports it. - Admin.tsx (1177 → 897): the data-governance sections (database- password rotation, GDPR data-subject rights + retention, Backups & restore) move to admin/DataGovernance.tsx; the shared section styles (GRADIENT, sectionTitle/Sub, colHeadStyle) move to admin/styles.ts so both files share one source. Pure move — no behaviour change. Build + lint clean; 111 web tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F1g44VLAeYdf3FAoXsXRu7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the three remaining gap-items from the evaluation.
1 — SoA automated per-control evidence linkage (was: "per-control automated evidence linkage… remain")
The ~20 ISO 27001 Annex A controls the Atlas platform satisfies by construction now carry a standing evidence note mapped to the concrete mechanism — RBAC → A.5.15/A.5.18/A.8.3, append-only audit log → A.8.15, backups → A.8.13, OpenTelemetry → A.8.16, CI SAST/SCA/DAST → A.8.8/A.8.25/A.8.28/A.8.29, secret redaction → A.8.11, TLS/CSP → A.8.20/A.8.24, Entra SSO → A.5.16/A.5.17/A.8.5 — so a SoA review starts from what the product provides, not a blank sheet. New
autoEvidencedcoverage KPI + a per-row chip. (SoAs for other frameworks generalise on the same row model — a data-addition, noted as a follow-up in ADR-0066.)2 — Whiteboard field-level merge (the CRDT/OT question)
Evaluated a full CRDT/OT upgrade and declined it as disproportionate (heavy dep, would replace the typed rows with an opaque CRDT doc + binary protocol, for a sub-RTT same-field race that already self-heals). Implemented the proportionate step: field-level merge. Co-editing node ops now send only the changed properties (
WbNodePatch); the server merges per field, so two people editing different aspects of one node (A moves, B recolours) both survive. Only same-field edits stay LWW. Backward compatible; create still sends a full node.3 — Split the two largest screens (was: "Project.tsx / Admin.tsx remain large-component candidates")
ADR-0041 decomposition continued: Project.tsx 1617 → 1361 (Governance tab →
project/Governance.tsx) and Admin.tsx 1177 → 897 (data-governance sections →admin/DataGovernance.tsx; shared styles →admin/styles.ts). Pure moves, no behaviour change.Verification
🤖 Generated with Claude Code
https://claude.ai/code/session_01F1g44VLAeYdf3FAoXsXRu7
Generated by Claude Code