[0b3l1X-SolidGeeks]

What this changes

Everything tried on the test artifact since 0.9.0, then the version set to 0.10.0. Commit by commit:

• Risk register (a new Risks view of an IS, and Risks on every asset sheet):

  • Threats per asset: 30 threats, with their MITRE ATT&CK techniques, ENISA families and EBIOS RM risk sources, apply to an asset from its type, exposure, criticality, ports, system, vulnerabilities and role.
  • Risk matrix: each risk sits on a configurable matrix (3×3 to 5×5) before requirements, with those applied, and once the planned ones are applied too. The acceptance threshold is set per criticality, and an asset can have its own.
  • Baselines: for each risk, requirements from ANSSI (42 measures), NIST CSF 2.0, CIS Controls v8.1 or ISO 27001 Annex A are marked applied, planned or not applicable. CIS and ISO come as numbering and paraphrased titles only. Custom baselines import from JSON or CSV.
  • Decision per risk: treat, accept, transfer or avoid.
  • Storage: settings are a new shared document risk (PUT /api/risk, approvers), kept in the history, proposals, export and import. Treatments are saved on the asset (risk), and the IS landscape on the IS (landscape).

• Overlapping requirements merged (Risks › Baselines, large view). One requirement per group is kept, chosen by a criterion (most demanding, widest coverage, best fit for the map, preferred baseline) or by hand.

• Logs for the SIEM, per asset and as an onboarding plan for the IS:

  • the sources the asset has (19 kinds) and the events of its threats;
  • the verbosity its residual risk calls for, and how long to keep the logs.

• The 2D plan of an asset lists the requirements against its risks, by baseline, under its firewall rules.

• Dashboard and KPIs for a steering committee, measured on the server from the history (GET /api/kpi):

  • exposure;
  • age of open vulnerabilities against remediation deadlines;
  • owner coverage and scan coverage.

  It covers 12 weeks, 6 months or 12 months, prints to PDF and exports as CSV.

• On the map:

  • a click on a plate shows its VLAN alone;
  • selecting an asset zooms on it and highlights it;
  • a click on an empty space zooms back out.

• Performance: the 3D model is no longer drawn under a lens or the 2D diagram.

• Release 0.10.0:

  • package.json, docker-compose.yml, the interface and the docs footers;
  • the dated CHANGELOG section, the README (roadmap, New in v0.10, limits), SECURITY.md (0.10.x supported);
  • the site.

New modules, all pure and tested in Node: public/risk.js, public/baselines.js, public/logs.js, public/kpi.js. The server loads kpi.js to measure.

How to check it

• npm test: 97 tests pass, including the new tests/risk.test.mjs and tests/kpi.test.mjs, and the API tests for /api/risk and /api/kpi.
• npm run test:e2e: 3 walk-throughs pass locally. The third covers:
  • the register, requirements applied, and the requirements in the 2D plan;
  • a VLAN shown alone, then left with a click on an empty space;
  • the baselines and their merging, the SIEM logs, and the dashboard.
• npm run build:online builds the one-page version tested on the artifact.
• Nix: the lockfile's version changed. If the Nix job asks for a new npmDepsHash, I will push it to this PR.

After merging: Actions › Release › Run workflow on main. It creates the v0.10.0 tag, then waits for a maintainer's approval.

The Solid checklist

• Tests cover the change and pass in CI (unit, API and browser tests above)
• Docs are updated (README, CHANGELOG, API reference, site)
• No secrets, keys or personal data in the diff (the demo uses example.com addresses)
• Every commit is signed off (git commit -s, see DCO)
• New files carry the repo's SPDX license header

---

Generated by Claude Code