3.6 KiB
Compliance PDF Audit — 2026-04-20 (M-02..06)
Scope: Audit-first per S2/S3/S4 recurring pattern. Verify each sub-item before committing to the 3.5 d backlog estimate.
Sub-item disposition
| Item | Spec | Engine | Route | UI | Verdict | Build est. |
|---|---|---|---|---|---|---|
| M-02 PDF export route | pdfmake + buildComplianceDocDefinition → createPdf → route | ✅ pdfmake@0.3.7 installed in packages/agent; buildComplianceDocDefinition(report) ✅ renderComplianceReportPdf(report) returns Buffer ✅ writeComplianceReportPdf writes to disk ✅ compliance-pdf.test.ts ✅ |
❌ no /api/compliance/export-pdf route |
n/a | 95% done — route wiring only | ~30 min |
| M-03 Template system JSON schema | Templates as JSON with sections/logo/branding/footer/risk class + loader + validator | ❌ nothing | ❌ | ❌ | 0% done — genuinely new | ~2-3 hr |
| M-04 ComplianceReport full-page viewer | Expand current card → full-page + date picker + section toggles + PDF download | 🟡 ComplianceDashboard.tsx exists as 324-line card |
✅ GET /api/compliance/status shipped | 🟡 no date picker, no section toggles, no PDF download button | 50% done — UI expansion | ~2-3 hr |
| M-05 Custom branding | Logo upload, org name override, risk classification override | ❌ no branding store; WorkspaceConfig.riskLevel + riskClassifiedAt shipped S1 (C2) |
❌ no branding route | ❌ | 15% done (C2 risk fields) — needs branding store + logo file | ~1-2 hr |
| M-06 KVARK template | IAM audit, data residency, department breakdown section | ❌ nothing | ❌ | ❌ | 0% done — needs M-03 first | ~1 hr once M-03 lands |
Total revised: ~7-10 hr (vs 3.5 d = 28 hr — ~65-75% reduction).
What's cheap and high-value — ship this session
M-02 (~30 min): Add POST /api/compliance/export-pdf to
packages/server/src/local/routes/compliance.ts. Reads the same body
shape as /api/compliance/export, calls generator.generate() to get
the AuditReport, pipes through renderComplianceReportPdf(), sends
with Content-Type: application/pdf.
M-04 (~2-3 hr): Expand ComplianceDashboard.tsx. Add:
- Date range picker (from/to inputs, default to last 30 days)
- Section toggles (interactions / oversight / models / provenance / risk)
- "Download PDF" button that POSTs to
/api/compliance/export-pdfand triggers a browser download from the blob response
What's design territory — defer to follow-up session
M-03 Template system is spec territory. Decisions:
- Schema shape: static JSON files shipped with the app, or user-editable template records in SQLite?
- Logo URL: where do logos live —
dataDir/compliance-logos/? workspace-scoped? - Section overrides: per-template section toggles that override the user's runtime selection?
- Risk class override per template, or tied to WorkspaceConfig?
M-05 Branding depends on M-03's template schema. Parking until M-03.
M-06 KVARK template is a JSON file once M-03 ships the loader. Content (IAM audit columns, data residency shape, department breakdown) needs Marko input from his actual KVARK demo storyboard.
Recommended execution
- M-02 (~30 min, this session) — unblocks downstream + lets M-04 have a working Download button to wire to.
- M-04 (~2-3 hr, this session) — visible demo value, no design decisions needed.
- M-03 + M-05 + M-06 — own session with Marko's input on the template-schema structure. Estimated ~4-6 hr together once decisions land.
Author: Claude (audit per Marko's M-02..06 pick after Wiki v2 completion)