Compliance, rebuilt

A new compliance module with per-framework runs, a lifecycle cron, applicability and a Statement of Applicability.

Compliance

The compliance module was rebuilt end to end: backend, shared DTOs and frontend. Runs happen per framework on a lifecycle cron, applicability is explicit, and a Statement of Applicability falls out of it rather than being assembled by hand. A weekly digest says what moved.

Improvements
  • Owners are assigned on the Controls tab, per row or in bulk.
  • The vendor import gained a Confirm step with a skip-or-overwrite choice, so a second import is not a guess.
  • A contact's questionnaire access can be revoked without deleting the contact.
  • The sidebar rail is clickable, and its tooltips are faster.
Fixes
  • Reviewer notes keep their text while you type.
  • A screenshot pastes into the report widget without the focus dance.
  • Organization name edits persist from settings.