Compliance coverage per framework and the auditor's pack export cannot be reached from any page

[rubenvdlinde]

What happens

An organisation owner opens Compliance. They see the raw list of controls, plus the incidents, AI Act audit export and retention widget. They cannot see two things hermiq already computes:

• Control-pack coverage. The per-framework coverage percentage and gap list for the EU AI Act, ISO 42001 and NIST AI RMF packs.
• The auditor's pack. One JSON download that combines the audit export with the organisation's compliance coverage.

Both backends work when called directly. No page reaches them.

Why

src/views/ComplianceDashboard.vue is the only caller of both endpoints: getComplianceDashboard() at :230 and getComplianceExport() at :260. They hit GET /api/compliance/dashboard and GET /api/compliance/export (routes.php:312-313, ComplianceController.php:99, :132).

The component is still registered (customComponents.js:37, :107), but the comment there says it is never mounted. The manifest-driven-pages change turned the Compliance page into type: "index" over agentcompliancecontrol with the compliance-operations widget below the header (manifest.json:1255-1258). A built-in page type never consults the custom component map.

The comment names the choice as a product decision: re-home the export and the coverage view onto the Compliance page, or retire the routes with the component. Nobody has made it yet, so the component ships in the bundle and the capability is dark.

Since when

Since the Compliance page moved to manifest-driven pages. The control packs themselves shipped on 13 July (e58b588).

Fix direction

Mount the coverage view and the auditor's-pack button on the Compliance page, most simply as a second widget beside compliance-operations built from the existing component. Keep the compliance.view-dashboard and compliance.export-pack action checks the component relies on. If the decision is to retire, remove both routes, the controller methods and the component together.

Live check

1. As an organisation owner, open Compliance and look for a coverage percentage per framework, or an "Export auditor's pack" button. Neither is there.
2. Call GET /index.php/apps/hermiq/api/compliance/dashboard and /api/compliance/export as the same user. Both answer with data.

Matrix rows: co-control-packs (partial), co-compliance-export (no). Do not confuse co-compliance-export with co-audit-export, the tenant-ops audit export, which is reachable.

Note: the matrix lane also listed GET /api/recommendations among the backends no page reaches. That route is course recommendations (re-course-recs), not a compliance recommendation, and it is not blocked by this component.

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue