本卡屬 FR-162（母卡見「母卡」欄），批 4，等 2a。顧問維護對照的畫面。只改 FE repo。決策者最早看得到的畫面之一。

這張卡做什麼（白話）

側選單「合規稽核」群組多一項「框架對照」。進去先選來源框架與目標框架（例如 CMMC 2.13 Level 2 ↔ ISO/IEC 27001:2022；NIST 800-53 這種參考用的也在清單、標「參考用」），主表一列一條控制項層對應，點展開看底下評估目標層的配對。顧問可以改一條的關係與信心度、停用、新增一條；工具列可以匯入 Excel 或 OSCAL JSON、匯出、下載空白範本、整批重建（要二次確認）。每條看得出是官方／顧問確認／AI 建議，改過的可以看歷史。

API 契約（2a 做好；路徑與欄位以 BE route／schema 為準）

GET  /oscal/control-mappings                       -> [{id, title, source:{fv_id, framework_name, version, is_reference}, target:{...}, status, entry_count}]
GET  /oscal/control-mappings/:id/matrix?origin=&status=&q=&page=&size=
     -> rows:[{entry_id, source:{code, part_id|null, title|null}, target:{...}, relationship, confidence, origin, status,
               overrides_entry_id, objectives:[{同結構}]}]
POST /oscal/control-mappings/:id/entries              body {source_control_code, source_part_id?, target_control_code, target_part_id?, relationship, confidence?, remarks?}
PUT  /oscal/control-mappings/:id/entries/:eid/override body {relationship, confidence?, remarks?}
POST /oscal/control-mappings/:id/entries/:eid/disable  body {remarks?}
GET  /oscal/control-mappings/:id/entries/:eid/history
GET  /oscal/control-mappings/:id/export?fmt=xlsx|oscal&effective_only=true&with_origin=false   -> 檔案
POST /oscal/control-mappings/:id/import   multipart file, fmt                                    -> {added, updated, skipped, errors[]}
POST /oscal/control-mappings/:id/rebuild  multipart file, fmt, confirm=true
GET  /oscal/control-mappings/template                                                            -> xlsx
能力點：oscal.control-mapping.read（看）／oscal.control-mapping.manage（改、匯入、重建）
error code：GRC_CONTROL_MAPPING_IMPORT_INVALID / NOT_FOUND / PAIR_EXISTS / REBUILD_NOT_CONFIRMED（實際碼見 2a 回寫）

怎麼做

手測（headless Playwright 截圖附回寫）

紀律