feat(agent): semantic control mapping — embedding index + region->control retrieval (#215)

compliance-agent/src/controls/index.rs

@@ -0,0 +1,110 @@
+//! In-memory embedding index over the control corpus, for region → control
+//! retrieval.
+//!
+//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
+//! controls carry none), so we map by *similarity*: embed each control's
+//! requirement text once, then for a code region pull the top-K nearest controls
+//! to hand to the grounded judge. This is the retrieval half of the semantic path.
+
+use compliance_core::control_check::ControlCheckSpec;
+use compliance_core::error::CoreError;
+
+use crate::llm::LlmClient;
+
+/// A control spec paired with its requirement-text embedding.
+pub struct ControlIndex {
+    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
+}
+
+impl ControlIndex {
+    /// Build directly from precomputed embeddings (used by tests + callers that
+    /// already embedded the corpus).
+    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
+        Self { entries }
+    }
+
+    /// Build by embedding each control's requirement text.
+    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
+        if specs.is_empty() {
+            return Ok(Self {
+                entries: Vec::new(),
+            });
+        }
+        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
+        let embeddings = llm
+            .embed(texts)
+            .await
+            .map_err(|e| CoreError::Llm(e.to_string()))?;
+        Ok(Self {
+            entries: specs.into_iter().zip(embeddings).collect(),
+        })
+    }
+
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
+    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
+        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
+            .entries
+            .iter()
+            .map(|(spec, emb)| (cosine(query, emb), spec))
+            .collect();
+        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
+        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
+    }
+}
+
+/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
+fn cosine(a: &[f64], b: &[f64]) -> f64 {
+    if a.len() != b.len() || a.is_empty() {
+        return 0.0;
+    }
+    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
+    let na: f64 = a.iter().map(|x| x * x).sum();
+    let nb: f64 = b.iter().map(|x| x * x).sum();
+    if na == 0.0 || nb == 0.0 {
+        return 0.0;
+    }
+    dot / (na.sqrt() * nb.sqrt())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::finding::Severity;
+
+    fn spec(id: &str) -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: id.into(),
+            title: id.into(),
+            requirement: id.into(),
+            default_cwe: None,
+            severity: Severity::Medium,
+        }
+    }
+
+    #[test]
+    fn nearest_ranks_by_cosine() {
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("a"), vec![1.0, 0.0]),
+            (spec("b"), vec![0.0, 1.0]),
+            (spec("c"), vec![0.7, 0.7]),
+        ]);
+        let hits = index.nearest(&[0.9, 0.1], 2);
+        assert_eq!(hits.len(), 2);
+        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
+    }
+
+    #[test]
+    fn cosine_edges_are_zero() {
+        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
+        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
+        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
+    }
+}