4 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	61c6eab54e	docs: document Nuclei/ZAP as decided deterministic detectors under the agentic DAST (not yet implemented) ... Spec v0.2.1 decision (2026-08-31): keep the agentic DAST/pentest layer, integrate Nuclei then ZAP baseline underneath as deterministic detectors feeding the control-map LUT; offline vuln DB (Trivy/Grype) on the on-prem runner trigger. Clearly marked as planned so the docs stay truthful until the code lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 15:12:41 +02:00
Sharang ParnerkarandClaude Fable 5	b7b9c812ab	docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) ... CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the Certifai requirements spec (Collectives) with the code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 15:05:06 +02:00
sharang	ea516cc054	docs(control-mapping): MCP emission loop + default-on flags (#227)	2026-07-22 11:23:51 +00:00
sharang	182dec69b8	docs(features): compliance control-mapping pipeline (#223)	2026-07-22 07:30:10 +00:00