docs(plc): add PLC Runtime Landscape reference + support watch-list

Documents the soft-PLC runtime ecosystem as a support watch-list: we support the
CODESYS family today (incl. the many rebranded-CODESYS OEMs — Schneider, WAGO,
ABB, Bosch, Eaton, KEBA), and everything else (ProConOS/ISaGRAF/straton, Siemens
TIA, Rockwell, Beckhoff TwinCAT, B&R, Mitsubishi, Omron, PLCnext) is watch-list —
we add a project-format parser when a customer needs it. The dynamic OT probe is
vendor-agnostic. Also lists the open-source test-bench substrates (OpenPLC,
Beremiz+MatIEC, 4diac). New Reference sidebar entry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -34,24 +34,6 @@ SCAN_SCHEDULE=0 0 */6 * * *
 CVE_MONITOR_SCHEDULE=0 0 0 * * *
 GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
 
-# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
-# enabled; requires the agent container to have Docker access (socket mount).
-# When on, a PLC/SPS target with control logic but no reachable device gets its
-# logic instantiated on a throwaway OpenPLC, probed, then torn down.
-PLC_RUNTIME_ENABLED=0
-PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
-PLC_RUNTIME_NETWORK=certifai
-PLC_RUNTIME_MEMORY=512m
-PLC_RUNTIME_CPUS=0.5
-PLC_RUNTIME_MAX_LIFETIME_SECS=180
-PLC_RUNTIME_OPENPLC_USER=openplc
-PLC_RUNTIME_OPENPLC_PASSWORD=openplc
-
-# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
-# When set, mounts the runner-facing queue + artifact endpoints behind this
-# bearer token; runners present the same token. Unset = endpoints not mounted.
-WERKBANK_RUNNER_TOKEN=
-
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001

.gitea/workflows/ci.yml

@@ -7,13 +7,6 @@ on:
   pull_request:
 
 env:
-  # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
-  # username contains '$', which sh expands when interpolated into the
-  # script (robot$ci-push -> robot-push) => docker login unauthorized.
-  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
-  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
@@ -72,7 +65,7 @@ jobs:
             echo '[source.crates-io]'
             echo 'replace-with = "kellnr"'
             echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.breakpilot.com/api/v1/cratesio/"'
+            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
           } >> "$CARGO_HOME/config.toml"
         env:
           RUSTC_WRAPPER: ""
@@ -94,8 +87,8 @@ jobs:
       - name: Configure git auth for private tramiton dependency
         run: |
           git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@git.breakpilot.com/".insteadOf \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@git.breakpilot.com:22222/"
+            "ssh://git@gitea.meghsakha.com:22222/"
         env:
           RUSTC_WRAPPER: ""
 
@@ -114,10 +107,6 @@ jobs:
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
-      - name: Clippy (werkbank-exec)
-        run: cargo clippy -p werkbank-exec -- -D warnings
-      - name: Clippy (control-map)
-        run: cargo clippy -p control-map -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -126,8 +115,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent + werkbank-exec + control-map)
+      - name: Tests (core + agent)
-        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
+        run: cargo test -p compliance-core -p compliance-agent --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)
@@ -213,14 +202,11 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-agent
+          IMAGE=registry.meghsakha.com/compliance-agent
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
-          chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -240,14 +226,11 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-dashboard
+          IMAGE=registry.meghsakha.com/compliance-dashboard
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
-          chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -265,13 +248,10 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-docs
+          IMAGE=registry.meghsakha.com/compliance-docs
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
-          chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -291,14 +271,11 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-mcp
+          IMAGE=registry.meghsakha.com/compliance-mcp
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
-          chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"

Cargo.lock

@@ -666,7 +666,6 @@ dependencies = [
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
- "control-map",
  "dashmap",
  "dotenvy",
  "futures-core",
@@ -700,7 +699,6 @@ dependencies = [
  "urlencoding",
  "uuid",
  "walkdir",
- "werkbank-exec",
  "zip",
 ]
 
@@ -725,7 +723,6 @@ dependencies = [
  "sha2",
  "thiserror 2.0.18",
  "tokio",
- "toml",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
@@ -969,15 +966,6 @@ dependencies = [
  "charset",
 ]
 
-[[package]]
-name = "control-map"
-version = "0.1.0"
-dependencies = [
- "serde",
- "serde_json",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "convert_case"
 version = "0.8.0"
@@ -5099,12 +5087,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "sha1_smol"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
-
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -6488,7 +6470,6 @@ dependencies = [
  "getrandom 0.4.1",
  "js-sys",
  "serde_core",
- "sha1_smol",
  "wasm-bindgen",
 ]
 
@@ -6732,25 +6713,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "werkbank-exec"
-version = "0.1.0"
-dependencies = [
- "compliance-core",
- "compliance-dast",
- "futures-util",
- "hex",
- "regex",
- "reqwest",
- "secrecy",
- "sha2",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "uuid",
- "walkdir",
-]
-
 [[package]]
 name = "which"
 version = "6.0.3"

Cargo.toml

@@ -7,8 +7,6 @@ members = [
     "compliance-dast",
     "compliance-mcp",
     "compliance-smoke",
-    "werkbank-exec",
-    "control-map",
 ]
 resolver = "2"
 
@@ -18,7 +16,6 @@ expect_used = "deny"
 
 [workspace.dependencies]
 compliance-core = { path = "compliance-core", default-features = false }
-control-map = { path = "control-map" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
@@ -26,11 +23,11 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
-uuid = { version = "1", features = ["v4", "v5", "serde"] }
+uuid = { version = "1", features = ["v4", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }

Dockerfile.agent

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 

Dockerfile.dashboard

@@ -13,8 +13,8 @@ ENV DOCS_URL=${DOCS_URL}
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 

Dockerfile.mcp

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 

compliance-agent/Cargo.toml

@@ -8,12 +8,8 @@ workspace = true
 
 [dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
-control-map = { workspace = true }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
-# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
-# used by the Werkbank runner.
-werkbank-exec = { path = "../werkbank-exec" }
 # Native firmware build/target detection for bare-metal & RTOS artifacts.
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this

compliance-agent/rules/cra_semgrep.yaml

@@ -1,117 +0,0 @@
-# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
-# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
-# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
-# not matter). Detection here is deterministic; the grounded LLM judge downstream
-# only confirms/refutes — it never detects. Keep patterns tight: a false positive
-# that the judge refutes marks the whole finding a false positive.
-rules:
-  # --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
-  - id: cra-ai-1-flask-debug-enabled
-    languages: [python]
-    severity: WARNING
-    message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
-    metadata:
-      cwe: ["CWE-489: Active Debug Code"]
-      control: cra-ai-1
-    patterns:
-      - pattern: '$APP.run(..., debug=True, ...)'
-
-  - id: cra-ai-1-django-debug-true
-    languages: [python]
-    severity: WARNING
-    message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
-    metadata:
-      cwe: ["CWE-489: Active Debug Code"]
-      control: cra-ai-1
-    patterns:
-      - pattern: 'DEBUG = True'
-
-  - id: cra-ai-1-tls-verify-disabled
-    languages: [python]
-    severity: ERROR
-    message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
-    metadata:
-      cwe: ["CWE-295: Improper Certificate Validation"]
-      control: cra-ai-1
-    patterns:
-      - pattern: 'requests.$M(..., verify=False, ...)'
-
-  - id: cra-ai-1-cors-wildcard
-    languages: [javascript, typescript]
-    severity: WARNING
-    message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
-    metadata:
-      cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
-      control: cra-ai-1
-    patterns:
-      - pattern-either:
-          - pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
-          - pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
-
-  # --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
-  - id: cra-ai-7-weak-password-hash
-    languages: [python]
-    severity: ERROR
-    message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
-    metadata:
-      cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
-      control: cra-ai-7
-    patterns:
-      - pattern-either:
-          - pattern: 'hashlib.md5($PW)'
-          - pattern: 'hashlib.sha1($PW)'
-      - metavariable-regex:
-          metavariable: $PW
-          regex: '(?i).*(pass|pwd|secret|cred|token).*'
-
-  # --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
-  - id: cra-ai-10-session-cookie-insecure
-    languages: [python]
-    severity: ERROR
-    message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
-    metadata:
-      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
-      control: cra-ai-10
-    patterns:
-      - pattern-either:
-          - pattern: 'SESSION_COOKIE_SECURE = False'
-          - pattern: 'SESSION_COOKIE_HTTPONLY = False'
-
-  - id: cra-ai-10-express-cookie-insecure
-    languages: [javascript, typescript]
-    severity: ERROR
-    message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
-    metadata:
-      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
-      control: cra-ai-10
-    patterns:
-      - pattern-either:
-          - pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
-          - pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
-
-  # --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
-  - id: cra-ai-14-python-weak-cipher
-    languages: [python]
-    severity: ERROR
-    message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
-    metadata:
-      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
-      control: cra-ai-14
-    patterns:
-      - pattern-either:
-          - pattern: 'AES.new($K, AES.MODE_ECB, ...)'
-          - pattern: 'DES.new(...)'
-          - pattern: 'DES3.new(...)'
-
-  - id: cra-ai-14-node-weak-cipher
-    languages: [javascript, typescript]
-    severity: ERROR
-    message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
-    metadata:
-      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
-      control: cra-ai-14
-    patterns:
-      - pattern-either:
-          - pattern: 'crypto.createCipheriv("des-ecb", ...)'
-          - pattern: 'crypto.createCipheriv("des", ...)'
-          - pattern: 'crypto.createCipher(...)'

compliance-agent/src/api/handlers/mod.rs

@@ -10,12 +10,10 @@ pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
-pub mod oscal;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod sbom;
 pub mod scans;
-pub mod werkbank_jobs;
 
 // Re-export all handler functions so routes.rs can use `handlers::function_name`
 pub use dto::*;

compliance-agent/src/api/handlers/oscal.rs

@@ -1,48 +0,0 @@
-//! OSCAL assessment endpoint.
-//!
-//! Returns a standard OSCAL assessment-results document for a target's findings,
-//! driven by each finding's stamped `control_refs` (from the scan's control-triage
-//! stage): mapped findings target their controls, unmapped findings are reported
-//! as-is. See `compliance_core::models::oscal_assessment`.
-
-use axum::extract::Extension;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use mongodb::bson::doc;
-use serde::Deserialize;
-
-use compliance_core::models::oscal_assessment::assess;
-use compliance_core::models::Finding;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use super::dto::{collect_cursor_async, tenant_db, AgentExt};
-
-#[derive(Debug, Deserialize)]
-pub struct AssessRequest {
-    /// The target / repo id whose findings are assessed.
-    pub target_id: String,
-}
-
-/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
-pub async fn assess_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<AssessRequest>,
-) -> Response {
-    let db = match tenant_db(&agent, &tenant).await {
-        Ok(db) => db,
-        Err(code) => return code.into_response(),
-    };
-
-    let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
-            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
-        }
-    };
-
-    Json(assess(&findings, chrono::Utc::now())).into_response()
-}

compliance-agent/src/api/handlers/werkbank_jobs.rs

@@ -1,289 +0,0 @@
-//! Werkbank runner endpoints (`/api/v1/werkbank/jobs/*`).
-//!
-//! The pull API a Werkbank runner talks to: lease a job, heartbeat while it runs,
-//! and post the result back. Machine auth is a **static bearer token**
-//! (`WERKBANK_RUNNER_TOKEN`) — not a Keycloak JWT, because a runner acts across
-//! tenants (each request names its `tenant`). Routes are only mounted when the
-//! token is configured; with none set they don't exist (404).
-//!
-//! On completion the runner's findings are persisted against the job's target,
-//! so a job run by a remote runner lands the same findings an in-process run
-//! would (WB-05, the control-plane cut-over).
-
-use axum::extract::{Extension, Path, Request};
-use axum::http::{header, StatusCode};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use mongodb::bson::{doc, oid::ObjectId};
-use secrecy::ExposeSecret;
-use serde::{Deserialize, Serialize};
-use std::time::Duration;
-
-use compliance_core::models::werkbank::{
-    CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
-};
-use compliance_core::models::ArtifactKind;
-
-use super::dto::AgentExt;
-use crate::database::Database;
-use crate::werkbank::JobQueue;
-
-/// Gate the runner endpoints behind the static runner bearer token.
-pub async fn require_runner_token(
-    Extension(agent): AgentExt,
-    request: Request,
-    next: Next,
-) -> Response {
-    let Some(expected) = agent.config.werkbank_runner_token.as_ref() else {
-        return (StatusCode::NOT_FOUND, "werkbank runner API disabled").into_response();
-    };
-    let presented = request
-        .headers()
-        .get(header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|s| s.strip_prefix("Bearer "))
-        .map(str::trim)
-        .filter(|s| !s.is_empty());
-    let Some(presented) = presented else {
-        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
-    };
-    if !constant_time_eq(presented, expected.expose_secret()) {
-        return (StatusCode::UNAUTHORIZED, "Invalid runner token").into_response();
-    }
-    next.run(request).await
-}
-
-/// `POST /api/v1/werkbank/jobs/lease` — lease the oldest runnable job, or `204`.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, runner = %req.runner_id))]
-pub async fn lease(
-    Extension(agent): AgentExt,
-    Json(req): Json<LeaseRequest>,
-) -> Result<Response, StatusCode> {
-    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
-    let leased = queue
-        .lease(
-            &req.runner_id,
-            req.executor,
-            &req.labels,
-            Duration::from_secs(req.lease_ttl_secs),
-            chrono::Utc::now(),
-        )
-        .await
-        .map_err(internal)?;
-    Ok(match leased {
-        Some(job) => Json(job).into_response(),
-        None => StatusCode::NO_CONTENT.into_response(),
-    })
-}
-
-/// `POST /api/v1/werkbank/jobs/heartbeat` — extend the lease; `409` if it's lost.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
-pub async fn heartbeat(
-    Extension(agent): AgentExt,
-    Json(req): Json<HeartbeatRequest>,
-) -> Result<Response, StatusCode> {
-    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
-    let ack = queue
-        .heartbeat(
-            &req.job_id,
-            &req.lease_token,
-            Duration::from_secs(req.lease_ttl_secs),
-            chrono::Utc::now(),
-        )
-        .await
-        .map_err(internal)?;
-    Ok(match ack {
-        Some(ack) => Json(ack).into_response(),
-        // Lease lost — the runner should abandon the job.
-        None => StatusCode::CONFLICT.into_response(),
-    })
-}
-
-/// `POST /api/v1/werkbank/jobs/complete` — record the result and persist findings.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
-pub async fn complete(
-    Extension(agent): AgentExt,
-    Json(req): Json<CompleteRequest>,
-) -> Result<Json<CompleteResponse>, StatusCode> {
-    let db = tenant_db(&agent, &req.tenant).await?;
-    let queue = JobQueue::new(&db);
-    let now = chrono::Utc::now();
-    let recorded = queue
-        .complete(&req.job_id, &req.lease_token, &req.result, now)
-        .await
-        .map_err(internal)?;
-
-    // Only persist findings for the run that actually recorded the result, so a
-    // duplicate/late completion can't double-insert.
-    if recorded {
-        if let Some(record) = queue.get(&req.job_id).await.map_err(internal)? {
-            persist_findings(&db, &record.job.target_id, &req.result).await;
-        }
-    }
-    Ok(Json(CompleteResponse { recorded }))
-}
-
-/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
-/// program a runner needs to load). The hash is validated against traversal by
-/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
-/// input.
-#[tracing::instrument(skip_all, fields(hash = %hash))]
-pub async fn serve_artifact(
-    Extension(agent): AgentExt,
-    Path(hash): Path<String>,
-) -> Result<Response, StatusCode> {
-    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
-    match crate::ingest::blob::read_blob(base, &hash) {
-        Ok(bytes) => {
-            Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
-        }
-        Err(_) => Err(StatusCode::NOT_FOUND),
-    }
-}
-
-/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
-/// stash it as a content-addressed blob (which the runner fetches via
-/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
-/// half of the loop — a runner then leases it, provisions, and posts results.
-#[derive(Debug, Deserialize)]
-pub struct EnqueueRequest {
-    /// The tenant whose queue to enqueue into.
-    pub tenant: String,
-    /// The onboarded target to test.
-    pub target_id: String,
-}
-
-/// The enqueued job's id.
-#[derive(Debug, Serialize)]
-pub struct EnqueueResponse {
-    /// The new job id.
-    pub job_id: String,
-    /// Whether this call inserted it (false = already queued).
-    pub enqueued: bool,
-}
-
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
-pub async fn enqueue(
-    Extension(agent): AgentExt,
-    Json(req): Json<EnqueueRequest>,
-) -> Result<Json<EnqueueResponse>, StatusCode> {
-    let db = tenant_db(&agent, &req.tenant).await?;
-    let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(internal)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // Extract the control-logic program from the target's PLC-source artifacts
-    // (same selection as the in-process PLC scan).
-    let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
-    let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
-    let program = target
-        .artifacts
-        .iter()
-        .filter(|a| {
-            matches!(
-                a.kind,
-                ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-            )
-        })
-        .find_map(|a| {
-            let path = ingest_set
-                .get(&a.id)
-                .and_then(|ia| ia.working_path.clone())?;
-            werkbank_exec::plc::extract_program(&path)
-        })
-        .ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
-
-    // Stash the program source so the runner can fetch it by hash.
-    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
-    let hash =
-        crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
-
-    let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
-    let job = Job::plc_provision(
-        &job_id,
-        &req.tenant,
-        &req.target_id,
-        InputRef::blob(hash),
-        agent.config.plc_runtime.max_lifetime_secs,
-    );
-    let enqueued = JobQueue::new(&db)
-        .enqueue(job, chrono::Utc::now())
-        .await
-        .map_err(internal)?;
-    Ok(Json(EnqueueResponse { job_id, enqueued }))
-}
-
-/// Persist a job result's findings against its target: general findings
-/// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
-/// is logged, not surfaced to the runner (its result is already recorded).
-async fn persist_findings(db: &Database, target_id: &str, result: &JobResult) {
-    for finding in &result.findings {
-        let exists = db
-            .findings()
-            .find_one(doc! { "fingerprint": &finding.fingerprint })
-            .await
-            .ok()
-            .flatten()
-            .is_some();
-        if !exists {
-            if let Err(e) = db.findings().insert_one(finding).await {
-                tracing::warn!(target_id, error = %e, "werkbank: persist finding failed");
-            }
-        }
-    }
-    for finding in &result.dast_findings {
-        if let Err(e) = db.dast_findings().insert_one(finding).await {
-            tracing::warn!(target_id, error = %e, "werkbank: persist DAST finding failed");
-        }
-    }
-    tracing::info!(
-        target_id,
-        findings = result.findings.len(),
-        dast = result.dast_findings.len(),
-        "werkbank: persisted runner results"
-    );
-}
-
-/// Resolve the tenant-scoped database for a request.
-async fn tenant_db(
-    agent: &crate::agent::ComplianceAgent,
-    tenant: &str,
-) -> Result<Database, StatusCode> {
-    agent.db_pool.for_tenant_id(tenant).await.map_err(internal)
-}
-
-/// Map any internal error to a 500.
-fn internal<E: std::fmt::Display>(e: E) -> StatusCode {
-    tracing::error!("werkbank endpoint error: {e}");
-    StatusCode::INTERNAL_SERVER_ERROR
-}
-
-/// Length-checked, constant-time-ish token comparison.
-fn constant_time_eq(a: &str, b: &str) -> bool {
-    if a.len() != b.len() {
-        return false;
-    }
-    let mut diff = 0u8;
-    for (x, y) in a.bytes().zip(b.bytes()) {
-        diff |= x ^ y;
-    }
-    diff == 0
-}
-
-#[cfg(test)]
-mod tests {
-    use super::constant_time_eq;
-
-    #[test]
-    fn token_compare() {
-        assert!(constant_time_eq("secret", "secret"));
-        assert!(!constant_time_eq("secret", "secrex"));
-        assert!(!constant_time_eq("secret", "secretx"));
-        assert!(!constant_time_eq("", "x"));
-    }
-}

compliance-agent/src/api/routes.rs

@@ -6,7 +6,6 @@ use crate::api::handlers;
 pub fn build_router() -> Router {
     Router::new()
         .route("/api/v1/health", get(handlers::health))
-        .route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
         .route("/api/v1/stats/overview", get(handlers::stats_overview))
         .route(
             "/api/v1/settings/ssh-public-key",

compliance-agent/src/api/server.rs

@@ -4,7 +4,7 @@ use axum::extract::{DefaultBodyLimit, Request};
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
-use axum::routing::{delete, get, post};
+use axum::routing::{delete, get};
 use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
@@ -72,43 +72,8 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
         Router::new()
     };
 
-    // Werkbank runner API. Like admin, only mounted when its bearer token is
-    // configured; runners authenticate with WERKBANK_RUNNER_TOKEN (not a JWT).
-    let werkbank_router: Router = if agent.config.werkbank_runner_token.is_some() {
-        tracing::info!(
-            "Werkbank runner API enabled — /api/v1/werkbank/jobs/* behind WERKBANK_RUNNER_TOKEN"
-        );
-        Router::new()
-            .route(
-                "/api/v1/werkbank/jobs/lease",
-                post(handlers::werkbank_jobs::lease),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/heartbeat",
-                post(handlers::werkbank_jobs::heartbeat),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/complete",
-                post(handlers::werkbank_jobs::complete),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/enqueue",
-                post(handlers::werkbank_jobs::enqueue),
-            )
-            .route(
-                "/api/v1/werkbank/artifacts/{hash}",
-                get(handlers::werkbank_jobs::serve_artifact),
-            )
-            .layer(middleware::from_fn(
-                handlers::werkbank_jobs::require_runner_token,
-            ))
-    } else {
-        Router::new()
-    };
-
     let mut app = routes::build_router()
         .merge(admin_router)
-        .merge(werkbank_router)
         // Allow large artifact uploads (PLC .projectarchive, firmware images,
         // mobile packages) — axum's default request-body limit is only 2 MiB.
         .layer(DefaultBodyLimit::max(512 * 1024 * 1024))

compliance-agent/src/config.rs

@@ -1,4 +1,3 @@
-use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -64,47 +63,5 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
         pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
         admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
         tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
-        plc_runtime: load_plc_runtime_config(),
-        werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
-        breakpilot: load_breakpilot_config(),
     })
 }
-
-/// Build the ephemeral soft-PLC provisioning config from the environment,
-/// falling back to [`PlcRuntimeConfig::default`] for any unset knob. Disabled
-/// unless `PLC_RUNTIME_ENABLED` is truthy — it requires Docker access.
-fn load_plc_runtime_config() -> PlcRuntimeConfig {
-    let d = PlcRuntimeConfig::default();
-    PlcRuntimeConfig {
-        enabled: env_var_opt("PLC_RUNTIME_ENABLED")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.enabled),
-        image: env_var_opt("PLC_RUNTIME_IMAGE").unwrap_or(d.image),
-        network: env_var_opt("PLC_RUNTIME_NETWORK").unwrap_or(d.network),
-        memory: env_var_opt("PLC_RUNTIME_MEMORY").unwrap_or(d.memory),
-        cpus: env_var_opt("PLC_RUNTIME_CPUS").unwrap_or(d.cpus),
-        max_lifetime_secs: env_var_opt("PLC_RUNTIME_MAX_LIFETIME_SECS")
-            .and_then(|v| v.parse().ok())
-            .unwrap_or(d.max_lifetime_secs),
-        openplc_user: env_var_opt("PLC_RUNTIME_OPENPLC_USER").unwrap_or(d.openplc_user),
-        openplc_password: env_secret_opt("PLC_RUNTIME_OPENPLC_PASSWORD")
-            .unwrap_or(d.openplc_password),
-    }
-}
-
-/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
-/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
-fn load_breakpilot_config() -> BreakpilotConfig {
-    let d = BreakpilotConfig::default();
-    BreakpilotConfig {
-        base_url: env_var_opt("BREAKPILOT_BASE_URL"),
-        token: env_secret_opt("BREAKPILOT_TOKEN"),
-        snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
-        semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.semantic_mapping),
-        grounded_control_checks: env_var_opt("BREAKPILOT_GROUNDED_CHECKS")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.grounded_control_checks),
-    }
-}

compliance-agent/src/controls/checker.rs

@@ -1,114 +0,0 @@
-//! The grounded control checker: judge each candidate region for a control, then
-//! keep only the verdicts that survive the grounding gate.
-//!
-//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
-//! the whole recognize → ground path is then exercised without an LLM. With the
-//! real judge, determinism comes from temperature 0 plus the gate.
-
-use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
-use compliance_core::models::Finding;
-
-use super::judge::ControlJudge;
-
-/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
-pub struct GroundedControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> GroundedControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Judge every candidate region for `spec` and return the grounded findings.
-    /// A verdict that doesn't quote real code in its region is dropped by
-    /// [`ground`], so nothing fabricated reaches the caller.
-    pub async fn check(
-        &self,
-        spec: &ControlCheckSpec,
-        regions: &[CandidateRegion],
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let mut findings = Vec::new();
-        for region in regions {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::LlmVerdict;
-    use compliance_core::models::finding::Severity;
-
-    /// Deterministic stub: returns a fixed verdict for every region, so the
-    /// recognize → ground composition is tested without an LLM.
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "No default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    fn region(content: &str) -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: content.into(),
-        }
-    }
-
-    #[tokio::test]
-    async fn keeps_grounded_and_drops_ungrounded() {
-        let checker = GroundedControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let regions = vec![
-            region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
-            region("totally unrelated code\n"),      // snippet absent → dropped
-        ];
-        let findings = checker.check(&spec(), &regions, "repo").await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
-        assert_eq!(findings[0].line_number, Some(2));
-    }
-
-    #[tokio::test]
-    async fn non_violation_yields_nothing() {
-        let checker = GroundedControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: false,
-                snippet: String::new(),
-                cwe: None,
-                confidence: 0.0,
-            },
-        });
-        let findings = checker
-            .check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
-            .await;
-        assert!(findings.is_empty());
-    }
-}

compliance-agent/src/controls/index.rs

@@ -1,245 +0,0 @@
-//! In-memory embedding index over the control corpus, for region → control
-//! retrieval.
-//!
-//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
-//! controls carry none), so we map by *similarity*: embed each control's
-//! requirement text once, then for a code region pull the top-K nearest controls
-//! to hand to the grounded judge. This is the retrieval half of the semantic path.
-
-use std::path::Path;
-
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-
-use compliance_core::control_check::ControlCheckSpec;
-use compliance_core::error::CoreError;
-
-use crate::llm::LlmClient;
-
-/// A control spec paired with its requirement-text embedding.
-pub struct ControlIndex {
-    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
-}
-
-/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
-/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
-#[derive(Serialize, Deserialize)]
-struct PersistedIndex {
-    corpus_hash: String,
-    entries: Vec<PersistedEntry>,
-}
-
-#[derive(Serialize, Deserialize)]
-struct PersistedEntry {
-    spec: ControlCheckSpec,
-    embedding: Vec<f64>,
-}
-
-/// Stable hash of the corpus identity (each control's id + requirement text, in
-/// order). Same catalog → same hash → the cached embeddings are reused instead of
-/// re-embedding the whole corpus.
-fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
-    let mut hasher = Sha256::new();
-    for s in specs {
-        hasher.update(s.control_id.as_bytes());
-        hasher.update([0u8]);
-        hasher.update(s.requirement.as_bytes());
-        hasher.update([0u8]);
-    }
-    format!("{:x}", hasher.finalize())
-}
-
-impl ControlIndex {
-    /// Build directly from precomputed embeddings (used by tests + callers that
-    /// already embedded the corpus).
-    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
-        Self { entries }
-    }
-
-    /// Load the index from `cache_path` if it still matches the current corpus,
-    /// otherwise embed the corpus and persist it there. This turns the per-scan
-    /// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
-    /// that survives across scans; the cache self-invalidates when the catalog
-    /// changes (its [`corpus_hash`] no longer matches).
-    pub async fn load_or_build(
-        llm: &LlmClient,
-        specs: Vec<ControlCheckSpec>,
-        cache_path: &Path,
-    ) -> Result<Self, CoreError> {
-        let hash = corpus_hash(&specs);
-        if let Some(index) = Self::load_cache(cache_path, &hash).await {
-            tracing::debug!(
-                controls = index.len(),
-                "reusing cached control embedding index"
-            );
-            return Ok(index);
-        }
-        let index = Self::build(llm, specs).await?;
-        if let Err(e) = index.write_cache(cache_path, &hash).await {
-            tracing::warn!(error = %e, "failed to persist control embedding index");
-        }
-        Ok(index)
-    }
-
-    /// Read a persisted index, returning it only if its corpus hash matches.
-    async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
-        let raw = tokio::fs::read(path).await.ok()?;
-        let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
-        if persisted.corpus_hash != hash {
-            return None;
-        }
-        Some(Self {
-            entries: persisted
-                .entries
-                .into_iter()
-                .map(|e| (e.spec, e.embedding))
-                .collect(),
-        })
-    }
-
-    /// Persist the index atomically (temp file + rename) keyed by corpus hash.
-    async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
-        if let Some(parent) = path.parent() {
-            tokio::fs::create_dir_all(parent).await?;
-        }
-        let persisted = PersistedIndex {
-            corpus_hash: hash.to_string(),
-            entries: self
-                .entries
-                .iter()
-                .map(|(spec, emb)| PersistedEntry {
-                    spec: spec.clone(),
-                    embedding: emb.clone(),
-                })
-                .collect(),
-        };
-        let raw = serde_json::to_vec(&persisted)?;
-        let tmp = path.with_extension("json.tmp");
-        tokio::fs::write(&tmp, &raw).await?;
-        tokio::fs::rename(&tmp, path).await?;
-        Ok(())
-    }
-
-    /// Build by embedding each control's requirement text.
-    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
-        if specs.is_empty() {
-            return Ok(Self {
-                entries: Vec::new(),
-            });
-        }
-        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
-        let embeddings = llm
-            .embed(texts)
-            .await
-            .map_err(|e| CoreError::Llm(e.to_string()))?;
-        Ok(Self {
-            entries: specs.into_iter().zip(embeddings).collect(),
-        })
-    }
-
-    pub fn len(&self) -> usize {
-        self.entries.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.entries.is_empty()
-    }
-
-    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
-    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
-        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
-            .entries
-            .iter()
-            .map(|(spec, emb)| (cosine(query, emb), spec))
-            .collect();
-        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
-        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
-    }
-}
-
-/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
-fn cosine(a: &[f64], b: &[f64]) -> f64 {
-    if a.len() != b.len() || a.is_empty() {
-        return 0.0;
-    }
-    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
-    let na: f64 = a.iter().map(|x| x * x).sum();
-    let nb: f64 = b.iter().map(|x| x * x).sum();
-    if na == 0.0 || nb == 0.0 {
-        return 0.0;
-    }
-    dot / (na.sqrt() * nb.sqrt())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[test]
-    fn nearest_ranks_by_cosine() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-            (spec("c"), vec![0.7, 0.7]),
-        ]);
-        let hits = index.nearest(&[0.9, 0.1], 2);
-        assert_eq!(hits.len(), 2);
-        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
-    }
-
-    #[test]
-    fn cosine_edges_are_zero() {
-        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
-        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
-        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
-    }
-
-    #[test]
-    fn corpus_hash_is_stable_and_identity_sensitive() {
-        let a = corpus_hash(&[spec("x"), spec("y")]);
-        assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
-        assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
-        assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
-    }
-
-    #[tokio::test]
-    #[allow(clippy::unwrap_used)]
-    async fn cache_round_trips_and_misses_on_corpus_change() {
-        let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
-        let path = dir.join("control-index.json");
-        let specs = [spec("a"), spec("b")];
-        let hash = corpus_hash(&specs);
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-        ]);
-        index.write_cache(&path, &hash).await.unwrap();
-
-        // matching corpus hash → hit
-        let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
-        assert_eq!(loaded.len(), 2);
-        assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
-        // corpus changed → miss (forces a rebuild)
-        assert!(ControlIndex::load_cache(&path, "differenthash")
-            .await
-            .is_none());
-        // absent file → miss, not an error
-        assert!(
-            ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
-                .await
-                .is_none()
-        );
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}

compliance-agent/src/controls/judge.rs

@@ -1,167 +0,0 @@
-//! The "recognize" stage: judge whether a code region violates a control.
-//!
-//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
-//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
-//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
-//! and everything it returns is then re-checked by the grounding gate
-//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
-//! smart; it is never trusted.
-
-use std::sync::Arc;
-
-use serde::Deserialize;
-
-use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
-
-use crate::llm::LlmClient;
-
-/// Prompt/logic version — part of the verdict cache key, bump on any change here.
-pub const PROMPT_VERSION: &str = "control-judge-v1";
-
-const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
-You are given ONE compliance control (a requirement) and ONE code region. Decide \
-ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
-shown — never assume code that is not present. (2) If and only if it violates, copy \
-the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
-region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
-violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
-Respond with STRICT JSON only, no prose: \
-{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
-
-/// Judges one (control, region). Async-in-trait so a stub can drive tests.
-#[allow(async_fn_in_trait)]
-pub trait ControlJudge: Send + Sync {
-    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
-}
-
-/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
-pub struct LlmControlJudge {
-    llm: Arc<LlmClient>,
-}
-
-impl LlmControlJudge {
-    pub fn new(llm: Arc<LlmClient>) -> Self {
-        Self { llm }
-    }
-}
-
-impl ControlJudge for LlmControlJudge {
-    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
-        let user = build_user_prompt(spec, region);
-        match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
-            Ok(response) => parse_verdict(&response),
-            Err(e) => {
-                // Fail closed: a transient model error yields no finding, never a
-                // fabricated one.
-                tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
-                no_violation()
-            }
-        }
-    }
-}
-
-fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
-    format!(
-        "CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
-        id = spec.control_id,
-        title = spec.title,
-        req = spec.requirement,
-        file = region.file,
-        line = region.start_line,
-        code = region.content,
-    )
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct RawVerdict {
-    #[serde(default)]
-    violates: bool,
-    #[serde(default)]
-    snippet: String,
-    #[serde(default)]
-    cwe: Option<String>,
-    #[serde(default)]
-    confidence: f64,
-}
-
-/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
-/// degrades to a non-violation (never a fabricated finding).
-fn parse_verdict(response: &str) -> LlmVerdict {
-    let cleaned = response
-        .trim()
-        .trim_start_matches("```json")
-        .trim_start_matches("```")
-        .trim_end_matches("```")
-        .trim();
-    match serde_json::from_str::<RawVerdict>(cleaned) {
-        Ok(raw) => LlmVerdict {
-            violates: raw.violates,
-            snippet: raw.snippet,
-            cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
-            confidence: raw.confidence,
-        },
-        Err(e) => {
-            tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
-            no_violation()
-        }
-    }
-}
-
-fn no_violation() -> LlmVerdict {
-    LlmVerdict {
-        violates: false,
-        snippet: String::new(),
-        cwe: None,
-        confidence: 0.0,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "Products must not ship default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    #[test]
-    fn parses_plain_and_fenced_json() {
-        let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
-        let v = parse_verdict(plain);
-        assert!(v.violates);
-        assert_eq!(v.snippet, "PASSWORD = \"x\"");
-        assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
-
-        let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
-        assert!(!parse_verdict(fenced).violates);
-    }
-
-    #[test]
-    fn garbage_and_empty_cwe_are_safe() {
-        assert!(!parse_verdict("not json at all").violates); // fail closed
-        let no_cwe =
-            parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": "  ", "confidence": 0.5}"#);
-        assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
-    }
-
-    #[test]
-    fn user_prompt_carries_control_and_code() {
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 10,
-            content: "PASSWORD = \"admin\"".into(),
-        };
-        let p = build_user_prompt(&spec(), &region);
-        assert!(p.contains("cra-ai-8"));
-        assert!(p.contains("Products must not ship default credentials"));
-        assert!(p.contains("PASSWORD = \"admin\""));
-        assert!(p.contains("src/auth.py"));
-    }
-}

compliance-agent/src/controls/mod.rs

@@ -1,23 +0,0 @@
-//! Controls corpus providers.
-//!
-//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
-//! the control corpus the mapping engine assesses findings against. Currently:
-//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
-//! and snapshots it locally.
-
-mod checker;
-mod index;
-mod judge;
-mod oscal_provider;
-mod scan_triage;
-mod semantic;
-mod surface;
-mod triage;
-
-pub use checker::GroundedControlChecker;
-pub use index::ControlIndex;
-pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
-pub use oscal_provider::OscalControlsProvider;
-pub use scan_triage::{grounded_surface_findings, semantic_stamp_findings, triage_repo_findings};
-pub use semantic::SemanticControlChecker;
-pub use triage::{ControlTriage, TriageOutcome};

compliance-agent/src/controls/oscal_provider.rs

@@ -1,229 +0,0 @@
-//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
-//! catalog export.
-//!
-//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
-//! the exact bytes to disk (so scans are deterministic and keep working offline /
-//! on-prem), and maps the catalog into the corpus controls the mapping engine
-//! consumes. The producer owns the catalog; we own the assessment — this is the
-//! ingest half of the loop.
-
-use std::path::PathBuf;
-
-use secrecy::{ExposeSecret, SecretString};
-
-use compliance_core::error::CoreError;
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::models::oscal::OscalDocument;
-use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
-
-/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
-/// and snapshots it locally for deterministic / offline reuse.
-pub struct OscalControlsProvider {
-    http: reqwest::Client,
-    base_url: String,
-    token: Option<SecretString>,
-    snapshot_dir: PathBuf,
-}
-
-impl OscalControlsProvider {
-    /// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
-    /// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
-    /// snapshots are written so a later scan can reuse them without the network.
-    pub fn new(
-        http: reqwest::Client,
-        base_url: impl Into<String>,
-        token: Option<SecretString>,
-        snapshot_dir: impl Into<PathBuf>,
-    ) -> Self {
-        Self {
-            http,
-            base_url: base_url.into(),
-            token,
-            snapshot_dir: snapshot_dir.into(),
-        }
-    }
-
-    fn catalog_url(&self, framework: &str) -> String {
-        format!(
-            "{}/api/compliance/v1/oscal/catalog?framework={framework}",
-            self.base_url.trim_end_matches('/')
-        )
-    }
-
-    fn snapshot_path(&self, framework: &str) -> PathBuf {
-        self.snapshot_dir
-            .join(format!("oscal-catalog-{framework}.json"))
-    }
-
-    /// Fetch the raw catalog bytes for a framework token over HTTP.
-    async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
-        let mut req = self.http.get(self.catalog_url(framework));
-        if let Some(token) = &self.token {
-            req = req.bearer_auth(token.expose_secret());
-        }
-        let resp = req
-            .send()
-            .await
-            .map_err(|e| CoreError::Http(e.to_string()))?;
-        if !resp.status().is_success() {
-            return Err(CoreError::Http(format!(
-                "catalog fetch for {framework} returned HTTP {}",
-                resp.status()
-            )));
-        }
-        resp.bytes()
-            .await
-            .map(|b| b.to_vec())
-            .map_err(|e| CoreError::Http(e.to_string()))
-    }
-
-    /// Write a catalog snapshot atomically (temp file + rename).
-    async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
-        tokio::fs::create_dir_all(&self.snapshot_dir).await?;
-        let path = self.snapshot_path(framework);
-        let tmp = path.with_extension("json.tmp");
-        tokio::fs::write(&tmp, raw).await?;
-        tokio::fs::rename(&tmp, &path).await?;
-        Ok(())
-    }
-
-    /// Read a previously written snapshot, if one exists.
-    async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
-        match tokio::fs::read(self.snapshot_path(framework)).await {
-            Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// Load the catalog for a framework token: fetch fresh + snapshot the exact
-    /// bytes; on network failure, fall back to the last snapshot so scans run.
-    async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
-        match self.fetch_raw(framework).await {
-            Ok(raw) => {
-                let doc: OscalDocument = serde_json::from_slice(&raw)?;
-                if let Err(e) = self.write_snapshot(framework, &raw).await {
-                    tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
-                }
-                Ok(doc)
-            }
-            Err(fetch_err) => match self.read_snapshot(framework).await? {
-                Some(doc) => {
-                    tracing::warn!(
-                        framework, error = %fetch_err,
-                        "OSCAL catalog fetch failed; falling back to snapshot"
-                    );
-                    Ok(doc)
-                }
-                None => Err(fetch_err),
-            },
-        }
-    }
-
-    /// Load the OSCAL catalog for a compliance framework.
-    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
-        self.load_token(&framework.to_string()).await
-    }
-
-    /// Load the code-checkable master-controls catalog
-    /// (`?framework=master-controls`).
-    pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
-        self.load_token("master-controls").await
-    }
-}
-
-/// Order controls whose title/text mention the query context first (stable), then
-/// truncate to the requested limit. Naive relevance — refined when the assessment
-/// layer lands.
-fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
-    if !context.is_empty() {
-        let needle = context.to_lowercase();
-        controls.sort_by_key(|c| {
-            let hit =
-                c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
-            u8::from(!hit)
-        });
-    }
-    controls.truncate(limit);
-    controls
-}
-
-impl ControlsProvider for OscalControlsProvider {
-    fn name(&self) -> &str {
-        "breakpilot-oscal"
-    }
-
-    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
-        let mut out: Vec<Control> = Vec::new();
-        for &framework in query.frameworks {
-            match self.load(framework).await {
-                Ok(doc) => out.extend(doc.to_controls()),
-                Err(e) => {
-                    tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
-                }
-            }
-        }
-        Ok(rank_and_truncate(out, query.context, query.limit))
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
-      "version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
-      "groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
-      "props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
-
-    fn provider(dir: &std::path::Path) -> OscalControlsProvider {
-        OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
-    }
-
-    #[test]
-    fn builds_catalog_url_and_snapshot_path() {
-        let p = provider(std::path::Path::new("/snap"));
-        assert_eq!(
-            p.catalog_url("cra"),
-            "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
-        );
-        assert_eq!(
-            p.snapshot_path("cra"),
-            std::path::Path::new("/snap/oscal-catalog-cra.json")
-        );
-    }
-
-    #[test]
-    fn ranks_context_hits_first_then_truncates() {
-        let mk = |id: &str, title: &str| Control {
-            id: id.into(),
-            framework: ComplianceFramework::Cra,
-            title: title.into(),
-            text: String::new(),
-            source: None,
-        };
-        let controls = vec![
-            mk("a", "logging policy"),
-            mk("b", "multi-factor auth"),
-            mk("c", "backup"),
-        ];
-        let ranked = rank_and_truncate(controls, "auth", 2);
-        assert_eq!(ranked.len(), 2);
-        assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
-    }
-
-    #[tokio::test]
-    async fn snapshot_round_trip_and_offline_fallback() {
-        let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
-        let p = provider(&dir);
-        assert!(p.read_snapshot("cra").await.unwrap().is_none());
-        p.write_snapshot("cra", MINI_CATALOG.as_bytes())
-            .await
-            .unwrap();
-        let doc = p.read_snapshot("cra").await.unwrap().unwrap();
-        assert_eq!(doc.to_controls().len(), 1);
-        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}

compliance-agent/src/controls/scan_triage.rs

@@ -1,299 +0,0 @@
-//! Scan-pipeline integration for control triage.
-//!
-//! After the deterministic tools have produced findings, this stamps each finding
-//! with the compliance control(s) it's evidence for and marks control-level false
-//! positives — using the ingested OSCAL catalog for control text, the
-//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
-//! confirm. Skipped entirely unless breakpilot is configured.
-
-use std::collections::HashMap;
-use std::path::Path;
-use std::sync::Arc;
-
-use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
-use compliance_core::models::finding::{Finding, FindingStatus, Severity};
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::AgentConfig;
-use control_map::ControlMap;
-
-use super::surface;
-use super::{
-    ControlIndex, ControlTriage, GroundedControlChecker, LlmControlJudge, OscalControlsProvider,
-    SemanticControlChecker, TriageOutcome,
-};
-use crate::llm::LlmClient;
-
-/// Nearest master controls judged per code region in the semantic pass.
-const SEMANTIC_TOP_K: usize = 5;
-
-/// Lines of context to read on each side of a finding's line.
-const REGION_WINDOW: usize = 6;
-
-/// Triage every finding in `findings` against the CRA control map: stamp
-/// `control_refs` on confirmed findings and flag control false positives. Returns
-/// the number of findings tagged with at least one control.
-pub async fn triage_repo_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let specs = build_specs(&provider).await;
-    if specs.is_empty() {
-        return 0;
-    }
-    let map = match ControlMap::cra() {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(error = %e, "control map failed to load; skipping control triage");
-            return 0;
-        }
-    };
-    let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        match triage.triage(finding, &region).await {
-            TriageOutcome::Confirmed(controls) => {
-                finding.control_refs = controls;
-                tagged += 1;
-            }
-            TriageOutcome::FalsePositive => {
-                finding.status = FindingStatus::FalsePositive;
-                finding.triage_action = Some("control_false_positive".to_string());
-            }
-            TriageOutcome::Unmapped => {}
-        }
-    }
-    tagged
-}
-
-/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
-async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
-    let mut specs = HashMap::new();
-    match provider.load(ComplianceFramework::Cra).await {
-        Ok(doc) => {
-            for control in doc.to_controls() {
-                specs.insert(
-                    control.id.clone(),
-                    ControlCheckSpec {
-                        control_id: control.id,
-                        title: control.title,
-                        requirement: control.text,
-                        default_cwe: None,
-                        severity: Severity::Medium,
-                    },
-                );
-            }
-        }
-        Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
-    }
-    specs
-}
-
-/// Absence-based control pass (the grounded half of the hybrid coverage): for each
-/// control with a [`surface`] definition, deterministically retrieve the code
-/// surfaces it governs (login routes, logging setup, update/download code) and have
-/// the grounded judge decide whether the control holds there. Returns net-new
-/// findings, each already tagged with its control and grounded to a real snippet.
-///
-/// The orchestrator runs this when `breakpilot.grounded_control_checks` is set
-/// (on by default). Validated live; it covers the 8 absence-based CRA controls
-/// (the judge decides presence/absence, grounded to a real snippet).
-pub async fn grounded_surface_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    repo_id: &str,
-) -> Vec<Finding> {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return Vec::new();
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let specs = build_specs(&provider).await;
-    if specs.is_empty() {
-        return Vec::new();
-    }
-    let checker = GroundedControlChecker::new(LlmControlJudge::new(llm));
-
-    let mut out = Vec::new();
-    for surf in surface::SURFACES {
-        let Some(spec) = specs.get(surf.control_id) else {
-            continue; // catalog doesn't carry this control
-        };
-        let regions = surface::retrieve(repo_path, surf.terms);
-        if regions.is_empty() {
-            continue;
-        }
-        out.extend(checker.check(spec, &regions, repo_id).await);
-    }
-    out
-}
-
-/// Read a window of lines around `line` (1-based) from `repo_path/file`.
-fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
-    let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
-    let lines: Vec<&str> = content.lines().collect();
-    if lines.is_empty() {
-        return None;
-    }
-    let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
-    let start = center.saturating_sub(REGION_WINDOW);
-    let end = (center + REGION_WINDOW + 1).min(lines.len());
-    Some(CandidateRegion {
-        file: file.to_string(),
-        start_line: (start as u32) + 1,
-        content: lines[start..end].join("\n"),
-    })
-}
-
-/// Master-controls **semantic** pass: for each finding's code region, retrieve the
-/// top-K nearest master controls by embedding, have the grounded judge confirm,
-/// and stamp the confirmed control ids onto the finding — the scale path for the
-/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
-/// of findings that gained a master-control ref.
-///
-/// The orchestrator runs this when `breakpilot.semantic_mapping` is set (on by
-/// default). The control embedding index is built once and cached to
-/// `snapshot_dir` keyed by corpus hash ([`ControlIndex::load_or_build`]), so only
-/// the first scan after a catalog change pays the embedding cost.
-pub async fn semantic_stamp_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0;
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let doc = match provider.load_master_controls().await {
-        Ok(d) => d,
-        Err(e) => {
-            tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
-            return 0;
-        }
-    };
-    let specs: Vec<ControlCheckSpec> = doc
-        .to_controls()
-        .into_iter()
-        .map(|c| ControlCheckSpec {
-            control_id: c.id,
-            title: c.title,
-            requirement: c.text,
-            default_cwe: None,
-            severity: Severity::Medium,
-        })
-        .collect();
-    let cache_path =
-        Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
-    let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
-        Ok(i) if !i.is_empty() => i,
-        Ok(_) => return 0,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to embed master-controls corpus");
-            return 0;
-        }
-    };
-    let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        if finding.status == FindingStatus::FalsePositive {
-            continue;
-        }
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        // Retrieve on the finding's intent + the code, not the region alone: two
-        // findings in one file share overlapping windows and otherwise embed alike,
-        // collapsing onto the same controls. The finding's title/description carry
-        // the discriminating signal (e.g. "brute-force protection" vs "weak hash").
-        // The raw `region` still goes to the judge for snippet grounding.
-        let query = format!(
-            "{}\n{}\n\n{}",
-            finding.title, finding.description, region.content
-        );
-        let query_emb = match llm.embed(vec![query]).await {
-            Ok(mut embs) => match embs.pop() {
-                Some(v) => v,
-                None => continue,
-            },
-            Err(e) => {
-                tracing::warn!(error = %e, "query embed failed; skipping finding");
-                continue;
-            }
-        };
-        let confirmed = checker
-            .check(
-                &index,
-                &region,
-                &query_emb,
-                SEMANTIC_TOP_K,
-                &finding.repo_id,
-            )
-            .await;
-        let before = finding.control_refs.len();
-        for f in confirmed {
-            for cref in f.control_refs {
-                if !finding.control_refs.contains(&cref) {
-                    finding.control_refs.push(cref);
-                }
-            }
-        }
-        if finding.control_refs.len() > before {
-            tagged += 1;
-        }
-    }
-    tagged
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn fetch_region_windows_around_the_line() {
-        let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let file = "a.py";
-        std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
-        let r = fetch_region(&dir, file, 4).unwrap();
-        assert!(r.content.contains("SECRET=1"));
-        assert_eq!(r.start_line, 1); // window clamps to file start
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn fetch_region_missing_file_is_none() {
-        assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
-    }
-}

compliance-agent/src/controls/semantic.rs

@@ -1,121 +0,0 @@
-//! Semantic control mapping: retrieve the top-K controls nearest a code region,
-//! then confirm each with the grounded judge.
-//!
-//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
-//! what scales to the full master-control corpus: the LLM only ever judges a
-//! handful of retrieved candidates, and every surviving verdict is still anchored
-//! to real code by the grounding gate.
-
-use compliance_core::control_check::{ground, CandidateRegion};
-use compliance_core::models::Finding;
-
-use super::index::ControlIndex;
-use super::judge::ControlJudge;
-
-/// Retrieve → judge → ground, generic over the judge so tests use a stub.
-pub struct SemanticControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> SemanticControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Map a code region to the controls it violates. `query_embedding` is the
-    /// caller-supplied retrieval embedding — typically the finding's intent
-    /// (title/description) plus the region, so retrieval keys on what the finding
-    /// is *about*, not just the ambient code. The top-`k` nearest controls in
-    /// `index` are then judged against the raw `region` and grounded.
-    pub async fn check(
-        &self,
-        index: &ControlIndex,
-        region: &CandidateRegion,
-        query_embedding: &[f64],
-        k: usize,
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let candidates = index.nearest(query_embedding, k);
-        let mut findings = Vec::new();
-        for spec in &candidates {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
-    use compliance_core::models::finding::Severity;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[tokio::test]
-    async fn retrieves_then_grounds_the_nearest_control() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("mc-near"), vec![1.0, 0.0]),
-            (spec("mc-far"), vec![0.0, 1.0]),
-        ]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin\"\n".into(),
-        };
-        // Query embedding nearest to mc-near; k=1 → only mc-near is judged.
-        let findings = checker
-            .check(&index, &region, &[0.95, 0.05], 1, "repo")
-            .await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
-    }
-
-    #[tokio::test]
-    async fn ungrounded_verdict_is_dropped() {
-        let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "not in the region".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "f".into(),
-            start_line: 1,
-            content: "real code\n".into(),
-        };
-        let findings = checker.check(&index, &region, &[1.0, 0.0], 1, "repo").await;
-        assert!(findings.is_empty());
-    }
-}

compliance-agent/src/controls/surface.rs

@@ -1,258 +0,0 @@
-//! Surface retrieval for absence-based controls.
-//!
-//! Some CRA controls are violated by an *absence* — no rate limiting on login, no
-//! security logging, no signature check on an update — so there's no offending
-//! pattern for semgrep to match. Instead we deterministically locate the code
-//! *surface* the control governs (a login route, a logging setup, update/download
-//! code) by identifier/route terms, then hand each surface region to the grounded
-//! judge, which decides whether the control is satisfied there. The resulting
-//! finding grounds to the surface snippet, so nothing fabricated survives.
-//!
-//! Retrieval is intentionally cheap and bounded: keyword match + a fixed window,
-//! capped per control to keep the downstream LLM cost predictable.
-
-use std::path::Path;
-
-use compliance_core::control_check::CandidateRegion;
-
-/// An absence-based control and the case-insensitive terms that mark the code
-/// surface it governs.
-pub struct Surface {
-    pub control_id: &'static str,
-    pub terms: &'static [&'static str],
-}
-
-/// The absence-based CRA controls we retrieve surfaces for — the grounded half of
-/// the hybrid coverage (the pattern-expressible half is custom semgrep rules).
-pub const SURFACES: &[Surface] = &[
-    Surface {
-        control_id: "cra-ai-6", // Integritaetspruefung
-        terms: &[
-            "checksum",
-            "sha256",
-            "signature",
-            "hmac",
-            "integrity",
-            "verify",
-        ],
-    },
-    Surface {
-        control_id: "cra-ai-11", // Brute-Force-Schutz
-        terms: &[
-            "login",
-            "signin",
-            "authenticate",
-            "/auth",
-            "password",
-            "ratelimit",
-        ],
-    },
-    Surface {
-        control_id: "cra-ai-12", // Rollenbasierte Autorisierung (RBAC)
-        terms: &[
-            "authorize",
-            "permission",
-            "role",
-            "rbac",
-            "require_role",
-            "has_role",
-        ],
-    },
-    Surface {
-        control_id: "cra-ai-24", // Security-Logging
-        terms: &["login", "authorize", "permission", "role", "admin", "audit"],
-    },
-    Surface {
-        control_id: "cra-ai-27", // Log-Integritaet und -Aufbewahrung
-        terms: &["logging", "logger", "getlogger", "audit_log"],
-    },
-    Surface {
-        control_id: "cra-ai-28", // Sichere Update-Mechanismen
-        terms: &["update", "upgrade", "download", "firmware"],
-    },
-    Surface {
-        control_id: "cra-ai-29", // Update-Authentizitaet
-        terms: &["update", "signature", "verify", "pubkey", "certificate"],
-    },
-    Surface {
-        control_id: "cra-ai-30", // Update-Integritaet
-        terms: &["update", "checksum", "digest", "integrity", "verify"],
-    },
-];
-
-/// Source file extensions worth reading (skip binaries/assets/lockfiles).
-const CODE_EXTS: &[&str] = &[
-    "py", "js", "ts", "tsx", "jsx", "go", "java", "rb", "php", "rs", "cs", "kt",
-];
-/// Directories never worth walking.
-const SKIP_DIRS: &[&str] = &[
-    ".git",
-    "node_modules",
-    "target",
-    "vendor",
-    ".venv",
-    "__pycache__",
-    "dist",
-    "build",
-];
-/// Lines of context on each side of a hit.
-const WINDOW: usize = 6;
-/// Cap on regions per control, to bound downstream LLM calls.
-const MAX_REGIONS_PER_CONTROL: usize = 8;
-/// Skip files larger than this (generated/minified).
-const MAX_FILE_BYTES: u64 = 512 * 1024;
-
-/// Deterministically retrieve up to [`MAX_REGIONS_PER_CONTROL`] code regions in
-/// `repo_path` whose lines mention any of `terms`. Hits close together within a
-/// file are merged into one region; results are capped to bound LLM cost.
-pub fn retrieve(repo_path: &Path, terms: &[&str]) -> Vec<CandidateRegion> {
-    let lowered: Vec<String> = terms.iter().map(|t| t.to_lowercase()).collect();
-    let mut regions = Vec::new();
-    for entry in walk(repo_path) {
-        if regions.len() >= MAX_REGIONS_PER_CONTROL {
-            break;
-        }
-        let path = entry.path();
-        if !has_code_ext(path) {
-            continue;
-        }
-        let Ok(meta) = entry.metadata() else { continue };
-        if !meta.is_file() || meta.len() > MAX_FILE_BYTES {
-            continue;
-        }
-        let Ok(content) = std::fs::read_to_string(path) else {
-            continue;
-        };
-        let rel = path
-            .strip_prefix(repo_path)
-            .unwrap_or(path)
-            .to_string_lossy()
-            .to_string();
-        let lines: Vec<&str> = content.lines().collect();
-        let hits: Vec<usize> = lines
-            .iter()
-            .enumerate()
-            .filter(|(_, line)| {
-                let ll = line.to_lowercase();
-                lowered.iter().any(|t| ll.contains(t.as_str()))
-            })
-            .map(|(i, _)| i)
-            .collect();
-        for center in merge_centers(&hits) {
-            if regions.len() >= MAX_REGIONS_PER_CONTROL {
-                break;
-            }
-            let start = center.saturating_sub(WINDOW);
-            let end = (center + WINDOW + 1).min(lines.len());
-            regions.push(CandidateRegion {
-                file: rel.clone(),
-                start_line: (start as u32) + 1,
-                content: lines[start..end].join("\n"),
-            });
-        }
-    }
-    regions
-}
-
-/// Collapse ascending hit indices that fall within one window into a single
-/// representative center, so overlapping regions aren't judged repeatedly.
-fn merge_centers(hits: &[usize]) -> Vec<usize> {
-    let mut out: Vec<usize> = Vec::new();
-    for &h in hits {
-        match out.last() {
-            Some(&last) if h.saturating_sub(last) <= WINDOW => {}
-            _ => out.push(h),
-        }
-    }
-    out
-}
-
-fn has_code_ext(path: &Path) -> bool {
-    path.extension()
-        .and_then(|e| e.to_str())
-        .is_some_and(|e| CODE_EXTS.contains(&e))
-}
-
-fn walk(root: &Path) -> Vec<walkdir::DirEntry> {
-    walkdir::WalkDir::new(root)
-        .into_iter()
-        .filter_entry(|e| {
-            let name = e.file_name().to_string_lossy();
-            !SKIP_DIRS.contains(&name.as_ref())
-        })
-        .filter_map(|e| e.ok())
-        .collect()
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn write(dir: &Path, rel: &str, body: &str) {
-        let p = dir.join(rel);
-        if let Some(parent) = p.parent() {
-            std::fs::create_dir_all(parent).unwrap();
-        }
-        std::fs::write(p, body).unwrap();
-    }
-
-    fn terms_for(control_id: &str) -> &'static [&'static str] {
-        SURFACES
-            .iter()
-            .find(|s| s.control_id == control_id)
-            .unwrap()
-            .terms
-    }
-
-    #[test]
-    fn surfaces_cover_the_absence_based_controls() {
-        assert_eq!(SURFACES.len(), 8);
-        for id in [
-            "cra-ai-6",
-            "cra-ai-11",
-            "cra-ai-12",
-            "cra-ai-24",
-            "cra-ai-27",
-            "cra-ai-28",
-            "cra-ai-29",
-            "cra-ai-30",
-        ] {
-            assert!(SURFACES.iter().any(|s| s.control_id == id), "{id} missing");
-        }
-    }
-
-    #[test]
-    fn retrieves_matching_region_with_context() {
-        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        write(
-            &dir,
-            "app/auth.py",
-            "import x\n\n\n\n\n\n\ndef login(u, p):\n    return check(u, p)\n",
-        );
-        let regions = retrieve(&dir, terms_for("cra-ai-11"));
-        assert_eq!(regions.len(), 1);
-        assert!(regions[0].content.contains("def login"));
-        assert_eq!(regions[0].file, "app/auth.py");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn skips_non_code_and_vendored() {
-        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        write(&dir, "README.md", "login and password and audit\n"); // not code ext
-        write(&dir, "node_modules/pkg/index.js", "function login() {}\n"); // vendored
-        assert!(retrieve(&dir, terms_for("cra-ai-11")).is_empty());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn merges_adjacent_hits_into_one_region() {
-        // Two hits one line apart collapse to a single center/region.
-        assert_eq!(merge_centers(&[10, 11, 30]), vec![10, 30]);
-        assert_eq!(merge_centers(&[]), Vec::<usize>::new());
-        assert_eq!(merge_centers(&[5]), vec![5]);
-    }
-}

compliance-agent/src/controls/triage.rs

@@ -1,234 +0,0 @@
-//! Triage step: confirm/refute a deterministic tool finding against the controls
-//! it maps to (via the `control-map` LUT), grounding the judgment.
-//!
-//! This is where the LLM finally enters — as a **false-positive filter over tool
-//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
-//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
-//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
-//! judge then confirms or refutes each, and only judgments anchored to real code
-//! survive.
-
-use std::collections::HashMap;
-
-use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
-use compliance_core::models::Finding;
-use control_map::ControlMap;
-
-use super::judge::ControlJudge;
-
-/// What triage decided for one tool finding.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TriageOutcome {
-    /// The finding maps to no control in the LUT — keep it, untagged.
-    Unmapped,
-    /// Maps to controls and the grounded judge confirmed at least one — keep the
-    /// finding and tag it with these control ids.
-    Confirmed(Vec<String>),
-    /// Maps to controls but the judge grounded none — treat as a false positive.
-    FalsePositive,
-}
-
-/// Triages tool findings against the control map, confirming with a grounded judge.
-pub struct ControlTriage<J> {
-    judge: J,
-    map: ControlMap,
-    /// Control requirement specs (by control id), built from the ingested catalog.
-    specs: HashMap<String, ControlCheckSpec>,
-}
-
-impl<J: ControlJudge> ControlTriage<J> {
-    pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
-        Self { judge, map, specs }
-    }
-
-    /// Triage one tool finding. `region` is the code around the finding, used as
-    /// the grounding evidence for the judge.
-    pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
-        // Match by CWE (off-the-shelf findings) and/or rule id (our custom
-        // detectors, which carry no LUT-bound CWE). A finding with neither is
-        // simply unmapped.
-        let mapped = self.map.controls_for_finding(
-            &finding.scanner,
-            finding.cwe.as_deref(),
-            finding.rule_id.as_deref(),
-        );
-        if mapped.is_empty() {
-            return TriageOutcome::Unmapped;
-        }
-
-        let mut confirmed = Vec::new();
-        for entry in mapped {
-            let Some(spec) = self.specs.get(&entry.control) else {
-                continue;
-            };
-            let verdict = self.judge.judge(spec, region).await;
-            // The verdict only counts if it grounds to real code in the region.
-            if ground(spec, region, &verdict, &finding.repo_id).is_some() {
-                confirmed.push(entry.control.clone());
-            }
-        }
-
-        if confirmed.is_empty() {
-            TriageOutcome::FalsePositive
-        } else {
-            TriageOutcome::Confirmed(confirmed)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::LlmVerdict;
-    use compliance_core::models::finding::Severity;
-    use compliance_core::models::scan::ScanType;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn specs() -> HashMap<String, ControlCheckSpec> {
-        let mut m = HashMap::new();
-        m.insert(
-            "cra-ai-8".to_string(),
-            ControlCheckSpec {
-                control_id: "cra-ai-8".into(),
-                title: "No default passwords".into(),
-                requirement: "No default credentials".into(),
-                default_cwe: Some("CWE-798".into()),
-                severity: Severity::High,
-            },
-        );
-        m
-    }
-
-    fn semgrep_finding(cwe: &str) -> Finding {
-        let mut f = Finding::new(
-            "repo".into(),
-            "fp1".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "hardcoded credential".into(),
-            "desc".into(),
-            Severity::High,
-        );
-        f.cwe = Some(cwe.into());
-        f
-    }
-
-    fn region() -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin123\"\n".into(),
-        }
-    }
-
-    #[tokio::test]
-    async fn confirmed_finding_is_tagged_with_control() {
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "PASSWORD = \"admin123\"".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
-        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
-    }
-
-    #[tokio::test]
-    async fn refuted_mapped_finding_is_false_positive() {
-        // Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: false,
-                    snippet: String::new(),
-                    cwe: None,
-                    confidence: 0.1,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
-        assert_eq!(out, TriageOutcome::FalsePositive);
-    }
-
-    #[tokio::test]
-    async fn custom_rule_finding_without_cwe_is_confirmed() {
-        // A custom detector finding carries a rule id but no LUT-bound CWE; it must
-        // still map (by rule id) and confirm.
-        let mut specs = specs();
-        specs.insert(
-            "cra-ai-1".to_string(),
-            ControlCheckSpec {
-                control_id: "cra-ai-1".into(),
-                title: "Secure-by-Default".into(),
-                requirement: "Ship secure defaults".into(),
-                default_cwe: None,
-                severity: Severity::Medium,
-            },
-        );
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "app.run(debug=True)".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs,
-        );
-        let mut f = Finding::new(
-            "repo".into(),
-            "fp".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "flask debug".into(),
-            "desc".into(),
-            Severity::Medium,
-        );
-        f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
-        let region = CandidateRegion {
-            file: "app.py".into(),
-            start_line: 1,
-            content: "app.run(debug=True)\n".into(),
-        };
-        let out = triage.triage(&f, &region).await;
-        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
-    }
-
-    #[tokio::test]
-    async fn unmapped_cwe_is_left_untagged() {
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "PASSWORD = \"admin123\"".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage
-            .triage(&semgrep_finding("CWE-99999"), &region())
-            .await;
-        assert_eq!(out, TriageOutcome::Unmapped);
-    }
-}

compliance-agent/src/database.rs

@@ -465,34 +465,6 @@ impl Database {
             )
             .await?;
 
-        // werkbank_jobs: unique job id (idempotent enqueue by job id)
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "job.id": 1 })
-                    .options(IndexOptions::builder().unique(true).build())
-                    .build(),
-            )
-            .await?;
-
-        // werkbank_jobs: lease query — oldest queued job for an executor
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // werkbank_jobs: visibility-timeout sweep of expired leases
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "lease_expires_at": 1 })
-                    .build(),
-            )
-            .await?;
-
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -591,12 +563,6 @@ impl Database {
         self.inner.collection("pentest_messages")
     }
 
-    /// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
-    /// control plane enqueues and runners lease.
-    pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
-        self.inner.collection("werkbank_jobs")
-    }
-
     #[allow(dead_code)]
     pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
         self.inner.collection(name)

compliance-agent/src/error.rs

@@ -27,9 +27,6 @@ pub enum AgentError {
     #[error("Configuration error: {0}")]
     Config(String),
 
-    #[error("Dynamic-execution error: {0}")]
-    Exec(#[from] werkbank_exec::ExecError),
-
     #[error("{0}")]
     Other(String),
 }

compliance-agent/src/ingest/blob.rs

@@ -32,30 +32,6 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
     Ok((hex::encode(hasher.finalize()), total))
 }
 
-/// Store raw bytes in the content-addressed blob store under `base`, returning
-/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
-/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
-pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
-    let sha = hex::encode(Sha256::digest(bytes));
-    let dir = base.join("blobs").join(&sha[0..2]);
-    fs::create_dir_all(&dir)?;
-    let dest = dir.join(&sha);
-    if !dest.exists() {
-        fs::write(&dest, bytes)?;
-    }
-    Ok(sha)
-}
-
-/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
-/// so a request can't traverse outside the blob store.
-pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
-    if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
-        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
-    }
-    let path = base.join("blobs").join(&sha[0..2]).join(sha);
-    Ok(fs::read(path)?)
-}
-
 /// Copy `src` into the content-addressed blob store under `base`, returning the
 /// stored path. Idempotent: an already-present blob is not rewritten.
 pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {

compliance-agent/src/ingest/mod.rs

@@ -6,7 +6,7 @@
 //! is also the reconciliation key against sibling products (a firmware sha256
 //! matches tramiton's `Artifact.sha256`).
 
-pub(crate) mod blob;
+mod blob;
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};

compliance-agent/src/lib.rs

@@ -4,7 +4,6 @@ pub mod agent;
 pub mod api;
 pub mod classify;
 pub mod config;
-pub mod controls;
 pub mod database;
 pub mod error;
 pub mod ingest;
@@ -17,4 +16,3 @@ pub mod ssh;
 #[allow(dead_code)]
 pub mod trackers;
 pub mod webhooks;
-pub mod werkbank;

compliance-agent/src/llm/embedding.rs

@@ -22,11 +22,6 @@ struct EmbeddingData {
     index: usize,
 }
 
-/// Max inputs per embedding request. The bge/OpenAI-like backends cap the input
-/// array (bge-multilingual-gemma2 rejects >25 with "batch size overflow"), so we
-/// chunk larger corpora — a whole control catalog (~1.8k) would otherwise 500.
-const EMBED_BATCH_SIZE: usize = 16;
-
 // ── Embedding implementation ───────────────────────────────────
 
 impl LlmClient {
@@ -34,21 +29,8 @@ impl LlmClient {
         &self.embed_model
     }
 
-    /// Generate embeddings for a batch of texts, chunking into backend-sized
+    /// Generate embeddings for a batch of texts
-    /// requests and preserving input order across chunks.
     pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
-        if texts.is_empty() {
-            return Ok(Vec::new());
-        }
-        let mut out = Vec::with_capacity(texts.len());
-        for chunk in texts.chunks(EMBED_BATCH_SIZE) {
-            out.extend(self.embed_batch(chunk.to_vec()).await?);
-        }
-        Ok(out)
-    }
-
-    /// Embed one backend-sized batch (≤ [`EMBED_BATCH_SIZE`]) in a single request.
-    async fn embed_batch(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
         let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));
 
         let request_body = EmbeddingRequest {
@@ -90,33 +72,3 @@ impl LlmClient {
         Ok(data.into_iter().map(|d| d.embedding).collect())
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use secrecy::SecretString;
-
-    fn client() -> LlmClient {
-        LlmClient::new(
-            "http://unused".into(),
-            SecretString::from(String::new()),
-            "m".into(),
-            "e".into(),
-        )
-    }
-
-    #[tokio::test]
-    async fn empty_input_makes_no_request() {
-        // Must short-circuit before any HTTP call (base_url is unroutable).
-        let out = client().embed(Vec::new()).await.unwrap();
-        assert!(out.is_empty());
-    }
-
-    #[test]
-    fn batch_size_is_within_backend_cap() {
-        assert!(
-            EMBED_BATCH_SIZE <= 25,
-            "must stay under the bge 25-input cap"
-        );
-    }
-}

compliance-agent/src/pentest/cleanup.rs

@@ -342,9 +342,6 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
-            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-            werkbank_runner_token: None,
-            breakpilot: compliance_core::config::BreakpilotConfig::default(),
         }
     }
 

compliance-agent/src/pipeline/ics/mod.rs

@@ -14,7 +14,7 @@ use std::time::Duration;
 
 use compliance_core::models::{Finding, ScanType, Severity};
 
-use crate::fingerprint as dedup;
+use crate::pipeline::dedup;
 
 /// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
 const MODBUS_PORT: u16 = 502;
@@ -103,39 +103,6 @@ async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration)
         );
         findings.push(f);
     }
-
-    // Exposed process points: coils / holding registers that a read enumerated
-    // and that, over unauthenticated Modbus/TCP, are also writable. This is the
-    // concrete attack surface behind the exposure — the live variables an
-    // attacker can overwrite. (Read-only to detect: we never write.)
-    let coils = probe.coils_readable.unwrap_or(0);
-    let registers = probe.holding_registers_readable.unwrap_or(0);
-    if coils > 0 || registers > 0 {
-        let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed-points", &target]);
-        let mut f = Finding::new(
-            repo_id.to_string(),
-            fp,
-            "ics-probe".to_string(),
-            ScanType::IcsProbe,
-            "Writable process points exposed over unauthenticated Modbus/TCP".to_string(),
-            format!(
-                "Reading the device at {target} enumerated {coils} coil(s) and {registers} \
-                 holding register(s). Coils and holding registers are read/write process points \
-                 in Modbus, so any host that can reach this port can not only read but overwrite \
-                 live process state (force coils, change setpoints) without authentication."
-            ),
-            Severity::High,
-        );
-        f.rule_id = Some("ics-modbus-exposed-points".to_string());
-        f.cwe = Some("CWE-306".to_string());
-        f.remediation = Some(
-            "Segment the Modbus/TCP port to a trusted control network; where the device \
-             supports it use Modbus/TLS or an authenticating protocol gateway; restrict which \
-             function codes and register ranges are reachable from outside the control zone."
-                .to_string(),
-        );
-        findings.push(f);
-    }
     findings
 }
 

compliance-agent/src/pipeline/ics/modbus.rs

@@ -21,13 +21,6 @@ pub struct ModbusProbe {
     pub speaks_modbus: bool,
     /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
     pub device: Option<DeviceId>,
-    /// Coils returned by a Read Coils of the first block, if that address range
-    /// exists. Coils are read/write process bits, so an exposed block is an
-    /// unauthenticated write surface on the live process.
-    pub coils_readable: Option<u16>,
-    /// Holding registers returned by a Read Holding Registers of the first block,
-    /// if that range exists. Holding registers are read/write process words.
-    pub holding_registers_readable: Option<u16>,
 }
 
 /// Vendor / product / revision from Read Device Identification.
@@ -38,13 +31,8 @@ pub struct DeviceId {
     pub revision: Option<String>,
 }
 
-/// How many coils / holding registers to request when enumerating the exposed
+/// Probe a Modbus/TCP endpoint. Read-only: issues a Read Holding Registers and a
-/// process surface. Read-only: a normal reply means the block exists and is,
+/// Read Device Identification request; never writes to the device.
-/// over unauthenticated Modbus/TCP, also writable.
-const ENUM_QTY: u16 = 16;
-
-/// Probe a Modbus/TCP endpoint. Read-only: issues Read Holding Registers, Read
-/// Coils, and Read Device Identification requests; never writes to the device.
 pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
     let mut out = ModbusProbe::default();
     let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
@@ -52,28 +40,13 @@ pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
     };
     out.reachable = true;
 
-    // Read Holding Registers (FC 0x03), unit 1, addr 0 — a benign read that also
+    // Read Holding Registers (FC 0x03), unit 1, addr 0, qty 1 — a benign read.
-    // enumerates the exposed register block.
+    let rhr = [0x03u8, 0x00, 0x00, 0x00, 0x01];
-    let rhr = [0x03u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
     if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
         // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
         if matches!(resp.first(), Some(0x03) | Some(0x83)) {
             out.speaks_modbus = true;
         }
-        if resp.first() == Some(&0x03) {
-            out.holding_registers_readable = Some(register_count_from_reply(&resp));
-        }
-    }
-
-    // Read Coils (FC 0x01), addr 0 — enumerates the exposed coil (bit) block.
-    let rc = [0x01u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
-    if let Some(resp) = txn(&mut stream, 1, &rc, budget).await {
-        if matches!(resp.first(), Some(0x01) | Some(0x81)) {
-            out.speaks_modbus = true;
-        }
-        if resp.first() == Some(&0x01) {
-            out.coils_readable = Some(coil_count_from_reply(&resp));
-        }
     }
 
     // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
@@ -87,17 +60,6 @@ pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
     out
 }
 
-/// Coils reported by a Read Coils reply `[0x01, byte_count, data…]` (8 per byte).
-fn coil_count_from_reply(pdu: &[u8]) -> u16 {
-    pdu.get(1).map(|&b| u16::from(b) * 8).unwrap_or(0)
-}
-
-/// Registers reported by a Read Holding Registers reply `[0x03, byte_count,
-/// data…]` (2 bytes per register).
-fn register_count_from_reply(pdu: &[u8]) -> u16 {
-    pdu.get(1).map(|&b| u16::from(b) / 2).unwrap_or(0)
-}
-
 /// Send one Modbus PDU and return the response PDU (function code + data), or
 /// `None` on timeout / malformed reply.
 async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
@@ -192,8 +154,7 @@ mod tests {
                     break;
                 }
                 let reply_pdu: Vec<u8> = match pdu.first() {
-                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register (byte_count 2)
+                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register = 0
-                    Some(0x01) => vec![0x01, 0x02, 0xFF, 0xFF], // 16 coils (byte_count 2)
                     Some(0x2B) if with_device => vec![
                         0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
                         0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
@@ -224,24 +185,6 @@ mod tests {
         assert_eq!(dev.product.as_deref(), Some("PLC"));
     }
 
-    #[tokio::test]
-    async fn probe_enumerates_exposed_process_points() {
-        let addr = mock_server(false).await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.speaks_modbus);
-        // The mock returns a 2-byte holding-register block (1 register) and a
-        // 2-byte coil block (16 coils).
-        assert_eq!(p.holding_registers_readable, Some(1));
-        assert_eq!(p.coils_readable, Some(16));
-    }
-
-    #[test]
-    fn reply_counts_decode_byte_counts() {
-        assert_eq!(register_count_from_reply(&[0x03, 0x08]), 4); // 8 bytes → 4 regs
-        assert_eq!(coil_count_from_reply(&[0x01, 0x03]), 24); // 3 bytes → 24 coils
-        assert_eq!(register_count_from_reply(&[0x03]), 0); // malformed → 0
-    }
-
     #[tokio::test]
     async fn probe_reports_unreachable_for_a_closed_port() {
         // 127.0.0.1:1 is (almost certainly) closed.

compliance-agent/src/pipeline/mod.rs

@@ -5,6 +5,7 @@ pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
+pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;

compliance-agent/src/pipeline/orchestrator.rs

@@ -215,72 +215,8 @@ impl PipelineOrchestrator {
         .await;
         tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
 
-        // Stage 5b: control triage — stamp findings with the compliance control(s)
+        // Dedup against existing findings and insert new ones
-        // they're evidence for and flag control false positives (grounded LLM over
-        // deterministic tool output). No-op unless breakpilot is configured.
-        self.update_phase(scan_run_id, "control_triage").await;
-        let tagged = crate::controls::triage_repo_findings(
-            &self.config,
-            self.llm.clone(),
-            &repo_path,
-            &mut all_findings,
-        )
-        .await;
-        if tagged > 0 {
-            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
-        }
-
-        // Stage 5c: semantic control mapping — scale path for the master-controls
-        // corpus (no CWE to LUT on): embed each finding's region, retrieve the
-        // nearest master controls, grounded-judge, and stamp confirmed refs. On by
-        // default (validated live); the corpus embedding is cached so only the
-        // first scan after a catalog change pays it.
-        if self.config.breakpilot.semantic_mapping {
-            self.update_phase(scan_run_id, "semantic_control_mapping")
-                .await;
-            let sem = crate::controls::semantic_stamp_findings(
-                &self.config,
-                self.llm.clone(),
-                &repo_path,
-                &mut all_findings,
-            )
-            .await;
-            if sem > 0 {
-                tracing::info!(
-                    "[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
-                );
-            }
-        }
-
-        // Stage 5d: grounded surface checks — the absence-based controls (no
-        // rate limiting, no security logging, no update-signature check) have no
-        // syntactic pattern to match, so we retrieve the code surface each governs
-        // and let the grounded judge decide whether it holds, producing net-new
-        // findings already tagged + grounded. On by default (validated live); it
-        // covers the 8 absence-based CRA controls.
-        if self.config.breakpilot.grounded_control_checks {
-            self.update_phase(scan_run_id, "grounded_control_checks")
-                .await;
-            let grounded = crate::controls::grounded_surface_findings(
-                &self.config,
-                self.llm.clone(),
-                &repo_path,
-                &repo_id,
-            )
-            .await;
-            if !grounded.is_empty() {
-                tracing::info!(
-                    "[{repo_id}] Grounded surface checks raised {} control findings",
-                    grounded.len()
-                );
-                all_findings.extend(grounded);
-            }
-        }
-
-        // Dedup against existing findings: insert first-seen ones, and refresh the
-        // control mappings on ones we've seen before.
         let mut new_count = 0u32;
-        let mut refreshed_count = 0u32;
         let mut new_findings: Vec<Finding> = Vec::new();
         for mut finding in all_findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
@@ -295,25 +231,8 @@ impl PipelineOrchestrator {
                 finding.id = result.inserted_id.as_object_id();
                 new_findings.push(finding);
                 new_count += 1;
-            } else if !finding.control_refs.is_empty() {
-                // Re-scan refresh: a mapping pass (newly enabled or tuned) computed
-                // control_refs for a finding first seen before mapping ran. Persist
-                // them onto the existing row — the insert path alone never would.
-                self.db
-                    .findings()
-                    .update_one(
-                        doc! { "fingerprint": &finding.fingerprint },
-                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
-                    )
-                    .await?;
-                refreshed_count += 1;
             }
         }
-        if refreshed_count > 0 {
-            tracing::info!(
-                "[{repo_id}] Refreshed control_refs on {refreshed_count} existing findings"
-            );
-        }
 
         // Remove stale SBOM entries for this repo before reinserting
         if !sbom_entries.is_empty() {
@@ -485,21 +404,6 @@ impl PipelineOrchestrator {
         let ics = plan.has(ScanType::IcsProbe);
         if plc {
             new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
-            // Provision-and-test (#183): with the control logic but no reachable
-            // device, instantiate it on an ephemeral soft-PLC and probe that
-            // instead of the customer's OT network. Opt-in (needs Docker) and only
-            // when there is no live URL to probe directly. Never fails the scan.
-            if self.config.plc_runtime.enabled && target.live_url().is_none() {
-                match self
-                    .run_provisioned_plc_test(target, &target_id, scan_run_id)
-                    .await
-                {
-                    Ok(n) => new_count += n,
-                    Err(e) => {
-                        tracing::warn!(target_id = %target_id, error = %e, "provision-and-test failed")
-                    }
-                }
-            }
         }
         if ics {
             new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
@@ -586,21 +490,7 @@ impl PipelineOrchestrator {
             let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
                 continue;
             };
-            let mut source_findings = crate::pipeline::plc::analyze_tree(&path, target_id);
+            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
-            // Control mapping for the PLC path (run_plc_scan is separate from
-            // run_pipeline, which does its own mapping). PLC findings carry
-            // file_path/line/cwe, so the semantic pass reads each region under this
-            // source's `path` and stamps master-control refs. The LUT + grounded
-            // surface passes are code-pattern / CRA-specific and don't apply to
-            // IEC 61131-3 control logic, so only the semantic pass runs here.
-            crate::controls::semantic_stamp_findings(
-                &self.config,
-                self.llm.clone(),
-                &path,
-                &mut source_findings,
-            )
-            .await;
-            all_findings.extend(source_findings);
             // Control-application SBOM: CODESYS libraries + runtime from a
             // `.projectarchive` (uploaded, or committed in the working tree).
             let archive = a
@@ -625,7 +515,6 @@ impl PipelineOrchestrator {
         );
 
         let mut new_count = 0u32;
-        let mut refreshed_count = 0u32;
         for mut finding in all_findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
             if self
@@ -637,27 +526,8 @@ impl PipelineOrchestrator {
             {
                 self.db.findings().insert_one(&finding).await?;
                 new_count += 1;
-            } else if !finding.control_refs.is_empty() {
-                // Re-scan refresh: mirror run_pipeline — persist newly-computed
-                // control_refs onto a PLC finding first seen before the semantic
-                // pass ran. The insert path alone never would, so without this a
-                // PLC re-scan can only pick up mappings via a delete + re-add.
-                self.db
-                    .findings()
-                    .update_one(
-                        doc! { "fingerprint": &finding.fingerprint },
-                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
-                    )
-                    .await?;
-                refreshed_count += 1;
             }
         }
-        if refreshed_count > 0 {
-            tracing::info!(
-                target_id,
-                "Refreshed control_refs on {refreshed_count} existing PLC findings"
-            );
-        }
 
         if !all_sbom.is_empty() {
             if let Err(e) = self
@@ -670,97 +540,6 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
-    /// Provision-and-test (#183): instantiate the target's control logic on an
-    /// ephemeral soft-PLC (OpenPLC), start it, probe the provisioned Modbus
-    /// endpoint, and tear the instance down. Used when a PLC/SPS target has the
-    /// control logic but no reachable live device to probe directly. Guarded by
-    /// `plc_runtime.enabled` (needs Docker); persists the same [`ScanType::IcsProbe`]
-    /// findings as a live probe.
-    async fn run_provisioned_plc_test(
-        &self,
-        target: &OnboardedTarget,
-        target_id: &str,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
-        self.update_phase(scan_run_id, "plc_provision").await;
-
-        // Locate a loadable control-logic program among the PLC-source artifacts
-        // (same selection as the static PLC scan: dedicated PLC projects plus code
-        // artifacts holding PLCopen XML / ST exports).
-        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
-        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
-        let program = target
-            .artifacts
-            .iter()
-            .filter(|a| {
-                matches!(
-                    a.kind,
-                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-                )
-            })
-            .find_map(|a| {
-                let path = ingest_set
-                    .get(&a.id)
-                    .and_then(|ia| ia.working_path.clone())?;
-                werkbank_exec::plc::extract_program(&path)
-            });
-        let Some(program) = program else {
-            tracing::info!(
-                target_id,
-                "provision-and-test: no loadable control-logic program"
-            );
-            return Ok(0);
-        };
-
-        let http = werkbank_exec::plc::http_client()?;
-        let provisioner = werkbank_exec::plc::DockerSoftPlc::new(self.config.plc_runtime.clone());
-        let outcome = werkbank_exec::plc::provision_and_test(
-            &provisioner,
-            &http,
-            &self.config.plc_runtime,
-            &program,
-            target_id,
-        )
-        .await?;
-        tracing::info!(
-            target_id,
-            found = outcome.findings.len(),
-            dast = outcome.dast.is_some(),
-            "provision-and-test complete"
-        );
-
-        let mut new_count = 0u32;
-        for mut finding in outcome.findings {
-            finding.scan_run_id = Some(scan_run_id.to_string());
-            if self
-                .db
-                .findings()
-                .find_one(doc! { "fingerprint": &finding.fingerprint })
-                .await?
-                .is_none()
-            {
-                self.db.findings().insert_one(&finding).await?;
-                new_count += 1;
-            }
-        }
-
-        // Persist the DAST scan of the provisioned web endpoint, linked to this
-        // scan run (mirrors `maybe_trigger_dast`).
-        if let Some(dast) = outcome.dast {
-            let mut scan_run = dast.scan_run;
-            scan_run.sast_scan_run_id = Some(scan_run_id.to_string());
-            if let Err(e) = self.db.dast_scan_runs().insert_one(&scan_run).await {
-                tracing::warn!(target_id, error = %e, "failed to store provisioned DAST scan run");
-            }
-            for finding in &dast.findings {
-                if let Err(e) = self.db.dast_findings().insert_one(finding).await {
-                    tracing::warn!(target_id, error = %e, "failed to store provisioned DAST finding");
-                }
-            }
-        }
-        Ok(new_count)
-    }
-
     /// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
     /// and persist findings for exposed / unauthenticated control access. The
     /// probe is read-only; it targets the Modbus port of the target's live URL.
@@ -777,7 +556,7 @@ impl PipelineOrchestrator {
         };
         // Short per-request budget so an unreachable device doesn't stall the scan.
         let budget = std::time::Duration::from_secs(5);
-        let findings = werkbank_exec::ics::probe_target(&endpoint, target_id, budget).await;
+        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
         tracing::info!(
             target_id,
             endpoint = %endpoint,

compliance-agent/src/pipeline/semgrep.rs

@@ -1,4 +1,4 @@
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use compliance_core::models::{Finding, ScanType, Severity};
 use compliance_core::traits::{ScanOutput, Scanner};
@@ -6,30 +6,6 @@ use compliance_core::CoreError;
 
 use crate::pipeline::dedup;
 
-/// Custom CRA-control detectors bundled into the binary and staged to a temp file
-/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
-/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
-/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
-/// keyed back to its control by the `control-map` LUT.
-const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
-
-/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
-/// rename). Returns `None` on failure — the scan then runs with auto rules only.
-async fn stage_cra_rules() -> Option<PathBuf> {
-    let dir = std::env::temp_dir();
-    let path = dir.join("compliance-cra-semgrep.yaml");
-    let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
-    if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
-        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
-        return None;
-    }
-    if let Err(e) = tokio::fs::rename(&tmp, &path).await {
-        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
-        return None;
-    }
-    Some(path)
-}
-
 pub struct SemgrepScanner;
 
 impl Scanner for SemgrepScanner {
@@ -43,26 +19,30 @@ impl Scanner for SemgrepScanner {
 
     #[tracing::instrument(skip_all)]
     async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let cra_rules = stage_cra_rules().await;
+        let output = tokio::time::timeout(
-        let mut command = tokio::process::Command::new("semgrep");
+            std::time::Duration::from_secs(600),
-        command.arg("--config=auto");
+            tokio::process::Command::new("semgrep")
-        if let Some(path) = &cra_rules {
+                .args([
-            command.arg(format!("--config={}", path.display()));
+                    "--config=auto",
-        }
+                    "--json",
-        command
+                    "--quiet",
-            .args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
+                    "--max-memory",
-            .arg(repo_path);
+                    "500",
-
+                    "--jobs",
-        let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
+                    "1",
-            .await
+                ])
-            .map_err(|_| CoreError::Scanner {
+                .arg(repo_path)
-                scanner: "semgrep".to_string(),
+                .output(),
-                source: "timed out after 10 minutes".into(),
+        )
-            })?
+        .await
-            .map_err(|e| CoreError::Scanner {
+        .map_err(|_| CoreError::Scanner {
-                scanner: "semgrep".to_string(),
+            scanner: "semgrep".to_string(),
-                source: Box::new(e),
+            source: "timed out after 10 minutes".into(),
-            })?;
+        })?
+        .map_err(|e| CoreError::Scanner {
+            scanner: "semgrep".to_string(),
+            source: Box::new(e),
+        })?;
 
         if !output.status.success() && output.stdout.is_empty() {
             let stderr = String::from_utf8_lossy(&output.stderr);
@@ -102,7 +82,10 @@ impl Scanner for SemgrepScanner {
                 finding.file_path = Some(r.path);
                 finding.line_number = Some(r.start.line);
                 finding.code_snippet = Some(r.extra.lines);
-                finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
+                finding.cwe = r
+                    .extra
+                    .metadata
+                    .and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
                 finding
             })
             .collect();
@@ -141,34 +124,10 @@ struct SemgrepExtra {
     metadata: Option<serde_json::Value>,
 }
 
-/// semgrep emits `metadata.cwe` as a list of strings like
-/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
-/// the first entry and normalise it to just the `CWE-NNN` id.
-fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
-    let raw = metadata.get("cwe")?;
-    let text = match raw {
-        serde_json::Value::Array(items) => items.first()?.as_str()?,
-        serde_json::Value::String(s) => s.as_str(),
-        _ => return None,
-    };
-    let id = text.split(':').next().unwrap_or(text).trim();
-    (!id.is_empty()).then(|| id.to_string())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn extract_cwe_handles_list_and_normalises() {
-        let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
-        assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
-        let bare = serde_json::json!({"cwe": "CWE-89"});
-        assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
-        let none = serde_json::json!({"severity": "ERROR"});
-        assert_eq!(extract_cwe(&none), None);
-    }
-
     #[test]
     fn deserialize_semgrep_output() {
         let json = r#"{

compliance-agent/src/werkbank/mod.rs

@@ -1,10 +0,0 @@
-//! Werkbank control-plane: the dynamic-execution job queue.
-//!
-//! The control plane enqueues declarative [`Job`](compliance_core::models::werkbank::Job)s
-//! and Werkbank runners lease, run, and complete them. [`queue::JobQueue`] is the
-//! Mongo-backed queue behind that flow (WB-02); the runner-facing HTTP transport
-//! and the runner itself land in later stories.
-
-pub mod queue;
-
-pub use queue::{JobQueue, SweepOutcome};

compliance-agent/src/werkbank/queue.rs

@@ -1,309 +0,0 @@
-//! The Mongo-backed Werkbank job queue (WB-02).
-//!
-//! A pull queue: the control plane [`enqueue`](JobQueue::enqueue)s jobs; a runner
-//! [`lease`](JobQueue::lease)s the oldest queued job it can run (matched by
-//! executor + labels), [`heartbeat`](JobQueue::heartbeat)s while it works, and
-//! [`complete`](JobQueue::complete)s it. Leases carry a visibility timeout: if a
-//! runner dies mid-job its heartbeats stop, the lease expires, and
-//! [`sweep_expired`](JobQueue::sweep_expired) returns the job to `queued` (or
-//! `expired` once it has been retried too many times).
-//!
-//! All state transitions are single atomic Mongo updates guarded by the lease
-//! token, so two runners can never both own a job. Every operation takes an
-//! explicit `now` so the queue's time-dependent behaviour is deterministically
-//! testable.
-
-use std::time::Duration;
-
-use chrono::{DateTime, Utc};
-use mongodb::bson::{doc, Bson, DateTime as BsonDateTime};
-use mongodb::error::{ErrorKind, WriteFailure};
-use mongodb::options::ReturnDocument;
-use mongodb::Collection;
-
-use compliance_core::models::werkbank::{
-    Executor, HeartbeatAck, Job, JobRecord, JobResult, JobStatus, LeasedJob,
-};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// The non-terminal states a job can be swept or cancelled from.
-const ACTIVE_STATES: [&str; 2] = ["leased", "running"];
-/// Every terminal state (no further transitions).
-const TERMINAL_STATES: [&str; 4] = ["succeeded", "failed", "expired", "cancelled"];
-
-/// What a visibility-timeout sweep did.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub struct SweepOutcome {
-    /// Expired-lease jobs returned to `queued` for another runner.
-    pub requeued: u64,
-    /// Jobs that had exhausted their attempts and were marked `expired`.
-    pub expired: u64,
-}
-
-/// The Mongo-backed job queue.
-pub struct JobQueue {
-    coll: Collection<JobRecord>,
-}
-
-impl JobQueue {
-    /// Build a queue over a tenant database's `werkbank_jobs` collection.
-    pub fn new(db: &Database) -> Self {
-        Self {
-            coll: db.werkbank_jobs(),
-        }
-    }
-
-    /// Enqueue a job. Idempotent by job id: a job that is already present is a
-    /// no-op. Returns `true` if this call inserted it, `false` if it existed.
-    pub async fn enqueue(&self, job: Job, now: DateTime<Utc>) -> Result<bool, AgentError> {
-        let record = JobRecord::queued(job, now);
-        match self.coll.insert_one(&record).await {
-            Ok(_) => Ok(true),
-            Err(e) if is_duplicate_key(&e) => Ok(false),
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// Atomically lease the oldest `queued` job this runner can run — matched by
-    /// executor and by labels (every label the job requires must be one the
-    /// runner advertises). Returns the job plus a lease token, or `None` if
-    /// nothing is runnable.
-    pub async fn lease(
-        &self,
-        runner_id: &str,
-        executor: Executor,
-        runner_labels: &[String],
-        lease_ttl: Duration,
-        now: DateTime<Utc>,
-    ) -> Result<Option<LeasedJob>, AgentError> {
-        let token = uuid::Uuid::new_v4().to_string();
-        let expires = bson_dt(now + ttl(lease_ttl));
-        let executor_bson = mongodb::bson::to_bson(&executor).unwrap_or(Bson::Null);
-
-        let filter = doc! {
-            "status": "queued",
-            "cancel_requested": { "$ne": true },
-            "job.executor": executor_bson,
-            // Every label the job requires must be in the runner's set — i.e. the
-            // job has no label that is not offered by the runner. Absent/empty
-            // job labels match any runner.
-            "job.labels": { "$not": { "$elemMatch": { "$nin": runner_labels.to_vec() } } },
-        };
-        let update = doc! {
-            "$set": {
-                "status": "leased",
-                "lease_token": &token,
-                "leased_by": runner_id,
-                "lease_expires_at": expires,
-                "heartbeat_at": bson_dt(now),
-                "updated_at": bson_dt(now),
-            },
-            "$inc": { "attempts": 1 },
-        };
-
-        let record = self
-            .coll
-            .find_one_and_update(filter, update)
-            .sort(doc! { "created_at": 1 }) // FIFO
-            .return_document(ReturnDocument::After)
-            .await?;
-        Ok(record.map(|r| LeasedJob {
-            job: r.job,
-            lease_token: token,
-        }))
-    }
-
-    /// Extend a lease and report whether the job has been asked to cancel.
-    /// Transitions the job to `running` on the first heartbeat. Returns `None`
-    /// when the lease is no longer valid (token mismatch, or the job is already
-    /// terminal) — the runner should then abandon the work.
-    pub async fn heartbeat(
-        &self,
-        job_id: &str,
-        lease_token: &str,
-        lease_ttl: Duration,
-        now: DateTime<Utc>,
-    ) -> Result<Option<HeartbeatAck>, AgentError> {
-        let filter = doc! {
-            "job.id": job_id,
-            "lease_token": lease_token,
-            "status": { "$in": ACTIVE_STATES.to_vec() },
-        };
-        let update = doc! {
-            "$set": {
-                "status": "running",
-                "lease_expires_at": bson_dt(now + ttl(lease_ttl)),
-                "heartbeat_at": bson_dt(now),
-                "updated_at": bson_dt(now),
-            },
-        };
-        let record = self
-            .coll
-            .find_one_and_update(filter, update)
-            .return_document(ReturnDocument::After)
-            .await?;
-        Ok(record.map(|r| HeartbeatAck {
-            cancelled: r.cancel_requested,
-        }))
-    }
-
-    /// Record a job's terminal result. Guarded by the lease token and only from
-    /// an active (`leased`/`running`) state, so it is idempotent — a duplicate or
-    /// late submission after the job already finished matches nothing. Returns
-    /// `true` if this call recorded the result.
-    pub async fn complete(
-        &self,
-        job_id: &str,
-        lease_token: &str,
-        result: &JobResult,
-        now: DateTime<Utc>,
-    ) -> Result<bool, AgentError> {
-        let status = result.status.unwrap_or(JobStatus::Failed);
-        let status_bson = mongodb::bson::to_bson(&status).unwrap_or(Bson::String("failed".into()));
-        let result_bson =
-            mongodb::bson::to_bson(result).map_err(|e| AgentError::Other(e.to_string()))?;
-
-        let filter = doc! {
-            "job.id": job_id,
-            "lease_token": lease_token,
-            "status": { "$in": ACTIVE_STATES.to_vec() },
-        };
-        let update = doc! {
-            "$set": {
-                "status": status_bson,
-                "result": result_bson,
-                "lease_token": Bson::Null,
-                "lease_expires_at": Bson::Null,
-                "updated_at": bson_dt(now),
-            },
-        };
-        let res = self.coll.update_one(filter, update).await?;
-        Ok(res.modified_count == 1)
-    }
-
-    /// Request cancellation of a job. A still-`queued` job is cancelled outright;
-    /// an in-flight one is flagged so the runner sees it on its next heartbeat and
-    /// tears down. Returns `true` if a non-terminal job matched.
-    pub async fn cancel(&self, job_id: &str, now: DateTime<Utc>) -> Result<bool, AgentError> {
-        let filter = doc! {
-            "job.id": job_id,
-            "status": { "$nin": TERMINAL_STATES.to_vec() },
-        };
-        // Pipeline update: flag cancellation, and if still queued flip straight to
-        // cancelled (nothing is running it).
-        let pipeline = vec![doc! {
-            "$set": {
-                "cancel_requested": true,
-                "status": {
-                    "$cond": [ { "$eq": ["$status", "queued"] }, "cancelled", "$status" ]
-                },
-                "updated_at": bson_dt(now),
-            }
-        }];
-        let res = self.coll.update_one(filter, pipeline).await?;
-        Ok(res.matched_count == 1)
-    }
-
-    /// Sweep leases whose visibility timeout has elapsed: return them to `queued`
-    /// for another runner, or mark them `expired` once they have been leased
-    /// `max_attempts` times. This is what makes a crashed runner's job recover.
-    pub async fn sweep_expired(
-        &self,
-        now: DateTime<Utc>,
-        max_attempts: u32,
-        // (kept explicit rather than a const so callers can tune retry policy)
-    ) -> Result<SweepOutcome, AgentError> {
-        let now_bson = bson_dt(now);
-        let max = i64::from(max_attempts);
-
-        let requeue = self
-            .coll
-            .update_many(
-                doc! {
-                    "status": { "$in": ACTIVE_STATES.to_vec() },
-                    "lease_expires_at": { "$lt": &now_bson },
-                    "attempts": { "$lt": max },
-                },
-                doc! { "$set": {
-                    "status": "queued",
-                    "lease_token": Bson::Null,
-                    "leased_by": Bson::Null,
-                    "lease_expires_at": Bson::Null,
-                    "updated_at": &now_bson,
-                } },
-            )
-            .await?;
-
-        let expire = self
-            .coll
-            .update_many(
-                doc! {
-                    "status": { "$in": ACTIVE_STATES.to_vec() },
-                    "lease_expires_at": { "$lt": &now_bson },
-                    "attempts": { "$gte": max },
-                },
-                doc! { "$set": {
-                    "status": "expired",
-                    "lease_token": Bson::Null,
-                    "lease_expires_at": Bson::Null,
-                    "updated_at": &now_bson,
-                } },
-            )
-            .await?;
-
-        Ok(SweepOutcome {
-            requeued: requeue.modified_count,
-            expired: expire.modified_count,
-        })
-    }
-
-    /// Fetch a job record by job id (inspection / control-plane reads).
-    pub async fn get(&self, job_id: &str) -> Result<Option<JobRecord>, AgentError> {
-        Ok(self.coll.find_one(doc! { "job.id": job_id }).await?)
-    }
-}
-
-/// A `chrono::Duration` for a lease TTL, saturating rather than panicking on an
-/// absurd input (`chrono::Duration::seconds` panics past its internal bound).
-fn ttl(d: Duration) -> chrono::Duration {
-    let secs = i64::try_from(d.as_secs()).unwrap_or(i64::MAX);
-    chrono::Duration::try_seconds(secs).unwrap_or(chrono::Duration::MAX)
-}
-
-/// A chrono instant as a BSON date (so Mongo stores/compares it as a real date).
-fn bson_dt(dt: DateTime<Utc>) -> BsonDateTime {
-    BsonDateTime::from_chrono(dt)
-}
-
-/// Whether a Mongo error is a duplicate-key (E11000) violation — a job with this
-/// id is already enqueued.
-fn is_duplicate_key(e: &mongodb::error::Error) -> bool {
-    match &*e.kind {
-        ErrorKind::Write(WriteFailure::WriteError(we)) => we.code == 11000,
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ttl_saturates_and_converts() {
-        assert_eq!(ttl(Duration::from_secs(30)), chrono::Duration::seconds(30));
-        // An absurd TTL saturates instead of panicking.
-        assert_eq!(ttl(Duration::from_secs(u64::MAX)), chrono::Duration::MAX);
-    }
-
-    #[test]
-    fn state_constants_are_disjoint() {
-        for s in ACTIVE_STATES {
-            assert!(
-                !TERMINAL_STATES.contains(&s),
-                "{s} cannot be both active and terminal"
-            );
-        }
-    }
-}

compliance-agent/tests/c5_example2.rs

@@ -1,125 +0,0 @@
-//! C5 example 2 — exploratory (not a committed regression test). Four topically
-//! distinct findings, to see whether tuned semantic retrieval maps each to the
-//! right master-control family. Run:
-//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
-//!   cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture
-
-mod common;
-
-use std::sync::Arc;
-
-use compliance_agent::llm::LlmClient;
-use compliance_core::config::BreakpilotConfig;
-use compliance_core::models::finding::{Finding, Severity};
-use compliance_core::models::scan::ScanType;
-use secrecy::SecretString;
-
-fn env(k: &str) -> String {
-    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
-}
-
-fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
-    let mut f = Finding::new(
-        "repo-c5b".into(),
-        format!("{file}:{line}"),
-        "semgrep".into(),
-        ScanType::Sast,
-        title.into(),
-        desc.into(),
-        Severity::High,
-    );
-    f.file_path = Some(file.into());
-    f.line_number = Some(line);
-    f
-}
-
-fn write(repo: &std::path::Path, rel: &str, body: &str) {
-    let p = repo.join(rel);
-    if let Some(parent) = p.parent() {
-        std::fs::create_dir_all(parent).unwrap();
-    }
-    std::fs::write(p, body).unwrap();
-}
-
-#[tokio::test]
-#[ignore = "live: api-dev + LiteLLM"]
-async fn c5b_varied_findings() {
-    let llm = Arc::new(LlmClient::new(
-        env("LITELLM_URL"),
-        SecretString::from(env("LITELLM_API_KEY")),
-        env("LITELLM_MODEL"),
-        env("LITELLM_EMBED_MODEL"),
-    ));
-    let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
-    config.breakpilot = BreakpilotConfig {
-        base_url: Some(env("BREAKPILOT_BASE_URL")),
-        token: None,
-        snapshot_dir: std::env::temp_dir()
-            .join("c5-oscal-snap")
-            .to_string_lossy()
-            .into_owned(),
-        semantic_mapping: true,
-        grounded_control_checks: false,
-    };
-
-    let repo = std::env::temp_dir().join("c5b-fixture-repo");
-    let _ = std::fs::remove_dir_all(&repo);
-    write(
-        &repo,
-        "app/db.py",
-        "import sqlite3\n\ndef get_user(username):\n    q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n    return conn.execute(q)\n",
-    );
-    write(
-        &repo,
-        "app/config.py",
-        "# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
-    );
-    write(
-        &repo,
-        "app/net.py",
-        "import requests\n\ndef fetch(url):\n    return requests.get(url, verify=False, timeout=5)\n",
-    );
-    write(
-        &repo,
-        "app/ser.py",
-        "import pickle\n\ndef load_state(blob):\n    return pickle.loads(blob)\n",
-    );
-
-    let mut findings = vec![
-        mk(
-            "app/db.py",
-            4,
-            "SQL injection via string-concatenated query",
-            "User input is concatenated directly into a SQL statement, allowing SQL injection.",
-        ),
-        mk(
-            "app/config.py",
-            2,
-            "Hardcoded API credential in source",
-            "A live API key is hardcoded in source code instead of a secret store.",
-        ),
-        mk(
-            "app/net.py",
-            4,
-            "TLS certificate verification disabled",
-            "requests is called with verify=False, disabling TLS certificate validation.",
-        ),
-        mk(
-            "app/ser.py",
-            3,
-            "Insecure deserialization with pickle.loads",
-            "Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
-        ),
-    ];
-
-    let tagged =
-        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
-            .await;
-    println!("\n=== C5 example 2: varied findings ===");
-    for f in &findings {
-        println!("  {:52} -> {:?}", f.title, f.control_refs);
-    }
-    println!("tagged: {tagged}/4");
-    let _ = std::fs::remove_dir_all(&repo);
-    assert!(tagged >= 1);
-}

compliance-agent/tests/c5_semantic_live.rs

@@ -1,145 +0,0 @@
-//! C5 live verification — the semantic master-controls path end to end against the
-//! deployed api-dev catalog. Ignored (hits api-dev + LiteLLM). Run explicitly:
-//!
-//!   set -a; . ./.env; set +a
-//!   BREAKPILOT_BASE_URL=https://api-dev.breakpilot.ai \
-//!     cargo test -p compliance-agent --test c5_semantic_live -- --ignored --nocapture
-//!
-//! Pulls the live master-controls catalog, embeds the corpus (chunked), then for a
-//! couple of real vulnerable findings retrieves the nearest master controls and
-//! grounded-judges them, stamping master-control refs.
-
-mod common;
-
-use std::sync::Arc;
-
-use compliance_agent::llm::LlmClient;
-use compliance_core::config::BreakpilotConfig;
-use compliance_core::models::finding::{Finding, Severity};
-use compliance_core::models::scan::ScanType;
-use secrecy::SecretString;
-
-fn env(k: &str) -> String {
-    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set for the live C5 test"))
-}
-
-fn mk_finding(file: &str, line: u32, title: &str) -> Finding {
-    let mut f = Finding::new(
-        "repo-c5".into(),
-        format!("{file}:{line}"),
-        "semgrep".into(),
-        ScanType::Sast,
-        title.into(),
-        title.into(),
-        Severity::High,
-    );
-    f.file_path = Some(file.into());
-    f.line_number = Some(line);
-    f
-}
-
-#[tokio::test]
-#[ignore = "live: requires deployed api-dev master-controls (fetch+parse only, no LLM)"]
-async fn c5_ingest_master_controls_catalog() {
-    use compliance_agent::controls::OscalControlsProvider;
-
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        env("BREAKPILOT_BASE_URL"),
-        None,
-        std::env::temp_dir().join("c5-ingest-snap"),
-    );
-    let doc = provider
-        .load_master_controls()
-        .await
-        .expect("pull + parse master-controls catalog");
-    let controls = doc.to_controls();
-    println!(
-        "\n=== C5 ingest: {} master controls parsed ===",
-        controls.len()
-    );
-    for c in controls.iter().take(4) {
-        let text: String = c.text.chars().take(90).collect();
-        println!("  {} | {} | {}", c.id, c.title, text);
-    }
-    assert!(
-        !controls.is_empty(),
-        "expected a non-empty master-control corpus"
-    );
-}
-
-#[tokio::test]
-#[ignore = "live: requires deployed api-dev master-controls + LiteLLM"]
-async fn c5_semantic_stamps_master_control_refs() {
-    let llm = Arc::new(LlmClient::new(
-        env("LITELLM_URL"),
-        SecretString::from(env("LITELLM_API_KEY")),
-        env("LITELLM_MODEL"),
-        env("LITELLM_EMBED_MODEL"),
-    ));
-
-    let mut config = common::dev_config("mongodb://unused".into(), "c5".into());
-    let snapshot = std::env::temp_dir().join("c5-oscal-snap");
-    config.breakpilot = BreakpilotConfig {
-        base_url: Some(env("BREAKPILOT_BASE_URL")),
-        token: None,
-        snapshot_dir: snapshot.to_string_lossy().into_owned(),
-        semantic_mapping: true,
-        grounded_control_checks: false,
-    };
-
-    // Fixture repo with recognizable code-checkable surfaces.
-    let repo = std::env::temp_dir().join("c5-fixture-repo");
-    let _ = std::fs::remove_dir_all(&repo);
-    std::fs::create_dir_all(repo.join("app")).expect("mkdir");
-    std::fs::write(
-        repo.join("app/auth.py"),
-        concat!(
-            "import hashlib\n",
-            "\n",
-            "def store_password(user, password):\n",
-            "    # weak, unsalted password hashing\n",
-            "    digest = hashlib.md5(password.encode()).hexdigest()\n",
-            "    db.save(user, digest)\n",
-            "\n",
-            "@app.route('/login', methods=['POST'])\n",
-            "def login():\n",
-            "    u = request.form['username']\n",
-            "    p = request.form['password']\n",
-            "    return 'ok' if check(u, p) else ('bad', 401)\n",
-        ),
-    )
-    .expect("write fixture");
-
-    let mut findings = vec![
-        mk_finding("app/auth.py", 5, "Weak password hash (md5, unsalted)"),
-        mk_finding(
-            "app/auth.py",
-            9,
-            "Login endpoint without brute-force protection",
-        ),
-    ];
-
-    let tagged =
-        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
-            .await;
-
-    println!("\n=== C5 semantic master-controls stamping ===");
-    for f in &findings {
-        println!(
-            "  {:50} {}:{:?} -> {:?}",
-            f.title,
-            f.file_path.as_deref().unwrap_or(""),
-            f.line_number,
-            f.control_refs
-        );
-    }
-    println!("findings that gained >=1 master-control ref: {tagged}");
-    let _ = std::fs::remove_dir_all(&repo);
-
-    // Live corpus — assert only that the path runs and stamps at least one ref.
-    assert!(
-        tagged >= 1,
-        "expected at least one finding to gain a master-control ref"
-    );
-}

compliance-agent/tests/common/mod.rs

@@ -2,10 +2,6 @@
 //
 // Spins up the agent API server on a random port with an isolated test
 // database. Each test gets a fresh database that is dropped on cleanup.
-//
-// Included via `mod common;` in several test binaries; not every binary uses
-// every helper, so allow dead code here.
-#![allow(dead_code)]
 
 use std::sync::Arc;
 
@@ -15,55 +11,6 @@ use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
-/// The runner bearer token wired into the test config.
-pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
-
-/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
-/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
-pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
-    AgentConfig {
-        mongodb_uri,
-        mongodb_database: db_name,
-        litellm_url: std::env::var("TEST_LITELLM_URL")
-            .unwrap_or_else(|_| "http://localhost:4000".into()),
-        litellm_api_key: SecretString::from(String::new()),
-        litellm_model: "gpt-4o".into(),
-        litellm_embed_model: "text-embedding-3-small".into(),
-        agent_port: 0, // not used — we bind ourselves
-        scan_schedule: String::new(),
-        cve_monitor_schedule: String::new(),
-        git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-        artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
-        ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
-        github_token: None,
-        github_webhook_secret: None,
-        gitlab_url: None,
-        gitlab_token: None,
-        gitlab_webhook_secret: None,
-        jira_url: None,
-        jira_email: None,
-        jira_api_token: None,
-        jira_project_key: None,
-        searxng_url: None,
-        nvd_api_key: None,
-        keycloak_url: None,
-        keycloak_realm: None,
-        keycloak_admin_username: None,
-        keycloak_admin_password: None,
-        pentest_verification_email: None,
-        pentest_imap_host: None,
-        pentest_imap_port: None,
-        pentest_imap_tls: false,
-        pentest_imap_username: None,
-        pentest_imap_password: None,
-        admin_api_token: None,
-        tenant_registry_url: None,
-        plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-        werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
-        breakpilot: compliance_core::config::BreakpilotConfig::default(),
-    }
-}
-
 /// A running test server with a unique database.
 pub struct TestServer {
     pub base_url: String,
@@ -86,7 +33,44 @@ impl TestServer {
             .await
             .expect("Failed to build DatabasePool");
 
-        let config = dev_config(mongodb_uri.clone(), db_name.clone());
+        let config = AgentConfig {
+            mongodb_uri: mongodb_uri.clone(),
+            mongodb_database: db_name.clone(),
+            litellm_url: std::env::var("TEST_LITELLM_URL")
+                .unwrap_or_else(|_| "http://localhost:4000".into()),
+            litellm_api_key: SecretString::from(String::new()),
+            litellm_model: "gpt-4o".into(),
+            litellm_embed_model: "text-embedding-3-small".into(),
+            agent_port: 0, // not used — we bind ourselves
+            scan_schedule: String::new(),
+            cve_monitor_schedule: String::new(),
+            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
+            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
+            github_token: None,
+            github_webhook_secret: None,
+            gitlab_url: None,
+            gitlab_token: None,
+            gitlab_webhook_secret: None,
+            jira_url: None,
+            jira_email: None,
+            jira_api_token: None,
+            jira_project_key: None,
+            searxng_url: None,
+            nvd_api_key: None,
+            keycloak_url: None,
+            keycloak_realm: None,
+            keycloak_admin_username: None,
+            keycloak_admin_password: None,
+            pentest_verification_email: None,
+            pentest_imap_host: None,
+            pentest_imap_port: None,
+            pentest_imap_tls: false,
+            pentest_imap_username: None,
+            pentest_imap_password: None,
+            admin_api_token: None,
+            tenant_registry_url: None,
+        };
 
         let agent = ComplianceAgent::new(config, db_pool);
 

compliance-agent/tests/grounded_surface_live.rs

@@ -1,92 +0,0 @@
-//! Live validation of the grounded surface path (Stage 5d) for absence-based CRA
-//! controls. Ignored (hits api-dev CRA catalog + LiteLLM). Run:
-//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
-//!   cargo test -p compliance-agent --test grounded_surface_live -- --ignored --nocapture
-//!
-//! Builds a fixture whose code surfaces trigger several absence-based controls
-//! (no rate limiting, no security logging, unverified update) and checks that the
-//! grounded checker produces control-tagged findings.
-
-mod common;
-
-use std::sync::Arc;
-
-use compliance_agent::llm::LlmClient;
-use compliance_core::config::BreakpilotConfig;
-use secrecy::SecretString;
-
-fn env(k: &str) -> String {
-    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
-}
-
-fn write(repo: &std::path::Path, rel: &str, body: &str) {
-    let p = repo.join(rel);
-    if let Some(parent) = p.parent() {
-        std::fs::create_dir_all(parent).unwrap();
-    }
-    std::fs::write(p, body).unwrap();
-}
-
-#[tokio::test]
-#[ignore = "live: api-dev CRA catalog + LiteLLM"]
-async fn grounded_surface_flags_absence_controls() {
-    let llm = Arc::new(LlmClient::new(
-        env("LITELLM_URL"),
-        SecretString::from(env("LITELLM_API_KEY")),
-        env("LITELLM_MODEL"),
-        env("LITELLM_EMBED_MODEL"),
-    ));
-    let mut config = common::dev_config("mongodb://unused".into(), "grounded".into());
-    config.breakpilot = BreakpilotConfig {
-        base_url: Some(env("BREAKPILOT_BASE_URL")),
-        token: None,
-        snapshot_dir: std::env::temp_dir()
-            .join("grounded-snap")
-            .to_string_lossy()
-            .into_owned(),
-        semantic_mapping: false,
-        grounded_control_checks: true,
-    };
-
-    let repo = std::env::temp_dir().join("grounded-fixture-repo");
-    let _ = std::fs::remove_dir_all(&repo);
-    // cra-ai-11: login endpoint with no rate limiting / lockout
-    write(
-        &repo,
-        "app/auth.py",
-        "@app.route('/login', methods=['POST'])\ndef login():\n    u = request.form['username']\n    p = request.form['password']\n    if authenticate(u, p):\n        return redirect('/')\n    return 'bad credentials', 401\n",
-    );
-    // cra-ai-24: privileged admin action with no security/audit logging
-    write(
-        &repo,
-        "app/admin.py",
-        "@app.route('/admin/delete_user', methods=['POST'])\ndef admin_delete_user():\n    uid = request.form['uid']\n    db.users.delete_one({'_id': uid})\n    return 'ok', 200\n",
-    );
-    // cra-ai-28/29/30: firmware update applied without signature / checksum verification
-    write(
-        &repo,
-        "app/updater.py",
-        "def apply_firmware_update(url):\n    blob = download(url)\n    install_firmware(blob)\n    reboot_device()\n",
-    );
-
-    let findings =
-        compliance_agent::controls::grounded_surface_findings(&config, llm, &repo, "repo-grounded")
-            .await;
-
-    println!("\n=== Grounded surface findings ({}) ===", findings.len());
-    for f in &findings {
-        println!(
-            "  {:24} {}:{:?}  {}",
-            f.control_refs.join(","),
-            f.file_path.as_deref().unwrap_or(""),
-            f.line_number,
-            f.title
-        );
-    }
-    let _ = std::fs::remove_dir_all(&repo);
-
-    assert!(
-        !findings.is_empty(),
-        "expected the grounded pass to flag at least one absence-based control"
-    );
-}

compliance-agent/tests/werkbank_api.rs

@@ -1,291 +0,0 @@
-//! Integration tests for the Werkbank runner endpoints (WB-05).
-//!
-//! Drives the real HTTP handlers (lease/heartbeat/complete) against a live Mongo:
-//! a runner leases a seeded job, completes it, and the result's findings are
-//! persisted against the job's target. Also checks the bearer-token gate. Skips
-//! cleanly when no Mongo is reachable.
-
-#![allow(clippy::expect_used, clippy::unwrap_used)]
-
-mod common;
-
-use std::sync::Arc;
-
-use axum::routing::{get, post};
-use axum::{middleware, Extension, Router};
-
-use compliance_agent::agent::ComplianceAgent;
-use compliance_agent::api::handlers::werkbank_jobs;
-use compliance_agent::database::DatabasePool;
-use compliance_agent::werkbank::JobQueue;
-use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
-use compliance_core::models::{
-    Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
-};
-
-use common::{dev_config, TEST_RUNNER_TOKEN};
-
-const TENANT: &str = "dev";
-
-/// A running werkbank API on a random port, or `None` if no Mongo.
-struct Harness {
-    base_url: String,
-    client: reqwest::Client,
-    pool: DatabasePool,
-    db_name: String,
-}
-
-async fn start() -> Option<Harness> {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    let db_name = format!("wba_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
-    let pool = match DatabasePool::connect(&uri, &db_name).await {
-        Ok(p) => p,
-        Err(_) => {
-            eprintln!("SKIP werkbank_api: no MongoDB reachable at {uri}");
-            return None;
-        }
-    };
-    // Touch the tenant DB so indexes are ensured before the queue is used.
-    pool.for_tenant_id(TENANT).await.expect("tenant db");
-
-    let agent = ComplianceAgent::new(dev_config(uri, db_name.clone()), pool.clone());
-    let app = Router::new()
-        .route("/api/v1/werkbank/jobs/lease", post(werkbank_jobs::lease))
-        .route(
-            "/api/v1/werkbank/jobs/heartbeat",
-            post(werkbank_jobs::heartbeat),
-        )
-        .route(
-            "/api/v1/werkbank/jobs/complete",
-            post(werkbank_jobs::complete),
-        )
-        .route(
-            "/api/v1/werkbank/jobs/enqueue",
-            post(werkbank_jobs::enqueue),
-        )
-        .route(
-            "/api/v1/werkbank/artifacts/{hash}",
-            get(werkbank_jobs::serve_artifact),
-        )
-        .layer(middleware::from_fn(werkbank_jobs::require_runner_token))
-        .layer(Extension(Arc::new(agent)));
-
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-    let port = listener.local_addr().unwrap().port();
-    tokio::spawn(async move {
-        axum::serve(listener, app).await.ok();
-    });
-
-    Some(Harness {
-        base_url: format!("http://127.0.0.1:{port}"),
-        client: reqwest::Client::new(),
-        pool,
-        db_name,
-    })
-}
-
-impl Harness {
-    fn post(
-        &self,
-        path: &str,
-        token: Option<&str>,
-        body: serde_json::Value,
-    ) -> reqwest::RequestBuilder {
-        let mut r = self
-            .client
-            .post(format!("{}{path}", self.base_url))
-            .json(&body);
-        if let Some(t) = token {
-            r = r.bearer_auth(t);
-        }
-        r
-    }
-    async fn cleanup(&self) {
-        let _ = self
-            .pool
-            .client()
-            .database(&format!("{}_{TENANT}", self.db_name))
-            .drop()
-            .await;
-    }
-}
-
-fn finding_for(target: &str, fp: &str) -> Finding {
-    let mut f = Finding::new(
-        target.to_string(),
-        fp.to_string(),
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "Modbus exposed".to_string(),
-        "unauthenticated".to_string(),
-        Severity::Critical,
-    );
-    f.rule_id = Some("ics-modbus-exposed".to_string());
-    f
-}
-
-#[tokio::test]
-async fn lease_complete_persists_findings_against_the_target() {
-    let Some(h) = start().await else { return };
-    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
-    let queue = JobQueue::new(&db);
-
-    // Seed a queued job.
-    let job = Job::plc_provision("job-1", TENANT, "target-1", InputRef::blob("sha256:x"), 180);
-    assert!(queue.enqueue(job, chrono::Utc::now()).await.unwrap());
-
-    // Lease it over HTTP.
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/lease",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-                "labels": [], "lease_ttl_secs": 60
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200, "lease should return a job");
-    let leased: LeasedJob = resp.json().await.unwrap();
-    assert_eq!(leased.job.id, "job-1");
-
-    // Complete it with a finding.
-    let mut result = JobResult::succeeded("job-1");
-    result.findings = vec![finding_for("target-1", "fp-abc")];
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/complete",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "job_id": "job-1",
-                "lease_token": leased.lease_token, "result": result
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200);
-    assert!(resp.json::<serde_json::Value>().await.unwrap()["recorded"]
-        .as_bool()
-        .unwrap());
-
-    // The job is now succeeded, and the finding was persisted to the target.
-    assert_eq!(
-        queue.get("job-1").await.unwrap().unwrap().status,
-        JobStatus::Succeeded
-    );
-    let stored = db
-        .findings()
-        .find_one(mongodb::bson::doc! { "fingerprint": "fp-abc" })
-        .await
-        .unwrap();
-    assert!(stored.is_some(), "finding should be persisted");
-
-    h.cleanup().await;
-}
-
-#[tokio::test]
-async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
-    let Some(h) = start().await else { return };
-    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
-
-    // A PlcSps target with a single complete ST program uploaded.
-    let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let st = dir.join("main.st");
-    std::fs::write(
-        &st,
-        "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n  RESOURCE R\nEND_CONFIGURATION\n",
-    )
-    .unwrap();
-    let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
-    let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
-    art.stored_path = Some(st.to_string_lossy().to_string());
-    target.artifacts.push(art);
-    let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
-    let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
-
-    // Enqueue → a plc-provision job whose program is a content-addressed blob.
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/enqueue",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200, "enqueue should succeed");
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let job_id = body["job_id"].as_str().unwrap().to_string();
-
-    let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
-    let hash = rec
-        .job
-        .inputs
-        .get("program")
-        .and_then(|i| i.blob.clone())
-        .expect("program blob");
-
-    // Serve the blob back and confirm it's the program source (what the runner
-    // would fetch).
-    let served = h
-        .client
-        .get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
-        .bearer_auth(TEST_RUNNER_TOKEN)
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(served.status(), 200);
-    assert!(served.text().await.unwrap().contains("CONFIGURATION"));
-
-    h.cleanup().await;
-    let _ = std::fs::remove_dir_all(&dir);
-}
-
-#[tokio::test]
-async fn empty_queue_leases_nothing() {
-    let Some(h) = start().await else { return };
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/lease",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-                "labels": [], "lease_ttl_secs": 60
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 204, "no job → 204");
-    h.cleanup().await;
-}
-
-#[tokio::test]
-async fn runner_endpoints_require_the_bearer_token() {
-    let Some(h) = start().await else { return };
-    let body = serde_json::json!({
-        "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-        "labels": [], "lease_ttl_secs": 60
-    });
-
-    let no_token = h
-        .post("/api/v1/werkbank/jobs/lease", None, body.clone())
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(no_token.status(), 401, "missing token → 401");
-
-    let bad_token = h
-        .post("/api/v1/werkbank/jobs/lease", Some("wrong"), body)
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(bad_token.status(), 401, "wrong token → 401");
-
-    h.cleanup().await;
-}

compliance-agent/tests/werkbank_queue.rs

@@ -1,258 +0,0 @@
-//! Integration tests for the Werkbank job queue (WB-02).
-//!
-//! Exercises the atomic lease/heartbeat/complete/sweep flow against a real
-//! MongoDB — the guarantees (idempotent enqueue, single-owner lease, visibility
-//! timeout) are Mongo-semantics-dependent and can't be unit-tested in isolation.
-//! Skips cleanly when no Mongo is reachable (set `TEST_MONGODB_URI` to point at
-//! one; defaults to the local dev cluster).
-
-#![allow(clippy::expect_used, clippy::unwrap_used)]
-
-use std::time::Duration;
-
-use chrono::{DateTime, TimeZone, Utc};
-
-use compliance_agent::database::Database;
-use compliance_agent::werkbank::JobQueue;
-use compliance_core::models::werkbank::{Executor, InputRef, Job, JobResult};
-
-/// Connect + ensure indexes on a throwaway database, or `None` if no Mongo.
-async fn setup() -> Option<(JobQueue, mongodb::Database)> {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    let db_name = format!("wbq_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
-    let db = match Database::connect(&uri, &db_name).await {
-        Ok(d) => d,
-        Err(_) => {
-            eprintln!("SKIP werkbank_queue: no MongoDB reachable at {uri}");
-            return None;
-        }
-    };
-    db.ensure_indexes().await.expect("ensure indexes");
-    let queue = JobQueue::new(&db);
-    Some((queue, db.inner().clone()))
-}
-
-fn base_time() -> DateTime<Utc> {
-    Utc.timestamp_opt(1_700_000_000, 0).unwrap()
-}
-
-fn job(id: &str) -> Job {
-    Job::plc_provision(id, "acme", "target-1", InputRef::blob("sha256:abc"), 180)
-}
-
-fn job_with_labels(id: &str, labels: &[&str]) -> Job {
-    let mut j = job(id);
-    j.labels = labels.iter().map(|s| s.to_string()).collect();
-    j
-}
-
-macro_rules! skip_if_no_mongo {
-    () => {
-        match setup().await {
-            Some(v) => v,
-            None => return,
-        }
-    };
-}
-
-#[tokio::test]
-async fn enqueue_is_idempotent() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    assert!(q.enqueue(job("j1"), now).await.expect("enqueue"));
-    // Same id again — no duplicate row, reports "already present".
-    assert!(!q.enqueue(job("j1"), now).await.expect("enqueue2"));
-
-    let rec = q.get("j1").await.expect("get").expect("exists");
-    assert_eq!(
-        rec.status,
-        compliance_core::models::werkbank::JobStatus::Queued
-    );
-    assert_eq!(rec.attempts, 0);
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn lease_matches_executor_and_labels_and_is_fifo() {
-    let (q, db) = skip_if_no_mongo!();
-    let t0 = base_time();
-
-    // Two docker jobs (j_old older than j_new) + one requiring a kvm label.
-    q.enqueue(job("j_old"), t0).await.unwrap();
-    q.enqueue(job("j_new"), t0 + chrono::Duration::seconds(5))
-        .await
-        .unwrap();
-    q.enqueue(job_with_labels("j_kvm", &["kvm=true"]), t0)
-        .await
-        .unwrap();
-
-    // Wrong executor: a shell runner leases nothing.
-    assert!(q
-        .lease("r-shell", Executor::Shell, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .is_none());
-
-    // A docker runner without the kvm label gets the oldest label-free job (FIFO).
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .expect("leased");
-    assert_eq!(leased.job.id, "j_old", "oldest matching job first");
-    assert!(!leased.lease_token.is_empty());
-
-    // The kvm job stays unleased for that runner (missing label)...
-    let none = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .expect("next");
-    assert_eq!(none.job.id, "j_new", "label-free job, not the kvm one");
-
-    // ...but a runner advertising kvm can take it.
-    let kvm = q
-        .lease(
-            "r2",
-            Executor::Docker,
-            &["kvm=true".to_string(), "arch=amd64".to_string()],
-            Duration::from_secs(30),
-            t0,
-        )
-        .await
-        .unwrap()
-        .expect("kvm leased");
-    assert_eq!(kvm.job.id, "j_kvm");
-
-    // A leased job increments attempts and is no longer queued.
-    let rec = q.get("j_old").await.unwrap().unwrap();
-    assert_eq!(rec.attempts, 1);
-    assert_eq!(rec.leased_by.as_deref(), Some("r1"));
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn heartbeat_extends_lease_and_surfaces_cancel() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    q.enqueue(job("j1"), now).await.unwrap();
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // A valid heartbeat moves it to running and reports not-cancelled.
-    let ack = q
-        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .expect("valid lease");
-    assert!(!ack.cancelled);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Running
-    );
-
-    // A wrong token is a lost lease.
-    assert!(q
-        .heartbeat("j1", "wrong-token", Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .is_none());
-
-    // Cancelling an in-flight job flags it; the next heartbeat reports cancelled.
-    assert!(q.cancel("j1", now).await.unwrap());
-    let ack = q
-        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .expect("still leased");
-    assert!(ack.cancelled);
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn complete_is_idempotent_and_token_guarded() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    q.enqueue(job("j1"), now).await.unwrap();
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // Wrong token cannot complete.
-    let mut result = JobResult::succeeded("j1");
-    result.findings = Vec::new();
-    assert!(!q.complete("j1", "nope", &result, now).await.unwrap());
-
-    // The lease holder completes it once...
-    assert!(q
-        .complete("j1", &leased.lease_token, &result, now)
-        .await
-        .unwrap());
-    let rec = q.get("j1").await.unwrap().unwrap();
-    assert_eq!(
-        rec.status,
-        compliance_core::models::werkbank::JobStatus::Succeeded
-    );
-    assert!(rec.result.is_some());
-    assert!(rec.lease_token.is_none(), "lease cleared on completion");
-
-    // ...and a second (duplicate) completion is a no-op.
-    assert!(!q
-        .complete("j1", &leased.lease_token, &result, now)
-        .await
-        .unwrap());
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn sweep_requeues_expired_then_expires_after_max_attempts() {
-    let (q, db) = skip_if_no_mongo!();
-    let t0 = base_time();
-
-    q.enqueue(job("j1"), t0).await.unwrap();
-
-    // Lease #1 with a 10s TTL; then time jumps past expiry.
-    q.lease("r1", Executor::Docker, &[], Duration::from_secs(10), t0)
-        .await
-        .unwrap()
-        .unwrap();
-    let past = t0 + chrono::Duration::seconds(60);
-
-    // attempts=1 < max=2 → requeued.
-    let swept = q.sweep_expired(past, 2).await.unwrap();
-    assert_eq!(swept.requeued, 1);
-    assert_eq!(swept.expired, 0);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Queued
-    );
-
-    // Lease #2 (attempts=2), let it expire again → now expired (>= max).
-    q.lease("r2", Executor::Docker, &[], Duration::from_secs(10), past)
-        .await
-        .unwrap()
-        .unwrap();
-    let later = past + chrono::Duration::seconds(60);
-    let swept = q.sweep_expired(later, 2).await.unwrap();
-    assert_eq!(swept.requeued, 0);
-    assert_eq!(swept.expired, 1);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Expired
-    );
-
-    db.drop().await.ok();
-}

compliance-core/Cargo.toml

@@ -50,7 +50,3 @@ axum = { version = "0.8", optional = true }
 jsonwebtoken = { version = "9", optional = true }
 reqwest = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
-
-[dev-dependencies]
-# Parse the declarative TOML job specs in the Werkbank contract tests.
-toml = "0.8"

compliance-core/src/auth.rs

@@ -64,11 +64,11 @@ struct Claims {
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 
 /// Path prefixes that bypass JWT validation. The admin sub-router
-/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
+/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
-/// have their own static-bearer middleware and must not be routed through the
+/// not be routed through the customer-JWT path — a Keycloak token
-/// customer-JWT path — a Keycloak token always carries a single tenant_id and
+/// always carries a single tenant_id and would semantically conflict
-/// would semantically conflict with these cross-tenant / machine operations.
+/// with cross-tenant admin operations.
-const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
+const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
 
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.

compliance-core/src/config.rs

@@ -49,102 +49,6 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
-    /// Ephemeral soft-PLC provisioning for dynamic PLC testing (#183). Off by
-    /// default: it needs Docker access in the agent's runtime, which is a
-    /// deployment opt-in.
-    pub plc_runtime: PlcRuntimeConfig,
-    /// Static bearer for the Werkbank runner endpoints
-    /// (`/api/v1/werkbank/jobs/*`). Machine auth for runners leasing/completing
-    /// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
-    /// `None`, those endpoints are not mounted at all.
-    pub werkbank_runner_token: Option<SecretString>,
-    /// Source for the OSCAL control catalog pulled from breakpilot-compliance
-    /// (drives the [`crate::traits::ControlsProvider`]). Disabled when
-    /// `base_url` is `None`.
-    pub breakpilot: BreakpilotConfig,
-}
-
-/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
-/// to snapshot it for deterministic / offline reuse.
-#[derive(Debug, Clone)]
-pub struct BreakpilotConfig {
-    /// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
-    /// the OSCAL controls provider.
-    pub base_url: Option<String>,
-    /// Optional bearer token for the catalog endpoint.
-    pub token: Option<SecretString>,
-    /// Directory for catalog snapshots.
-    pub snapshot_dir: String,
-    /// Enable the master-controls **semantic** mapping pass (embed regions,
-    /// Enable the master-controls **semantic** mapping pass (embed regions,
-    /// retrieve nearest controls, grounded-judge). On by default — validated live
-    /// against the deployed master-controls catalog. Still a no-op unless
-    /// `base_url` is set and the catalog is reachable.
-    pub semantic_mapping: bool,
-    /// Enable the **grounded surface** pass for absence-based controls (retrieve
-    /// the code surface a control governs, judge whether it holds). On by default
-    /// — validated live; it covers the 8 absence-based CRA controls that no
-    /// syntactic rule can.
-    pub grounded_control_checks: bool,
-}
-
-impl Default for BreakpilotConfig {
-    fn default() -> Self {
-        Self {
-            base_url: None,
-            token: None,
-            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
-            semantic_mapping: true,
-            grounded_control_checks: true,
-        }
-    }
-}
-
-/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
-///
-/// When a PLC/SPS target ships control logic but no reachable live device, the
-/// agent can instantiate that logic itself: spin up a throwaway soft-PLC
-/// (OpenPLC) container in-cluster, load the program, start the runtime, probe it
-/// over industrial protocols, then tear it down. This struct carries the knobs
-/// for that container's lifecycle and the OpenPLC web-UI credentials used to
-/// upload the program.
-#[derive(Clone, Debug)]
-pub struct PlcRuntimeConfig {
-    /// Master switch. Provision-and-test does nothing unless this is set — it
-    /// shells out to `docker`, which requires the agent container to have Docker
-    /// access (socket mount), an explicit deployment decision.
-    pub enabled: bool,
-    /// Container image for the ephemeral soft-PLC (OpenPLC).
-    pub image: String,
-    /// Docker network the instance joins. Must be the agent's own network so it
-    /// is reachable in-cluster by container name and never published to the host.
-    pub network: String,
-    /// Memory cap passed to `docker run --memory` (e.g. `512m`).
-    pub memory: String,
-    /// CPU cap passed to `docker run --cpus` (e.g. `0.5`).
-    pub cpus: String,
-    /// Hard ceiling on a provisioned instance's lifetime. Teardown is guaranteed
-    /// no later than this even if a load/probe step hangs.
-    pub max_lifetime_secs: u64,
-    /// OpenPLC web-UI username for the program upload (image default `openplc`).
-    pub openplc_user: String,
-    /// OpenPLC web-UI password (image default `openplc`).
-    pub openplc_password: SecretString,
-}
-
-impl Default for PlcRuntimeConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            image: "registry.meghsakha.com/openplc:latest".to_string(),
-            network: "certifai".to_string(),
-            memory: "512m".to_string(),
-            cpus: "0.5".to_string(),
-            max_lifetime_secs: 180,
-            openplc_user: "openplc".to_string(),
-            openplc_password: SecretString::from("openplc".to_string()),
-        }
-    }
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/control_check.rs

@@ -1,205 +0,0 @@
-//! Grounded control-driven checking.
-//!
-//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
-//! whose output is grounded to real code — so a hallucinated finding cannot
-//! survive. Determinism is structural, not a prompt plea:
-//!
-//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
-//!    code it never saw;
-//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
-//!    in the region, and the line is recomputed from that match — the model's own
-//!    line number is never trusted ([`ground`]);
-//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
-//!
-//! The LLM supplies cross-language / cross-stack pattern recognition; this module
-//! supplies the determinism.
-
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-
-use crate::models::finding::{Finding, Severity};
-use crate::models::scan::ScanType;
-
-/// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlCheckSpec {
-    /// Stable control id, e.g. `"cra-ai-8"`.
-    pub control_id: String,
-    /// Short control title (used in the finding title).
-    pub title: String,
-    /// The requirement text the LLM judges against (control objective/statement).
-    pub requirement: String,
-    /// CWE to fall back to when the model doesn't supply one.
-    pub default_cwe: Option<String>,
-    /// Severity for findings raised from this control.
-    pub severity: Severity,
-}
-
-/// A retrieved code region the LLM judges — never the whole repo.
-#[derive(Debug, Clone)]
-pub struct CandidateRegion {
-    /// Repo-relative path.
-    pub file: String,
-    /// 1-based line number of the region's first line in `file`.
-    pub start_line: u32,
-    /// The region's source text.
-    pub content: String,
-}
-
-/// The LLM's structured verdict for one (control, region). `snippet` is the
-/// verbatim code the model claims proves the violation — it is the anchor the
-/// grounding gate checks.
-#[derive(Debug, Clone)]
-pub struct LlmVerdict {
-    pub violates: bool,
-    pub snippet: String,
-    pub cwe: Option<String>,
-    pub confidence: f64,
-}
-
-/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
-/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
-/// finding's line is computed from the match, so a fabricated or mis-located
-/// snippet is dropped. Pure — no LLM, no I/O.
-pub fn ground(
-    spec: &ControlCheckSpec,
-    region: &CandidateRegion,
-    verdict: &LlmVerdict,
-    repo_id: &str,
-) -> Option<Finding> {
-    if !verdict.violates {
-        return None;
-    }
-    let snippet = verdict.snippet.trim();
-    if snippet.is_empty() {
-        return None;
-    }
-    // Grounding: the quoted snippet must literally exist in the retrieved region.
-    let pos = region.content.find(snippet)?;
-    // Recompute the real line from the match — never trust the model's number.
-    let newlines_before = region.content[..pos].matches('\n').count();
-    let line = region.start_line + newlines_before as u32;
-
-    let mut finding = Finding::new(
-        repo_id.to_string(),
-        control_finding_fingerprint(&spec.control_id, &region.file, snippet),
-        "control-check".to_string(),
-        ScanType::CodeReview,
-        format!("{}: {}", spec.control_id, spec.title),
-        format!(
-            "Control {} appears violated ({}) at {}:{line}",
-            spec.control_id, spec.requirement, region.file
-        ),
-        spec.severity.clone(),
-    );
-    finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
-    finding.file_path = Some(region.file.clone());
-    finding.line_number = Some(line);
-    finding.code_snippet = Some(snippet.to_string());
-    finding.confidence = Some(verdict.confidence);
-    // Carry the control reference on the finding.
-    finding.control_refs = vec![spec.control_id.clone()];
-    Some(finding)
-}
-
-/// Deterministic cache key for a (control, region, model, prompt-version) verdict
-/// so identical inputs reproduce the same verdict without another LLM call.
-pub fn cache_key(
-    control_id: &str,
-    region_content: &str,
-    model: &str,
-    prompt_version: &str,
-) -> String {
-    hash_parts(&[control_id, region_content, model, prompt_version])
-}
-
-fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
-    hash_parts(&[control_id, file, snippet])
-}
-
-fn hash_parts(parts: &[&str]) -> String {
-    let mut hasher = Sha256::new();
-    for part in parts {
-        hasher.update(part.as_bytes());
-        hasher.update([0u8]); // domain separator between parts
-    }
-    hex::encode(hasher.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "Products must not ship default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    fn region() -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 10,
-            content: "def login():\n    PASSWORD = \"admin123\"\n    return PASSWORD\n".into(),
-        }
-    }
-
-    #[test]
-    fn grounds_real_snippet_with_recomputed_line() {
-        let v = LlmVerdict {
-            violates: true,
-            snippet: "PASSWORD = \"admin123\"".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        let f = ground(&spec(), &region(), &v, "repo").expect("should ground");
-        assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
-        assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
-        assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
-        assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
-        assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
-    }
-
-    #[test]
-    fn drops_fabricated_snippet_not_in_region() {
-        let v = LlmVerdict {
-            violates: true,
-            snippet: "SECRET = \"totally-made-up\"".into(),
-            cwe: None,
-            confidence: 0.99,
-        };
-        assert!(ground(&spec(), &region(), &v, "repo").is_none());
-    }
-
-    #[test]
-    fn drops_non_violation_and_empty_snippet() {
-        let no = LlmVerdict {
-            violates: false,
-            snippet: "PASSWORD = \"admin123\"".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        assert!(ground(&spec(), &region(), &no, "repo").is_none());
-        let empty = LlmVerdict {
-            violates: true,
-            snippet: "   ".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        assert!(ground(&spec(), &region(), &empty, "repo").is_none());
-    }
-
-    #[test]
-    fn cache_key_and_fingerprint_are_deterministic() {
-        assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
-        assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
-        assert_eq!(
-            control_finding_fingerprint("c", "f", "s"),
-            control_finding_fingerprint("c", "f", "s")
-        );
-    }
-}

compliance-core/src/lib.rs

@@ -1,5 +1,4 @@
 pub mod config;
-pub mod control_check;
 pub mod db;
 pub mod error;
 pub mod models;
@@ -14,6 +13,6 @@ pub mod auth;
 #[cfg(feature = "axum")]
 pub mod tenant_ctx;
 
-pub use config::{AgentConfig, DashboardConfig, PlcRuntimeConfig};
+pub use config::{AgentConfig, DashboardConfig};
 pub use error::CoreError;
 pub use tenant::{OrgRole, TenantContext, TenantStatus};

compliance-core/src/models/finding.rs

@@ -76,10 +76,6 @@ pub struct Finding {
     pub triage_rationale: Option<String>,
     /// Developer feedback on finding quality
     pub developer_feedback: Option<String>,
-    /// Compliance control ids this finding is evidence for (stamped by control
-    /// triage against the `control-map` LUT). Empty when unmapped.
-    #[serde(default)]
-    pub control_refs: Vec<String>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
@@ -122,7 +118,6 @@ impl Finding {
             triage_action: None,
             triage_rationale: None,
             developer_feedback: None,
-            control_refs: Vec::new(),
             created_at: now,
             updated_at: now,
         }

compliance-core/src/models/mod.rs

@@ -10,14 +10,11 @@ pub mod mcp;
 pub mod mcp_token;
 pub mod notification;
 pub mod onboarding;
-pub mod oscal;
-pub mod oscal_assessment;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
 pub mod scan;
 pub(crate) mod serde_helpers;
-pub mod werkbank;
 
 pub use auth::AuthInfo;
 pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
@@ -41,8 +38,6 @@ pub use onboarding::{
     GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
     TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
-pub use oscal::OscalDocument;
-pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
     PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
@@ -52,8 +47,3 @@ pub use pentest::{
 pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
-pub use werkbank::{
-    CompleteRequest, CompleteResponse, DastCollect, Executor, HeartbeatAck, HeartbeatRequest,
-    InputRef, Job, JobCollect, JobRecord, JobResult, JobRuntime, JobStatus, JobType, LeaseRequest,
-    LeasedJob,
-};

compliance-core/src/models/oscal.rs

@@ -1,250 +0,0 @@
-//! OSCAL 1.1 catalog types + mapping into the controls corpus.
-//!
-//! Deserialises the OSCAL catalog served by breakpilot-compliance
-//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
-//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
-//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
-//! producer can add detail without breaking us.
-//!
-//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
-//! and scanner routing live in our assessment layer, not here — see
-//! [`crate::traits::ControlsProvider`].
-
-use serde::Deserialize;
-
-use crate::models::onboarding::ComplianceFramework;
-use crate::traits::Control as CorpusControl;
-
-/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
-#[derive(Debug, Clone, Deserialize)]
-pub struct OscalDocument {
-    pub catalog: Catalog,
-}
-
-/// An OSCAL catalog: metadata + a tree of control groups.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Catalog {
-    pub uuid: String,
-    pub metadata: Metadata,
-    #[serde(default)]
-    pub groups: Vec<Group>,
-    #[serde(rename = "back-matter", default)]
-    pub back_matter: Option<BackMatter>,
-}
-
-/// Catalog metadata (title/version + provenance props).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Metadata {
-    pub title: String,
-    pub version: String,
-    #[serde(rename = "oscal-version")]
-    pub oscal_version: String,
-    #[serde(default)]
-    pub props: Vec<Prop>,
-}
-
-/// A name/value property, optionally namespaced.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Prop {
-    pub name: String,
-    pub value: String,
-    #[serde(default)]
-    pub ns: Option<String>,
-}
-
-/// A control group (may nest sub-groups and controls).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Group {
-    #[serde(default)]
-    pub id: String,
-    #[serde(default)]
-    pub title: String,
-    #[serde(default)]
-    pub controls: Vec<Control>,
-    #[serde(default)]
-    pub groups: Vec<Group>,
-}
-
-/// An OSCAL control (may nest enhancement controls).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Control {
-    pub id: String,
-    #[serde(default)]
-    pub title: String,
-    #[serde(default)]
-    pub props: Vec<Prop>,
-    #[serde(default)]
-    pub parts: Vec<Part>,
-    #[serde(default)]
-    pub links: Vec<Link>,
-    #[serde(default)]
-    pub controls: Vec<Control>,
-}
-
-/// A control part (e.g. the `statement`), may nest sub-parts.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Part {
-    #[serde(default)]
-    pub name: String,
-    #[serde(default)]
-    pub prose: Option<String>,
-    #[serde(default)]
-    pub parts: Vec<Part>,
-}
-
-/// A link, e.g. a `reference` to a back-matter resource.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Link {
-    pub href: String,
-    #[serde(default)]
-    pub rel: Option<String>,
-}
-
-/// Back-matter holding referenced resources (e.g. the CRA measures).
-#[derive(Debug, Clone, Deserialize)]
-pub struct BackMatter {
-    #[serde(default)]
-    pub resources: Vec<Resource>,
-}
-
-/// A back-matter resource referenced by control links.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Resource {
-    pub uuid: String,
-    #[serde(default)]
-    pub title: Option<String>,
-    #[serde(default)]
-    pub description: Option<String>,
-}
-
-impl Metadata {
-    /// First prop value with the given name.
-    pub fn prop(&self, name: &str) -> Option<&str> {
-        self.props
-            .iter()
-            .find(|p| p.name == name)
-            .map(|p| p.value.as_str())
-    }
-}
-
-impl Control {
-    /// First prop value with the given name.
-    pub fn prop(&self, name: &str) -> Option<&str> {
-        self.props
-            .iter()
-            .find(|p| p.name == name)
-            .map(|p| p.value.as_str())
-    }
-
-    /// The control's `statement` prose, if present.
-    pub fn statement(&self) -> Option<&str> {
-        self.parts
-            .iter()
-            .find(|p| p.name == "statement")
-            .and_then(|p| p.prose.as_deref())
-    }
-}
-
-impl OscalDocument {
-    /// The framework this catalog declares (`metadata.props[name="framework"]`).
-    pub fn framework(&self) -> Option<ComplianceFramework> {
-        framework_from_str(self.catalog.metadata.prop("framework")?)
-    }
-
-    /// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
-    pub fn content_hash(&self) -> Option<&str> {
-        self.catalog.metadata.prop("content-hash")
-    }
-
-    /// Flatten the catalog into the corpus controls the mapping engine consumes.
-    pub fn to_controls(&self) -> Vec<CorpusControl> {
-        let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
-        let source_label = self.catalog.metadata.title.as_str();
-        let mut out = Vec::new();
-        for group in &self.catalog.groups {
-            collect_group(group, framework, source_label, &mut out);
-        }
-        out
-    }
-}
-
-/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
-/// serde snake_case representation.
-fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
-    serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
-}
-
-fn collect_group(
-    group: &Group,
-    framework: ComplianceFramework,
-    source_label: &str,
-    out: &mut Vec<CorpusControl>,
-) {
-    for control in &group.controls {
-        collect_control(control, framework, source_label, out);
-    }
-    for sub in &group.groups {
-        collect_group(sub, framework, source_label, out);
-    }
-}
-
-fn collect_control(
-    control: &Control,
-    framework: ComplianceFramework,
-    source_label: &str,
-    out: &mut Vec<CorpusControl>,
-) {
-    let source = match control.prop("annex-anchor") {
-        Some(anchor) => Some(format!("{source_label} · {anchor}")),
-        None => Some(source_label.to_string()),
-    };
-    out.push(CorpusControl {
-        id: control.id.clone(),
-        framework,
-        title: control.title.clone(),
-        text: control.statement().unwrap_or_default().to_string(),
-        source,
-    });
-    for enhancement in &control.controls {
-        collect_control(enhancement, framework, source_label, out);
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
-
-    fn parse() -> OscalDocument {
-        serde_json::from_str(CATALOG).unwrap()
-    }
-
-    #[test]
-    fn parses_full_catalog() {
-        let doc = parse();
-        assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
-        assert!(!doc.catalog.groups.is_empty());
-        assert!(doc.catalog.back_matter.is_some());
-    }
-
-    #[test]
-    fn maps_all_controls_to_corpus() {
-        let doc = parse();
-        let controls = doc.to_controls();
-        assert_eq!(controls.len(), 40);
-        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
-
-        let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
-        assert_eq!(c8.framework, ComplianceFramework::Cra);
-        assert!(!c8.title.is_empty());
-        assert!(!c8.text.is_empty(), "statement prose should map into text");
-        assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
-    }
-
-    #[test]
-    fn exposes_content_hash_for_snapshotting() {
-        assert_eq!(parse().content_hash().map(str::len), Some(64));
-    }
-}

compliance-core/src/models/oscal_assessment.rs

@@ -1,424 +0,0 @@
-//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
-//!
-//! The catalog (domain content) comes from the producer; the **assessment** is
-//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
-//! standard OSCAL assessment-results document: an observation per linked finding,
-//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
-//! records the full catalog set we considered.
-//!
-//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
-//! timestamp. Pure — no DB, no network.
-
-use std::collections::HashMap;
-
-use chrono::{DateTime, Utc};
-use serde::Serialize;
-use uuid::Uuid;
-
-use crate::models::finding::{Finding, FindingStatus};
-
-const OSCAL_VERSION: &str = "1.1.2";
-/// Same namespace as the catalog exporter, so ids are stable and correlatable.
-const NAMESPACE: Uuid = Uuid::from_bytes([
-    0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
-]);
-
-fn det_uuid(name: &str) -> String {
-    Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
-}
-
-/// Links findings to the catalog control-ids they provide evidence for.
-pub struct ControlLinker {
-    cwe_to_controls: HashMap<u32, Vec<String>>,
-}
-
-impl ControlLinker {
-    /// Build a linker from an explicit CWE → control-id map.
-    pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
-        Self { cwe_to_controls }
-    }
-
-    /// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
-    /// `_CWE_TO_REQ`; extend as scanner coverage grows).
-    pub fn cra_seed() -> Self {
-        let pairs: &[(u32, &str)] = &[
-            (798, "cra-ai-8"),
-            (259, "cra-ai-8"),
-            (1392, "cra-ai-8"),
-            (327, "cra-ai-13"),
-            (326, "cra-ai-13"),
-            (319, "cra-ai-15"),
-            (311, "cra-ai-15"),
-            (89, "cra-ai-20"),
-            (79, "cra-ai-20"),
-            (78, "cra-ai-20"),
-            (22, "cra-ai-20"),
-        ];
-        let mut map: HashMap<u32, Vec<String>> = HashMap::new();
-        for (cwe, id) in pairs {
-            map.entry(*cwe).or_default().push((*id).to_string());
-        }
-        Self::new(map)
-    }
-
-    /// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
-    fn parse_cwe(raw: &str) -> Option<u32> {
-        raw.trim_start_matches(|c: char| !c.is_ascii_digit())
-            .split(|c: char| !c.is_ascii_digit())
-            .next()
-            .filter(|s| !s.is_empty())
-            .and_then(|s| s.parse().ok())
-    }
-
-    /// The control-ids a finding provides evidence for (via its CWE).
-    pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
-        finding
-            .cwe
-            .as_deref()
-            .and_then(Self::parse_cwe)
-            .and_then(|cwe| self.cwe_to_controls.get(&cwe))
-            .cloned()
-            .unwrap_or_default()
-    }
-}
-
-/// Build a standard OSCAL assessment-results document from `findings`, using each
-/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
-/// finding is emitted as an observation — mapped findings additionally produce a
-/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
-/// (an observation carrying their CWE/tool/severity, with no control target) so
-/// nothing is lost. `at` is the assessment timestamp.
-pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
-    let ts = at.to_rfc3339();
-
-    let mut observations = Vec::new();
-    let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
-    let mut mapped = 0usize;
-    let mut unmapped = 0usize;
-
-    for finding in findings {
-        if finding.status == FindingStatus::FalsePositive {
-            continue; // flagged tool false positive — excluded from the report
-        }
-        let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
-        let location = match (&finding.file_path, finding.line_number) {
-            (Some(f), Some(l)) => Some(format!("{f}:{l}")),
-            (Some(f), None) => Some(f.clone()),
-            _ => None,
-        };
-        let is_mapped = !finding.control_refs.is_empty();
-        if is_mapped {
-            mapped += 1;
-        } else {
-            unmapped += 1;
-        }
-        let mut props = vec![
-            ObsProp::new("tool", &finding.scanner),
-            ObsProp::new("severity", &finding.severity.to_string()),
-            ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
-        ];
-        if let Some(cwe) = &finding.cwe {
-            props.push(ObsProp::new("cwe", cwe));
-        }
-        observations.push(Observation {
-            uuid: obs_uuid.clone(),
-            title: finding.title.clone(),
-            description: finding.description.clone(),
-            methods: vec!["TEST".to_string()],
-            collected: ts.clone(),
-            props,
-            relevant_evidence: vec![RelevantEvidence {
-                href: location.map(|l| format!("file://{l}")),
-                description: format!("[{}] {}", finding.scanner, finding.title),
-            }],
-        });
-        for control_id in &finding.control_refs {
-            obs_by_control
-                .entry(control_id.clone())
-                .or_default()
-                .push(obs_uuid.clone());
-        }
-    }
-
-    let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
-    hit_controls.sort();
-    let ar_findings: Vec<ArFinding> = hit_controls
-        .iter()
-        .map(|control_id| ArFinding {
-            uuid: det_uuid(&format!("finding:{control_id}")),
-            title: format!("Findings affect {control_id}"),
-            target: FindingTarget {
-                target_type: "statement-id".to_string(),
-                target_id: format!("{control_id}_smt"),
-                status: TargetStatus {
-                    state: "not-satisfied".to_string(),
-                },
-            },
-            related_observations: obs_by_control[*control_id]
-                .iter()
-                .map(|u| RelatedObservation {
-                    observation_uuid: u.clone(),
-                })
-                .collect(),
-        })
-        .collect();
-
-    let include_controls: Vec<SelectControlById> = hit_controls
-        .iter()
-        .map(|c| SelectControlById {
-            control_id: (*c).clone(),
-        })
-        .collect();
-
-    let result = ArResult {
-        uuid: det_uuid("result:cra"),
-        title: "Automated code-compliance assessment".to_string(),
-        description: format!(
-            "{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
-            observations.len(),
-            include_controls.len()
-        ),
-        start: ts.clone(),
-        reviewed_controls: ReviewedControls {
-            control_selections: vec![ControlSelection { include_controls }],
-        },
-        observations,
-        findings: ar_findings,
-    };
-
-    AssessmentResultsDoc {
-        assessment_results: AssessmentResults {
-            uuid: det_uuid("assessment-results:cra"),
-            metadata: ArMetadata {
-                title: "Compliance scanner — OSCAL assessment results".to_string(),
-                last_modified: ts,
-                version: "1.0.0".to_string(),
-                oscal_version: OSCAL_VERSION.to_string(),
-            },
-            import_ap: ImportAp {
-                href: "#cra-annex-i".to_string(),
-            },
-            results: vec![result],
-        },
-    }
-}
-
-// ── OSCAL assessment-results document (serialise) ────────────────────────────
-
-/// The root OSCAL assessment-results document.
-#[derive(Debug, Clone, Serialize)]
-pub struct AssessmentResultsDoc {
-    #[serde(rename = "assessment-results")]
-    pub assessment_results: AssessmentResults,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct AssessmentResults {
-    pub uuid: String,
-    pub metadata: ArMetadata,
-    #[serde(rename = "import-ap")]
-    pub import_ap: ImportAp,
-    pub results: Vec<ArResult>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArMetadata {
-    pub title: String,
-    #[serde(rename = "last-modified")]
-    pub last_modified: String,
-    pub version: String,
-    #[serde(rename = "oscal-version")]
-    pub oscal_version: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ImportAp {
-    pub href: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArResult {
-    pub uuid: String,
-    pub title: String,
-    pub description: String,
-    pub start: String,
-    #[serde(rename = "reviewed-controls")]
-    pub reviewed_controls: ReviewedControls,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub observations: Vec<Observation>,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub findings: Vec<ArFinding>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ReviewedControls {
-    #[serde(rename = "control-selections")]
-    pub control_selections: Vec<ControlSelection>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ControlSelection {
-    #[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
-    pub include_controls: Vec<SelectControlById>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct SelectControlById {
-    #[serde(rename = "control-id")]
-    pub control_id: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct Observation {
-    pub uuid: String,
-    pub title: String,
-    pub description: String,
-    pub methods: Vec<String>,
-    pub collected: String,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub props: Vec<ObsProp>,
-    #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
-    pub relevant_evidence: Vec<RelevantEvidence>,
-}
-
-/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
-/// unmapped finding be reported fully as-is.
-#[derive(Debug, Clone, Serialize)]
-pub struct ObsProp {
-    pub name: String,
-    pub value: String,
-}
-
-impl ObsProp {
-    fn new(name: &str, value: &str) -> Self {
-        Self {
-            name: name.to_string(),
-            value: value.to_string(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct RelevantEvidence {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub href: Option<String>,
-    pub description: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArFinding {
-    pub uuid: String,
-    pub title: String,
-    pub target: FindingTarget,
-    #[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
-    pub related_observations: Vec<RelatedObservation>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct FindingTarget {
-    #[serde(rename = "type")]
-    pub target_type: String,
-    #[serde(rename = "target-id")]
-    pub target_id: String,
-    pub status: TargetStatus,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct TargetStatus {
-    pub state: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct RelatedObservation {
-    #[serde(rename = "observation-uuid")]
-    pub observation_uuid: String,
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use crate::models::finding::Severity;
-    use crate::models::scan::ScanType;
-
-    fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
-        let mut f = Finding::new(
-            "repo".into(),
-            fp.into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "hardcoded credential".into(),
-            "desc".into(),
-            Severity::High,
-        );
-        f.cwe = cwe.map(Into::into);
-        f.file_path = Some("src/auth.rs".into());
-        f.line_number = Some(42);
-        f.control_refs = refs.iter().map(|s| s.to_string()).collect();
-        f
-    }
-
-    fn at() -> DateTime<Utc> {
-        DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
-            .unwrap()
-            .with_timezone(&Utc)
-    }
-
-    #[test]
-    fn mapped_finding_becomes_control_finding() {
-        let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
-        let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1);
-        assert_eq!(r.findings.len(), 1);
-        assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
-        assert_eq!(r.findings[0].target.status.state, "not-satisfied");
-        assert_eq!(
-            r.reviewed_controls.control_selections[0]
-                .include_controls
-                .len(),
-            1
-        );
-    }
-
-    #[test]
-    fn unmapped_finding_is_reported_as_is() {
-        let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
-        let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1); // still emitted...
-        assert!(r.findings.is_empty()); // ...but no control finding
-        assert!(r.reviewed_controls.control_selections[0]
-            .include_controls
-            .is_empty());
-        let props: Vec<(&str, &str)> = r.observations[0]
-            .props
-            .iter()
-            .map(|p| (p.name.as_str(), p.value.as_str()))
-            .collect();
-        assert!(props.contains(&("mapping", "unmapped")));
-        assert!(props.contains(&("cwe", "CWE-319")));
-    }
-
-    #[test]
-    fn false_positive_is_excluded() {
-        let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
-        f.status = FindingStatus::FalsePositive;
-        let doc = assess(&[f], at());
-        assert!(doc.assessment_results.results[0].observations.is_empty());
-    }
-
-    #[test]
-    fn deterministic_and_valid_oscal() {
-        let mk = || {
-            vec![
-                finding("f1", Some("CWE-798"), &["cra-ai-8"]),
-                finding("f2", Some("CWE-319"), &[]),
-            ]
-        };
-        let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
-        let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
-        assert_eq!(a, b);
-        assert!(a.contains("\"oscal-version\":\"1.1.2\""));
-        assert!(a.contains("\"not-satisfied\""));
-        assert!(a.contains("\"mapping\""));
-    }
-}

compliance-core/src/models/werkbank.rs

@@ -1,514 +0,0 @@
-//! The Werkbank job/result contract (WB-01).
-//!
-//! The shared, dependency-free vocabulary the control plane and the Werkbank
-//! execution runner agree on: what a [`Job`] is, which [`Executor`] runs it, how
-//! it moves through the queue ([`JobStatus`]), and what a [`JobResult`] carries
-//! back. Jobs are declarative — TOML on disk, JSON on the wire — and results
-//! reuse the existing scanner result types ([`Finding`], [`DastFinding`],
-//! [`SbomEntry`]) so the runner produces exactly what the control plane persists.
-//!
-//! This module is intentionally free of the `mongodb`/`axum` features so the
-//! runner can depend on `compliance-core` without pulling the server stack.
-
-use std::collections::BTreeMap;
-
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
-
-use super::dast::DastFinding;
-use super::finding::Finding;
-use super::sbom::SbomEntry;
-
-/// The kind of dynamic-execution job.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "kebab-case")]
-pub enum JobType {
-    /// Instantiate control logic on an ephemeral soft-PLC and probe it.
-    PlcProvision,
-    /// Boot a firmware image under QEMU and run dynamic checks.
-    QemuBoot,
-    /// Crawl and dynamically test a running web endpoint.
-    Dast,
-    /// Run an active penetration test against a running target.
-    Pentest,
-}
-
-/// How a runner executes a job — the CI-runner-style classification. A runner
-/// advertises exactly one; a job requires one.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Executor {
-    /// A subprocess on the runner host (dev / trusted single-node).
-    Shell,
-    /// One or more containers on the runner's Docker (default; QEMU runs here).
-    Docker,
-    /// A Pod/Job in a Kubernetes cluster (scale-out / multi-tenant).
-    K8s,
-}
-
-/// Lifecycle state of a job in the queue.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum JobStatus {
-    /// Waiting to be leased.
-    Queued,
-    /// Leased by a runner but not yet started.
-    Leased,
-    /// Executing on a runner.
-    Running,
-    /// Completed successfully.
-    Succeeded,
-    /// Completed with an error.
-    Failed,
-    /// The lease/lifetime deadline elapsed before completion.
-    Expired,
-    /// Cancelled by the control plane.
-    Cancelled,
-}
-
-impl JobStatus {
-    /// Whether the job has reached a terminal state (no further transitions).
-    pub fn is_terminal(self) -> bool {
-        matches!(
-            self,
-            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Expired | JobStatus::Cancelled
-        )
-    }
-}
-
-/// A reference to an input artifact. Resolved by the runner from a source it can
-/// reach; the blob itself never flows through the control plane (so an on-prem
-/// runner keeps customer data local). Exactly one of `blob`/`url` should be set.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct InputRef {
-    /// Content-addressed blob (e.g. `sha256:…`) the runner fetches from its store.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub blob: Option<String>,
-    /// A URL the runner can reach (git repo, internal artifact store, …).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
-}
-
-impl InputRef {
-    /// A content-addressed blob reference.
-    pub fn blob(id: impl Into<String>) -> Self {
-        Self {
-            blob: Some(id.into()),
-            url: None,
-        }
-    }
-}
-
-/// Sandbox runtime knobs. Fields are executor/job-type specific and all optional;
-/// `extra` carries anything not modelled explicitly.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobRuntime {
-    /// Container image (Docker executor).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub image: Option<String>,
-    /// Memory cap (e.g. `512m`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub memory: Option<String>,
-    /// CPU cap (e.g. `0.5`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub cpus: Option<String>,
-    /// Network to join (e.g. `isolated`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub network: Option<String>,
-    /// QEMU machine type (qemu-boot).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub machine: Option<String>,
-    /// QEMU target architecture (qemu-boot).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub arch: Option<String>,
-    /// Executor-specific extras not modelled above.
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub extra: BTreeMap<String, String>,
-}
-
-/// DAST collection settings for jobs that scan a web endpoint.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DastCollect {
-    /// Maximum crawl depth (kept shallow for ephemeral instances).
-    pub max_crawl_depth: u32,
-}
-
-/// What to collect from a run.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobCollect {
-    /// Run the industrial-protocol probe (Modbus/OPC-UA/EtherNet-IP).
-    #[serde(default)]
-    pub ics_probe: bool,
-    /// Run DAST against the provisioned/booted web endpoint.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub dast: Option<DastCollect>,
-    /// Run an active pentest.
-    #[serde(default)]
-    pub pentest: bool,
-    /// Collect an SBOM.
-    #[serde(default)]
-    pub sbom: bool,
-}
-
-/// A declarative dynamic-execution job the control plane enqueues and a Werkbank
-/// runner leases and executes.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct Job {
-    /// Unique job id (assigned by the control plane on enqueue).
-    pub id: String,
-    /// What kind of job this is.
-    #[serde(rename = "type")]
-    pub job_type: JobType,
-    /// Owning tenant.
-    pub tenant: String,
-    /// The onboarded target this job tests.
-    pub target_id: String,
-    /// The executor a runner must provide to run this job.
-    pub executor: Executor,
-    /// Runner capabilities this job requires (e.g. `arch=amd64`, `kvm=true`).
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub labels: Vec<String>,
-    /// Hard lifetime deadline for the whole job.
-    pub timeout_secs: u64,
-    /// Named input artifacts (e.g. `program`, `firmware`), by reference.
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub inputs: BTreeMap<String, InputRef>,
-    /// Sandbox runtime knobs.
-    #[serde(default)]
-    pub runtime: JobRuntime,
-    /// What to collect from the run.
-    #[serde(default)]
-    pub collect: JobCollect,
-}
-
-impl Job {
-    /// A `plc-provision` job: instantiate the control logic named `program` on an
-    /// ephemeral soft-PLC (Docker executor) and collect the ICS probe + DAST.
-    pub fn plc_provision(
-        id: impl Into<String>,
-        tenant: impl Into<String>,
-        target_id: impl Into<String>,
-        program: InputRef,
-        timeout_secs: u64,
-    ) -> Self {
-        let mut inputs = BTreeMap::new();
-        inputs.insert("program".to_string(), program);
-        Self {
-            id: id.into(),
-            job_type: JobType::PlcProvision,
-            tenant: tenant.into(),
-            target_id: target_id.into(),
-            executor: Executor::Docker,
-            labels: Vec::new(),
-            timeout_secs,
-            inputs,
-            runtime: JobRuntime::default(),
-            collect: JobCollect {
-                ics_probe: true,
-                dast: Some(DastCollect { max_crawl_depth: 2 }),
-                pentest: false,
-                sbom: false,
-            },
-        }
-    }
-}
-
-/// The outcome of running a job, posted back to the control plane. Findings and
-/// SBOM reuse the shared scanner types, so the control plane persists them
-/// unchanged. Submission is idempotent — keyed by [`JobResult::job_id`].
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct JobResult {
-    /// The job this result is for.
-    pub job_id: String,
-    /// Terminal status of the job.
-    pub status: Option<JobStatus>,
-    /// General scanner findings (e.g. ICS-probe findings).
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub findings: Vec<Finding>,
-    /// DAST findings from a web-endpoint scan.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub dast_findings: Vec<DastFinding>,
-    /// SBOM components collected from the run.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub sbom: Vec<SbomEntry>,
-    /// Error message when the job failed.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Captured execution log (truncated by the runner).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub logs: Option<String>,
-    /// When execution started on the runner.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub started_at: Option<DateTime<Utc>>,
-    /// When execution finished.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub finished_at: Option<DateTime<Utc>>,
-}
-
-impl JobResult {
-    /// A successful result for a job.
-    pub fn succeeded(job_id: impl Into<String>) -> Self {
-        Self {
-            job_id: job_id.into(),
-            status: Some(JobStatus::Succeeded),
-            ..Default::default()
-        }
-    }
-
-    /// A failed result carrying an error message.
-    pub fn failed(job_id: impl Into<String>, error: impl Into<String>) -> Self {
-        Self {
-            job_id: job_id.into(),
-            status: Some(JobStatus::Failed),
-            error: Some(error.into()),
-            ..Default::default()
-        }
-    }
-}
-
-/// A queued job as persisted by the control plane (WB-02): the [`Job`] contract
-/// plus the queue bookkeeping — status, lease ownership, attempt count, and the
-/// eventual result. The runner never sees this record; on lease it receives a
-/// [`LeasedJob`] (the job plus a token it presents to heartbeat/complete).
-///
-/// Timestamps persist as native BSON dates so the queue's range queries (lease
-/// FIFO by `created_at`, visibility-timeout sweep by `lease_expires_at`) compare
-/// correctly.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct JobRecord {
-    /// The job to run.
-    pub job: Job,
-    /// Current queue state.
-    pub status: JobStatus,
-    /// The lease token held by the current runner (proves lease ownership).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub lease_token: Option<String>,
-    /// Id of the runner holding the lease.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub leased_by: Option<String>,
-    /// When the current lease expires — the visibility timeout after which a
-    /// crashed runner's job is swept back to `queued`.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub lease_expires_at: Option<DateTime<Utc>>,
-    /// Last heartbeat from the runner.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub heartbeat_at: Option<DateTime<Utc>>,
-    /// How many times the job has been leased (incremented on each lease).
-    #[serde(default)]
-    pub attempts: u32,
-    /// Set when the control plane requests cancellation; the runner sees it on
-    /// its next heartbeat and aborts.
-    #[serde(default)]
-    pub cancel_requested: bool,
-    /// The result, once the job reaches a terminal state.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub result: Option<JobResult>,
-    /// When the job was enqueued.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub created_at: DateTime<Utc>,
-    /// Last modification.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub updated_at: DateTime<Utc>,
-}
-
-impl JobRecord {
-    /// A freshly-enqueued (`queued`) record for a job.
-    pub fn queued(job: Job, now: DateTime<Utc>) -> Self {
-        Self {
-            job,
-            status: JobStatus::Queued,
-            lease_token: None,
-            leased_by: None,
-            lease_expires_at: None,
-            heartbeat_at: None,
-            attempts: 0,
-            cancel_requested: false,
-            result: None,
-            created_at: now,
-            updated_at: now,
-        }
-    }
-}
-
-/// A job handed to a runner on lease: what to run plus the token the runner must
-/// present to heartbeat and complete it.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LeasedJob {
-    /// The job to execute.
-    pub job: Job,
-    /// The lease token proving ownership (opaque to the runner).
-    pub lease_token: String,
-}
-
-/// The runner's view of a heartbeat: whether the control plane has asked the job
-/// to stop. `None` from the queue means the lease was lost (token mismatch or the
-/// job already terminal) and the runner should abandon the work.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct HeartbeatAck {
-    /// The control plane requested cancellation — the runner should tear down.
-    pub cancelled: bool,
-}
-
-// --- Runner ↔ control-plane transport (the pull API wire types) ---------------
-// Shared so the runner (client) and the control plane (server) agree on shapes.
-
-/// Runner → control plane: lease the oldest runnable job for this runner.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct LeaseRequest {
-    /// The tenant queue to lease from.
-    pub tenant: String,
-    /// The runner id (advertised for attribution).
-    pub runner_id: String,
-    /// The executor this runner provides.
-    pub executor: Executor,
-    /// The capability labels this runner advertises.
-    #[serde(default)]
-    pub labels: Vec<String>,
-    /// Requested lease lifetime (the visibility timeout), in seconds.
-    pub lease_ttl_secs: u64,
-}
-
-/// Runner → control plane: prove lease ownership and extend it.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct HeartbeatRequest {
-    /// The tenant queue.
-    pub tenant: String,
-    /// The job being worked.
-    pub job_id: String,
-    /// The lease token from the [`LeasedJob`].
-    pub lease_token: String,
-    /// Lease lifetime to extend to, in seconds.
-    pub lease_ttl_secs: u64,
-}
-
-/// Runner → control plane: record a job's terminal result.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CompleteRequest {
-    /// The tenant queue.
-    pub tenant: String,
-    /// The job being completed.
-    pub job_id: String,
-    /// The lease token proving ownership.
-    pub lease_token: String,
-    /// The result to record.
-    pub result: JobResult,
-}
-
-/// Control plane → runner: whether the completion was recorded (false if the
-/// lease was already lost — token mismatch or the job had become terminal).
-#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
-pub struct CompleteResponse {
-    /// Whether the result was recorded.
-    pub recorded: bool,
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn job_round_trips_through_json() {
-        let job = Job::plc_provision("job_1", "acme", "64f0aa", InputRef::blob("sha256:abc"), 180);
-        let json = serde_json::to_string(&job).expect("serialize");
-        let back: Job = serde_json::from_str(&json).expect("deserialize");
-        assert_eq!(job, back);
-        // Enum wire forms are the kebab/lowercase the contract documents.
-        assert!(json.contains("\"type\":\"plc-provision\""));
-        assert!(json.contains("\"executor\":\"docker\""));
-    }
-
-    #[test]
-    fn parses_the_design_doc_plc_provision_toml() {
-        // The exact shape from docs/DESIGN.md §5 (wrapped in a [job] table).
-        #[derive(Deserialize)]
-        struct JobFile {
-            job: Job,
-        }
-        let src = r#"
-            [job]
-            id = "job_01H"
-            type = "plc-provision"
-            tenant = "acme"
-            target_id = "64f0"
-            executor = "docker"
-            labels = ["arch=amd64"]
-            timeout_secs = 180
-
-            [job.inputs]
-            program = { blob = "sha256:deadbeef" }
-
-            [job.runtime]
-            image = "openplc:latest"
-            memory = "512m"
-            cpus = "0.5"
-            network = "isolated"
-
-            [job.collect]
-            ics_probe = true
-            dast = { max_crawl_depth = 2 }
-        "#;
-        let file: JobFile = toml::from_str(src).expect("parse job toml");
-        let job = file.job;
-        assert_eq!(job.job_type, JobType::PlcProvision);
-        assert_eq!(job.executor, Executor::Docker);
-        assert_eq!(job.labels, vec!["arch=amd64".to_string()]);
-        assert_eq!(
-            job.inputs.get("program").and_then(|i| i.blob.as_deref()),
-            Some("sha256:deadbeef")
-        );
-        assert_eq!(job.runtime.image.as_deref(), Some("openplc:latest"));
-        assert!(job.collect.ics_probe);
-        assert_eq!(job.collect.dast.map(|d| d.max_crawl_depth), Some(2));
-    }
-
-    #[test]
-    fn qemu_boot_runtime_fields_parse() {
-        #[derive(Deserialize)]
-        struct JobFile {
-            job: Job,
-        }
-        let src = r#"
-            [job]
-            id = "j2"
-            type = "qemu-boot"
-            tenant = "acme"
-            target_id = "t"
-            executor = "docker"
-            labels = ["kvm=true"]
-            timeout_secs = 600
-            [job.inputs]
-            firmware = { blob = "sha256:cafe" }
-            [job.runtime]
-            machine = "virt"
-            arch = "arm"
-            memory = "1g"
-        "#;
-        let file: JobFile = toml::from_str(src).expect("parse");
-        assert_eq!(file.job.job_type, JobType::QemuBoot);
-        assert_eq!(file.job.runtime.arch.as_deref(), Some("arm"));
-        assert_eq!(
-            file.job
-                .inputs
-                .get("firmware")
-                .and_then(|i| i.blob.as_deref()),
-            Some("sha256:cafe")
-        );
-    }
-
-    #[test]
-    fn status_terminality() {
-        assert!(JobStatus::Succeeded.is_terminal());
-        assert!(JobStatus::Expired.is_terminal());
-        assert!(!JobStatus::Queued.is_terminal());
-        assert!(!JobStatus::Running.is_terminal());
-    }
-
-    #[test]
-    fn result_constructors() {
-        assert_eq!(JobResult::succeeded("j").status, Some(JobStatus::Succeeded));
-        let f = JobResult::failed("j", "boom");
-        assert_eq!(f.status, Some(JobStatus::Failed));
-        assert_eq!(f.error.as_deref(), Some("boom"));
-    }
-}

compliance-mcp/src/main.rs

@@ -42,19 +42,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
         let pool_for_factory = pool.clone();
         let service = StreamableHttpService::new(
-            move || {
+            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
-                // The factory runs in the request task, still inside the bearer
-                // middleware's `TENANT_ID` scope, and BEFORE rmcp spawns the
-                // session task (which would lose the task_local). So bind the
-                // tenant into the session's server instance here, once.
-                let tenant_id = auth::current_tenant_id().ok_or_else(|| {
-                    std::io::Error::other("no tenant context when creating MCP session")
-                })?;
-                Ok(ComplianceMcpServer::new(
-                    pool_for_factory.clone(),
-                    tenant_id,
-                ))
-            },
             Arc::new(LocalSessionManager::default()),
             StreamableHttpServerConfig::default(),
         );
@@ -81,11 +69,16 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             tenant_id = %synth_tenant,
             "stdio transport — using synthetic tenant id; DO NOT use in production"
         );
-        let server = ComplianceMcpServer::new(pool, synth_tenant);
+        let server = ComplianceMcpServer::new(pool);
         let transport = rmcp::transport::stdio();
         use rmcp::ServiceExt;
-        let handle = server.serve(transport).await?;
+        auth::TENANT_ID
-        handle.waiting().await?;
+            .scope(synth_tenant, async {
+                let handle = server.serve(transport).await?;
+                handle.waiting().await?;
+                Ok::<_, Box<dyn std::error::Error>>(())
+            })
+            .await?;
     }
 
     Ok(())

compliance-mcp/src/server.rs

@@ -2,33 +2,37 @@ use rmcp::{
     handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
 };
 
+use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
-use crate::tools::{dast, findings, oscal, pentest, sbom};
+use crate::tools::{dast, findings, pentest, sbom};
 
 pub struct ComplianceMcpServer {
     pool: DatabasePool,
-    /// Tenant this session serves. Bound once at session creation (the HTTP
-    /// factory reads the bearer-set tenant while still in the request scope;
-    /// stdio passes a synthetic id) — NOT a per-request `task_local`, which is
-    /// lost across the `tokio::spawn` that runs the Streamable-HTTP session.
-    tenant_id: String,
     #[allow(dead_code)]
     tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
 }
 
 impl ComplianceMcpServer {
-    /// The per-tenant `Database` for this session.
+    /// Resolve the per-tenant `Database` from the bearer-set
+    /// `task_local`. Every tool handler calls this; missing context
+    /// surfaces as `internal_error` because it means the auth
+    /// middleware was misconfigured (handler ran without scope).
     fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
-        Ok(self.pool.for_tenant_id(&self.tenant_id))
+        let tenant_id = current_tenant_id().ok_or_else(|| {
+            rmcp::ErrorData::internal_error(
+                "no tenant context — bearer middleware not in chain".to_string(),
+                None,
+            )
+        })?;
+        Ok(self.pool.for_tenant_id(&tenant_id))
     }
 }
 
 #[tool_router]
 impl ComplianceMcpServer {
-    pub fn new(pool: DatabasePool, tenant_id: String) -> Self {
+    pub fn new(pool: DatabasePool) -> Self {
         Self {
             pool,
-            tenant_id,
             tool_router: Self::tool_router(),
         }
     }
@@ -64,17 +68,6 @@ impl ComplianceMcpServer {
         findings::findings_summary(&db, params).await
     }
 
-    #[tool(
-        description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
-    )]
-    async fn oscal_assessment(
-        &self,
-        Parameters(params): Parameters<oscal::OscalAssessmentParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        oscal::oscal_assessment(&db, params).await
-    }
-
     // ── SBOM ──────────────────────────────────────────────
 
     #[tool(

compliance-mcp/src/tools/mod.rs

@@ -1,5 +1,4 @@
 pub mod dast;
 pub mod findings;
-pub mod oscal;
 pub mod pentest;
 pub mod sbom;

compliance-mcp/src/tools/oscal.rs

@@ -1,51 +0,0 @@
-//! OSCAL assessment MCP tool.
-//!
-//! Emits a standard OSCAL assessment-results document for a repo's findings —
-//! what breakpilot's scanner MCP client pulls. Mapped findings target their
-//! compliance controls (via the stamped `control_refs`); unmapped findings are
-//! reported as-is, so nothing is lost.
-
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use compliance_core::models::oscal_assessment::assess;
-use compliance_core::models::Finding;
-
-use crate::database::Database;
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct OscalAssessmentParams {
-    /// Repository / target id to assess.
-    pub repo_id: String,
-}
-
-pub async fn oscal_assessment(
-    db: &Database,
-    params: OscalAssessmentParams,
-) -> Result<CallToolResult, McpError> {
-    let mut cursor = db
-        .findings()
-        .find(doc! { "repo_id": &params.repo_id })
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut findings: Vec<Finding> = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        findings.push(
-            cursor
-                .deserialize_current()
-                .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
-        );
-    }
-
-    let document = assess(&findings, chrono::Utc::now());
-    let json = serde_json::to_string_pretty(&document)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}

control-map/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "control-map"
-version = "0.1.0"
-edition = "2021"
-
-[lints]
-workspace = true
-
-[dependencies]
-serde = { workspace = true }
-serde_json = { workspace = true }
-thiserror = { workspace = true }

control-map/data/cra_control_map.json

@@ -1,496 +0,0 @@
-{
-  "version": "1.0",
-  "framework": "cra",
-  "controls": [
-    {
-      "control": "cra-ai-1",
-      "title": "Secure-by-Default-Konfiguration",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-1-flask-debug-enabled",
-            "cra-ai-1-django-debug-true",
-            "cra-ai-1-tls-verify-disabled",
-            "cra-ai-1-cors-wildcard"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-2",
-      "title": "Minimale Angriffsflaeche",
-      "scans": [],
-      "note": "design property (minimal attack surface) — not derivable from local code patterns; architecture/threat-model review",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-3",
-      "title": "Sichere Systemarchitektur",
-      "scans": [],
-      "note": "design property (secure system architecture) — architecture review, not statically code-checkable",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-4",
-      "title": "Least-Privilege-Prinzip",
-      "scans": [],
-      "note": "design property (least-privilege) — deployment/IAM & architecture review, not a local code pattern",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-5",
-      "title": "Manipulationsschutz",
-      "scans": [],
-      "note": "design property (tamper protection) — hardware/runtime & operational control, not statically code-checkable",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-6",
-      "title": "Integritaetspruefung",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-7",
-      "title": "Starke Authentifizierung",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-7-weak-password-hash"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-8",
-      "title": "Keine Default-Passwoerter",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-259"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-9",
-      "title": "Sicheres Credential-Management",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-522"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-10",
-      "title": "Sitzungsmanagement",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-10-session-cookie-insecure",
-            "cra-ai-10-express-cookie-insecure"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-11",
-      "title": "Brute-Force-Schutz",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-12",
-      "title": "Rollenbasierte Autorisierung",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-13",
-      "title": "Verschluesselung sensibler Daten",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-327",
-            "CWE-326"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-14",
-      "title": "Speicher-Schutz (Data at Rest)",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-14-python-weak-cipher",
-            "cra-ai-14-node-weak-cipher"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-15",
-      "title": "Transport-Schutz (Data in Transit)",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-319",
-            "CWE-311"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-16",
-      "title": "Sicheres Schluesselmanagement",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-321"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-17",
-      "title": "Datenminimierung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-18",
-      "title": "Strukturierter SSDLC",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-19",
-      "title": "Systematische Code Reviews",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-20",
-      "title": "Automatisierte Sicherheitstests",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-89",
-            "CWE-78",
-            "CWE-79",
-            "CWE-22"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-21",
-      "title": "Supply-Chain-Security",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-22",
-      "title": "Dependency-Monitoring",
-      "scans": [
-        {
-          "tool": "osv",
-          "scan_type": "cve",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-23",
-      "title": "Software Bill of Materials (SBOM)",
-      "scans": [
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-24",
-      "title": "Security-Logging",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-25",
-      "title": "Ereignis-Monitoring",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-26",
-      "title": "Anomalie-Erkennung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-27",
-      "title": "Log-Integritaet und -Aufbewahrung",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-28",
-      "title": "Sichere Update-Mechanismen",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-29",
-      "title": "Update-Authentizitaet",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-30",
-      "title": "Update-Integritaet",
-      "scans": [
-        {
-          "tool": "grounded-control-check",
-          "scan_type": "code_review",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-31",
-      "title": "Lifecycle-Support",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-32",
-      "title": "Schwachstellen-Identifikation",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-33",
-      "title": "SBOM-Pflege und Analyse",
-      "scans": [
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "osv",
-          "scan_type": "cve",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-34",
-      "title": "Risikobasierte Priorisierung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-35",
-      "title": "Coordinated Vulnerability Disclosure",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-36",
-      "title": "Incident-Response-Prozess",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-37",
-      "title": "Fruehwarnung (24h)",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-38",
-      "title": "Detaillierter Vorfallsbericht (72h)",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-39",
-      "title": "Patch-Bereitstellung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-40",
-      "title": "Dokumentation und Nachbereitung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    }
-  ]
-}

control-map/src/lib.rs

@@ -1,254 +0,0 @@
-//! `control-map` — the deterministic control → scan lookup table (LUT).
-//!
-//! The "transcribing" layer: it maps each compliance control to the static-scan
-//! step(s) that check it, or marks it as needing custom tooling, or as not
-//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
-//! decides coverage. The LLM only enters later, downstream, to triage/ground the
-//! *tool's* findings (that lives in the agent, not here).
-//!
-//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
-//! + query helpers.
-
-use serde::{Deserialize, Serialize};
-
-/// Coverage bucket for a control under static (SAST-family) scanning.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Coverage {
-    /// An existing tool's scan surfaces findings for this control.
-    Covered,
-    /// Code-checkable, but no existing tool digs it out — we must write tooling.
-    NeedsTooling,
-    /// Process / document control — out of static-scan scope.
-    NotCodeCheckable,
-}
-
-/// One tool binding: a scan step that (at least partially) checks a control.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ScanBinding {
-    /// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
-    pub tool: String,
-    /// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
-    pub scan_type: String,
-    /// CWEs whose findings map to this control (used to attach findings back).
-    #[serde(default)]
-    pub cwe: Vec<String>,
-    /// Optional specific rule ids this control keys on.
-    #[serde(default)]
-    pub rules: Vec<String>,
-}
-
-/// One control's entry in the LUT.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlEntry {
-    /// Control id, e.g. `"cra-ai-8"`.
-    pub control: String,
-    /// Human-readable title (for the reviewable view).
-    #[serde(default)]
-    pub title: String,
-    /// Coverage bucket.
-    pub status: Coverage,
-    /// Tool bindings (empty unless `status == Covered`).
-    #[serde(default)]
-    pub scans: Vec<ScanBinding>,
-    /// Reviewer note — why it needs tooling / isn't code-checkable.
-    #[serde(default)]
-    pub note: Option<String>,
-}
-
-/// The control → scan lookup table for one framework.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlMap {
-    pub version: String,
-    pub framework: String,
-    pub controls: Vec<ControlEntry>,
-}
-
-const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
-
-/// Whether an authored rule id `bound` matches a scanner's emitted rule id
-/// `actual`. semgrep prefixes local-rule check_ids with a path
-/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
-/// id segment rather than requiring exact equality.
-fn rule_id_matches(bound: &str, actual: &str) -> bool {
-    actual == bound || actual.ends_with(&format!(".{bound}"))
-}
-
-impl ControlMap {
-    /// Load the built-in CRA control map (the embedded, authored LUT).
-    pub fn cra() -> Result<Self, MapError> {
-        Ok(serde_json::from_str(CRA_MAP_JSON)?)
-    }
-
-    /// The coverage entry for a control id, if present.
-    pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
-        self.controls.iter().find(|c| c.control == control_id)
-    }
-
-    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
-    /// raw tool finding back to the control(s) it's evidence for.
-    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
-        self.controls_for_finding(tool, Some(cwe), None)
-    }
-
-    /// Controls a tool finding is evidence for, matched by CWE and/or the specific
-    /// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
-    /// bind by rule id (precise — a broad CWE would over-attribute and then the
-    /// grounded judge could drop a genuine finding as a control false positive).
-    pub fn controls_for_finding(
-        &self,
-        tool: &str,
-        cwe: Option<&str>,
-        rule_id: Option<&str>,
-    ) -> Vec<&ControlEntry> {
-        self.controls
-            .iter()
-            .filter(|c| {
-                c.scans.iter().any(|s| {
-                    s.tool == tool
-                        && (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
-                            || rule_id
-                                .is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
-                })
-            })
-            .collect()
-    }
-
-    /// Count of controls in each coverage bucket.
-    pub fn summary(&self) -> CoverageSummary {
-        let mut s = CoverageSummary::default();
-        for c in &self.controls {
-            match c.status {
-                Coverage::Covered => s.covered += 1,
-                Coverage::NeedsTooling => s.needs_tooling += 1,
-                Coverage::NotCodeCheckable => s.not_code_checkable += 1,
-            }
-        }
-        s
-    }
-}
-
-/// Coverage bucket counts.
-#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
-pub struct CoverageSummary {
-    pub covered: usize,
-    pub needs_tooling: usize,
-    pub not_code_checkable: usize,
-}
-
-impl CoverageSummary {
-    pub fn total(&self) -> usize {
-        self.covered + self.needs_tooling + self.not_code_checkable
-    }
-}
-
-/// Errors loading a control map.
-#[derive(Debug, thiserror::Error)]
-pub enum MapError {
-    #[error("failed to parse control map: {0}")]
-    Parse(#[from] serde_json::Error),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn cra_map_loads_all_40_controls() {
-        let map = ControlMap::cra().expect("CRA map should parse");
-        assert_eq!(map.framework, "cra");
-        assert_eq!(map.controls.len(), 40);
-        assert_eq!(map.summary().total(), 40);
-    }
-
-    #[test]
-    fn hardcoded_password_control_is_tool_covered() {
-        let map = ControlMap::cra().unwrap();
-        let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
-        assert_eq!(c.status, Coverage::Covered);
-        assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
-        assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
-    }
-
-    #[test]
-    fn finding_attaches_back_to_control_via_tool_and_cwe() {
-        let map = ControlMap::cra().unwrap();
-        let hits = map.controls_for("semgrep", "CWE-798");
-        assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
-    }
-
-    #[test]
-    fn covered_and_not_checkable_are_populated() {
-        let s = ControlMap::cra().unwrap().summary();
-        assert!(s.covered > 0);
-        assert!(s.not_code_checkable > 0);
-        // needs_tooling is now empty: every code-checkable control is either
-        // tool-covered or covered by the grounded surface pass.
-        assert_eq!(s.needs_tooling, 0);
-    }
-
-    #[test]
-    fn rule_id_matching_handles_semgrep_path_prefix() {
-        let bound = "cra-ai-1-flask-debug-enabled";
-        assert!(rule_id_matches(bound, bound)); // exact
-        assert!(rule_id_matches(
-            bound,
-            "tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
-        )); // semgrep path prefix
-        assert!(!rule_id_matches(
-            bound,
-            "cra-ai-1-flask-debug-enabled-extra"
-        )); // not a suffix segment
-        assert!(!rule_id_matches(
-            bound,
-            "python.lang.security.exec-detected"
-        )); // unrelated
-    }
-
-    #[test]
-    fn custom_rule_finding_attaches_to_control_by_rule_id() {
-        let map = ControlMap::cra().unwrap();
-        // cra-ai-1 is now tool-covered by custom rules.
-        assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
-        // A prefixed check_id still maps back to cra-ai-1 by rule id.
-        let hits =
-            map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
-        assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
-    }
-
-    #[test]
-    fn coverage_after_grounded_promotion() {
-        let s = ControlMap::cra().unwrap().summary();
-        // 9 off-the-shelf + 4 custom-semgrep + 8 grounded surface controls (promoted
-        // after the grounded path was validated live).
-        assert_eq!(s.covered, 21);
-        // Nothing left as needs_tooling — every code-checkable control is covered.
-        assert_eq!(s.needs_tooling, 0);
-        // The 4 pure-architectural controls remain not code-checkable.
-        assert_eq!(s.not_code_checkable, 19);
-        assert_eq!(s.total(), 40);
-    }
-
-    #[test]
-    fn architectural_controls_are_not_code_checkable() {
-        let map = ControlMap::cra().unwrap();
-        for id in ["cra-ai-2", "cra-ai-3", "cra-ai-4", "cra-ai-5"] {
-            let c = map.coverage(id).unwrap();
-            assert_eq!(c.status, Coverage::NotCodeCheckable, "{id}");
-            assert!(c.scans.is_empty(), "{id} should carry no scan bindings");
-        }
-    }
-
-    #[test]
-    fn custom_rule_controls_do_not_bind_by_broad_cwe() {
-        let map = ControlMap::cra().unwrap();
-        // cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
-        // only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
-        assert!(map.controls_for("semgrep", "CWE-489").is_empty());
-        // The CWE path for off-the-shelf findings is unchanged.
-        assert!(map
-            .controls_for("semgrep", "CWE-798")
-            .iter()
-            .any(|c| c.control == "cra-ai-8"));
-    }
-}

docs/.vitepress/config.mts

@@ -36,7 +36,6 @@ export default withMermaid(defineConfig({
           { text: 'Pentest Architecture', link: '/features/pentest-architecture' },
           { text: 'AI Chat', link: '/features/ai-chat' },
           { text: 'Code Knowledge Graph', link: '/features/graph' },
-          { text: 'Compliance Control Mapping', link: '/features/control-mapping' },
           { text: 'MCP Integration', link: '/features/mcp-server' },
         ],
       },

docs/features/control-mapping.md

@@ -1,136 +0,0 @@
-# Compliance Control Mapping
-
-Control mapping connects the scanner's raw output — deterministic tool findings and the code itself — to the **compliance controls** each piece of evidence supports. A hardcoded credential stops being just "CWE-798 from semgrep" and becomes evidence for *"cra-ai-8: no default passwords"* and, at scale, master control *`mc-31761` hardcoded_secrets_detection*. Findings carry those references (`control_refs`) into the dashboard and out over the MCP server as OSCAL, so the compliance report is built from real, grounded findings rather than a questionnaire.
-
-## The core principle: tools detect, the LLM judges
-
-The design has one rule, borrowed from the ZeroFalse / IRIS line of research: **deterministic tools are the detectors; the LLM is only ever a grounded false-positive filter, never the thing that finds the issue.**
-
-- A tool (semgrep, gitleaks, syft/osv, the PLC linter; the DAST agents today, with **Nuclei and ZAP planned** as deterministic web/OT detectors underneath them — see [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code)) detects.
-- An **authored, human-reviewed lookup table** (`control-map`) maps that detection to the control(s) it's evidence for.
-- The LLM enters last, to *confirm or refute* the mapping against the actual code — and every surviving verdict is anchored to a verbatim snippet by the grounding gate.
-
-This keeps hallucination out of detection. The LLM supplies cross-language, cross-stack pattern *recognition*; the surrounding machinery supplies determinism.
-
-## Coverage model
-
-Every control lands in one of three buckets, recorded in the `control-map` LUT (`control-map/data/cra_control_map.json`) and never decided by an LLM:
-
-| Bucket | Meaning |
-| --- | --- |
-| `covered` | An existing tool's scan surfaces findings for this control |
-| `needs_tooling` | Code-checkable, but no off-the-shelf tool digs it out — we author a detector or use the grounded surface check |
-| `not_code_checkable` | A design/process property — out of static-scan scope |
-
-For the **CRA** framework (40 controls) the split is **13 covered · 8 needs_tooling · 19 not_code_checkable**. The 16 originally-uncovered controls were resolved as a hybrid:
-
-- **4 custom semgrep detectors** (`cra-ai-1`, `7`, `10`, `14`) — secure-by-default, weak password hashing, insecure session cookies, weak data-at-rest ciphers. Shipped in the binary and matched back to controls **by rule id** so a broad CWE can't over-attribute.
-- **8 grounded surface checks** (`cra-ai-6`, `11`, `12`, `24`, `27`, `28`, `29`, `30`) — the absence-based controls (no rate limiting, no security logging, no update-signature check…) that have no syntactic pattern.
-- **4 marked not_code_checkable** (`cra-ai-2`, `3`, `4`, `5`) — minimal attack surface, secure architecture, least privilege, tamper protection.
-
-At scale, the **master-controls** corpus (breakpilot's deduped clusters, exported as OSCAL) currently provides **~2,882 code-checkable controls** (2,143 `network` + 739 `source_code`), matched semantically.
-
-## The three mapping paths
-
-```mermaid
-flowchart TD
-    T[Deterministic tools\nsemgrep · gitleaks · syft/osv · DAST · PLC linter] --> F[Findings]
-    F --> B["Stage 5b — LUT triage\ncontrols_for(tool, cwe / rule_id)"]
-    F --> C["Stage 5c — Semantic\nembed region+intent → top-K master controls"]
-    R[Repo source] --> D["Stage 5d — Grounded surface\nretrieve surface for absence-based controls"]
-    B --> J{{Grounded LLM judge\ntemp 0 · verbatim snippet}}
-    C --> J
-    D --> J
-    J -->|snippet grounds in region| S[Stamp control_refs]
-    J -->|refuted / ungrounded| X[Dropped]
-```
-
-All three paths converge on the same **grounded judge** and the same **grounding gate**. They differ only in how candidate (finding/region, control) pairs are produced.
-
-### Stage 5b — deterministic LUT triage
-
-The default path. A tool finding is matched to controls via `control_map.controls_for_finding(tool, cwe, rule_id)`; the judge then confirms each mapped control against the code region. Outcomes: `Confirmed([ids])` (stamp them), `FalsePositive` (drop the finding), or `Unmapped` (keep it untagged). Runs whenever `BREAKPILOT_BASE_URL` is set.
-
-### Stage 5c — semantic retrieval (master-controls scale)
-
-Master controls carry no CWE, so they can't be LUT-mapped. Instead we map by *similarity*: embed every control's requirement text once (cached), then for each finding retrieve the top-K nearest controls and hand them to the judge. Gated behind `BREAKPILOT_SEMANTIC_MAPPING` (default off). See [Semantic retrieval](#semantic-retrieval-in-detail).
-
-### Stage 5d — grounded surface checks (absence-based controls)
-
-Some controls are violated by an *absence* — no rate limiting on login, no security logging, no signature check on an update. There's no pattern for semgrep to match, so we deterministically retrieve the code **surface** the control governs (a login route, a logging setup, update/download code) by identifier/route terms, and let the judge decide whether the control holds there. Produces net-new, already-grounded findings. Gated behind `BREAKPILOT_GROUNDED_CHECKS` (default off).
-
-## The grounding gate
-
-No matter the path, a verdict becomes a finding only if it survives `compliance_core::control_check::ground`:
-
-1. The judge runs at **temperature 0** with a closed prompt and must quote the offending code **verbatim** into `snippet`.
-2. That snippet must appear **literally** in the retrieved region — otherwise the verdict is dropped.
-3. The finding's line is **recomputed from the match**; the model's own line number is never trusted.
-4. Verdicts are cached by content hash, so re-scans reproduce.
-
-The model is allowed to be smart; it is never trusted.
-
-## Semantic retrieval in detail
-
-1. **Embed the corpus once.** Each control's requirement text is embedded with `bge-multilingual-gemma2` (3584-dim — multilingual matters, the master controls are in German while code is English). The embedding backend caps input arrays at 25 per request, so `embed()` chunks at 16; the whole `ControlIndex` is persisted to `snapshot_dir` keyed by a **corpus hash**, so only the first scan after a catalog change pays the embedding cost.
-2. **Build the query from the finding's intent, not just the code.** The retrieval query is `finding.title + finding.description + region`, not the raw region. This is the single most important tuning: two findings in one file share overlapping windows and, on the code alone, embed alike and collapse onto the same controls. The finding's own words ("brute-force protection" vs "weak hash") carry the discriminating signal. The raw region still goes to the judge for grounding.
-3. **Retrieve → judge → ground.** Top-K nearest by cosine, each judged against the region, each grounded.
-
-## Worked examples
-
-Both examples are from the live end-to-end verification (`c5_semantic_live.rs`) against the real ~2,882-control corpus.
-
-### Example 1 — a small auth file (the tuning story)
-
-Two findings in one `auth.py`: a weak `hashlib.md5(password)` hash and a login endpoint with no brute-force protection.
-
-| Finding | Region-only retrieval | Intent-enriched retrieval |
-| --- | --- | --- |
-| Weak md5 hash | 19874, 20683, 23149, 29985 | **`mc-23149`** (eliminate weak unsalted hashes) at rank 1, + `mc-21634` salted hashing |
-| Login w/o brute-force protection | *identical 4, reordered* | newly surfaces **`mc-19984`** brute_force_protection + **`mc-23186`** account_lockout |
-
-Region-only retrieval gave both findings the *same* four password-hashing controls — the brute-force finding never found its real controls because its window is saturated with `password` tokens. Enriching the query with the finding's intent fixed it: the brute-force finding now pulls the correct rate-limiting / lockout controls out of the 2,882.
-
-### Example 2 — four topically distinct vulnerabilities
-
-| Finding | Top matched controls | Family |
-| --- | --- | --- |
-| SQL injection (string-concat query) | `sql_injection_prevention`, `sql_injection`, `parameterized_queries`, input_sanitization | input-validation ✓ |
-| Hardcoded API credential | `hardcoded_secrets_detection`, credential_scanning, secrets_detection | credentials ✓ |
-| TLS verification disabled (`verify=False`) | `https_enforcement`, `configuration_verification`, transport config | transport-encryption ✓ |
-| Insecure deserialization (`pickle.loads`) | `deserialization`, `deserialization_testing`, `deserialization_security` | deserialization ✓ |
-
-Every finding maps to its exact control family, with the most specific control often at the top, and the four sets are distinct.
-
-## Known limitations
-
-- **Absence findings are weak for semantic retrieval.** Similarity matches what code *is about*, not what it *lacks*; a "missing rate limiting" finding embeds like login code. This is exactly why the grounded surface path (Stage 5d) exists — it decides presence/absence at a retrieved surface rather than by embedding distance.
-- **Generic catch-all controls co-occur.** `mc-20890 secure_development_security_code_review` appears in the top-K for many code-security findings because it is semantically near almost all of them. It's harmless (the judge grounds it, and it never crowds out the specific controls — the SQLi example didn't get it) but is a candidate for future down-weighting.
-- **Corpus classification noise.** The master-controls `verification_method` classification is imperfect — e.g. a documentation control (`eu_declaration_accuracy`) is currently tagged `source_code`. That's a corpus-side data-quality issue, separate from the mapping engine.
-
-## Emitting over MCP — closing the loop
-
-Findings don't just land in the dashboard; they flow to breakpilot-compliance as OSCAL over the scanner's MCP server, so the compliance report is assembled from real, control-tagged findings.
-
-- The MCP server exposes an **`oscal_assessment`** tool: given a `repo_id`, it emits a standard OSCAL 1.1 assessment-results document for that repo's findings — mapped findings target their controls via the stamped `control_refs`, and unmapped findings are reported **as-is** (as observations), so nothing is lost.
-- breakpilot pulls it: `POST /v1/cra/oscal-from-scanner` calls `oscal_assessment` over MCP (Streamable HTTP + bearer) and consumes the pre-computed OSCAL — rather than pulling raw findings and re-assessing.
-
-**Operational note — tenant context over HTTP.** The MCP server is multi-tenant; the bearer token resolves a tenant whose per-tenant database the tools query. rmcp's Streamable HTTP transport runs each session's tool calls in a `tokio::spawn`ed task, and `task_local`s do **not** cross a spawn — so binding the tenant in a per-request middleware `task_local` leaves tool handlers with no context (every call fails `no tenant context`). The fix is to bind the tenant to the **per-session server instance** at creation (the factory runs in the request scope before the spawn), not to a per-request task_local. Until this was fixed, the loop silently failed over HTTP and consumers fell back to demo data.
-
-## Configuration
-
-| Variable | Effect |
-| --- | --- |
-| `BREAKPILOT_BASE_URL` | breakpilot-compliance root; enables control ingest + all mapping passes. **Unset disables all control mapping** — findings are produced without `control_refs`. |
-| `BREAKPILOT_SEMANTIC_MAPPING` | Stage 5c (semantic master-controls mapping). **Default on** (validated live). |
-| `BREAKPILOT_GROUNDED_CHECKS` | Stage 5d (grounded surface checks). **Default on** (validated live). |
-| `BREAKPILOT_SNAPSHOT_DIR` | Where OSCAL catalog snapshots and the cached control-embedding index live. |
-
-The semantic and grounded passes default **on** now that both are validated live; each is still a no-op if `BREAKPILOT_BASE_URL` is unset or the catalog is unreachable, so they only ever add coverage. The live verifications live in `compliance-agent/tests/c5_semantic_live.rs` and `grounded_surface_live.rs` (ignored; run with `--ignored`).
-
-## Appendix — the master-controls data pipeline
-
-The master-controls corpus is produced by breakpilot-compliance and pulled as an OSCAL catalog from `GET /api/compliance/v1/oscal/catalog?framework=master-controls`. Two operational lessons are worth recording, because they cost real time to diagnose:
-
-- **The catalog is served from `breakpilot_db`, not `postgres`.** Diagnostics run against the wrong database will look clean while the app serves something else entirely. Confirm the app's datname (`pg_stat_activity`) before trusting any count or `EXPLAIN`.
-- **A constraint-less dump triplicated the master-control tables.** Restored without their PK/unique constraints, `master_controls` / `mc_verification` / `master_control_members` accumulated identical rows 3× (the same artifact migration `158` fixed for `doc_check_controls`). That inflated the catalog to ~26k dup'd controls and, with the indexes also missing, drove the export query to a >120s / 502. The fix (breakpilot migration `160`) ctid-dedups each table by its natural key and restores the constraints + indexes so it can't recur; the export query was also rewritten set-based (a single windowed pass instead of a per-row correlated subquery). After dedup: 41,850 → 13,950 master controls, catalog **25,938 → 2,882** code-checkable, endpoint **502 → 200 in ~3s**.

docs/features/dast.md

@@ -92,7 +92,3 @@ Filters can be combined. A count indicator shows how many findings match the cur
 ::: tip
 Findings marked as **Confirmed** exploitable were verified with a successful attack payload. **Unconfirmed** findings show suspicious behavior that may indicate a vulnerability but could not be fully exploited.
 :::
-
-## Deterministic detectors (planned)
-
-The DAST engine above is agentic: an LLM drives crawler, browser and testing tools and decides what to try next. That gives depth and code-aware exploitation, but not run-to-run reproducibility. The next step (decided 2026-08-31, not yet implemented) adds two deterministic open-source detectors **under** the agents: **Nuclei** (template checks incl. ICS/OT and default-credential templates) first, then an **OWASP ZAP** baseline scan. Their findings will appear alongside agent findings, carry CWE + compliance `control_refs`, and seed the agent's context so it verifies and chains instead of rediscovering. See [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code).

docs/guide/findings.md

@@ -26,7 +26,7 @@ Filters can be combined. Results are paginated with 20 findings per page.
 | Severity | Color-coded badge: Critical (red), High (orange), Medium (yellow), Low (green), Info (blue) |
 | Title | Short description of the vulnerability (clickable) |
 | Type | SAST, SBOM, CVE, GDPR, OAuth, Secrets, or Code Review |
-| Scanner | Tool that found the issue (e.g. Semgrep, Syft/OSV) |
+| Scanner | Tool that found the issue (e.g. Semgrep, Grype) |
 | File | Source file path where the issue was found |
 | Status | Current triage status |
 
@@ -73,7 +73,7 @@ If the finding has been pushed to an issue tracker (GitHub, GitLab, Gitea, Jira)
 | Type | Source | Description |
 |------|--------|-------------|
 | **SAST** | Semgrep | Code-level vulnerabilities found through static analysis |
-| **SBOM** | Syft + OSV.dev/NVD | Vulnerable dependencies identified in your software bill of materials |
+| **SBOM** | Syft + Grype | Vulnerable dependencies identified in your software bill of materials |
 | **CVE** | NVD | Known CVEs matching your dependency versions |
 | **GDPR** | Custom rules | Personal data handling and consent issues |
 | **OAuth** | Custom rules | OAuth/OIDC misconfigurations and insecure token handling |

docs/guide/plc.md

@@ -11,72 +11,6 @@ the control application *and* the device it runs on.
 | A device firmware image | Firmware SBOM / CVE (opt-in) |
 | A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
 
-## Anatomy: a soft PLC is a SoC + Linux + runtime
-
-A CODESYS controller is **not** a monolithic appliance like a classic Siemens
-S7. It is **PC-based ("soft") control** — commodity silicon running a
-general-purpose Linux, with a **software PLC runtime** as just another process:
-
-| Classic PLC (e.g. Siemens S7) | Soft PLC (CODESYS-on-Yocto, OpenPLC-on-Raspbian) |
-| --- | --- |
-| Proprietary hardware + firmware | Commodity SoC (x86 / ARM) |
-| Proprietary OS | General-purpose Linux (a **Yocto** image, or Raspbian) |
-| Proprietary runtime | Software runtime (**CODESYS Control**, or OpenPLC) |
-| STEP7 / TIA project | IEC 61131-3 control app (ST / LD / FBD / SFC) |
-
-Because of this, the device is built along **two independent tracks**, by
-different people, on different timelines, and shipped separately. It also
-inherits the **entire Linux / IT attack surface on top of** the OT / control
-one — which is exactly why a PLC/SPS target is treated as a **composite**:
-Certifai ingests one artifact per layer and scans each with the right pipeline.
-
-```mermaid
-flowchart TB
-    subgraph TA["Track A · Device platform — built by the hardware OEM / vendor"]
-        direction LR
-        A1["Yocto / OpenEmbedded<br/>BSP + RT kernel"] --> A2["Bake in the CODESYS<br/>Control for Linux runtime"] --> A3["bitbake → device image<br/>.wic / .tar + manifest"]
-    end
-    subgraph TB2["Track B · Control application — built by the machine builder / customer"]
-        direction LR
-        B1["CODESYS IDE<br/>ST / LD / FBD / SFC + WebVisu"] --> B2["Reference CODESYS +<br/>vendor libraries"] --> B3["Compile → download<br/>to device (gateway 11740)"]
-    end
-
-    A3 --> DEV(["Running soft-PLC device<br/>SoC + Linux + runtime + control app<br/>Modbus · OPC UA · EtherNet/IP · WebVisu"])
-    B3 --> DEV
-
-    subgraph CERT["What Certifai scans — one layer per artifact"]
-        direction LR
-        S1["Firmware layer<br/>FirmwareStatic · SBOM · CVE"]
-        S2["Control-logic layer<br/>PLC SAST — ST + FBD/LD"]
-        S3["Control-app SBOM<br/>libraries + runtime → CVE"]
-        S4["Running layer<br/>ICS probe · DAST (WebVisu)"]
-    end
-
-    A3 -. firmware image .-> S1
-    B1 -. PLCopen XML / ST via git .-> S2
-    B2 -. projectarchive (zip) .-> S3
-    DEV -. live URL / provisioned .-> S4
-
-    classDef yocto fill:#fde68a,stroke:#b45309,color:#111
-    classDef codesys fill:#bfdbfe,stroke:#1d4ed8,color:#111
-    classDef dev fill:#e9d5ff,stroke:#7e22ce,color:#111
-    classDef cert fill:#bbf7d0,stroke:#15803d,color:#111
-    class A1,A2,A3 yocto
-    class B1,B2,B3 codesys
-    class DEV dev
-    class S1,S2,S3,S4 cert
-```
-
-::: tip Where Yocto fits
-Yocto is **Track A** — the *build system* for the device platform. It produces
-the Linux image and bakes in the CODESYS runtime, so it is the **firmware
-layer**, entirely separate from the control application. Hand it to Certifai as
-its own **firmware image** artifact (scanned by the firmware pipeline, not the
-PLC pipeline). The device OS need not be Yocto — Raspbian/Debian/Buildroot, or
-even an RTOS / bare-metal, are all possible — but Yocto is the common,
-product-grade industrial choice.
-:::
-
 ## Two ways to deliver the project
 
 You can either **upload** the project when onboarding, or point Certifai at a

docs/guide/sbom.md

@@ -6,7 +6,7 @@ The SBOM (Software Bill of Materials) feature provides a complete inventory of a
 
 A Software Bill of Materials is a list of every component (library, package, framework) that your software depends on, along with version numbers, licenses, and known vulnerabilities. SBOMs are increasingly required for compliance audits, customer security questionnaires, and supply chain transparency.
 
-Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and OSV.dev + NVD for vulnerability matching.
+Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and Grype for vulnerability matching.
 
 ## Packages Tab
 

docs/guide/scanning.md

@@ -8,7 +8,7 @@ When a scan is triggered, Certifai runs through these phases in order:
 
 1. **Clone** -- pulls the latest code from the Git remote (or clones it for the first time)
 2. **SAST** -- runs static analysis using Semgrep with rules covering OWASP, GDPR, OAuth, secrets, and general security patterns
-3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via OSV.dev + NVD
+3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via Grype
 4. **CVE Check** -- cross-references dependencies against the NVD database for known CVEs
 5. **Graph Build** -- parses the codebase to construct a code knowledge graph of functions, classes, and their relationships
 6. **AI Triage** -- new findings are reviewed by an LLM that assesses severity, considers blast radius using the code graph, and generates remediation guidance
@@ -52,7 +52,7 @@ A full scan runs multiple analysis engines, each producing different types of fi
 | Scan Type | What It Detects | Scanner |
 |-----------|----------------|---------|
 | **SAST** | Code-level vulnerabilities (injection, XSS, insecure crypto, etc.) | Semgrep |
-| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + OSV.dev/NVD |
+| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + Grype |
 | **CVE** | Known CVEs in dependencies cross-referenced against NVD | NVD API |
 | **GDPR** | Personal data handling issues, consent violations | Custom rules |
 | **OAuth** | OAuth/OIDC misconfigurations, insecure token handling | Custom rules |

docs/reference/glossary.md

@@ -58,8 +58,8 @@ An open-source static analysis tool that finds bugs and enforces code standards
 **Syft**
 An open-source tool for generating SBOMs from container images and filesystems. Used by Certifai to extract dependency information.
 
-**OSV.dev**
+**Grype**
-Google's open distributed vulnerability database, queried by package URL. Certifai uses it (together with NVD) to match SBOM components against known vulnerabilities.
+An open-source vulnerability scanner for container images and filesystems. Used by Certifai to match dependencies against known vulnerabilities.
 
 ## Protocols
 

docs/reference/tools.md

@@ -24,14 +24,15 @@ Semgrep produces SAST-type findings with file paths, line numbers, and rule desc
 
 Syft output feeds into both the SBOM feature and the vulnerability scanning pipeline.
 
-## OSV.dev + NVD -- Vulnerability Matching
+## Grype -- Vulnerability Scanning
 
-Certifai matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):
+[Grype](https://github.com/anchore/grype) is an open-source vulnerability scanner that matches your dependencies against known vulnerability databases. It takes Syft's SBOM output and cross-references it against:
 
-- [OSV.dev](https://osv.dev/) -- batch queried by package URL (purl) for ecosystem advisories (npm, PyPI, crates.io, Go, Maven, ...)
+- National Vulnerability Database (NVD)
-- [NVD](https://nvd.nist.gov/) -- queried per CVE for the CVSS v3.1 base score, and by CPE for CODESYS runtime versions found in PLC projects
+- GitHub Advisory Database
+- OS-specific advisory databases
 
-Matches are stored as CVE alerts with CVSS scores and re-checked hourly, so newly published CVEs against an unchanged dependency still raise a notification.
+Grype produces SBOM-type findings with CVE identifiers, severity ratings, and links to advisories.
 
 ## Custom OAuth Scanner
 
@@ -96,14 +97,3 @@ When you mark findings as false positives or provide developer feedback, this in
 ::: tip
 The AI triage is a starting point, not a final verdict. Always review the rationale and code evidence before acting on a finding. See [Understanding Findings](/guide/findings#human-in-the-loop) for more on the human-in-the-loop workflow.
 :::
-
-## Planned integrations (decided 2026-08-31, not yet in the code)
-
-The product spec keeps an **OSS-only** tooling policy and a control-mapping rule of *tools detect, the LLM judges*. Two deterministic detectors are therefore being added **underneath** the agentic DAST/pentest layer — the agents stay on top for context-seeded exploitation, chaining and explanation:
-
-| Tool | Role | Status |
-|------|------|--------|
-| [Nuclei](https://github.com/projectdiscovery/nuclei) | Template-driven checks (CVE probes, default credentials, exposed panels, misconfigurations) including ICS/OT templates for WebVisu / OpenPLC / HMI endpoints. Runs as a DAST phase and as a Werkbank job with vendored templates so it works on-prem. | Planned — tracked as an issue |
-| [OWASP ZAP](https://www.zaproxy.org/) | Baseline (passive) and, behind the destructive-tests flag, active scan for reproducible spider + rule coverage; results seed the pentest agent. | Planned — follows Nuclei |
-
-Both feed the same `control-map` lookup table as Semgrep, so their findings receive compliance `control_refs` through the grounded judge. An **offline vulnerability database** (Trivy preferred, Grype as alternative) is planned for the on-prem Werkbank runner, which cannot reach the OSV.dev / NVD APIs. Until these land, DAST findings come exclusively from the in-house agents described above.

werkbank-exec/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "werkbank-exec"
-version = "0.1.0"
-edition = "2021"
-description = "Shared dynamic-execution logic: soft-PLC provisioning + industrial-protocol probing, used by the compliance agent and the Werkbank runner."
-
-[lints]
-workspace = true
-
-[dependencies]
-compliance-core = { workspace = true }
-compliance-dast = { path = "../compliance-dast" }
-tokio = { workspace = true }
-reqwest = { workspace = true }
-uuid = { workspace = true }
-regex = { workspace = true }
-secrecy = { workspace = true }
-sha2 = { workspace = true }
-hex = { workspace = true }
-tracing = { workspace = true }
-thiserror = { workspace = true }
-walkdir = "2"
-futures-util = "0.3"

werkbank-exec/src/error.rs

@@ -1,16 +0,0 @@
-//! Error type for the dynamic-execution logic.
-
-/// Anything that can go wrong provisioning and testing a soft-PLC. The compliance
-/// agent maps this into its own `AgentError` at the call boundary.
-#[derive(thiserror::Error, Debug)]
-pub enum ExecError {
-    /// An HTTP request (to OpenPLC) failed.
-    #[error("HTTP error: {0}")]
-    Http(#[from] reqwest::Error),
-    /// A local IO / process error (e.g. invoking `docker`).
-    #[error("IO error: {0}")]
-    Io(#[from] std::io::Error),
-    /// Any other failure, with a message.
-    #[error("{0}")]
-    Other(String),
-}

werkbank-exec/src/fingerprint.rs

@@ -1,32 +0,0 @@
-//! Finding fingerprint helper (a SHA-256 over the salient parts), shared by the
-//! probe modules for stable dedup keys. Mirrors the agent's `dedup` helper.
-
-use sha2::{Digest, Sha256};
-
-/// A stable fingerprint over the given parts (order-sensitive, separated so
-/// `["ab","c"]` and `["a","bc"]` differ).
-pub fn compute_fingerprint(parts: &[&str]) -> String {
-    let mut hasher = Sha256::new();
-    for part in parts {
-        hasher.update(part.as_bytes());
-        hasher.update(b"|");
-    }
-    hex::encode(hasher.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn deterministic_and_hex() {
-        let a = compute_fingerprint(&["repo", "rule", "1"]);
-        assert_eq!(a, compute_fingerprint(&["repo", "rule", "1"]));
-        assert_eq!(a.len(), 64);
-        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
-        assert_ne!(
-            compute_fingerprint(&["ab", "c"]),
-            compute_fingerprint(&["a", "bc"])
-        );
-    }
-}

werkbank-exec/src/lib.rs

@@ -1,18 +0,0 @@
-//! Shared dynamic-execution logic for Werkbank.
-//!
-//! The soft-PLC provisioning + industrial-protocol probing that turns a control-
-//! logic artifact into findings: provision an ephemeral OpenPLC, load the program,
-//! start it, probe it over Modbus/OPC-UA/EtherNet-IP, DAST its web endpoint, tear
-//! it down. Extracted from the compliance agent (#183) so both the agent (in
-//! process) and the Werkbank runner (WB-04) run identical logic.
-//!
-//! - [`ics`] — read-only industrial-protocol probing.
-//! - [`plc`] — ephemeral soft-PLC provisioning + the provision-and-test loop.
-
-pub mod error;
-pub mod ics;
-pub mod plc;
-
-mod fingerprint;
-
-pub use error::ExecError;

werkbank-exec/src/plc/mod.rs

@@ -1,422 +0,0 @@
-//! Dynamic PLC testing via an ephemeral soft-PLC (#183).
-//!
-//! When a PLC/SPS target ships control logic but no reachable live device, the
-//! agent instantiates that logic itself instead of trying to reach the customer's
-//! OT network: it provisions a throwaway soft-PLC (OpenPLC) container in-cluster,
-//! loads the program, starts the runtime, probes it over industrial protocols,
-//! then tears the instance down. No customer network access, sandboxed, and
-//! reproducible — destructive tests become safe because the target is ours.
-//!
-//! - [`provision`] owns the container lifecycle (sub-task 1 + 5).
-//! - [`openplc`] loads the program into the running instance (sub-task 2).
-//! - [`provision_and_test`] composes them with a hard deadline and guaranteed
-//!   teardown, and runs the ICS probe against the provisioned endpoint.
-
-pub mod openplc;
-pub mod provision;
-
-use std::path::Path;
-use std::time::Duration;
-
-use secrecy::ExposeSecret;
-
-use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
-use compliance_core::models::Finding;
-use compliance_core::PlcRuntimeConfig;
-
-use crate::error::ExecError;
-
-pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
-
-/// The result of a DAST scan against a provisioned web endpoint.
-#[derive(Debug)]
-pub struct DastRunResult {
-    /// The scan-run record (linked to the onboarded target).
-    pub scan_run: DastScanRun,
-    /// The DAST findings.
-    pub findings: Vec<DastFinding>,
-}
-
-/// Everything a provision-and-test run produced: the ICS-probe findings plus, if
-/// it ran, the DAST scan of the provisioned web endpoint. The caller persists
-/// both — keeping this a plain data return means the whole run is portable to a
-/// remote execution backend that just hands the results back.
-#[derive(Debug, Default)]
-pub struct ProvisionOutcome {
-    /// ICS-probe findings from the provisioned Modbus endpoint.
-    pub findings: Vec<Finding>,
-    /// DAST scan of the provisioned web endpoint, if it ran.
-    pub dast: Option<DastRunResult>,
-}
-
-/// A control-logic program ready to load into a soft-PLC: the source text plus a
-/// cosmetic file name (OpenPLC re-stores it under its own name).
-#[derive(Debug, Clone)]
-pub struct PlcProgram {
-    /// The original file name (for the upload form; OpenPLC renames on storage).
-    pub file_name: String,
-    /// The program source — Structured Text or PLCopen XML.
-    pub source: String,
-}
-
-/// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
-/// isolates the OpenPLC session (its Flask login cookie) from every other scan.
-pub fn http_client() -> Result<reqwest::Client, ExecError> {
-    reqwest::Client::builder()
-        .cookie_store(true)
-        .timeout(Duration::from_secs(30))
-        .build()
-        .map_err(ExecError::Http)
-}
-
-/// Pick the control-logic program to run from an ingested PLC source tree.
-///
-/// OpenPLC runs one program, so we choose the best single candidate: a complete
-/// Structured Text program (one carrying a `CONFIGURATION` block) is ideal;
-/// failing that the largest ST file; failing that a PLCopen XML export. Returns
-/// `None` when the tree holds no loadable control logic.
-pub fn extract_program(root: &Path) -> Option<PlcProgram> {
-    let mut st: Vec<(String, String)> = Vec::new();
-    let mut xml: Vec<(String, String)> = Vec::new();
-    for entry in walkdir::WalkDir::new(root)
-        .into_iter()
-        .filter_map(Result::ok)
-    {
-        if !entry.file_type().is_file() {
-            continue;
-        }
-        let path = entry.path();
-        let ext = path
-            .extension()
-            .and_then(|e| e.to_str())
-            .unwrap_or("")
-            .to_ascii_lowercase();
-        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
-        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
-        if !is_st && !is_xml {
-            continue;
-        }
-        let Ok(content) = std::fs::read_to_string(path) else {
-            continue;
-        };
-        let name = path
-            .file_name()
-            .and_then(|n| n.to_str())
-            .unwrap_or("program")
-            .to_string();
-        if is_st {
-            st.push((name, content));
-        } else if looks_like_plcopen(&content) {
-            xml.push((name, content));
-        }
-    }
-
-    if let Some((name, source)) = st.iter().find(|(_, c)| has_configuration(c)) {
-        return Some(PlcProgram {
-            file_name: name.clone(),
-            source: source.clone(),
-        });
-    }
-    if let Some((name, source)) = st.iter().max_by_key(|(_, c)| c.len()) {
-        return Some(PlcProgram {
-            file_name: name.clone(),
-            source: source.clone(),
-        });
-    }
-    xml.into_iter()
-        .max_by_key(|(_, c)| c.len())
-        .map(|(file_name, source)| PlcProgram { file_name, source })
-}
-
-/// Whether an ST source is a complete, runnable program (has a `CONFIGURATION`).
-fn has_configuration(source: &str) -> bool {
-    source.to_ascii_uppercase().contains("CONFIGURATION")
-}
-
-/// Whether an XML file looks like a PLCopen project export.
-fn looks_like_plcopen(source: &str) -> bool {
-    let lower = source.to_ascii_lowercase();
-    lower.contains("<project") || lower.contains("plcopen")
-}
-
-/// Provision an ephemeral soft-PLC, load `program`, start it, probe it over
-/// industrial protocols, and tear it down. Returns the ICS-probe findings.
-///
-/// Teardown is guaranteed: the load/probe work runs under a hard deadline
-/// (`max_lifetime_secs`) and the instance is removed afterwards on every path —
-/// success, error, or deadline expiry.
-pub async fn provision_and_test<P: SoftPlc>(
-    provisioner: &P,
-    http: &reqwest::Client,
-    cfg: &PlcRuntimeConfig,
-    program: &PlcProgram,
-    target_id: &str,
-) -> Result<ProvisionOutcome, ExecError> {
-    let handle = provisioner.provision(target_id).await?;
-    tracing::info!(
-        target_id,
-        instance = %handle.name,
-        modbus = %handle.modbus_endpoint,
-        "provisioned ephemeral soft-PLC"
-    );
-
-    let deadline = Duration::from_secs(cfg.max_lifetime_secs);
-    let result = tokio::time::timeout(
-        deadline,
-        run_dynamic_test(http, cfg, program, target_id, &handle),
-    )
-    .await;
-
-    // Guaranteed teardown — runs on success, error, and deadline expiry. The
-    // inner future is panic-free (the workspace lint bans unwrap/expect), so no
-    // unwind can skip this; a container leaked by an agent *crash* is swept by
-    // the next run's stale reaper.
-    provisioner.teardown(&handle).await;
-
-    match result {
-        Ok(inner) => inner,
-        Err(_) => {
-            tracing::warn!(
-                target_id,
-                instance = %handle.name,
-                "provision-and-test hit the lifetime deadline; torn down"
-            );
-            Ok(ProvisionOutcome::default())
-        }
-    }
-}
-
-/// The load → start → probe → DAST body, run under the caller's deadline.
-async fn run_dynamic_test(
-    http: &reqwest::Client,
-    cfg: &PlcRuntimeConfig,
-    program: &PlcProgram,
-    target_id: &str,
-    handle: &ProvisionedRuntime,
-) -> Result<ProvisionOutcome, ExecError> {
-    let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
-    openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
-
-    let compile_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
-    openplc::load_and_start(
-        http,
-        &handle.webvisu_url,
-        &cfg.openplc_user,
-        cfg.openplc_password.expose_secret(),
-        program,
-        compile_budget,
-    )
-    .await?;
-
-    // Give the runtime a moment to open the Modbus/TCP server before probing.
-    tokio::time::sleep(Duration::from_secs(3)).await;
-
-    let probe_budget = Duration::from_secs(5);
-    let findings = crate::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
-    tracing::info!(
-        target_id,
-        instance = %handle.name,
-        found = findings.len(),
-        "provision-and-test probe complete"
-    );
-
-    // DAST the provisioned web endpoint (independently bounded so it can't eat
-    // the whole lifetime). On the OpenPLC substrate this is OpenPLC's own web UI,
-    // not a customer HMI — the CODESYS-runtime follow-up raises the fidelity —
-    // but it proves the deploy→run→probe→DAST loop end to end.
-    let dast_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
-    let dast = match tokio::time::timeout(dast_budget, run_webvisu_dast(handle, target_id)).await {
-        Ok(d) => d,
-        Err(_) => {
-            tracing::warn!(target_id, instance = %handle.name, "provision-and-test DAST timed out");
-            None
-        }
-    };
-
-    Ok(ProvisionOutcome { findings, dast })
-}
-
-/// Run a bounded DAST scan against the provisioned web endpoint and tag the
-/// results with our target id. Best-effort — a DAST failure never fails the run.
-async fn run_webvisu_dast(handle: &ProvisionedRuntime, target_id: &str) -> Option<DastRunResult> {
-    let mut dt = DastTarget::new(
-        "provisioned-webvisu".to_string(),
-        handle.webvisu_url.clone(),
-        DastTargetType::WebApp,
-    );
-    dt.repo_id = Some(target_id.to_string());
-    dt.max_crawl_depth = 2; // shallow — the instance is ephemeral
-
-    let orchestrator = compliance_dast::DastOrchestrator::new(100);
-    match orchestrator.run_scan(&dt, Vec::new()).await {
-        Ok((mut scan_run, mut findings)) => {
-            scan_run.target_id = target_id.to_string();
-            for f in &mut findings {
-                f.target_id = target_id.to_string();
-            }
-            tracing::info!(
-                target_id,
-                instance = %handle.name,
-                dast_findings = findings.len(),
-                "provision-and-test DAST complete"
-            );
-            Some(DastRunResult { scan_run, findings })
-        }
-        Err(e) => {
-            tracing::warn!(target_id, instance = %handle.name, error = %e, "provision-and-test DAST failed");
-            None
-        }
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use std::sync::Arc;
-
-    /// A scratch dir removed on drop.
-    struct Scratch(std::path::PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-plc-rt-{}", uuid::Uuid::new_v4()));
-            std::fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    #[test]
-    fn extract_prefers_a_complete_st_program() {
-        let s = Scratch::new();
-        std::fs::write(s.0.join("fragment.st"), "PROGRAM P\nEND_PROGRAM\n").expect("w");
-        std::fs::write(
-            s.0.join("full.st"),
-            "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION Config0\n  RESOURCE R\nEND_CONFIGURATION\n",
-        )
-        .expect("w");
-        let prog = extract_program(&s.0).expect("program");
-        assert_eq!(prog.file_name, "full.st");
-        assert!(prog.source.contains("CONFIGURATION"));
-    }
-
-    #[test]
-    fn extract_falls_back_to_largest_st_then_plcopen() {
-        let s = Scratch::new();
-        std::fs::write(s.0.join("small.st"), "PROGRAM A\nEND_PROGRAM\n").expect("w");
-        std::fs::write(
-            s.0.join("big.st"),
-            "PROGRAM B\nVAR x : INT; y : INT; z : INT; END_VAR\nEND_PROGRAM\n",
-        )
-        .expect("w");
-        let prog = extract_program(&s.0).expect("program");
-        assert_eq!(
-            prog.file_name, "big.st",
-            "largest ST wins when none complete"
-        );
-
-        // Only a PLCopen XML present.
-        let s2 = Scratch::new();
-        std::fs::write(
-            s2.0.join("proj.xml"),
-            "<?xml version='1.0'?><project xmlns='http://www.plcopen.org/xml/tc6_0201'><pou/></project>",
-        )
-        .expect("w");
-        let prog2 = extract_program(&s2.0).expect("program");
-        assert_eq!(prog2.file_name, "proj.xml");
-    }
-
-    #[test]
-    fn extract_returns_none_without_control_logic() {
-        let s = Scratch::new();
-        std::fs::write(s.0.join("readme.md"), "# not a plc program").expect("w");
-        std::fs::write(s.0.join("data.xml"), "<config><db/></config>").expect("w");
-        assert!(extract_program(&s.0).is_none());
-    }
-
-    /// A fake provisioner recording provision/teardown calls, for lifecycle tests.
-    struct FakeSoftPlc {
-        provisions: Arc<AtomicUsize>,
-        teardowns: Arc<AtomicUsize>,
-        fail_provision: bool,
-    }
-
-    impl SoftPlc for FakeSoftPlc {
-        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
-            self.provisions.fetch_add(1, Ordering::SeqCst);
-            if self.fail_provision {
-                return Err(ExecError::Other("provision failed".into()));
-            }
-            // Unreachable address so run_dynamic_test blocks on readiness until the
-            // deadline fires — exercising the teardown-on-deadline path.
-            Ok(ProvisionedRuntime {
-                name: "fake-plc".into(),
-                modbus_endpoint: "fake-plc:502".into(),
-                webvisu_url: "http://fake-plc.invalid:8080".into(),
-            })
-        }
-        async fn teardown(&self, _handle: &ProvisionedRuntime) {
-            self.teardowns.fetch_add(1, Ordering::SeqCst);
-        }
-    }
-
-    fn short_cfg() -> PlcRuntimeConfig {
-        PlcRuntimeConfig {
-            enabled: true,
-            max_lifetime_secs: 1, // keep the deadline path fast
-            ..PlcRuntimeConfig::default()
-        }
-    }
-
-    #[tokio::test]
-    async fn teardown_runs_even_when_the_test_never_completes() {
-        let provisions = Arc::new(AtomicUsize::new(0));
-        let teardowns = Arc::new(AtomicUsize::new(0));
-        let fake = FakeSoftPlc {
-            provisions: provisions.clone(),
-            teardowns: teardowns.clone(),
-            fail_provision: false,
-        };
-        let http = http_client().expect("client");
-        let prog = PlcProgram {
-            file_name: "p.st".into(),
-            source: "PROGRAM P\nEND_PROGRAM\n".into(),
-        };
-        let out = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1")
-            .await
-            .expect("ok on deadline");
-        assert!(out.findings.is_empty(), "deadline path yields no findings");
-        assert!(out.dast.is_none(), "deadline path runs no DAST");
-        assert_eq!(provisions.load(Ordering::SeqCst), 1);
-        assert_eq!(teardowns.load(Ordering::SeqCst), 1, "teardown must run");
-    }
-
-    #[tokio::test]
-    async fn provision_failure_propagates_and_skips_teardown() {
-        let provisions = Arc::new(AtomicUsize::new(0));
-        let teardowns = Arc::new(AtomicUsize::new(0));
-        let fake = FakeSoftPlc {
-            provisions: provisions.clone(),
-            teardowns: teardowns.clone(),
-            fail_provision: true,
-        };
-        let http = http_client().expect("client");
-        let prog = PlcProgram {
-            file_name: "p.st".into(),
-            source: String::new(),
-        };
-        let err = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1").await;
-        assert!(err.is_err(), "provision failure propagates");
-        assert_eq!(provisions.load(Ordering::SeqCst), 1);
-        assert_eq!(
-            teardowns.load(Ordering::SeqCst),
-            0,
-            "nothing to tear down when provisioning failed"
-        );
-    }
-}

werkbank-exec/src/plc/openplc.rs

@@ -1,254 +0,0 @@
-//! Loading a control-logic program into a provisioned OpenPLC (#183, sub-task 2).
-//!
-//! Drives the OpenPLC v3 web UI over HTTP to turn a static control-logic artifact
-//! into a *running* PLC: log in, upload the program, save it, compile it (MatIEC),
-//! and start the runtime — at which point OpenPLC opens its Modbus/TCP server on
-//! 502 and the ICS probe has something to talk to. The endpoint sequence mirrors
-//! the OpenPLC web UI: `POST /login` → `POST /upload-program` (which hands back a
-//! server-assigned `prog_file`) → `POST /upload-program-action` →
-//! `GET /compile-program?file=<prog_file>` → `GET /start_plc`.
-
-use std::time::Duration;
-
-use crate::error::ExecError;
-
-use super::PlcProgram;
-
-/// Default OpenPLC program name/description recorded in its UI.
-const PROG_NAME: &str = "certifai-provisioned";
-const PROG_DESCR: &str = "Uploaded by the Certifai provision-and-test scan";
-
-/// Poll interval while waiting for readiness / compilation.
-const POLL_INTERVAL: Duration = Duration::from_secs(2);
-
-/// Wait until the OpenPLC web UI answers (any non-5xx reply to `/login`), or the
-/// budget elapses. A freshly-started container needs a few seconds to boot.
-pub async fn wait_ready(
-    http: &reqwest::Client,
-    base_url: &str,
-    budget: Duration,
-) -> Result<(), ExecError> {
-    let login = format!("{base_url}/login");
-    let outcome = tokio::time::timeout(budget, async {
-        loop {
-            if let Ok(resp) = http.get(&login).send().await {
-                if !resp.status().is_server_error() {
-                    return;
-                }
-            }
-            tokio::time::sleep(POLL_INTERVAL).await;
-        }
-    })
-    .await;
-    outcome.map_err(|_| ExecError::Other(format!("OpenPLC at {base_url} did not become ready")))
-}
-
-/// Log in, upload the program, compile it, and start the runtime. On success the
-/// OpenPLC Modbus/TCP server is listening on 502.
-pub async fn load_and_start(
-    http: &reqwest::Client,
-    base_url: &str,
-    user: &str,
-    password: &str,
-    program: &PlcProgram,
-    compile_budget: Duration,
-) -> Result<(), ExecError> {
-    login(http, base_url, user, password).await?;
-    let prog_file = upload_program(http, base_url, program).await?;
-    save_program(http, base_url, &prog_file).await?;
-    compile(http, base_url, &prog_file, compile_budget).await?;
-    start(http, base_url).await?;
-    Ok(())
-}
-
-/// `POST /login` — establishes the session cookie (the client must have a cookie
-/// store; see the provision-and-test entry point).
-async fn login(
-    http: &reqwest::Client,
-    base_url: &str,
-    user: &str,
-    password: &str,
-) -> Result<(), ExecError> {
-    let resp = http
-        .post(format!("{base_url}/login"))
-        .form(&[("username", user), ("password", password)])
-        .send()
-        .await?;
-    if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
-            "OpenPLC login failed: HTTP {}",
-            resp.status()
-        )));
-    }
-    Ok(())
-}
-
-/// `POST /upload-program` (multipart `file`) — OpenPLC stores the program under a
-/// server-assigned name and returns it in a hidden `prog_file` form field, which
-/// we parse out for the follow-up save/compile steps.
-async fn upload_program(
-    http: &reqwest::Client,
-    base_url: &str,
-    program: &PlcProgram,
-) -> Result<String, ExecError> {
-    let part = reqwest::multipart::Part::text(program.source.clone())
-        .file_name(program.file_name.clone())
-        .mime_str("application/octet-stream")?;
-    let form = reqwest::multipart::Form::new().part("file", part);
-    let resp = http
-        .post(format!("{base_url}/upload-program"))
-        .multipart(form)
-        .send()
-        .await?;
-    let html = resp.text().await?;
-    parse_prog_file(&html).ok_or_else(|| {
-        ExecError::Other("OpenPLC upload did not return a prog_file handle".to_string())
-    })
-}
-
-/// `POST /upload-program-action` — records the uploaded program in OpenPLC's
-/// program list. `epoch_time` must be close to the server's clock (OpenPLC
-/// rejects stale timestamps), so we send the current time.
-async fn save_program(
-    http: &reqwest::Client,
-    base_url: &str,
-    prog_file: &str,
-) -> Result<(), ExecError> {
-    let epoch = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-        .to_string();
-    let resp = http
-        .post(format!("{base_url}/upload-program-action"))
-        .form(&[
-            ("prog_name", PROG_NAME),
-            ("prog_descr", PROG_DESCR),
-            ("prog_file", prog_file),
-            ("epoch_time", &epoch),
-        ])
-        .send()
-        .await?;
-    if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
-            "OpenPLC save-program failed: HTTP {}",
-            resp.status()
-        )));
-    }
-    Ok(())
-}
-
-/// `GET /compile-program?file=<prog_file>` then poll `/compilation-logs` until
-/// MatIEC reports it finished (or the budget elapses). Errors if compilation
-/// finishes with errors — a program that won't compile can't be started.
-async fn compile(
-    http: &reqwest::Client,
-    base_url: &str,
-    prog_file: &str,
-    budget: Duration,
-) -> Result<(), ExecError> {
-    http.get(format!("{base_url}/compile-program"))
-        .query(&[("file", prog_file)])
-        .send()
-        .await?;
-
-    let logs_url = format!("{base_url}/compilation-logs");
-    let outcome = tokio::time::timeout(budget, async {
-        loop {
-            if let Ok(resp) = http.get(&logs_url).send().await {
-                if let Ok(text) = resp.text().await {
-                    if compilation_finished(&text) {
-                        return !compilation_failed(&text);
-                    }
-                }
-            }
-            tokio::time::sleep(POLL_INTERVAL).await;
-        }
-    })
-    .await;
-    match outcome {
-        Ok(true) => Ok(()),
-        Ok(false) => Err(ExecError::Other(
-            "OpenPLC compilation finished with errors".to_string(),
-        )),
-        Err(_) => Err(ExecError::Other(
-            "OpenPLC compilation did not finish in time".to_string(),
-        )),
-    }
-}
-
-/// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
-async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), ExecError> {
-    let resp = http.get(format!("{base_url}/start_plc")).send().await?;
-    if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
-            "OpenPLC start_plc failed: HTTP {}",
-            resp.status()
-        )));
-    }
-    Ok(())
-}
-
-/// Extract the server-assigned `prog_file` from the `/upload-program` response,
-/// which embeds it in a hidden input. Attribute order varies, so accept both
-/// `value=… name='prog_file'` and `name='prog_file' … value=…`.
-fn parse_prog_file(html: &str) -> Option<String> {
-    // The OpenPLC template renders `value='<name>.st' id='prog_file'
-    // name='prog_file'`. Match the value bound to that input, either order.
-    let value_then_name =
-        regex::Regex::new(r#"(?is)value=['"]([^'"]+)['"][^>]*name=['"]prog_file['"]"#).ok()?;
-    if let Some(c) = value_then_name.captures(html) {
-        return c.get(1).map(|m| m.as_str().to_string());
-    }
-    let name_then_value =
-        regex::Regex::new(r#"(?is)name=['"]prog_file['"][^>]*value=['"]([^'"]+)['"]"#).ok()?;
-    name_then_value
-        .captures(html)
-        .and_then(|c| c.get(1))
-        .map(|m| m.as_str().to_string())
-}
-
-/// Whether the MatIEC compilation log shows the build has finished (either way).
-fn compilation_finished(log: &str) -> bool {
-    log.contains("Compilation finished")
-}
-
-/// Whether a finished compilation ended in failure.
-fn compilation_failed(log: &str) -> bool {
-    log.contains("Compilation finished with errors")
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_prog_file_value_then_name() {
-        let html = "<form><input type='hidden' value='483927.st' id='prog_file' \
-                    name='prog_file'/></form>";
-        assert_eq!(parse_prog_file(html), Some("483927.st".to_string()));
-    }
-
-    #[test]
-    fn parses_prog_file_name_then_value() {
-        let html = r#"<input name="prog_file" id="prog_file" value="12.st" />"#;
-        assert_eq!(parse_prog_file(html), Some("12.st".to_string()));
-    }
-
-    #[test]
-    fn parse_prog_file_none_when_absent() {
-        assert_eq!(parse_prog_file("<html>no form here</html>"), None);
-    }
-
-    #[test]
-    fn compilation_predicates() {
-        assert!(!compilation_finished("Compiling..."));
-        assert!(compilation_finished(
-            "...\nCompilation finished successfully!\n"
-        ));
-        assert!(compilation_finished("Compilation finished with errors!"));
-        assert!(compilation_failed("Compilation finished with errors!"));
-        assert!(!compilation_failed("Compilation finished successfully!"));
-    }
-}

werkbank-exec/src/plc/provision.rs

@@ -1,306 +0,0 @@
-//! Ephemeral soft-PLC container lifecycle (#183, sub-task 1 + 5).
-//!
-//! Provisions a throwaway OpenPLC container per scan, isolated on the agent's own
-//! Docker network with hard resource caps and **no host port exposure**, then
-//! guarantees teardown. The container is reachable in-cluster only, by its name
-//! (the shared user-defined network's embedded DNS resolves it); it is never
-//! published to the host.
-//!
-//! The `docker` argv is produced by pure functions so provisioning is unit-tested
-//! without a Docker daemon — only the thin [`run_docker`] wrapper touches the OS.
-//! It requires the agent's runtime to have Docker access (a socket mount), which
-//! is why the whole path is gated behind [`PlcRuntimeConfig::enabled`].
-
-use std::time::{SystemTime, UNIX_EPOCH};
-
-use compliance_core::PlcRuntimeConfig;
-
-use crate::error::ExecError;
-
-/// The Modbus/TCP port an OpenPLC instance opens once a program is running.
-const MODBUS_PORT: u16 = 502;
-/// The OpenPLC web-UI / WebVisu port.
-const WEBVISU_PORT: u16 = 8080;
-
-/// Label key marking a container as an ephemeral PLC runtime we own.
-const OWNER_LABEL_KEY: &str = "certifai.ephemeral";
-/// Label value for our ephemeral PLC runtimes.
-const OWNER_LABEL_VALUE: &str = "plc-runtime";
-
-/// A running ephemeral soft-PLC instance. Reachable in-cluster by `name`.
-#[derive(Debug, Clone)]
-pub struct ProvisionedRuntime {
-    /// The container name — also its in-network DNS alias.
-    pub name: String,
-    /// `name:502` — the Modbus/TCP endpoint the ICS probe targets.
-    pub modbus_endpoint: String,
-    /// `http://name:8080` — the WebVisu / OpenPLC web UI.
-    pub webvisu_url: String,
-}
-
-/// A source of ephemeral soft-PLC instances. Abstracted so the provision-and-test
-/// orchestration is unit-testable with a fake that never touches Docker.
-pub trait SoftPlc {
-    /// Start a fresh instance for a target and return its handle.
-    fn provision(
-        &self,
-        target_id: &str,
-    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, ExecError>> + Send;
-
-    /// Tear an instance down. Best-effort and idempotent — never fails the scan.
-    fn teardown(&self, handle: &ProvisionedRuntime)
-        -> impl std::future::Future<Output = ()> + Send;
-}
-
-/// Provisions OpenPLC instances by shelling out to the Docker CLI.
-pub struct DockerSoftPlc {
-    cfg: PlcRuntimeConfig,
-}
-
-impl DockerSoftPlc {
-    /// Build a provisioner from the PLC-runtime config.
-    pub fn new(cfg: PlcRuntimeConfig) -> Self {
-        Self { cfg }
-    }
-}
-
-impl SoftPlc for DockerSoftPlc {
-    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
-        // Best-effort sweep of any container leaked by a crashed earlier run
-        // before we add another. Only removes instances past their max lifetime,
-        // so it can never disturb a concurrent run.
-        reap_stale(&self.cfg, now_epoch()).await;
-
-        let name = instance_name(target_id, now_epoch(), &random_suffix());
-        let args = run_args(&self.cfg, &name, target_id);
-        let out = run_docker(&args).await?;
-        if !out.status.success() {
-            return Err(ExecError::Other(format!(
-                "docker run for soft-PLC {name} failed: {}",
-                String::from_utf8_lossy(&out.stderr).trim()
-            )));
-        }
-        Ok(ProvisionedRuntime {
-            modbus_endpoint: format!("{name}:{MODBUS_PORT}"),
-            webvisu_url: format!("http://{name}:{WEBVISU_PORT}"),
-            name,
-        })
-    }
-
-    async fn teardown(&self, handle: &ProvisionedRuntime) {
-        match run_docker(&rm_args(&handle.name)).await {
-            Ok(out) if out.status.success() => {
-                tracing::info!(instance = %handle.name, "soft-PLC instance torn down");
-            }
-            Ok(out) => tracing::warn!(
-                instance = %handle.name,
-                "soft-PLC teardown non-zero exit: {}",
-                String::from_utf8_lossy(&out.stderr).trim()
-            ),
-            Err(e) => {
-                tracing::warn!(instance = %handle.name, error = %e, "soft-PLC teardown failed")
-            }
-        }
-    }
-}
-
-/// Seconds since the Unix epoch (0 if the clock is before 1970, which never
-/// happens in practice).
-fn now_epoch() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-}
-
-/// A short random, docker-name-safe suffix.
-fn random_suffix() -> String {
-    uuid::Uuid::new_v4().simple().to_string()
-}
-
-/// A unique, docker-safe container name that encodes the creation epoch (for the
-/// stale reaper) and the target it belongs to. Shape:
-/// `certifai-plc-<epoch>-<target12>-<rand6>`.
-fn instance_name(target_id: &str, epoch: u64, rand: &str) -> String {
-    let short: String = target_id
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(12)
-        .collect();
-    let rand: String = rand
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(6)
-        .collect();
-    format!("certifai-plc-{epoch}-{short}-{rand}")
-}
-
-/// The creation epoch encoded in an instance name, if it is one of ours.
-fn parse_epoch(name: &str) -> Option<u64> {
-    name.strip_prefix("certifai-plc-")?
-        .split('-')
-        .next()?
-        .parse()
-        .ok()
-}
-
-/// The `docker run` argv for an ephemeral soft-PLC: detached, joined to the
-/// agent's network, resource-capped, hardened, labelled for reaping, and — by
-/// omitting any `-p` — never published to the host.
-fn run_args(cfg: &PlcRuntimeConfig, name: &str, target_id: &str) -> Vec<String> {
-    vec![
-        "run".into(),
-        "-d".into(),
-        "--name".into(),
-        name.into(),
-        "--network".into(),
-        cfg.network.clone(),
-        "--memory".into(),
-        cfg.memory.clone(),
-        "--cpus".into(),
-        cfg.cpus.clone(),
-        "--pids-limit".into(),
-        "512".into(),
-        "--security-opt".into(),
-        "no-new-privileges".into(),
-        "--stop-timeout".into(),
-        "5".into(),
-        "--label".into(),
-        format!("{OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
-        "--label".into(),
-        format!("certifai.target={target_id}"),
-        cfg.image.clone(),
-    ]
-}
-
-/// The `docker rm -f` argv that stops and removes an instance.
-fn rm_args(name: &str) -> Vec<String> {
-    vec!["rm".into(), "-f".into(), name.into()]
-}
-
-/// The `docker ps` argv listing the names of every ephemeral PLC container we own.
-fn reap_list_args() -> Vec<String> {
-    vec![
-        "ps".into(),
-        "-a".into(),
-        "--filter".into(),
-        format!("label={OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
-        "--format".into(),
-        "{{.Names}}".into(),
-    ]
-}
-
-/// Remove any ephemeral PLC container older than twice the configured max
-/// lifetime — i.e. one a crashed run leaked. The generous threshold guarantees a
-/// container from a *live* run (still within its own deadline) is never swept.
-/// Best-effort: any Docker error (e.g. no daemon) is ignored.
-async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
-    let cutoff = cfg.max_lifetime_secs.saturating_mul(2);
-    let Ok(out) = run_docker(&reap_list_args()).await else {
-        return;
-    };
-    if !out.status.success() {
-        return;
-    }
-    let names = String::from_utf8_lossy(&out.stdout);
-    for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
-        let Some(epoch) = parse_epoch(name) else {
-            continue;
-        };
-        if now.saturating_sub(epoch) > cutoff {
-            tracing::warn!(instance = %name, "reaping stale soft-PLC instance");
-            let _ = run_docker(&rm_args(name)).await;
-        }
-    }
-}
-
-/// Run a `docker` subcommand, capturing its output.
-async fn run_docker(args: &[String]) -> Result<std::process::Output, ExecError> {
-    tokio::process::Command::new("docker")
-        .args(args)
-        .output()
-        .await
-        .map_err(ExecError::Io)
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn cfg() -> PlcRuntimeConfig {
-        PlcRuntimeConfig {
-            enabled: true,
-            image: "registry.example.com/openplc:latest".into(),
-            network: "certifai".into(),
-            memory: "512m".into(),
-            cpus: "0.5".into(),
-            max_lifetime_secs: 180,
-            ..PlcRuntimeConfig::default()
-        }
-    }
-
-    #[test]
-    fn instance_name_is_unique_docker_safe_and_reaper_parseable() {
-        let a = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "abcdef123456");
-        assert_eq!(a, "certifai-plc-1700000000-64f0aabbccdd-abcdef");
-        assert_eq!(parse_epoch(&a), Some(1_700_000_000));
-        // Docker names: only [A-Za-z0-9_.-].
-        assert!(a
-            .chars()
-            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')));
-        // A different random suffix yields a different name for the same target.
-        let b = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "zzzzzz999999");
-        assert_ne!(a, b);
-    }
-
-    #[test]
-    fn parse_epoch_rejects_foreign_names() {
-        assert_eq!(parse_epoch("some-other-container"), None);
-        assert_eq!(parse_epoch("certifai-plc-notanumber-x"), None);
-    }
-
-    #[test]
-    fn run_args_cap_resources_harden_label_and_never_publish_a_port() {
-        let args = run_args(&cfg(), "certifai-plc-1-t-r", "target-123");
-        // No host port publishing.
-        assert!(!args.iter().any(|a| a == "-p" || a == "--publish"));
-        // Detached.
-        assert!(args.contains(&"-d".to_string()));
-        // Joined to the agent's own network.
-        let net = args.iter().position(|a| a == "--network").expect("network");
-        assert_eq!(args[net + 1], "certifai");
-        // Resource caps.
-        let mem = args.iter().position(|a| a == "--memory").expect("memory");
-        assert_eq!(args[mem + 1], "512m");
-        let cpu = args.iter().position(|a| a == "--cpus").expect("cpus");
-        assert_eq!(args[cpu + 1], "0.5");
-        assert!(args.iter().any(|a| a == "--pids-limit"));
-        // Hardening.
-        let so = args
-            .iter()
-            .position(|a| a == "--security-opt")
-            .expect("secopt");
-        assert_eq!(args[so + 1], "no-new-privileges");
-        // Ownership + target labels for reaping / attribution.
-        assert!(args.contains(&"certifai.ephemeral=plc-runtime".to_string()));
-        assert!(args.contains(&"certifai.target=target-123".to_string()));
-        // Image is last.
-        assert_eq!(
-            args.last().map(String::as_str),
-            Some("registry.example.com/openplc:latest")
-        );
-    }
-
-    #[test]
-    fn rm_args_force_remove() {
-        assert_eq!(rm_args("x"), vec!["rm", "-f", "x"]);
-    }
-
-    #[test]
-    fn reap_list_filters_by_owner_label() {
-        let args = reap_list_args();
-        assert!(args.contains(&"label=certifai.ephemeral=plc-runtime".to_string()));
-        assert!(args.contains(&"{{.Names}}".to_string()));
-    }
-}