fix(deps): bump h2 0.4.13 -> 0.4.19 (RUSTSEC-2026-0258, unblocks CI audit)

The CI Security Audit step fails on RUSTSEC-2026-0258 — "h2 unbounded empty DATA frames" (DoS), fixed in h2 >= 0.4.16. h2 is a transitive dependency (hyper/reqwest), so this is a lockfile-only bump; no Cargo.toml or code change, diff limited to the single version line. The remaining audit findings (anyhow, git2, lru) are `unsound` warnings, not vulnerabilities, and do not fail the step. Folded into this CI-fix PR because the audit gate blocks every PR from going green, including this one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI)
2026-08-31 18:59:00 +02:00 · 2026-08-31 18:22:52 +02:00 · 2026-08-31 15:58:16 +00:00 · 2026-08-31 15:58:11 +00:00 · 2026-08-06 08:42:45 +00:00 · 2026-07-22 17:06:08 +00:00
40 changed files with 2782 additions and 185 deletions
@@ -7,6 +7,13 @@ on:
  pull_request:

 env:
+  # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
+  # username contains '$', which sh expands when interpolated into the
+  # script (robot$ci-push -> robot-push) => docker login unauthorized.
+  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
@@ -65,7 +72,7 @@ jobs:
            echo '[source.crates-io]'
            echo 'replace-with = "kellnr"'
            echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
+            echo 'index = "sparse+https://crates.breakpilot.com/api/v1/cratesio/"'
          } >> "$CARGO_HOME/config.toml"
        env:
          RUSTC_WRAPPER: ""
@@ -87,8 +94,8 @@ jobs:
      - name: Configure git auth for private tramiton dependency
        run: |
          git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@gitea.meghsakha.com:22222/"
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@git.breakpilot.com/".insteadOf \
+            "ssh://git@git.breakpilot.com:22222/"
        env:
          RUSTC_WRAPPER: ""

@@ -206,11 +213,14 @@ jobs:
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-agent
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.breakpilot.com/certifai/compliance-agent
+          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -230,11 +240,14 @@ jobs:
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-dashboard
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.breakpilot.com/certifai/compliance-dashboard
+          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -252,10 +265,13 @@ jobs:
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-docs
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.breakpilot.com/certifai/compliance-docs
+          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
          docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -275,11 +291,14 @@ jobs:
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-mcp
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.breakpilot.com/certifai/compliance-mcp
+          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -2116,7 +2116,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -2474,9 +2474,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2796,7 +2796,7 @@ dependencies = [
 "libc",
 "percent-encoding",
 "pin-project-lite",
- "socket2 0.6.2",
+ "socket2 0.5.10",
 "system-configuration",
 "tokio",
 "tower-layer",
@@ -3711,7 +3711,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -4298,7 +4298,7 @@ dependencies = [
 "quinn-udp",
 "rustc-hash 2.1.1",
 "rustls",
- "socket2 0.6.2",
+ "socket2 0.5.10",
 "thiserror 2.0.18",
 "tokio",
 "tracing",
@@ -4335,9 +4335,9 @@ dependencies = [
 "cfg_aliases",
 "libc",
 "once_cell",
- "socket2 0.6.2",
+ "socket2 0.5.10",
 "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -4711,7 +4711,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -5598,7 +5598,7 @@ dependencies = [
 "getrandom 0.4.1",
 "once_cell",
 "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -6176,7 +6176,7 @@ dependencies = [
 [[package]]
 name = "tramiton-core"
 version = "0.4.1"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
 dependencies = [
 "serde",
 "tempfile",
@@ -6188,7 +6188,7 @@ dependencies = [
 [[package]]
 name = "tramiton-repro"
 version = "0.4.1"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
 dependencies = [
 "serde",
 "serde_json",
@@ -6203,7 +6203,7 @@ dependencies = [
 [[package]]
 name = "tramiton-sbom"
 version = "0.4.1"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
 dependencies = [
 "object",
 "serde",
@@ -6791,7 +6791,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]

 [[package]]
@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        "ssh://git@git.breakpilot.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent

@@ -13,8 +13,8 @@ ENV DOCS_URL=${DOCS_URL}
 RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        "ssh://git@git.breakpilot.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        "ssh://git@git.breakpilot.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp

@@ -16,14 +16,16 @@ compliance-dast = { path = "../compliance-dast" }
 werkbank-exec = { path = "../werkbank-exec" }
 # Native firmware build/target detection for bare-metal & RTOS artifacts.
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
-# available to the onboarding classifier. NOTE: CI must be able to fetch this
+# available to the onboarding classifier. Repo renamed tramiton -> firmwerk
+# (git.breakpilot.com/sharang/firmwerk); crates stay tramiton-* at tag v0.4.1.
+# NOTE: CI must be able to fetch this
 # private repo (see the git-auth step in .gitea/workflows/ci.yml).
-tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+tramiton-core = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" }
 # tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
 # yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
-tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+tramiton-repro = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" }
 # tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
-tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+tramiton-sbom = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -0,0 +1,117 @@
+# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
+# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
+# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
+# not matter). Detection here is deterministic; the grounded LLM judge downstream
+# only confirms/refutes — it never detects. Keep patterns tight: a false positive
+# that the judge refutes marks the whole finding a false positive.
+rules:
+  # --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
+  - id: cra-ai-1-flask-debug-enabled
+    languages: [python]
+    severity: WARNING
+    message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
+    metadata:
+      cwe: ["CWE-489: Active Debug Code"]
+      control: cra-ai-1
+    patterns:
+      - pattern: '$APP.run(..., debug=True, ...)'
+
+  - id: cra-ai-1-django-debug-true
+    languages: [python]
+    severity: WARNING
+    message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
+    metadata:
+      cwe: ["CWE-489: Active Debug Code"]
+      control: cra-ai-1
+    patterns:
+      - pattern: 'DEBUG = True'
+
+  - id: cra-ai-1-tls-verify-disabled
+    languages: [python]
+    severity: ERROR
+    message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
+    metadata:
+      cwe: ["CWE-295: Improper Certificate Validation"]
+      control: cra-ai-1
+    patterns:
+      - pattern: 'requests.$M(..., verify=False, ...)'
+
+  - id: cra-ai-1-cors-wildcard
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
+    metadata:
+      cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
+      control: cra-ai-1
+    patterns:
+      - pattern-either:
+          - pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
+          - pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
+
+  # --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
+  - id: cra-ai-7-weak-password-hash
+    languages: [python]
+    severity: ERROR
+    message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
+    metadata:
+      cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
+      control: cra-ai-7
+    patterns:
+      - pattern-either:
+          - pattern: 'hashlib.md5($PW)'
+          - pattern: 'hashlib.sha1($PW)'
+      - metavariable-regex:
+          metavariable: $PW
+          regex: '(?i).*(pass|pwd|secret|cred|token).*'
+
+  # --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
+  - id: cra-ai-10-session-cookie-insecure
+    languages: [python]
+    severity: ERROR
+    message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
+    metadata:
+      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
+      control: cra-ai-10
+    patterns:
+      - pattern-either:
+          - pattern: 'SESSION_COOKIE_SECURE = False'
+          - pattern: 'SESSION_COOKIE_HTTPONLY = False'
+
+  - id: cra-ai-10-express-cookie-insecure
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
+    metadata:
+      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
+      control: cra-ai-10
+    patterns:
+      - pattern-either:
+          - pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
+          - pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
+
+  # --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
+  - id: cra-ai-14-python-weak-cipher
+    languages: [python]
+    severity: ERROR
+    message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
+    metadata:
+      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
+      control: cra-ai-14
+    patterns:
+      - pattern-either:
+          - pattern: 'AES.new($K, AES.MODE_ECB, ...)'
+          - pattern: 'DES.new(...)'
+          - pattern: 'DES3.new(...)'
+
+  - id: cra-ai-14-node-weak-cipher
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
+    metadata:
+      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
+      control: cra-ai-14
+    patterns:
+      - pattern-either:
+          - pattern: 'crypto.createCipheriv("des-ecb", ...)'
+          - pattern: 'crypto.createCipheriv("des", ...)'
+          - pattern: 'crypto.createCipher(...)'
@@ -100,5 +100,11 @@ fn load_breakpilot_config() -> BreakpilotConfig {
        base_url: env_var_opt("BREAKPILOT_BASE_URL"),
        token: env_secret_opt("BREAKPILOT_TOKEN"),
        snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
+        semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.semantic_mapping),
+        grounded_control_checks: env_var_opt("BREAKPILOT_GROUNDED_CHECKS")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.grounded_control_checks),
    }
 }
@@ -0,0 +1,245 @@
+//! In-memory embedding index over the control corpus, for region → control
+//! retrieval.
+//!
+//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
+//! controls carry none), so we map by *similarity*: embed each control's
+//! requirement text once, then for a code region pull the top-K nearest controls
+//! to hand to the grounded judge. This is the retrieval half of the semantic path.
+
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use compliance_core::control_check::ControlCheckSpec;
+use compliance_core::error::CoreError;
+
+use crate::llm::LlmClient;
+
+/// A control spec paired with its requirement-text embedding.
+pub struct ControlIndex {
+    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
+}
+
+/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
+/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
+#[derive(Serialize, Deserialize)]
+struct PersistedIndex {
+    corpus_hash: String,
+    entries: Vec<PersistedEntry>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct PersistedEntry {
+    spec: ControlCheckSpec,
+    embedding: Vec<f64>,
+}
+
+/// Stable hash of the corpus identity (each control's id + requirement text, in
+/// order). Same catalog → same hash → the cached embeddings are reused instead of
+/// re-embedding the whole corpus.
+fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
+    let mut hasher = Sha256::new();
+    for s in specs {
+        hasher.update(s.control_id.as_bytes());
+        hasher.update([0u8]);
+        hasher.update(s.requirement.as_bytes());
+        hasher.update([0u8]);
+    }
+    format!("{:x}", hasher.finalize())
+}
+
+impl ControlIndex {
+    /// Build directly from precomputed embeddings (used by tests + callers that
+    /// already embedded the corpus).
+    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
+        Self { entries }
+    }
+
+    /// Load the index from `cache_path` if it still matches the current corpus,
+    /// otherwise embed the corpus and persist it there. This turns the per-scan
+    /// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
+    /// that survives across scans; the cache self-invalidates when the catalog
+    /// changes (its [`corpus_hash`] no longer matches).
+    pub async fn load_or_build(
+        llm: &LlmClient,
+        specs: Vec<ControlCheckSpec>,
+        cache_path: &Path,
+    ) -> Result<Self, CoreError> {
+        let hash = corpus_hash(&specs);
+        if let Some(index) = Self::load_cache(cache_path, &hash).await {
+            tracing::debug!(
+                controls = index.len(),
+                "reusing cached control embedding index"
+            );
+            return Ok(index);
+        }
+        let index = Self::build(llm, specs).await?;
+        if let Err(e) = index.write_cache(cache_path, &hash).await {
+            tracing::warn!(error = %e, "failed to persist control embedding index");
+        }
+        Ok(index)
+    }
+
+    /// Read a persisted index, returning it only if its corpus hash matches.
+    async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
+        let raw = tokio::fs::read(path).await.ok()?;
+        let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
+        if persisted.corpus_hash != hash {
+            return None;
+        }
+        Some(Self {
+            entries: persisted
+                .entries
+                .into_iter()
+                .map(|e| (e.spec, e.embedding))
+                .collect(),
+        })
+    }
+
+    /// Persist the index atomically (temp file + rename) keyed by corpus hash.
+    async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
+        if let Some(parent) = path.parent() {
+            tokio::fs::create_dir_all(parent).await?;
+        }
+        let persisted = PersistedIndex {
+            corpus_hash: hash.to_string(),
+            entries: self
+                .entries
+                .iter()
+                .map(|(spec, emb)| PersistedEntry {
+                    spec: spec.clone(),
+                    embedding: emb.clone(),
+                })
+                .collect(),
+        };
+        let raw = serde_json::to_vec(&persisted)?;
+        let tmp = path.with_extension("json.tmp");
+        tokio::fs::write(&tmp, &raw).await?;
+        tokio::fs::rename(&tmp, path).await?;
+        Ok(())
+    }
+
+    /// Build by embedding each control's requirement text.
+    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
+        if specs.is_empty() {
+            return Ok(Self {
+                entries: Vec::new(),
+            });
+        }
+        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
+        let embeddings = llm
+            .embed(texts)
+            .await
+            .map_err(|e| CoreError::Llm(e.to_string()))?;
+        Ok(Self {
+            entries: specs.into_iter().zip(embeddings).collect(),
+        })
+    }
+
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
+    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
+        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
+            .entries
+            .iter()
+            .map(|(spec, emb)| (cosine(query, emb), spec))
+            .collect();
+        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
+        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
+    }
+}
+
+/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
+fn cosine(a: &[f64], b: &[f64]) -> f64 {
+    if a.len() != b.len() || a.is_empty() {
+        return 0.0;
+    }
+    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
+    let na: f64 = a.iter().map(|x| x * x).sum();
+    let nb: f64 = b.iter().map(|x| x * x).sum();
+    if na == 0.0 || nb == 0.0 {
+        return 0.0;
+    }
+    dot / (na.sqrt() * nb.sqrt())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::finding::Severity;
+
+    fn spec(id: &str) -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: id.into(),
+            title: id.into(),
+            requirement: id.into(),
+            default_cwe: None,
+            severity: Severity::Medium,
+        }
+    }
+
+    #[test]
+    fn nearest_ranks_by_cosine() {
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("a"), vec![1.0, 0.0]),
+            (spec("b"), vec![0.0, 1.0]),
+            (spec("c"), vec![0.7, 0.7]),
+        ]);
+        let hits = index.nearest(&[0.9, 0.1], 2);
+        assert_eq!(hits.len(), 2);
+        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
+    }
+
+    #[test]
+    fn cosine_edges_are_zero() {
+        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
+        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
+        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
+    }
+
+    #[test]
+    fn corpus_hash_is_stable_and_identity_sensitive() {
+        let a = corpus_hash(&[spec("x"), spec("y")]);
+        assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
+        assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
+        assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
+    }
+
+    #[tokio::test]
+    #[allow(clippy::unwrap_used)]
+    async fn cache_round_trips_and_misses_on_corpus_change() {
+        let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
+        let path = dir.join("control-index.json");
+        let specs = [spec("a"), spec("b")];
+        let hash = corpus_hash(&specs);
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("a"), vec![1.0, 0.0]),
+            (spec("b"), vec![0.0, 1.0]),
+        ]);
+        index.write_cache(&path, &hash).await.unwrap();
+
+        // matching corpus hash → hit
+        let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
+        assert_eq!(loaded.len(), 2);
+        assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
+        // corpus changed → miss (forces a rebuild)
+        assert!(ControlIndex::load_cache(&path, "differenthash")
+            .await
+            .is_none());
+        // absent file → miss, not an error
+        assert!(
+            ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
+                .await
+                .is_none()
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
@@ -6,13 +6,18 @@
 //! and snapshots it locally.

 mod checker;
+mod index;
 mod judge;
 mod oscal_provider;
 mod scan_triage;
+mod semantic;
+mod surface;
 mod triage;

 pub use checker::GroundedControlChecker;
+pub use index::ControlIndex;
 pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
 pub use oscal_provider::OscalControlsProvider;
-pub use scan_triage::triage_repo_findings;
+pub use scan_triage::{grounded_surface_findings, semantic_stamp_findings, triage_repo_findings};
+pub use semantic::SemanticControlChecker;
 pub use triage::{ControlTriage, TriageOutcome};
@@ -43,20 +43,20 @@ impl OscalControlsProvider {
        }
    }

-    fn catalog_url(&self, framework: ComplianceFramework) -> String {
+    fn catalog_url(&self, framework: &str) -> String {
        format!(
            "{}/api/compliance/v1/oscal/catalog?framework={framework}",
            self.base_url.trim_end_matches('/')
        )
    }

-    fn snapshot_path(&self, framework: ComplianceFramework) -> PathBuf {
+    fn snapshot_path(&self, framework: &str) -> PathBuf {
        self.snapshot_dir
            .join(format!("oscal-catalog-{framework}.json"))
    }

-    /// Fetch the raw catalog bytes for a framework over HTTP.
-    async fn fetch_raw(&self, framework: ComplianceFramework) -> Result<Vec<u8>, CoreError> {
+    /// Fetch the raw catalog bytes for a framework token over HTTP.
+    async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
        let mut req = self.http.get(self.catalog_url(framework));
        if let Some(token) = &self.token {
            req = req.bearer_auth(token.expose_secret());
@@ -78,11 +78,7 @@ impl OscalControlsProvider {
    }

    /// Write a catalog snapshot atomically (temp file + rename).
-    async fn write_snapshot(
-        &self,
-        framework: ComplianceFramework,
-        raw: &[u8],
-    ) -> Result<(), CoreError> {
+    async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
        tokio::fs::create_dir_all(&self.snapshot_dir).await?;
        let path = self.snapshot_path(framework);
        let tmp = path.with_extension("json.tmp");
@@ -92,10 +88,7 @@ impl OscalControlsProvider {
    }

    /// Read a previously written snapshot, if one exists.
-    async fn read_snapshot(
-        &self,
-        framework: ComplianceFramework,
-    ) -> Result<Option<OscalDocument>, CoreError> {
+    async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
        match tokio::fs::read(self.snapshot_path(framework)).await {
            Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
@@ -103,21 +96,21 @@ impl OscalControlsProvider {
        }
    }

-    /// Load the catalog for a framework: fetch fresh + snapshot the exact bytes;
-    /// on network failure, fall back to the last snapshot so scans still run.
-    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
+    /// Load the catalog for a framework token: fetch fresh + snapshot the exact
+    /// bytes; on network failure, fall back to the last snapshot so scans run.
+    async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
        match self.fetch_raw(framework).await {
            Ok(raw) => {
                let doc: OscalDocument = serde_json::from_slice(&raw)?;
                if let Err(e) = self.write_snapshot(framework, &raw).await {
-                    tracing::warn!(%framework, error = %e, "failed to write OSCAL snapshot");
+                    tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
                }
                Ok(doc)
            }
            Err(fetch_err) => match self.read_snapshot(framework).await? {
                Some(doc) => {
                    tracing::warn!(
-                        %framework, error = %fetch_err,
+                        framework, error = %fetch_err,
                        "OSCAL catalog fetch failed; falling back to snapshot"
                    );
                    Ok(doc)
@@ -126,6 +119,17 @@ impl OscalControlsProvider {
            },
        }
    }
+
+    /// Load the OSCAL catalog for a compliance framework.
+    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
+        self.load_token(&framework.to_string()).await
+    }
+
+    /// Load the code-checkable master-controls catalog
+    /// (`?framework=master-controls`).
+    pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
+        self.load_token("master-controls").await
+    }
 }

 /// Order controls whose title/text mention the query context first (stable), then
@@ -181,11 +185,11 @@ mod tests {
    fn builds_catalog_url_and_snapshot_path() {
        let p = provider(std::path::Path::new("/snap"));
        assert_eq!(
-            p.catalog_url(ComplianceFramework::Cra),
+            p.catalog_url("cra"),
            "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
        );
        assert_eq!(
-            p.snapshot_path(ComplianceFramework::Cra),
+            p.snapshot_path("cra"),
            std::path::Path::new("/snap/oscal-catalog-cra.json")
        );
    }
@@ -213,19 +217,11 @@ mod tests {
    async fn snapshot_round_trip_and_offline_fallback() {
        let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
        let p = provider(&dir);
-        assert!(p
-            .read_snapshot(ComplianceFramework::Cra)
-            .await
-            .unwrap()
-            .is_none());
-        p.write_snapshot(ComplianceFramework::Cra, MINI_CATALOG.as_bytes())
+        assert!(p.read_snapshot("cra").await.unwrap().is_none());
+        p.write_snapshot("cra", MINI_CATALOG.as_bytes())
            .await
            .unwrap();
-        let doc = p
-            .read_snapshot(ComplianceFramework::Cra)
-            .await
-            .unwrap()
-            .unwrap();
+        let doc = p.read_snapshot("cra").await.unwrap().unwrap();
        assert_eq!(doc.to_controls().len(), 1);
        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
        let _ = std::fs::remove_dir_all(&dir);
@@ -16,9 +16,16 @@ use compliance_core::models::onboarding::ComplianceFramework;
 use compliance_core::AgentConfig;
 use control_map::ControlMap;

-use super::{ControlTriage, LlmControlJudge, OscalControlsProvider, TriageOutcome};
+use super::surface;
+use super::{
+    ControlIndex, ControlTriage, GroundedControlChecker, LlmControlJudge, OscalControlsProvider,
+    SemanticControlChecker, TriageOutcome,
+};
 use crate::llm::LlmClient;

+/// Nearest master controls judged per code region in the semantic pass.
+const SEMANTIC_TOP_K: usize = 5;
+
 /// Lines of context to read on each side of a finding's line.
 const REGION_WINDOW: usize = 6;

@@ -99,6 +106,50 @@ async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, Contro
    specs
 }

+/// Absence-based control pass (the grounded half of the hybrid coverage): for each
+/// control with a [`surface`] definition, deterministically retrieve the code
+/// surfaces it governs (login routes, logging setup, update/download code) and have
+/// the grounded judge decide whether the control holds there. Returns net-new
+/// findings, each already tagged with its control and grounded to a real snippet.
+///
+/// The orchestrator runs this when `breakpilot.grounded_control_checks` is set
+/// (on by default). Validated live; it covers the 8 absence-based CRA controls
+/// (the judge decides presence/absence, grounded to a real snippet).
+pub async fn grounded_surface_findings(
+    config: &AgentConfig,
+    llm: Arc<LlmClient>,
+    repo_path: &Path,
+    repo_id: &str,
+) -> Vec<Finding> {
+    let Some(base_url) = config.breakpilot.base_url.clone() else {
+        return Vec::new();
+    };
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        base_url,
+        config.breakpilot.token.clone(),
+        &config.breakpilot.snapshot_dir,
+    );
+    let specs = build_specs(&provider).await;
+    if specs.is_empty() {
+        return Vec::new();
+    }
+    let checker = GroundedControlChecker::new(LlmControlJudge::new(llm));
+
+    let mut out = Vec::new();
+    for surf in surface::SURFACES {
+        let Some(spec) = specs.get(surf.control_id) else {
+            continue; // catalog doesn't carry this control
+        };
+        let regions = surface::retrieve(repo_path, surf.terms);
+        if regions.is_empty() {
+            continue;
+        }
+        out.extend(checker.check(spec, &regions, repo_id).await);
+    }
+    out
+}
+
 /// Read a window of lines around `line` (1-based) from `repo_path/file`.
 fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
    let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
@@ -116,6 +167,115 @@ fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegi
    })
 }

+/// Master-controls **semantic** pass: for each finding's code region, retrieve the
+/// top-K nearest master controls by embedding, have the grounded judge confirm,
+/// and stamp the confirmed control ids onto the finding — the scale path for the
+/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
+/// of findings that gained a master-control ref.
+///
+/// The orchestrator runs this when `breakpilot.semantic_mapping` is set (on by
+/// default). The control embedding index is built once and cached to
+/// `snapshot_dir` keyed by corpus hash ([`ControlIndex::load_or_build`]), so only
+/// the first scan after a catalog change pays the embedding cost.
+pub async fn semantic_stamp_findings(
+    config: &AgentConfig,
+    llm: Arc<LlmClient>,
+    repo_path: &Path,
+    findings: &mut [Finding],
+) -> usize {
+    let Some(base_url) = config.breakpilot.base_url.clone() else {
+        return 0;
+    };
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        base_url,
+        config.breakpilot.token.clone(),
+        &config.breakpilot.snapshot_dir,
+    );
+    let doc = match provider.load_master_controls().await {
+        Ok(d) => d,
+        Err(e) => {
+            tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
+            return 0;
+        }
+    };
+    let specs: Vec<ControlCheckSpec> = doc
+        .to_controls()
+        .into_iter()
+        .map(|c| ControlCheckSpec {
+            control_id: c.id,
+            title: c.title,
+            requirement: c.text,
+            default_cwe: None,
+            severity: Severity::Medium,
+        })
+        .collect();
+    let cache_path =
+        Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
+    let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
+        Ok(i) if !i.is_empty() => i,
+        Ok(_) => return 0,
+        Err(e) => {
+            tracing::warn!(error = %e, "failed to embed master-controls corpus");
+            return 0;
+        }
+    };
+    let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
+
+    let mut tagged = 0;
+    for finding in findings.iter_mut() {
+        if finding.status == FindingStatus::FalsePositive {
+            continue;
+        }
+        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
+            continue;
+        };
+        let Some(region) = fetch_region(repo_path, &file, line) else {
+            continue;
+        };
+        // Retrieve on the finding's intent + the code, not the region alone: two
+        // findings in one file share overlapping windows and otherwise embed alike,
+        // collapsing onto the same controls. The finding's title/description carry
+        // the discriminating signal (e.g. "brute-force protection" vs "weak hash").
+        // The raw `region` still goes to the judge for snippet grounding.
+        let query = format!(
+            "{}\n{}\n\n{}",
+            finding.title, finding.description, region.content
+        );
+        let query_emb = match llm.embed(vec![query]).await {
+            Ok(mut embs) => match embs.pop() {
+                Some(v) => v,
+                None => continue,
+            },
+            Err(e) => {
+                tracing::warn!(error = %e, "query embed failed; skipping finding");
+                continue;
+            }
+        };
+        let confirmed = checker
+            .check(
+                &index,
+                &region,
+                &query_emb,
+                SEMANTIC_TOP_K,
+                &finding.repo_id,
+            )
+            .await;
+        let before = finding.control_refs.len();
+        for f in confirmed {
+            for cref in f.control_refs {
+                if !finding.control_refs.contains(&cref) {
+                    finding.control_refs.push(cref);
+                }
+            }
+        }
+        if finding.control_refs.len() > before {
+            tagged += 1;
+        }
+    }
+    tagged
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -0,0 +1,121 @@
+//! Semantic control mapping: retrieve the top-K controls nearest a code region,
+//! then confirm each with the grounded judge.
+//!
+//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
+//! what scales to the full master-control corpus: the LLM only ever judges a
+//! handful of retrieved candidates, and every surviving verdict is still anchored
+//! to real code by the grounding gate.
+
+use compliance_core::control_check::{ground, CandidateRegion};
+use compliance_core::models::Finding;
+
+use super::index::ControlIndex;
+use super::judge::ControlJudge;
+
+/// Retrieve → judge → ground, generic over the judge so tests use a stub.
+pub struct SemanticControlChecker<J> {
+    judge: J,
+}
+
+impl<J: ControlJudge> SemanticControlChecker<J> {
+    pub fn new(judge: J) -> Self {
+        Self { judge }
+    }
+
+    /// Map a code region to the controls it violates. `query_embedding` is the
+    /// caller-supplied retrieval embedding — typically the finding's intent
+    /// (title/description) plus the region, so retrieval keys on what the finding
+    /// is *about*, not just the ambient code. The top-`k` nearest controls in
+    /// `index` are then judged against the raw `region` and grounded.
+    pub async fn check(
+        &self,
+        index: &ControlIndex,
+        region: &CandidateRegion,
+        query_embedding: &[f64],
+        k: usize,
+        repo_id: &str,
+    ) -> Vec<Finding> {
+        let candidates = index.nearest(query_embedding, k);
+        let mut findings = Vec::new();
+        for spec in &candidates {
+            let verdict = self.judge.judge(spec, region).await;
+            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
+                findings.push(finding);
+            }
+        }
+        findings
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
+    use compliance_core::models::finding::Severity;
+
+    struct StubJudge {
+        verdict: LlmVerdict,
+    }
+    impl ControlJudge for StubJudge {
+        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
+            self.verdict.clone()
+        }
+    }
+
+    fn spec(id: &str) -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: id.into(),
+            title: id.into(),
+            requirement: id.into(),
+            default_cwe: None,
+            severity: Severity::Medium,
+        }
+    }
+
+    #[tokio::test]
+    async fn retrieves_then_grounds_the_nearest_control() {
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("mc-near"), vec![1.0, 0.0]),
+            (spec("mc-far"), vec![0.0, 1.0]),
+        ]);
+        let checker = SemanticControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: true,
+                snippet: "PASSWORD = \"admin\"".into(),
+                cwe: None,
+                confidence: 0.9,
+            },
+        });
+        let region = CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 1,
+            content: "PASSWORD = \"admin\"\n".into(),
+        };
+        // Query embedding nearest to mc-near; k=1 → only mc-near is judged.
+        let findings = checker
+            .check(&index, &region, &[0.95, 0.05], 1, "repo")
+            .await;
+        assert_eq!(findings.len(), 1);
+        assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
+    }
+
+    #[tokio::test]
+    async fn ungrounded_verdict_is_dropped() {
+        let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
+        let checker = SemanticControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: true,
+                snippet: "not in the region".into(),
+                cwe: None,
+                confidence: 0.9,
+            },
+        });
+        let region = CandidateRegion {
+            file: "f".into(),
+            start_line: 1,
+            content: "real code\n".into(),
+        };
+        let findings = checker.check(&index, &region, &[1.0, 0.0], 1, "repo").await;
+        assert!(findings.is_empty());
+    }
+}
@@ -0,0 +1,258 @@
+//! Surface retrieval for absence-based controls.
+//!
+//! Some CRA controls are violated by an *absence* — no rate limiting on login, no
+//! security logging, no signature check on an update — so there's no offending
+//! pattern for semgrep to match. Instead we deterministically locate the code
+//! *surface* the control governs (a login route, a logging setup, update/download
+//! code) by identifier/route terms, then hand each surface region to the grounded
+//! judge, which decides whether the control is satisfied there. The resulting
+//! finding grounds to the surface snippet, so nothing fabricated survives.
+//!
+//! Retrieval is intentionally cheap and bounded: keyword match + a fixed window,
+//! capped per control to keep the downstream LLM cost predictable.
+
+use std::path::Path;
+
+use compliance_core::control_check::CandidateRegion;
+
+/// An absence-based control and the case-insensitive terms that mark the code
+/// surface it governs.
+pub struct Surface {
+    pub control_id: &'static str,
+    pub terms: &'static [&'static str],
+}
+
+/// The absence-based CRA controls we retrieve surfaces for — the grounded half of
+/// the hybrid coverage (the pattern-expressible half is custom semgrep rules).
+pub const SURFACES: &[Surface] = &[
+    Surface {
+        control_id: "cra-ai-6", // Integritaetspruefung
+        terms: &[
+            "checksum",
+            "sha256",
+            "signature",
+            "hmac",
+            "integrity",
+            "verify",
+        ],
+    },
+    Surface {
+        control_id: "cra-ai-11", // Brute-Force-Schutz
+        terms: &[
+            "login",
+            "signin",
+            "authenticate",
+            "/auth",
+            "password",
+            "ratelimit",
+        ],
+    },
+    Surface {
+        control_id: "cra-ai-12", // Rollenbasierte Autorisierung (RBAC)
+        terms: &[
+            "authorize",
+            "permission",
+            "role",
+            "rbac",
+            "require_role",
+            "has_role",
+        ],
+    },
+    Surface {
+        control_id: "cra-ai-24", // Security-Logging
+        terms: &["login", "authorize", "permission", "role", "admin", "audit"],
+    },
+    Surface {
+        control_id: "cra-ai-27", // Log-Integritaet und -Aufbewahrung
+        terms: &["logging", "logger", "getlogger", "audit_log"],
+    },
+    Surface {
+        control_id: "cra-ai-28", // Sichere Update-Mechanismen
+        terms: &["update", "upgrade", "download", "firmware"],
+    },
+    Surface {
+        control_id: "cra-ai-29", // Update-Authentizitaet
+        terms: &["update", "signature", "verify", "pubkey", "certificate"],
+    },
+    Surface {
+        control_id: "cra-ai-30", // Update-Integritaet
+        terms: &["update", "checksum", "digest", "integrity", "verify"],
+    },
+];
+
+/// Source file extensions worth reading (skip binaries/assets/lockfiles).
+const CODE_EXTS: &[&str] = &[
+    "py", "js", "ts", "tsx", "jsx", "go", "java", "rb", "php", "rs", "cs", "kt",
+];
+/// Directories never worth walking.
+const SKIP_DIRS: &[&str] = &[
+    ".git",
+    "node_modules",
+    "target",
+    "vendor",
+    ".venv",
+    "__pycache__",
+    "dist",
+    "build",
+];
+/// Lines of context on each side of a hit.
+const WINDOW: usize = 6;
+/// Cap on regions per control, to bound downstream LLM calls.
+const MAX_REGIONS_PER_CONTROL: usize = 8;
+/// Skip files larger than this (generated/minified).
+const MAX_FILE_BYTES: u64 = 512 * 1024;
+
+/// Deterministically retrieve up to [`MAX_REGIONS_PER_CONTROL`] code regions in
+/// `repo_path` whose lines mention any of `terms`. Hits close together within a
+/// file are merged into one region; results are capped to bound LLM cost.
+pub fn retrieve(repo_path: &Path, terms: &[&str]) -> Vec<CandidateRegion> {
+    let lowered: Vec<String> = terms.iter().map(|t| t.to_lowercase()).collect();
+    let mut regions = Vec::new();
+    for entry in walk(repo_path) {
+        if regions.len() >= MAX_REGIONS_PER_CONTROL {
+            break;
+        }
+        let path = entry.path();
+        if !has_code_ext(path) {
+            continue;
+        }
+        let Ok(meta) = entry.metadata() else { continue };
+        if !meta.is_file() || meta.len() > MAX_FILE_BYTES {
+            continue;
+        }
+        let Ok(content) = std::fs::read_to_string(path) else {
+            continue;
+        };
+        let rel = path
+            .strip_prefix(repo_path)
+            .unwrap_or(path)
+            .to_string_lossy()
+            .to_string();
+        let lines: Vec<&str> = content.lines().collect();
+        let hits: Vec<usize> = lines
+            .iter()
+            .enumerate()
+            .filter(|(_, line)| {
+                let ll = line.to_lowercase();
+                lowered.iter().any(|t| ll.contains(t.as_str()))
+            })
+            .map(|(i, _)| i)
+            .collect();
+        for center in merge_centers(&hits) {
+            if regions.len() >= MAX_REGIONS_PER_CONTROL {
+                break;
+            }
+            let start = center.saturating_sub(WINDOW);
+            let end = (center + WINDOW + 1).min(lines.len());
+            regions.push(CandidateRegion {
+                file: rel.clone(),
+                start_line: (start as u32) + 1,
+                content: lines[start..end].join("\n"),
+            });
+        }
+    }
+    regions
+}
+
+/// Collapse ascending hit indices that fall within one window into a single
+/// representative center, so overlapping regions aren't judged repeatedly.
+fn merge_centers(hits: &[usize]) -> Vec<usize> {
+    let mut out: Vec<usize> = Vec::new();
+    for &h in hits {
+        match out.last() {
+            Some(&last) if h.saturating_sub(last) <= WINDOW => {}
+            _ => out.push(h),
+        }
+    }
+    out
+}
+
+fn has_code_ext(path: &Path) -> bool {
+    path.extension()
+        .and_then(|e| e.to_str())
+        .is_some_and(|e| CODE_EXTS.contains(&e))
+}
+
+fn walk(root: &Path) -> Vec<walkdir::DirEntry> {
+    walkdir::WalkDir::new(root)
+        .into_iter()
+        .filter_entry(|e| {
+            let name = e.file_name().to_string_lossy();
+            !SKIP_DIRS.contains(&name.as_ref())
+        })
+        .filter_map(|e| e.ok())
+        .collect()
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn write(dir: &Path, rel: &str, body: &str) {
+        let p = dir.join(rel);
+        if let Some(parent) = p.parent() {
+            std::fs::create_dir_all(parent).unwrap();
+        }
+        std::fs::write(p, body).unwrap();
+    }
+
+    fn terms_for(control_id: &str) -> &'static [&'static str] {
+        SURFACES
+            .iter()
+            .find(|s| s.control_id == control_id)
+            .unwrap()
+            .terms
+    }
+
+    #[test]
+    fn surfaces_cover_the_absence_based_controls() {
+        assert_eq!(SURFACES.len(), 8);
+        for id in [
+            "cra-ai-6",
+            "cra-ai-11",
+            "cra-ai-12",
+            "cra-ai-24",
+            "cra-ai-27",
+            "cra-ai-28",
+            "cra-ai-29",
+            "cra-ai-30",
+        ] {
+            assert!(SURFACES.iter().any(|s| s.control_id == id), "{id} missing");
+        }
+    }
+
+    #[test]
+    fn retrieves_matching_region_with_context() {
+        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        write(
+            &dir,
+            "app/auth.py",
+            "import x\n\n\n\n\n\n\ndef login(u, p):\n    return check(u, p)\n",
+        );
+        let regions = retrieve(&dir, terms_for("cra-ai-11"));
+        assert_eq!(regions.len(), 1);
+        assert!(regions[0].content.contains("def login"));
+        assert_eq!(regions[0].file, "app/auth.py");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn skips_non_code_and_vendored() {
+        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        write(&dir, "README.md", "login and password and audit\n"); // not code ext
+        write(&dir, "node_modules/pkg/index.js", "function login() {}\n"); // vendored
+        assert!(retrieve(&dir, terms_for("cra-ai-11")).is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn merges_adjacent_hits_into_one_region() {
+        // Two hits one line apart collapse to a single center/region.
+        assert_eq!(merge_centers(&[10, 11, 30]), vec![10, 30]);
+        assert_eq!(merge_centers(&[]), Vec::<usize>::new());
+        assert_eq!(merge_centers(&[5]), vec![5]);
+    }
+}
@@ -44,10 +44,14 @@ impl<J: ControlJudge> ControlTriage<J> {
    /// Triage one tool finding. `region` is the code around the finding, used as
    /// the grounding evidence for the judge.
    pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
-        let Some(cwe) = finding.cwe.as_deref() else {
-            return TriageOutcome::Unmapped;
-        };
-        let mapped = self.map.controls_for(&finding.scanner, cwe);
+        // Match by CWE (off-the-shelf findings) and/or rule id (our custom
+        // detectors, which carry no LUT-bound CWE). A finding with neither is
+        // simply unmapped.
+        let mapped = self.map.controls_for_finding(
+            &finding.scanner,
+            finding.cwe.as_deref(),
+            finding.rule_id.as_deref(),
+        );
        if mapped.is_empty() {
            return TriageOutcome::Unmapped;
        }
@@ -162,6 +166,52 @@ mod tests {
        assert_eq!(out, TriageOutcome::FalsePositive);
    }

+    #[tokio::test]
+    async fn custom_rule_finding_without_cwe_is_confirmed() {
+        // A custom detector finding carries a rule id but no LUT-bound CWE; it must
+        // still map (by rule id) and confirm.
+        let mut specs = specs();
+        specs.insert(
+            "cra-ai-1".to_string(),
+            ControlCheckSpec {
+                control_id: "cra-ai-1".into(),
+                title: "Secure-by-Default".into(),
+                requirement: "Ship secure defaults".into(),
+                default_cwe: None,
+                severity: Severity::Medium,
+            },
+        );
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: true,
+                    snippet: "app.run(debug=True)".into(),
+                    cwe: None,
+                    confidence: 0.9,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs,
+        );
+        let mut f = Finding::new(
+            "repo".into(),
+            "fp".into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            "flask debug".into(),
+            "desc".into(),
+            Severity::Medium,
+        );
+        f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
+        let region = CandidateRegion {
+            file: "app.py".into(),
+            start_line: 1,
+            content: "app.run(debug=True)\n".into(),
+        };
+        let out = triage.triage(&f, &region).await;
+        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
+    }
+
    #[tokio::test]
    async fn unmapped_cwe_is_left_untagged() {
        let triage = ControlTriage::new(
@@ -0,0 +1,306 @@
+//! Curated demo targets (#187).
+//!
+//! `fixtures/demo-targets/targets.json` is the versioned, reproducible set of
+//! representative targets every scan path can be exercised against: PlcSps
+//! (composite), a plain git SAST repo, a WebApp (git + live URL) and an RTOS
+//! firmware repo. The manifest is consumed by:
+//!
+//! * `scripts/seed-demo-targets.sh` — onboards the targets through the
+//!   public API (optionally triggering a first scan),
+//! * the nightly regression (#188) — the `expect` block is the golden
+//!   baseline per target,
+//! * the lib tests below — which keep the manifest well-formed and assert the
+//!   PLC baselines offline (no Mongo, no network) on every CI run.
+//!
+//! Artifacts come in two flavours: `source_ref` (git URL / live URL / image
+//! ref; may be overridden by the env var named in `source_ref_env`) and
+//! `upload` (a file path relative to the workspace root, pushed through
+//! `POST /targets/{id}/artifacts/upload`; may instead come from the env var
+//! named in `upload_env`). Artifacts flagged `optional` are skipped when their
+//! env var is unset, so the set seeds cleanly on a laptop without OT infra.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use compliance_core::models::onboarding::{ArtifactKind, PlcFormat, TargetType};
+use serde::{Deserialize, Serialize};
+
+/// Manifest path, relative to the workspace root.
+pub const MANIFEST_PATH: &str = "fixtures/demo-targets/targets.json";
+
+/// Why a manifest could not be loaded.
+#[derive(Debug, thiserror::Error)]
+pub enum FixtureError {
+    #[error("read {path}: {source}")]
+    Io {
+        path: PathBuf,
+        #[source]
+        source: std::io::Error,
+    },
+    #[error("parse {path}: {source}")]
+    Parse {
+        path: PathBuf,
+        #[source]
+        source: serde_json::Error,
+    },
+}
+
+/// The whole demo-target set.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DemoTargets {
+    /// Bumped on incompatible manifest changes.
+    pub schema_version: u32,
+    /// Prepended to every target name on seed; the seed script's `--reset`
+    /// deletes exactly the targets carrying this prefix.
+    pub name_prefix: String,
+    pub targets: Vec<DemoTarget>,
+}
+
+/// One curated target.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DemoTarget {
+    /// Stable machine key (used in baseline reports and as the default
+    /// `repo_id`-ish handle in nightly output).
+    pub key: String,
+    /// Human name (without the prefix).
+    pub name: String,
+    pub target_type: TargetType,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub artifacts: Vec<DemoArtifact>,
+    /// Golden baseline for the nightly regression.
+    #[serde(default)]
+    pub expect: Expect,
+}
+
+/// One artifact of a curated target.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DemoArtifact {
+    pub kind: ArtifactKind,
+    /// Literal reference (git URL, live URL, image ref) — the default when
+    /// `source_ref_env` is unset in the environment.
+    #[serde(default)]
+    pub source_ref: Option<String>,
+    /// Env var that overrides `source_ref` at seed time.
+    #[serde(default)]
+    pub source_ref_env: Option<String>,
+    /// Workspace-relative file to upload as this artifact's content.
+    #[serde(default)]
+    pub upload: Option<String>,
+    /// Env var holding an absolute path to upload instead of `upload`.
+    #[serde(default)]
+    pub upload_env: Option<String>,
+    #[serde(default)]
+    pub branch: Option<String>,
+    /// Commit the baseline was recorded against (informational: the agent
+    /// clones `branch`; re-pin when the baseline moves).
+    #[serde(default)]
+    pub pin: Option<String>,
+    #[serde(default)]
+    pub pin_tag: Option<String>,
+    #[serde(default)]
+    pub plc_format: Option<PlcFormat>,
+    /// Skip silently when the env var is unset (needs infra not every
+    /// environment has).
+    #[serde(default)]
+    pub optional: bool,
+}
+
+impl DemoArtifact {
+    /// The upload path, resolved against the workspace root. `None` for
+    /// reference-style artifacts or env-only uploads whose var is unset.
+    pub fn upload_path(&self, root: &Path) -> Option<PathBuf> {
+        if let Some(var) = &self.upload_env {
+            if let Ok(p) = std::env::var(var) {
+                if !p.is_empty() {
+                    return Some(PathBuf::from(p));
+                }
+            }
+        }
+        self.upload.as_ref().map(|p| root.join(p))
+    }
+
+    /// True when this artifact only exists if its env var is provided.
+    pub fn env_only(&self) -> bool {
+        self.upload.is_none() && self.source_ref.is_none()
+    }
+}
+
+/// Golden baseline; every field is optional so a target can assert only what
+/// is deterministic for it.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct Expect {
+    /// Lower bound on total findings after a full scan.
+    #[serde(default)]
+    pub min_findings: Option<usize>,
+    /// Rule ids that must be present among SAST findings.
+    #[serde(default)]
+    pub sast_rule_ids: Vec<String>,
+    /// CWE ids (`CWE-NNN`) that must be present.
+    #[serde(default)]
+    pub cwes: Vec<String>,
+    /// Control refs (e.g. `cra-ai-8`) that must be stamped on some finding.
+    #[serde(default)]
+    pub control_refs: Vec<String>,
+    /// Lower bound on SBOM components.
+    #[serde(default)]
+    pub min_sbom_components: Option<usize>,
+    /// Scans `applicable-scans` must offer for this target.
+    #[serde(default)]
+    pub scans_offered: Vec<String>,
+    #[serde(default)]
+    pub pentest_supported: Option<bool>,
+    /// `key -> value` facts `detect` must surface.
+    #[serde(default)]
+    pub detected_facts: BTreeMap<String, String>,
+}
+
+impl DemoTargets {
+    /// Workspace root, derived from this crate's manifest dir.
+    pub fn workspace_root() -> PathBuf {
+        Path::new(env!("CARGO_MANIFEST_DIR"))
+            .parent()
+            .map(Path::to_path_buf)
+            .unwrap_or_else(|| PathBuf::from("."))
+    }
+
+    /// Load the checked-in manifest.
+    pub fn load() -> Result<Self, FixtureError> {
+        Self::load_from(&Self::workspace_root().join(MANIFEST_PATH))
+    }
+
+    /// Load a manifest from an explicit path.
+    pub fn load_from(path: &Path) -> Result<Self, FixtureError> {
+        let raw = std::fs::read_to_string(path).map_err(|source| FixtureError::Io {
+            path: path.to_path_buf(),
+            source,
+        })?;
+        serde_json::from_str(&raw).map_err(|source| FixtureError::Parse {
+            path: path.to_path_buf(),
+            source,
+        })
+    }
+
+    /// Display name as the seed script creates it.
+    pub fn full_name(&self, t: &DemoTarget) -> String {
+        format!("{}{}", self.name_prefix, t.name)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::pipeline::plc::analyze_tree;
+    use std::collections::{BTreeSet, HashSet};
+
+    fn manifest() -> DemoTargets {
+        DemoTargets::load().expect("demo manifest loads")
+    }
+
+    #[test]
+    fn manifest_is_well_formed() {
+        let m = manifest();
+        let root = DemoTargets::workspace_root();
+        assert_eq!(m.schema_version, 1);
+        assert!(!m.targets.is_empty());
+
+        let mut keys = HashSet::new();
+        for t in &m.targets {
+            assert!(keys.insert(t.key.as_str()), "duplicate key {}", t.key);
+            assert!(!t.artifacts.is_empty(), "{}: needs artifacts", t.key);
+            for a in &t.artifacts {
+                let refs = usize::from(a.source_ref.is_some()) + usize::from(a.upload.is_some());
+                let env_only = a.env_only();
+                assert!(
+                    refs == 1 || (env_only && a.optional),
+                    "{}: artifact {:?} must have exactly one of source_ref/upload, \
+                     or be optional + env-only",
+                    t.key,
+                    a.kind
+                );
+                if let Some(p) = &a.upload {
+                    assert!(root.join(p).is_file(), "{}: upload {p} missing", t.key);
+                }
+                match a.kind {
+                    ArtifactKind::PlcProject => {
+                        assert!(
+                            a.plc_format.is_some(),
+                            "{}: PLC upload needs plc_format",
+                            t.key
+                        );
+                    }
+                    ArtifactKind::GitRepo => {
+                        assert!(a.branch.is_some(), "{}: git artifact needs branch", t.key);
+                        assert!(a.pin.is_some(), "{}: git artifact needs a pin", t.key);
+                    }
+                    _ => {}
+                }
+            }
+        }
+
+        // Coverage the story asks for: PlcSps, firmware, web app, plain git.
+        let types: HashSet<TargetType> = m.targets.iter().map(|t| t.target_type).collect();
+        for want in [
+            TargetType::PlcSps,
+            TargetType::FirmwareRtos,
+            TargetType::WebApp,
+            TargetType::BackendService,
+        ] {
+            assert!(types.contains(&want), "manifest lacks a {want:?} target");
+        }
+    }
+
+    /// Offline golden baseline: the checked-in PLC fixtures must keep producing
+    /// the rule ids the manifest promises. Runs the real control-logic
+    /// analyzer over the fixture files.
+    #[test]
+    fn plc_fixtures_meet_golden_baseline() {
+        let m = manifest();
+        let root = DemoTargets::workspace_root();
+        let all = analyze_tree(&root.join("examples/plc-demo"), "demo");
+
+        for t in m
+            .targets
+            .iter()
+            .filter(|t| t.target_type == TargetType::PlcSps)
+        {
+            let files: Vec<String> = t
+                .artifacts
+                .iter()
+                .filter(|a| a.kind == ArtifactKind::PlcProject)
+                .filter_map(|a| a.upload.as_deref())
+                .filter_map(|p| Path::new(p).file_name())
+                .map(|n| n.to_string_lossy().into_owned())
+                .collect();
+            assert!(!files.is_empty(), "{}: no PLC uploads", t.key);
+
+            let mine: Vec<_> = all
+                .iter()
+                .filter(|f| {
+                    f.file_path
+                        .as_deref()
+                        .is_some_and(|p| files.iter().any(|n| p.ends_with(n.as_str())))
+                })
+                .collect();
+            let rules: BTreeSet<&str> = mine.iter().filter_map(|f| f.rule_id.as_deref()).collect();
+            eprintln!("{} -> {} findings, rules {:?}", t.key, mine.len(), rules);
+
+            if let Some(min) = t.expect.min_findings {
+                assert!(
+                    mine.len() >= min,
+                    "{}: {} findings < min {min}",
+                    t.key,
+                    mine.len()
+                );
+            }
+            for r in &t.expect.sast_rule_ids {
+                assert!(
+                    rules.contains(r.as_str()),
+                    "{}: missing rule {r}; got {rules:?}",
+                    t.key
+                );
+            }
+        }
+    }
+}
@@ -7,6 +7,7 @@ pub mod config;
 pub mod controls;
 pub mod database;
 pub mod error;
+pub mod fixtures;
 pub mod ingest;
 pub mod llm;
 pub mod pentest;
@@ -22,6 +22,11 @@ struct EmbeddingData {
    index: usize,
 }

+/// Max inputs per embedding request. The bge/OpenAI-like backends cap the input
+/// array (bge-multilingual-gemma2 rejects >25 with "batch size overflow"), so we
+/// chunk larger corpora — a whole control catalog (~1.8k) would otherwise 500.
+const EMBED_BATCH_SIZE: usize = 16;
+
 // ── Embedding implementation ───────────────────────────────────

 impl LlmClient {
@@ -29,8 +34,21 @@ impl LlmClient {
        &self.embed_model
    }

-    /// Generate embeddings for a batch of texts
+    /// Generate embeddings for a batch of texts, chunking into backend-sized
+    /// requests and preserving input order across chunks.
    pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
+        if texts.is_empty() {
+            return Ok(Vec::new());
+        }
+        let mut out = Vec::with_capacity(texts.len());
+        for chunk in texts.chunks(EMBED_BATCH_SIZE) {
+            out.extend(self.embed_batch(chunk.to_vec()).await?);
+        }
+        Ok(out)
+    }
+
+    /// Embed one backend-sized batch (≤ [`EMBED_BATCH_SIZE`]) in a single request.
+    async fn embed_batch(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
        let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));

        let request_body = EmbeddingRequest {
@@ -72,3 +90,33 @@ impl LlmClient {
        Ok(data.into_iter().map(|d| d.embedding).collect())
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use secrecy::SecretString;
+
+    fn client() -> LlmClient {
+        LlmClient::new(
+            "http://unused".into(),
+            SecretString::from(String::new()),
+            "m".into(),
+            "e".into(),
+        )
+    }
+
+    #[tokio::test]
+    async fn empty_input_makes_no_request() {
+        // Must short-circuit before any HTTP call (base_url is unroutable).
+        let out = client().embed(Vec::new()).await.unwrap();
+        assert!(out.is_empty());
+    }
+
+    #[test]
+    fn batch_size_is_within_backend_cap() {
+        assert!(
+            EMBED_BATCH_SIZE <= 25,
+            "must stay under the bge 25-input cap"
+        );
+    }
+}
@@ -230,8 +230,57 @@ impl PipelineOrchestrator {
            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
        }

-        // Dedup against existing findings and insert new ones
+        // Stage 5c: semantic control mapping — scale path for the master-controls
+        // corpus (no CWE to LUT on): embed each finding's region, retrieve the
+        // nearest master controls, grounded-judge, and stamp confirmed refs. On by
+        // default (validated live); the corpus embedding is cached so only the
+        // first scan after a catalog change pays it.
+        if self.config.breakpilot.semantic_mapping {
+            self.update_phase(scan_run_id, "semantic_control_mapping")
+                .await;
+            let sem = crate::controls::semantic_stamp_findings(
+                &self.config,
+                self.llm.clone(),
+                &repo_path,
+                &mut all_findings,
+            )
+            .await;
+            if sem > 0 {
+                tracing::info!(
+                    "[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
+                );
+            }
+        }
+
+        // Stage 5d: grounded surface checks — the absence-based controls (no
+        // rate limiting, no security logging, no update-signature check) have no
+        // syntactic pattern to match, so we retrieve the code surface each governs
+        // and let the grounded judge decide whether it holds, producing net-new
+        // findings already tagged + grounded. On by default (validated live); it
+        // covers the 8 absence-based CRA controls.
+        if self.config.breakpilot.grounded_control_checks {
+            self.update_phase(scan_run_id, "grounded_control_checks")
+                .await;
+            let grounded = crate::controls::grounded_surface_findings(
+                &self.config,
+                self.llm.clone(),
+                &repo_path,
+                &repo_id,
+            )
+            .await;
+            if !grounded.is_empty() {
+                tracing::info!(
+                    "[{repo_id}] Grounded surface checks raised {} control findings",
+                    grounded.len()
+                );
+                all_findings.extend(grounded);
+            }
+        }
+
+        // Dedup against existing findings: insert first-seen ones, and refresh the
+        // control mappings on ones we've seen before.
        let mut new_count = 0u32;
+        let mut refreshed_count = 0u32;
        let mut new_findings: Vec<Finding> = Vec::new();
        for mut finding in all_findings {
            finding.scan_run_id = Some(scan_run_id.to_string());
@@ -246,8 +295,25 @@ impl PipelineOrchestrator {
                finding.id = result.inserted_id.as_object_id();
                new_findings.push(finding);
                new_count += 1;
+            } else if !finding.control_refs.is_empty() {
+                // Re-scan refresh: a mapping pass (newly enabled or tuned) computed
+                // control_refs for a finding first seen before mapping ran. Persist
+                // them onto the existing row — the insert path alone never would.
+                self.db
+                    .findings()
+                    .update_one(
+                        doc! { "fingerprint": &finding.fingerprint },
+                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
+                    )
+                    .await?;
+                refreshed_count += 1;
            }
        }
+        if refreshed_count > 0 {
+            tracing::info!(
+                "[{repo_id}] Refreshed control_refs on {refreshed_count} existing findings"
+            );
+        }

        // Remove stale SBOM entries for this repo before reinserting
        if !sbom_entries.is_empty() {
@@ -520,7 +586,21 @@ impl PipelineOrchestrator {
            let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
                continue;
            };
-            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
+            let mut source_findings = crate::pipeline::plc::analyze_tree(&path, target_id);
+            // Control mapping for the PLC path (run_plc_scan is separate from
+            // run_pipeline, which does its own mapping). PLC findings carry
+            // file_path/line/cwe, so the semantic pass reads each region under this
+            // source's `path` and stamps master-control refs. The LUT + grounded
+            // surface passes are code-pattern / CRA-specific and don't apply to
+            // IEC 61131-3 control logic, so only the semantic pass runs here.
+            crate::controls::semantic_stamp_findings(
+                &self.config,
+                self.llm.clone(),
+                &path,
+                &mut source_findings,
+            )
+            .await;
+            all_findings.extend(source_findings);
            // Control-application SBOM: CODESYS libraries + runtime from a
            // `.projectarchive` (uploaded, or committed in the working tree).
            let archive = a
@@ -545,6 +625,7 @@ impl PipelineOrchestrator {
        );

        let mut new_count = 0u32;
+        let mut refreshed_count = 0u32;
        for mut finding in all_findings {
            finding.scan_run_id = Some(scan_run_id.to_string());
            if self
@@ -556,8 +637,27 @@ impl PipelineOrchestrator {
            {
                self.db.findings().insert_one(&finding).await?;
                new_count += 1;
+            } else if !finding.control_refs.is_empty() {
+                // Re-scan refresh: mirror run_pipeline — persist newly-computed
+                // control_refs onto a PLC finding first seen before the semantic
+                // pass ran. The insert path alone never would, so without this a
+                // PLC re-scan can only pick up mappings via a delete + re-add.
+                self.db
+                    .findings()
+                    .update_one(
+                        doc! { "fingerprint": &finding.fingerprint },
+                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
+                    )
+                    .await?;
+                refreshed_count += 1;
            }
        }
+        if refreshed_count > 0 {
+            tracing::info!(
+                target_id,
+                "Refreshed control_refs on {refreshed_count} existing PLC findings"
+            );
+        }

        if !all_sbom.is_empty() {
            if let Err(e) = self
@@ -1,4 +1,4 @@
-use std::path::Path;
+use std::path::{Path, PathBuf};

 use compliance_core::models::{Finding, ScanType, Severity};
 use compliance_core::traits::{ScanOutput, Scanner};
@@ -6,6 +6,30 @@ use compliance_core::CoreError;

 use crate::pipeline::dedup;

+/// Custom CRA-control detectors bundled into the binary and staged to a temp file
+/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
+/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
+/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
+/// keyed back to its control by the `control-map` LUT.
+const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
+
+/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
+/// rename). Returns `None` on failure — the scan then runs with auto rules only.
+async fn stage_cra_rules() -> Option<PathBuf> {
+    let dir = std::env::temp_dir();
+    let path = dir.join("compliance-cra-semgrep.yaml");
+    let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
+    if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
+        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
+        return None;
+    }
+    if let Err(e) = tokio::fs::rename(&tmp, &path).await {
+        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
+        return None;
+    }
+    Some(path)
+}
+
 pub struct SemgrepScanner;

 impl Scanner for SemgrepScanner {
@@ -19,30 +43,26 @@ impl Scanner for SemgrepScanner {

    #[tracing::instrument(skip_all)]
    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let output = tokio::time::timeout(
-            std::time::Duration::from_secs(600),
-            tokio::process::Command::new("semgrep")
-                .args([
-                    "--config=auto",
-                    "--json",
-                    "--quiet",
-                    "--max-memory",
-                    "500",
-                    "--jobs",
-                    "1",
-                ])
-                .arg(repo_path)
-                .output(),
-        )
-        .await
-        .map_err(|_| CoreError::Scanner {
-            scanner: "semgrep".to_string(),
-            source: "timed out after 10 minutes".into(),
-        })?
-        .map_err(|e| CoreError::Scanner {
-            scanner: "semgrep".to_string(),
-            source: Box::new(e),
-        })?;
+        let cra_rules = stage_cra_rules().await;
+        let mut command = tokio::process::Command::new("semgrep");
+        command.arg("--config=auto");
+        if let Some(path) = &cra_rules {
+            command.arg(format!("--config={}", path.display()));
+        }
+        command
+            .args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
+            .arg(repo_path);
+
+        let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
+            .await
+            .map_err(|_| CoreError::Scanner {
+                scanner: "semgrep".to_string(),
+                source: "timed out after 10 minutes".into(),
+            })?
+            .map_err(|e| CoreError::Scanner {
+                scanner: "semgrep".to_string(),
+                source: Box::new(e),
+            })?;

        if !output.status.success() && output.stdout.is_empty() {
            let stderr = String::from_utf8_lossy(&output.stderr);
@@ -0,0 +1,125 @@
+//! C5 example 2 — exploratory (not a committed regression test). Four topically
+//! distinct findings, to see whether tuned semantic retrieval maps each to the
+//! right master-control family. Run:
+//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
+//!   cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use compliance_core::models::finding::{Finding, Severity};
+use compliance_core::models::scan::ScanType;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
+}
+
+fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
+    let mut f = Finding::new(
+        "repo-c5b".into(),
+        format!("{file}:{line}"),
+        "semgrep".into(),
+        ScanType::Sast,
+        title.into(),
+        desc.into(),
+        Severity::High,
+    );
+    f.file_path = Some(file.into());
+    f.line_number = Some(line);
+    f
+}
+
+fn write(repo: &std::path::Path, rel: &str, body: &str) {
+    let p = repo.join(rel);
+    if let Some(parent) = p.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    std::fs::write(p, body).unwrap();
+}
+
+#[tokio::test]
+#[ignore = "live: api-dev + LiteLLM"]
+async fn c5b_varied_findings() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+    let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: std::env::temp_dir()
+            .join("c5-oscal-snap")
+            .to_string_lossy()
+            .into_owned(),
+        semantic_mapping: true,
+        grounded_control_checks: false,
+    };
+
+    let repo = std::env::temp_dir().join("c5b-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    write(
+        &repo,
+        "app/db.py",
+        "import sqlite3\n\ndef get_user(username):\n    q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n    return conn.execute(q)\n",
+    );
+    write(
+        &repo,
+        "app/config.py",
+        "# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
+    );
+    write(
+        &repo,
+        "app/net.py",
+        "import requests\n\ndef fetch(url):\n    return requests.get(url, verify=False, timeout=5)\n",
+    );
+    write(
+        &repo,
+        "app/ser.py",
+        "import pickle\n\ndef load_state(blob):\n    return pickle.loads(blob)\n",
+    );
+
+    let mut findings = vec![
+        mk(
+            "app/db.py",
+            4,
+            "SQL injection via string-concatenated query",
+            "User input is concatenated directly into a SQL statement, allowing SQL injection.",
+        ),
+        mk(
+            "app/config.py",
+            2,
+            "Hardcoded API credential in source",
+            "A live API key is hardcoded in source code instead of a secret store.",
+        ),
+        mk(
+            "app/net.py",
+            4,
+            "TLS certificate verification disabled",
+            "requests is called with verify=False, disabling TLS certificate validation.",
+        ),
+        mk(
+            "app/ser.py",
+            3,
+            "Insecure deserialization with pickle.loads",
+            "Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
+        ),
+    ];
+
+    let tagged =
+        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
+            .await;
+    println!("\n=== C5 example 2: varied findings ===");
+    for f in &findings {
+        println!("  {:52} -> {:?}", f.title, f.control_refs);
+    }
+    println!("tagged: {tagged}/4");
+    let _ = std::fs::remove_dir_all(&repo);
+    assert!(tagged >= 1);
+}
@@ -0,0 +1,145 @@
+//! C5 live verification — the semantic master-controls path end to end against the
+//! deployed api-dev catalog. Ignored (hits api-dev + LiteLLM). Run explicitly:
+//!
+//!   set -a; . ./.env; set +a
+//!   BREAKPILOT_BASE_URL=https://api-dev.breakpilot.ai \
+//!     cargo test -p compliance-agent --test c5_semantic_live -- --ignored --nocapture
+//!
+//! Pulls the live master-controls catalog, embeds the corpus (chunked), then for a
+//! couple of real vulnerable findings retrieves the nearest master controls and
+//! grounded-judges them, stamping master-control refs.
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use compliance_core::models::finding::{Finding, Severity};
+use compliance_core::models::scan::ScanType;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set for the live C5 test"))
+}
+
+fn mk_finding(file: &str, line: u32, title: &str) -> Finding {
+    let mut f = Finding::new(
+        "repo-c5".into(),
+        format!("{file}:{line}"),
+        "semgrep".into(),
+        ScanType::Sast,
+        title.into(),
+        title.into(),
+        Severity::High,
+    );
+    f.file_path = Some(file.into());
+    f.line_number = Some(line);
+    f
+}
+
+#[tokio::test]
+#[ignore = "live: requires deployed api-dev master-controls (fetch+parse only, no LLM)"]
+async fn c5_ingest_master_controls_catalog() {
+    use compliance_agent::controls::OscalControlsProvider;
+
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        env("BREAKPILOT_BASE_URL"),
+        None,
+        std::env::temp_dir().join("c5-ingest-snap"),
+    );
+    let doc = provider
+        .load_master_controls()
+        .await
+        .expect("pull + parse master-controls catalog");
+    let controls = doc.to_controls();
+    println!(
+        "\n=== C5 ingest: {} master controls parsed ===",
+        controls.len()
+    );
+    for c in controls.iter().take(4) {
+        let text: String = c.text.chars().take(90).collect();
+        println!("  {} | {} | {}", c.id, c.title, text);
+    }
+    assert!(
+        !controls.is_empty(),
+        "expected a non-empty master-control corpus"
+    );
+}
+
+#[tokio::test]
+#[ignore = "live: requires deployed api-dev master-controls + LiteLLM"]
+async fn c5_semantic_stamps_master_control_refs() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+
+    let mut config = common::dev_config("mongodb://unused".into(), "c5".into());
+    let snapshot = std::env::temp_dir().join("c5-oscal-snap");
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: snapshot.to_string_lossy().into_owned(),
+        semantic_mapping: true,
+        grounded_control_checks: false,
+    };
+
+    // Fixture repo with recognizable code-checkable surfaces.
+    let repo = std::env::temp_dir().join("c5-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    std::fs::create_dir_all(repo.join("app")).expect("mkdir");
+    std::fs::write(
+        repo.join("app/auth.py"),
+        concat!(
+            "import hashlib\n",
+            "\n",
+            "def store_password(user, password):\n",
+            "    # weak, unsalted password hashing\n",
+            "    digest = hashlib.md5(password.encode()).hexdigest()\n",
+            "    db.save(user, digest)\n",
+            "\n",
+            "@app.route('/login', methods=['POST'])\n",
+            "def login():\n",
+            "    u = request.form['username']\n",
+            "    p = request.form['password']\n",
+            "    return 'ok' if check(u, p) else ('bad', 401)\n",
+        ),
+    )
+    .expect("write fixture");
+
+    let mut findings = vec![
+        mk_finding("app/auth.py", 5, "Weak password hash (md5, unsalted)"),
+        mk_finding(
+            "app/auth.py",
+            9,
+            "Login endpoint without brute-force protection",
+        ),
+    ];
+
+    let tagged =
+        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
+            .await;
+
+    println!("\n=== C5 semantic master-controls stamping ===");
+    for f in &findings {
+        println!(
+            "  {:50} {}:{:?} -> {:?}",
+            f.title,
+            f.file_path.as_deref().unwrap_or(""),
+            f.line_number,
+            f.control_refs
+        );
+    }
+    println!("findings that gained >=1 master-control ref: {tagged}");
+    let _ = std::fs::remove_dir_all(&repo);
+
+    // Live corpus — assert only that the path runs and stamps at least one ref.
+    assert!(
+        tagged >= 1,
+        "expected at least one finding to gain a master-control ref"
+    );
+}
@@ -0,0 +1,92 @@
+//! Live validation of the grounded surface path (Stage 5d) for absence-based CRA
+//! controls. Ignored (hits api-dev CRA catalog + LiteLLM). Run:
+//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
+//!   cargo test -p compliance-agent --test grounded_surface_live -- --ignored --nocapture
+//!
+//! Builds a fixture whose code surfaces trigger several absence-based controls
+//! (no rate limiting, no security logging, unverified update) and checks that the
+//! grounded checker produces control-tagged findings.
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
+}
+
+fn write(repo: &std::path::Path, rel: &str, body: &str) {
+    let p = repo.join(rel);
+    if let Some(parent) = p.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    std::fs::write(p, body).unwrap();
+}
+
+#[tokio::test]
+#[ignore = "live: api-dev CRA catalog + LiteLLM"]
+async fn grounded_surface_flags_absence_controls() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+    let mut config = common::dev_config("mongodb://unused".into(), "grounded".into());
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: std::env::temp_dir()
+            .join("grounded-snap")
+            .to_string_lossy()
+            .into_owned(),
+        semantic_mapping: false,
+        grounded_control_checks: true,
+    };
+
+    let repo = std::env::temp_dir().join("grounded-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    // cra-ai-11: login endpoint with no rate limiting / lockout
+    write(
+        &repo,
+        "app/auth.py",
+        "@app.route('/login', methods=['POST'])\ndef login():\n    u = request.form['username']\n    p = request.form['password']\n    if authenticate(u, p):\n        return redirect('/')\n    return 'bad credentials', 401\n",
+    );
+    // cra-ai-24: privileged admin action with no security/audit logging
+    write(
+        &repo,
+        "app/admin.py",
+        "@app.route('/admin/delete_user', methods=['POST'])\ndef admin_delete_user():\n    uid = request.form['uid']\n    db.users.delete_one({'_id': uid})\n    return 'ok', 200\n",
+    );
+    // cra-ai-28/29/30: firmware update applied without signature / checksum verification
+    write(
+        &repo,
+        "app/updater.py",
+        "def apply_firmware_update(url):\n    blob = download(url)\n    install_firmware(blob)\n    reboot_device()\n",
+    );
+
+    let findings =
+        compliance_agent::controls::grounded_surface_findings(&config, llm, &repo, "repo-grounded")
+            .await;
+
+    println!("\n=== Grounded surface findings ({}) ===", findings.len());
+    for f in &findings {
+        println!(
+            "  {:24} {}:{:?}  {}",
+            f.control_refs.join(","),
+            f.file_path.as_deref().unwrap_or(""),
+            f.line_number,
+            f.title
+        );
+    }
+    let _ = std::fs::remove_dir_all(&repo);
+
+    assert!(
+        !findings.is_empty(),
+        "expected the grounded pass to flag at least one absence-based control"
+    );
+}
@@ -75,6 +75,17 @@ pub struct BreakpilotConfig {
    pub token: Option<SecretString>,
    /// Directory for catalog snapshots.
    pub snapshot_dir: String,
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// retrieve nearest controls, grounded-judge). On by default — validated live
+    /// against the deployed master-controls catalog. Still a no-op unless
+    /// `base_url` is set and the catalog is reachable.
+    pub semantic_mapping: bool,
+    /// Enable the **grounded surface** pass for absence-based controls (retrieve
+    /// the code surface a control governs, judge whether it holds). On by default
+    /// — validated live; it covers the 8 absence-based CRA controls that no
+    /// syntactic rule can.
+    pub grounded_control_checks: bool,
 }

 impl Default for BreakpilotConfig {
@@ -83,6 +94,8 @@ impl Default for BreakpilotConfig {
            base_url: None,
            token: None,
            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
+            semantic_mapping: true,
+            grounded_control_checks: true,
        }
    }
 }
@@ -14,13 +14,14 @@
 //! The LLM supplies cross-language / cross-stack pattern recognition; this module
 //! supplies the determinism.

+use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};

 use crate::models::finding::{Finding, Severity};
 use crate::models::scan::ScanType;

 /// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ControlCheckSpec {
    /// Stable control id, e.g. `"cra-ai-8"`.
    pub control_id: String,
@@ -42,7 +42,19 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {

        let pool_for_factory = pool.clone();
        let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
+            move || {
+                // The factory runs in the request task, still inside the bearer
+                // middleware's `TENANT_ID` scope, and BEFORE rmcp spawns the
+                // session task (which would lose the task_local). So bind the
+                // tenant into the session's server instance here, once.
+                let tenant_id = auth::current_tenant_id().ok_or_else(|| {
+                    std::io::Error::other("no tenant context when creating MCP session")
+                })?;
+                Ok(ComplianceMcpServer::new(
+                    pool_for_factory.clone(),
+                    tenant_id,
+                ))
+            },
            Arc::new(LocalSessionManager::default()),
            StreamableHttpServerConfig::default(),
        );
@@ -69,16 +81,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
            tenant_id = %synth_tenant,
            "stdio transport — using synthetic tenant id; DO NOT use in production"
        );
-        let server = ComplianceMcpServer::new(pool);
+        let server = ComplianceMcpServer::new(pool, synth_tenant);
        let transport = rmcp::transport::stdio();
        use rmcp::ServiceExt;
-        auth::TENANT_ID
-            .scope(synth_tenant, async {
-                let handle = server.serve(transport).await?;
-                handle.waiting().await?;
-                Ok::<_, Box<dyn std::error::Error>>(())
-            })
-            .await?;
+        let handle = server.serve(transport).await?;
+        handle.waiting().await?;
    }

    Ok(())
@@ -2,37 +2,33 @@ use rmcp::{
    handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
 };

-use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
 use crate::tools::{dast, findings, oscal, pentest, sbom};

 pub struct ComplianceMcpServer {
    pool: DatabasePool,
+    /// Tenant this session serves. Bound once at session creation (the HTTP
+    /// factory reads the bearer-set tenant while still in the request scope;
+    /// stdio passes a synthetic id) — NOT a per-request `task_local`, which is
+    /// lost across the `tokio::spawn` that runs the Streamable-HTTP session.
+    tenant_id: String,
    #[allow(dead_code)]
    tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
 }

 impl ComplianceMcpServer {
-    /// Resolve the per-tenant `Database` from the bearer-set
-    /// `task_local`. Every tool handler calls this; missing context
-    /// surfaces as `internal_error` because it means the auth
-    /// middleware was misconfigured (handler ran without scope).
+    /// The per-tenant `Database` for this session.
    fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
-        let tenant_id = current_tenant_id().ok_or_else(|| {
-            rmcp::ErrorData::internal_error(
-                "no tenant context — bearer middleware not in chain".to_string(),
-                None,
-            )
-        })?;
-        Ok(self.pool.for_tenant_id(&tenant_id))
+        Ok(self.pool.for_tenant_id(&self.tenant_id))
    }
 }

 #[tool_router]
 impl ComplianceMcpServer {
-    pub fn new(pool: DatabasePool) -> Self {
+    pub fn new(pool: DatabasePool, tenant_id: String) -> Self {
        Self {
            pool,
+            tenant_id,
            tool_router: Self::tool_router(),
        }
    }
@@ -5,51 +5,79 @@
    {
      "control": "cra-ai-1",
      "title": "Secure-by-Default-Konfiguration",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-1-flask-debug-enabled",
+            "cra-ai-1-django-debug-true",
+            "cra-ai-1-tls-verify-disabled",
+            "cra-ai-1-cors-wildcard"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
    },
    {
      "control": "cra-ai-2",
      "title": "Minimale Angriffsflaeche",
      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "note": "design property (minimal attack surface) — not derivable from local code patterns; architecture/threat-model review",
+      "status": "not_code_checkable"
    },
    {
      "control": "cra-ai-3",
      "title": "Sichere Systemarchitektur",
      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "note": "design property (secure system architecture) — architecture review, not statically code-checkable",
+      "status": "not_code_checkable"
    },
    {
      "control": "cra-ai-4",
      "title": "Least-Privilege-Prinzip",
      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "note": "design property (least-privilege) — deployment/IAM & architecture review, not a local code pattern",
+      "status": "not_code_checkable"
    },
    {
      "control": "cra-ai-5",
      "title": "Manipulationsschutz",
      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "note": "design property (tamper protection) — hardware/runtime & operational control, not statically code-checkable",
+      "status": "not_code_checkable"
    },
    {
      "control": "cra-ai-6",
      "title": "Integritaetspruefung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-7",
      "title": "Starke Authentifizierung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-7-weak-password-hash"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
    },
    {
      "control": "cra-ai-8",
@@ -100,23 +128,47 @@
    {
      "control": "cra-ai-10",
      "title": "Sitzungsmanagement",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-10-session-cookie-insecure",
+            "cra-ai-10-express-cookie-insecure"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
    },
    {
      "control": "cra-ai-11",
      "title": "Brute-Force-Schutz",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-12",
      "title": "Rollenbasierte Autorisierung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-13",
@@ -138,9 +190,19 @@
    {
      "control": "cra-ai-14",
      "title": "Speicher-Schutz (Data at Rest)",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-14-python-weak-cipher",
+            "cra-ai-14-node-weak-cipher"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
    },
    {
      "control": "cra-ai-15",
@@ -266,9 +328,16 @@
    {
      "control": "cra-ai-24",
      "title": "Security-Logging",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-25",
@@ -287,30 +356,58 @@
    {
      "control": "cra-ai-27",
      "title": "Log-Integritaet und -Aufbewahrung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-28",
      "title": "Sichere Update-Mechanismen",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-29",
      "title": "Update-Authentizitaet",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-30",
      "title": "Update-Integritaet",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
    },
    {
      "control": "cra-ai-31",
@@ -66,6 +66,14 @@ pub struct ControlMap {

 const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");

+/// Whether an authored rule id `bound` matches a scanner's emitted rule id
+/// `actual`. semgrep prefixes local-rule check_ids with a path
+/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
+/// id segment rather than requiring exact equality.
+fn rule_id_matches(bound: &str, actual: &str) -> bool {
+    actual == bound || actual.ends_with(&format!(".{bound}"))
+}
+
 impl ControlMap {
    /// Load the built-in CRA control map (the embedded, authored LUT).
    pub fn cra() -> Result<Self, MapError> {
@@ -80,12 +88,28 @@ impl ControlMap {
    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
    /// raw tool finding back to the control(s) it's evidence for.
    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
+        self.controls_for_finding(tool, Some(cwe), None)
+    }
+
+    /// Controls a tool finding is evidence for, matched by CWE and/or the specific
+    /// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
+    /// bind by rule id (precise — a broad CWE would over-attribute and then the
+    /// grounded judge could drop a genuine finding as a control false positive).
+    pub fn controls_for_finding(
+        &self,
+        tool: &str,
+        cwe: Option<&str>,
+        rule_id: Option<&str>,
+    ) -> Vec<&ControlEntry> {
        self.controls
            .iter()
            .filter(|c| {
-                c.scans
-                    .iter()
-                    .any(|s| s.tool == tool && s.cwe.iter().any(|w| w == cwe))
+                c.scans.iter().any(|s| {
+                    s.tool == tool
+                        && (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
+                            || rule_id
+                                .is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
+                })
            })
            .collect()
    }
@@ -154,10 +178,77 @@ mod tests {
    }

    #[test]
-    fn every_bucket_is_represented() {
+    fn covered_and_not_checkable_are_populated() {
        let s = ControlMap::cra().unwrap().summary();
        assert!(s.covered > 0);
-        assert!(s.needs_tooling > 0);
        assert!(s.not_code_checkable > 0);
+        // needs_tooling is now empty: every code-checkable control is either
+        // tool-covered or covered by the grounded surface pass.
+        assert_eq!(s.needs_tooling, 0);
+    }
+
+    #[test]
+    fn rule_id_matching_handles_semgrep_path_prefix() {
+        let bound = "cra-ai-1-flask-debug-enabled";
+        assert!(rule_id_matches(bound, bound)); // exact
+        assert!(rule_id_matches(
+            bound,
+            "tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
+        )); // semgrep path prefix
+        assert!(!rule_id_matches(
+            bound,
+            "cra-ai-1-flask-debug-enabled-extra"
+        )); // not a suffix segment
+        assert!(!rule_id_matches(
+            bound,
+            "python.lang.security.exec-detected"
+        )); // unrelated
+    }
+
+    #[test]
+    fn custom_rule_finding_attaches_to_control_by_rule_id() {
+        let map = ControlMap::cra().unwrap();
+        // cra-ai-1 is now tool-covered by custom rules.
+        assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
+        // A prefixed check_id still maps back to cra-ai-1 by rule id.
+        let hits =
+            map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
+        assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
+    }
+
+    #[test]
+    fn coverage_after_grounded_promotion() {
+        let s = ControlMap::cra().unwrap().summary();
+        // 9 off-the-shelf + 4 custom-semgrep + 8 grounded surface controls (promoted
+        // after the grounded path was validated live).
+        assert_eq!(s.covered, 21);
+        // Nothing left as needs_tooling — every code-checkable control is covered.
+        assert_eq!(s.needs_tooling, 0);
+        // The 4 pure-architectural controls remain not code-checkable.
+        assert_eq!(s.not_code_checkable, 19);
+        assert_eq!(s.total(), 40);
+    }
+
+    #[test]
+    fn architectural_controls_are_not_code_checkable() {
+        let map = ControlMap::cra().unwrap();
+        for id in ["cra-ai-2", "cra-ai-3", "cra-ai-4", "cra-ai-5"] {
+            let c = map.coverage(id).unwrap();
+            assert_eq!(c.status, Coverage::NotCodeCheckable, "{id}");
+            assert!(c.scans.is_empty(), "{id} should carry no scan bindings");
+        }
+    }
+
+    #[test]
+    fn custom_rule_controls_do_not_bind_by_broad_cwe() {
+        let map = ControlMap::cra().unwrap();
+        // cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
+        // only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
+        assert!(map.controls_for("semgrep", "CWE-489").is_empty());
+        // The CWE path for off-the-shelf findings is unchanged.
+        assert!(map
+            .controls_for("semgrep", "CWE-798")
+            .iter()
+            .any(|c| c.control == "cra-ai-8"));
    }
 }
@@ -21,6 +21,7 @@ export default withMermaid(defineConfig({
          { text: 'Adding Repositories', link: '/guide/repositories' },
          { text: 'Running Scans', link: '/guide/scanning' },
          { text: 'PLC / SPS (CODESYS)', link: '/guide/plc' },
+          { text: 'Demo Targets', link: '/guide/demo-targets' },
          { text: 'Understanding Findings', link: '/guide/findings' },
          { text: 'SBOM & Licenses', link: '/guide/sbom' },
          { text: 'Issues & Tracking', link: '/guide/issues' },
@@ -36,6 +37,7 @@ export default withMermaid(defineConfig({
          { text: 'Pentest Architecture', link: '/features/pentest-architecture' },
          { text: 'AI Chat', link: '/features/ai-chat' },
          { text: 'Code Knowledge Graph', link: '/features/graph' },
+          { text: 'Compliance Control Mapping', link: '/features/control-mapping' },
          { text: 'MCP Integration', link: '/features/mcp-server' },
        ],
      },
@@ -0,0 +1,136 @@
+# Compliance Control Mapping
+
+Control mapping connects the scanner's raw output — deterministic tool findings and the code itself — to the **compliance controls** each piece of evidence supports. A hardcoded credential stops being just "CWE-798 from semgrep" and becomes evidence for *"cra-ai-8: no default passwords"* and, at scale, master control *`mc-31761` hardcoded_secrets_detection*. Findings carry those references (`control_refs`) into the dashboard and out over the MCP server as OSCAL, so the compliance report is built from real, grounded findings rather than a questionnaire.
+
+## The core principle: tools detect, the LLM judges
+
+The design has one rule, borrowed from the ZeroFalse / IRIS line of research: **deterministic tools are the detectors; the LLM is only ever a grounded false-positive filter, never the thing that finds the issue.**
+
+- A tool (semgrep, gitleaks, syft/osv, the PLC linter; the DAST agents today, with **Nuclei and ZAP planned** as deterministic web/OT detectors underneath them — see [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code)) detects.
+- An **authored, human-reviewed lookup table** (`control-map`) maps that detection to the control(s) it's evidence for.
+- The LLM enters last, to *confirm or refute* the mapping against the actual code — and every surviving verdict is anchored to a verbatim snippet by the grounding gate.
+
+This keeps hallucination out of detection. The LLM supplies cross-language, cross-stack pattern *recognition*; the surrounding machinery supplies determinism.
+
+## Coverage model
+
+Every control lands in one of three buckets, recorded in the `control-map` LUT (`control-map/data/cra_control_map.json`) and never decided by an LLM:
+
+| Bucket | Meaning |
+| --- | --- |
+| `covered` | An existing tool's scan surfaces findings for this control |
+| `needs_tooling` | Code-checkable, but no off-the-shelf tool digs it out — we author a detector or use the grounded surface check |
+| `not_code_checkable` | A design/process property — out of static-scan scope |
+
+For the **CRA** framework (40 controls) the split is **13 covered · 8 needs_tooling · 19 not_code_checkable**. The 16 originally-uncovered controls were resolved as a hybrid:
+
+- **4 custom semgrep detectors** (`cra-ai-1`, `7`, `10`, `14`) — secure-by-default, weak password hashing, insecure session cookies, weak data-at-rest ciphers. Shipped in the binary and matched back to controls **by rule id** so a broad CWE can't over-attribute.
+- **8 grounded surface checks** (`cra-ai-6`, `11`, `12`, `24`, `27`, `28`, `29`, `30`) — the absence-based controls (no rate limiting, no security logging, no update-signature check…) that have no syntactic pattern.
+- **4 marked not_code_checkable** (`cra-ai-2`, `3`, `4`, `5`) — minimal attack surface, secure architecture, least privilege, tamper protection.
+
+At scale, the **master-controls** corpus (breakpilot's deduped clusters, exported as OSCAL) currently provides **~2,882 code-checkable controls** (2,143 `network` + 739 `source_code`), matched semantically.
+
+## The three mapping paths
+
+```mermaid
+flowchart TD
+    T[Deterministic tools\nsemgrep · gitleaks · syft/osv · DAST · PLC linter] --> F[Findings]
+    F --> B["Stage 5b — LUT triage\ncontrols_for(tool, cwe / rule_id)"]
+    F --> C["Stage 5c — Semantic\nembed region+intent → top-K master controls"]
+    R[Repo source] --> D["Stage 5d — Grounded surface\nretrieve surface for absence-based controls"]
+    B --> J{{Grounded LLM judge\ntemp 0 · verbatim snippet}}
+    C --> J
+    D --> J
+    J -->|snippet grounds in region| S[Stamp control_refs]
+    J -->|refuted / ungrounded| X[Dropped]
+```
+
+All three paths converge on the same **grounded judge** and the same **grounding gate**. They differ only in how candidate (finding/region, control) pairs are produced.
+
+### Stage 5b — deterministic LUT triage
+
+The default path. A tool finding is matched to controls via `control_map.controls_for_finding(tool, cwe, rule_id)`; the judge then confirms each mapped control against the code region. Outcomes: `Confirmed([ids])` (stamp them), `FalsePositive` (drop the finding), or `Unmapped` (keep it untagged). Runs whenever `BREAKPILOT_BASE_URL` is set.
+
+### Stage 5c — semantic retrieval (master-controls scale)
+
+Master controls carry no CWE, so they can't be LUT-mapped. Instead we map by *similarity*: embed every control's requirement text once (cached), then for each finding retrieve the top-K nearest controls and hand them to the judge. Gated behind `BREAKPILOT_SEMANTIC_MAPPING` (default off). See [Semantic retrieval](#semantic-retrieval-in-detail).
+
+### Stage 5d — grounded surface checks (absence-based controls)
+
+Some controls are violated by an *absence* — no rate limiting on login, no security logging, no signature check on an update. There's no pattern for semgrep to match, so we deterministically retrieve the code **surface** the control governs (a login route, a logging setup, update/download code) by identifier/route terms, and let the judge decide whether the control holds there. Produces net-new, already-grounded findings. Gated behind `BREAKPILOT_GROUNDED_CHECKS` (default off).
+
+## The grounding gate
+
+No matter the path, a verdict becomes a finding only if it survives `compliance_core::control_check::ground`:
+
+1. The judge runs at **temperature 0** with a closed prompt and must quote the offending code **verbatim** into `snippet`.
+2. That snippet must appear **literally** in the retrieved region — otherwise the verdict is dropped.
+3. The finding's line is **recomputed from the match**; the model's own line number is never trusted.
+4. Verdicts are cached by content hash, so re-scans reproduce.
+
+The model is allowed to be smart; it is never trusted.
+
+## Semantic retrieval in detail
+
+1. **Embed the corpus once.** Each control's requirement text is embedded with `bge-multilingual-gemma2` (3584-dim — multilingual matters, the master controls are in German while code is English). The embedding backend caps input arrays at 25 per request, so `embed()` chunks at 16; the whole `ControlIndex` is persisted to `snapshot_dir` keyed by a **corpus hash**, so only the first scan after a catalog change pays the embedding cost.
+2. **Build the query from the finding's intent, not just the code.** The retrieval query is `finding.title + finding.description + region`, not the raw region. This is the single most important tuning: two findings in one file share overlapping windows and, on the code alone, embed alike and collapse onto the same controls. The finding's own words ("brute-force protection" vs "weak hash") carry the discriminating signal. The raw region still goes to the judge for grounding.
+3. **Retrieve → judge → ground.** Top-K nearest by cosine, each judged against the region, each grounded.
+
+## Worked examples
+
+Both examples are from the live end-to-end verification (`c5_semantic_live.rs`) against the real ~2,882-control corpus.
+
+### Example 1 — a small auth file (the tuning story)
+
+Two findings in one `auth.py`: a weak `hashlib.md5(password)` hash and a login endpoint with no brute-force protection.
+
+| Finding | Region-only retrieval | Intent-enriched retrieval |
+| --- | --- | --- |
+| Weak md5 hash | 19874, 20683, 23149, 29985 | **`mc-23149`** (eliminate weak unsalted hashes) at rank 1, + `mc-21634` salted hashing |
+| Login w/o brute-force protection | *identical 4, reordered* | newly surfaces **`mc-19984`** brute_force_protection + **`mc-23186`** account_lockout |
+
+Region-only retrieval gave both findings the *same* four password-hashing controls — the brute-force finding never found its real controls because its window is saturated with `password` tokens. Enriching the query with the finding's intent fixed it: the brute-force finding now pulls the correct rate-limiting / lockout controls out of the 2,882.
+
+### Example 2 — four topically distinct vulnerabilities
+
+| Finding | Top matched controls | Family |
+| --- | --- | --- |
+| SQL injection (string-concat query) | `sql_injection_prevention`, `sql_injection`, `parameterized_queries`, input_sanitization | input-validation ✓ |
+| Hardcoded API credential | `hardcoded_secrets_detection`, credential_scanning, secrets_detection | credentials ✓ |
+| TLS verification disabled (`verify=False`) | `https_enforcement`, `configuration_verification`, transport config | transport-encryption ✓ |
+| Insecure deserialization (`pickle.loads`) | `deserialization`, `deserialization_testing`, `deserialization_security` | deserialization ✓ |
+
+Every finding maps to its exact control family, with the most specific control often at the top, and the four sets are distinct.
+
+## Known limitations
+
+- **Absence findings are weak for semantic retrieval.** Similarity matches what code *is about*, not what it *lacks*; a "missing rate limiting" finding embeds like login code. This is exactly why the grounded surface path (Stage 5d) exists — it decides presence/absence at a retrieved surface rather than by embedding distance.
+- **Generic catch-all controls co-occur.** `mc-20890 secure_development_security_code_review` appears in the top-K for many code-security findings because it is semantically near almost all of them. It's harmless (the judge grounds it, and it never crowds out the specific controls — the SQLi example didn't get it) but is a candidate for future down-weighting.
+- **Corpus classification noise.** The master-controls `verification_method` classification is imperfect — e.g. a documentation control (`eu_declaration_accuracy`) is currently tagged `source_code`. That's a corpus-side data-quality issue, separate from the mapping engine.
+
+## Emitting over MCP — closing the loop
+
+Findings don't just land in the dashboard; they flow to breakpilot-compliance as OSCAL over the scanner's MCP server, so the compliance report is assembled from real, control-tagged findings.
+
+- The MCP server exposes an **`oscal_assessment`** tool: given a `repo_id`, it emits a standard OSCAL 1.1 assessment-results document for that repo's findings — mapped findings target their controls via the stamped `control_refs`, and unmapped findings are reported **as-is** (as observations), so nothing is lost.
+- breakpilot pulls it: `POST /v1/cra/oscal-from-scanner` calls `oscal_assessment` over MCP (Streamable HTTP + bearer) and consumes the pre-computed OSCAL — rather than pulling raw findings and re-assessing.
+
+**Operational note — tenant context over HTTP.** The MCP server is multi-tenant; the bearer token resolves a tenant whose per-tenant database the tools query. rmcp's Streamable HTTP transport runs each session's tool calls in a `tokio::spawn`ed task, and `task_local`s do **not** cross a spawn — so binding the tenant in a per-request middleware `task_local` leaves tool handlers with no context (every call fails `no tenant context`). The fix is to bind the tenant to the **per-session server instance** at creation (the factory runs in the request scope before the spawn), not to a per-request task_local. Until this was fixed, the loop silently failed over HTTP and consumers fell back to demo data.
+
+## Configuration
+
+| Variable | Effect |
+| --- | --- |
+| `BREAKPILOT_BASE_URL` | breakpilot-compliance root; enables control ingest + all mapping passes. **Unset disables all control mapping** — findings are produced without `control_refs`. |
+| `BREAKPILOT_SEMANTIC_MAPPING` | Stage 5c (semantic master-controls mapping). **Default on** (validated live). |
+| `BREAKPILOT_GROUNDED_CHECKS` | Stage 5d (grounded surface checks). **Default on** (validated live). |
+| `BREAKPILOT_SNAPSHOT_DIR` | Where OSCAL catalog snapshots and the cached control-embedding index live. |
+
+The semantic and grounded passes default **on** now that both are validated live; each is still a no-op if `BREAKPILOT_BASE_URL` is unset or the catalog is unreachable, so they only ever add coverage. The live verifications live in `compliance-agent/tests/c5_semantic_live.rs` and `grounded_surface_live.rs` (ignored; run with `--ignored`).
+
+## Appendix — the master-controls data pipeline
+
+The master-controls corpus is produced by breakpilot-compliance and pulled as an OSCAL catalog from `GET /api/compliance/v1/oscal/catalog?framework=master-controls`. Two operational lessons are worth recording, because they cost real time to diagnose:
+
+- **The catalog is served from `breakpilot_db`, not `postgres`.** Diagnostics run against the wrong database will look clean while the app serves something else entirely. Confirm the app's datname (`pg_stat_activity`) before trusting any count or `EXPLAIN`.
+- **A constraint-less dump triplicated the master-control tables.** Restored without their PK/unique constraints, `master_controls` / `mc_verification` / `master_control_members` accumulated identical rows 3× (the same artifact migration `158` fixed for `doc_check_controls`). That inflated the catalog to ~26k dup'd controls and, with the indexes also missing, drove the export query to a >120s / 502. The fix (breakpilot migration `160`) ctid-dedups each table by its natural key and restores the constraints + indexes so it can't recur; the export query was also rewritten set-based (a single windowed pass instead of a per-row correlated subquery). After dedup: 41,850 → 13,950 master controls, catalog **25,938 → 2,882** code-checkable, endpoint **502 → 200 in ~3s**.
@@ -92,3 +92,7 @@ Filters can be combined. A count indicator shows how many findings match the cur
 ::: tip
 Findings marked as **Confirmed** exploitable were verified with a successful attack payload. **Unconfirmed** findings show suspicious behavior that may indicate a vulnerability but could not be fully exploited.
 :::
+
+## Deterministic detectors (planned)
+
+The DAST engine above is agentic: an LLM drives crawler, browser and testing tools and decides what to try next. That gives depth and code-aware exploitation, but not run-to-run reproducibility. The next step (decided 2026-08-31, not yet implemented) adds two deterministic open-source detectors **under** the agents: **Nuclei** (template checks incl. ICS/OT and default-credential templates) first, then an **OWASP ZAP** baseline scan. Their findings will appear alongside agent findings, carry CWE + compliance `control_refs`, and seed the agent's context so it verifies and chains instead of rediscovering. See [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code).
@@ -0,0 +1,84 @@
+# Demo Targets
+
+Certifai ships a small, versioned set of **demo targets** — representative
+inputs that exercise every scan path repeatably. They double as the fixture
+set for the nightly regression and as a ready-made walkthrough for demos.
+
+The set lives in [`fixtures/demo-targets/targets.json`](https://git.breakpilot.com/sharang/compliance-scanner-agent/src/branch/main/fixtures/demo-targets/targets.json).
+
+## What is in the set
+
+| Key | Target type | Artifacts | What it exercises |
+|-----|-------------|-----------|-------------------|
+| `plc-pump-station` | PLC / SPS (composite) | `pump_station.st`, `pump_fbd.xml`, optional Modbus live URL, optional firmware image | PLC control-logic SAST (ST **and** FBD-as-XML), ICS probe, semantic CRA/master-control mapping |
+| `plc-conveyor-line` | PLC / SPS | `conveyor.xml`, `traffic_light.st` | Pure control-logic SAST on a PLCopen-XML program plus a realistic OpenPLC-style sample with three planted defects |
+| `git-cra-vuln-demo` | Backend service | git `sharang/cra-vuln-demo` | Plain git SAST: Semgrep → CWE → CRA control refs (`cra-ai-8/13/20`) |
+| `web-juice-shop` | Web app | git `juice-shop/juice-shop` @ v19.2.1 + live URL | SAST + SBOM/CVE on a large Node app, DAST + pentest against the running instance |
+| `firmware-zephyr-example` | Firmware (RTOS) | git `zephyrproject-rtos/example-application` | Tramiton detect handoff (`build_system = zephyr`), firmware source SBOM |
+
+The PLC files are the same ones under `examples/plc-demo/` that the PLC rule
+tests already run against, so their expected rule ids are enforced offline on
+every CI run (`compliance-agent::fixtures` tests).
+
+## Reproducibility
+
+* Git artifacts carry a `pin` (commit SHA, plus `pin_tag` where a release tag
+  exists). The agent clones `branch`; the pin records **which commit the
+  baseline was recorded against**. When a baseline drifts, re-pin and update
+  `expect` in the same change.
+* Uploaded artifacts are checked into this repository.
+* Anything that needs infrastructure is **optional** and env-driven, so the
+  set seeds cleanly on a laptop and gains the dynamic pieces on `comp-dev`:
+
+| Env var | Used by | Meaning |
+|---------|---------|---------|
+| `DEMO_WEB_URL` | `web-juice-shop` | Live URL for DAST/pentest. Default `http://localhost:3000` — run `docker run -d -p 3000:3000 bkimminich/juice-shop:v19.2.1`. |
+| `DEMO_PLC_MODBUS_URL` | `plc-pump-station` | Modbus endpoint for the ICS probe (in-cluster default `modbus://plc-sim:502`). Skipped when unset. |
+| `DEMO_PLC_FIRMWARE_IMAGE` | `plc-pump-station` | Absolute path to a device firmware image to attach. Skipped when unset. |
+
+## Seeding the targets
+
+```bash
+# against a local dev agent (no Keycloak → dev tenant)
+scripts/seed-demo-targets.sh
+
+# seed and trigger the first scan of each
+scripts/seed-demo-targets.sh --scan
+
+# only some targets
+scripts/seed-demo-targets.sh --only web-juice-shop,git-cra-vuln-demo
+
+# wipe every "Demo · " target and reseed
+scripts/seed-demo-targets.sh --reset --scan
+
+# a deployed agent
+AGENT_URL=https://comp-dev.breakpilot.com AGENT_TOKEN=$TOKEN \
+DEMO_PLC_MODBUS_URL=modbus://plc-sim:502 scripts/seed-demo-targets.sh --scan
+```
+
+The script uses only `curl` + `jq` and the public onboarding API:
+`POST /api/v1/targets`, `POST /api/v1/targets/{id}/artifacts/upload`,
+`POST /api/v1/targets/{id}/detect`, `POST /api/v1/targets/{id}/scan`.
+Every seeded target is named `Demo · <name>`; `--reset` deletes exactly that
+prefix and nothing else.
+
+## Manual (re)onboarding
+
+Each target can also be created through the onboarding wizard:
+
+1. **PLC targets** — pick *PLC / SPS*, upload the `.st` / `.xml` files from
+   `examples/plc-demo/`, optionally add a `modbus://` live URL. See
+   [PLC / SPS (CODESYS)](/guide/plc).
+2. **Git targets** — pick the type, add the git URL and branch from the
+   manifest. Public repos need no credentials.
+3. **Web app** — add the git repo *and* the live URL; enable DAST and, if
+   wanted, pentest on the scan-selection step.
+
+## Golden baselines
+
+Each target's `expect` block states what a healthy scan must produce
+(`min_findings`, required `sast_rule_ids`, `cwes`, `control_refs`,
+`min_sbom_components`, `scans_offered`, `pentest_supported`,
+`detected_facts`). The PLC baselines are asserted in unit tests today; the
+nightly regression story (#188) runs the full set against a live agent and
+alerts on drift.
@@ -26,7 +26,7 @@ Filters can be combined. Results are paginated with 20 findings per page.
 | Severity | Color-coded badge: Critical (red), High (orange), Medium (yellow), Low (green), Info (blue) |
 | Title | Short description of the vulnerability (clickable) |
 | Type | SAST, SBOM, CVE, GDPR, OAuth, Secrets, or Code Review |
-| Scanner | Tool that found the issue (e.g. Semgrep, Grype) |
+| Scanner | Tool that found the issue (e.g. Semgrep, Syft/OSV) |
 | File | Source file path where the issue was found |
 | Status | Current triage status |

@@ -73,7 +73,7 @@ If the finding has been pushed to an issue tracker (GitHub, GitLab, Gitea, Jira)
 | Type | Source | Description |
 |------|--------|-------------|
 | **SAST** | Semgrep | Code-level vulnerabilities found through static analysis |
-| **SBOM** | Syft + Grype | Vulnerable dependencies identified in your software bill of materials |
+| **SBOM** | Syft + OSV.dev/NVD | Vulnerable dependencies identified in your software bill of materials |
 | **CVE** | NVD | Known CVEs matching your dependency versions |
 | **GDPR** | Custom rules | Personal data handling and consent issues |
 | **OAuth** | Custom rules | OAuth/OIDC misconfigurations and insecure token handling |
@@ -6,7 +6,7 @@ The SBOM (Software Bill of Materials) feature provides a complete inventory of a

 A Software Bill of Materials is a list of every component (library, package, framework) that your software depends on, along with version numbers, licenses, and known vulnerabilities. SBOMs are increasingly required for compliance audits, customer security questionnaires, and supply chain transparency.

-Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and Grype for vulnerability matching.
+Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and OSV.dev + NVD for vulnerability matching.

 ## Packages Tab

@@ -8,7 +8,7 @@ When a scan is triggered, Certifai runs through these phases in order:

 1. **Clone** -- pulls the latest code from the Git remote (or clones it for the first time)
 2. **SAST** -- runs static analysis using Semgrep with rules covering OWASP, GDPR, OAuth, secrets, and general security patterns
-3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via Grype
+3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via OSV.dev + NVD
 4. **CVE Check** -- cross-references dependencies against the NVD database for known CVEs
 5. **Graph Build** -- parses the codebase to construct a code knowledge graph of functions, classes, and their relationships
 6. **AI Triage** -- new findings are reviewed by an LLM that assesses severity, considers blast radius using the code graph, and generates remediation guidance
@@ -52,7 +52,7 @@ A full scan runs multiple analysis engines, each producing different types of fi
 | Scan Type | What It Detects | Scanner |
 |-----------|----------------|---------|
 | **SAST** | Code-level vulnerabilities (injection, XSS, insecure crypto, etc.) | Semgrep |
-| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + Grype |
+| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + OSV.dev/NVD |
 | **CVE** | Known CVEs in dependencies cross-referenced against NVD | NVD API |
 | **GDPR** | Personal data handling issues, consent violations | Custom rules |
 | **OAuth** | OAuth/OIDC misconfigurations, insecure token handling | Custom rules |
@@ -58,8 +58,8 @@ An open-source static analysis tool that finds bugs and enforces code standards
 **Syft**
 An open-source tool for generating SBOMs from container images and filesystems. Used by Certifai to extract dependency information.

-**Grype**
-An open-source vulnerability scanner for container images and filesystems. Used by Certifai to match dependencies against known vulnerabilities.
+**OSV.dev**
+Google's open distributed vulnerability database, queried by package URL. Certifai uses it (together with NVD) to match SBOM components against known vulnerabilities.

 ## Protocols

@@ -24,15 +24,14 @@ Semgrep produces SAST-type findings with file paths, line numbers, and rule desc

 Syft output feeds into both the SBOM feature and the vulnerability scanning pipeline.

-## Grype -- Vulnerability Scanning
+## OSV.dev + NVD -- Vulnerability Matching

-[Grype](https://github.com/anchore/grype) is an open-source vulnerability scanner that matches your dependencies against known vulnerability databases. It takes Syft's SBOM output and cross-references it against:
+Certifai matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):

- National Vulnerability Database (NVD)
- GitHub Advisory Database
- OS-specific advisory databases
+- [OSV.dev](https://osv.dev/) -- batch queried by package URL (purl) for ecosystem advisories (npm, PyPI, crates.io, Go, Maven, ...)
+- [NVD](https://nvd.nist.gov/) -- queried per CVE for the CVSS v3.1 base score, and by CPE for CODESYS runtime versions found in PLC projects

-Grype produces SBOM-type findings with CVE identifiers, severity ratings, and links to advisories.
+Matches are stored as CVE alerts with CVSS scores and re-checked hourly, so newly published CVEs against an unchanged dependency still raise a notification.

 ## Custom OAuth Scanner

@@ -97,3 +96,14 @@ When you mark findings as false positives or provide developer feedback, this in
 ::: tip
 The AI triage is a starting point, not a final verdict. Always review the rationale and code evidence before acting on a finding. See [Understanding Findings](/guide/findings#human-in-the-loop) for more on the human-in-the-loop workflow.
 :::
+
+## Planned integrations (decided 2026-08-31, not yet in the code)
+
+The product spec keeps an **OSS-only** tooling policy and a control-mapping rule of *tools detect, the LLM judges*. Two deterministic detectors are therefore being added **underneath** the agentic DAST/pentest layer — the agents stay on top for context-seeded exploitation, chaining and explanation:
+
+| Tool | Role | Status |
+|------|------|--------|
+| [Nuclei](https://github.com/projectdiscovery/nuclei) | Template-driven checks (CVE probes, default credentials, exposed panels, misconfigurations) including ICS/OT templates for WebVisu / OpenPLC / HMI endpoints. Runs as a DAST phase and as a Werkbank job with vendored templates so it works on-prem. | Planned — tracked as an issue |
+| [OWASP ZAP](https://www.zaproxy.org/) | Baseline (passive) and, behind the destructive-tests flag, active scan for reproducible spider + rule coverage; results seed the pentest agent. | Planned — follows Nuclei |
+
+Both feed the same `control-map` lookup table as Semgrep, so their findings receive compliance `control_refs` through the grounded judge. An **offline vulnerability database** (Trivy preferred, Grype as alternative) is planned for the on-prem Werkbank runner, which cannot reach the OSV.dev / NVD APIs. Until these land, DAST findings come exclusively from the in-house agents described above.
@@ -0,0 +1,161 @@
+{
+  "schema_version": 1,
+  "name_prefix": "Demo · ",
+  "targets": [
+    {
+      "key": "plc-pump-station",
+      "name": "PLC pump station (ST + FBD, composite)",
+      "target_type": "plc_sps",
+      "description": "Composite PlcSps demo: Structured Text + FBD-as-PLCopen-XML control logic, plus an optional live Modbus endpoint (in-cluster plc-sim) and an optional device firmware image. Exercises PLC SAST, ICS probe, semantic control mapping.",
+      "artifacts": [
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/pump_station.st",
+          "plc_format": "structured_text"
+        },
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/pump_fbd.xml",
+          "plc_format": "plcopen_xml"
+        },
+        {
+          "kind": "live_url",
+          "source_ref_env": "DEMO_PLC_MODBUS_URL",
+          "source_ref": "modbus://plc-sim:502",
+          "optional": true
+        },
+        {
+          "kind": "firmware_image",
+          "upload_env": "DEMO_PLC_FIRMWARE_IMAGE",
+          "optional": true
+        }
+      ],
+      "expect": {
+        "min_findings": 16,
+        "sast_rule_ids": [
+          "plc-hardcoded-credential",
+          "plc-default-password",
+          "plc-safety-bypass",
+          "plc-array-unchecked-index",
+          "plc-insecure-comm",
+          "plc-insecure-protocol-port",
+          "plc-unstructured-jump",
+          "plc-division-by-zero"
+        ],
+        "cwes": [
+          "CWE-798",
+          "CWE-319",
+          "CWE-1384"
+        ],
+        "control_refs_any": true
+      }
+    },
+    {
+      "key": "plc-conveyor-line",
+      "name": "PLC conveyor + traffic light (PLCopen XML + ST)",
+      "target_type": "plc_sps",
+      "description": "Pure PLC SAST demo: a PLCopen-XML conveyor program and a realistic OpenPLC-style traffic-light program with three planted defects. Exercises the control-logic rules without any dynamic infra.",
+      "artifacts": [
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/conveyor.xml",
+          "plc_format": "plcopen_xml"
+        },
+        {
+          "kind": "plc_project",
+          "upload": "examples/plc-demo/traffic_light.st",
+          "plc_format": "structured_text"
+        }
+      ],
+      "expect": {
+        "min_findings": 8,
+        "sast_rule_ids": [
+          "plc-hardcoded-credential",
+          "plc-default-password",
+          "plc-safety-bypass",
+          "plc-insecure-comm",
+          "plc-insecure-protocol-port"
+        ]
+      }
+    },
+    {
+      "key": "git-cra-vuln-demo",
+      "name": "Git SAST · cra-vuln-demo",
+      "target_type": "backend_service",
+      "description": "Plain git SAST target. Small deliberately-vulnerable Python service (hardcoded credential, weak cipher, SQL injection, cleartext transport) used to prove the CWE → CRA control mapping.",
+      "artifacts": [
+        {
+          "kind": "git_repo",
+          "source_ref": "https://git.breakpilot.com/sharang/cra-vuln-demo.git",
+          "branch": "main",
+          "pin": "21951249b9977d0c7feb555a9d5ce42c70ab5ae4"
+        }
+      ],
+      "expect": {
+        "min_findings": 3,
+        "cwes": [
+          "CWE-798",
+          "CWE-327",
+          "CWE-89"
+        ],
+        "control_refs": [
+          "cra-ai-8",
+          "cra-ai-13",
+          "cra-ai-20"
+        ]
+      }
+    },
+    {
+      "key": "web-juice-shop",
+      "name": "Web app · OWASP Juice Shop",
+      "target_type": "web_app",
+      "description": "WebApp target: git repo for SAST/SBOM/CVE plus a live URL for DAST + pentest. Run the instance locally with `docker run -d -p 3000:3000 bkimminich/juice-shop:v19.2.1` or point DEMO_WEB_URL at a deployed copy.",
+      "artifacts": [
+        {
+          "kind": "git_repo",
+          "source_ref": "https://github.com/juice-shop/juice-shop.git",
+          "branch": "master",
+          "pin": "f87c6f58c49b61c9de20e4d69a9bdb1fbd4f3bd3",
+          "pin_tag": "v19.2.1"
+        },
+        {
+          "kind": "live_url",
+          "source_ref_env": "DEMO_WEB_URL",
+          "source_ref": "http://localhost:3000"
+        }
+      ],
+      "expect": {
+        "min_findings": 10,
+        "min_sbom_components": 500,
+        "scans_offered": [
+          "sast",
+          "dast"
+        ],
+        "pentest_supported": true
+      }
+    },
+    {
+      "key": "firmware-zephyr-example",
+      "name": "Firmware RTOS · Zephyr example-application",
+      "target_type": "firmware_rtos",
+      "description": "Upstream Zephyr example application (Apache-2.0). Exercises the tramiton detect handoff (build system = zephyr) and the firmware source SBOM path.",
+      "artifacts": [
+        {
+          "kind": "git_repo",
+          "source_ref": "https://github.com/zephyrproject-rtos/example-application.git",
+          "branch": "main",
+          "pin": "38a6d9b276ed434454900130cacc87d058d3ac62"
+        }
+      ],
+      "expect": {
+        "detected_facts": {
+          "build_system": "zephyr"
+        },
+        "scans_offered": [
+          "sast"
+        ],
+        "pentest_supported": false
+      }
+    }
+  ]
+}
@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# Seed the curated demo targets (#187) into a running compliance-agent.
+#
+# Reads fixtures/demo-targets/targets.json and, for every target:
+#   1. POST /api/v1/targets                       (name = name_prefix + name)
+#   2. POST /api/v1/targets/{id}/artifacts/upload  for each `upload` artifact
+#   3. POST /api/v1/targets/{id}/detect            (surface detected facts)
+#   4. POST /api/v1/targets/{id}/scan              (only with --scan)
+#
+# Artifact env overrides (see the manifest): DEMO_WEB_URL, DEMO_PLC_MODBUS_URL,
+# DEMO_PLC_FIRMWARE_IMAGE. Optional artifacts whose env var is unset are
+# skipped, so the set seeds on a bare laptop; set them on comp-dev / Orca.
+#
+# Usage:
+#   scripts/seed-demo-targets.sh                 # seed all
+#   scripts/seed-demo-targets.sh --scan          # seed + trigger first scan
+#   scripts/seed-demo-targets.sh --only web-juice-shop,git-cra-vuln-demo
+#   scripts/seed-demo-targets.sh --reset         # delete every "Demo · " target
+#   scripts/seed-demo-targets.sh --reset --scan  # reset, reseed, scan
+#
+# Env:
+#   AGENT_URL    base URL of the agent            (default http://localhost:3011)
+#   AGENT_TOKEN  bearer token; omit for dev mode  (no Keycloak → dev tenant)
+#   MANIFEST     alternative manifest path
+
+set -euo pipefail
+
+AGENT_URL="${AGENT_URL:-http://localhost:3011}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MANIFEST="${MANIFEST:-$ROOT/fixtures/demo-targets/targets.json}"
+
+DO_SCAN=0
+DO_RESET=0
+ONLY=""
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --scan) DO_SCAN=1 ;;
+        --reset) DO_RESET=1 ;;
+        --only) ONLY="$2"; shift ;;
+        -h|--help) sed -n '2,25p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+        *) echo "unknown arg: $1" >&2; exit 2 ;;
+    esac
+    shift
+done
+
+for bin in jq curl; do
+    command -v "$bin" >/dev/null || { echo "need $bin" >&2; exit 1; }
+done
+[[ -f "$MANIFEST" ]] || { echo "manifest not found: $MANIFEST" >&2; exit 1; }
+
+AUTH=()
+[[ -n "${AGENT_TOKEN:-}" ]] && AUTH=(-H "Authorization: Bearer ${AGENT_TOKEN}")
+
+green() { printf '\033[32m%s\033[0m' "$*"; }
+yellow() { printf '\033[33m%s\033[0m' "$*"; }
+red() { printf '\033[31m%s\033[0m' "$*"; }
+
+# api METHOD PATH [curl args...] → body on stdout; non-2xx → exit 1 with body.
+api() {
+    local method="$1" path="$2"; shift 2
+    local out code
+    out=$(curl -sS -X "$method" "${AGENT_URL}${path}" "${AUTH[@]}" -w '\n%{http_code}' "$@")
+    code="${out##*$'\n'}"
+    out="${out%$'\n'*}"
+    if [[ "$code" != 2* ]]; then
+        echo "$(red "HTTP $code") $method $path" >&2
+        echo "$out" >&2
+        return 1
+    fi
+    printf '%s' "$out"
+}
+
+PREFIX="$(jq -r '.name_prefix' "$MANIFEST")"
+
+reset_targets() {
+    echo "== reset: deleting targets named '${PREFIX}*'"
+    local list ids
+    list=$(api GET "/api/v1/targets?limit=500")
+    ids=$(jq -r --arg p "$PREFIX" '.data[] | select(.name | startswith($p)) | ._id."$oid"' <<<"$list")
+    local n=0
+    for id in $ids; do
+        api DELETE "/api/v1/targets/${id}" >/dev/null && n=$((n + 1))
+    done
+    echo "   deleted $n"
+}
+
+# Build the JSON artifact list for reference-style (non-upload) artifacts.
+# Prints one JSON object per artifact that should be created inline.
+inline_artifacts() {
+    local target_json="$1"
+    jq -c '.artifacts[] | select(.upload == null and .upload_env == null)' <<<"$target_json" |
+    while IFS= read -r a; do
+        local kind env ref optional branch
+        kind=$(jq -r '.kind' <<<"$a")
+        env=$(jq -r '.source_ref_env // empty' <<<"$a")
+        ref=$(jq -r '.source_ref // empty' <<<"$a")
+        optional=$(jq -r '.optional // false' <<<"$a")
+        branch=$(jq -r '.branch // empty' <<<"$a")
+        if [[ -n "$env" && -n "${!env:-}" ]]; then
+            ref="${!env}"
+        elif [[ -n "$env" && "$optional" == "true" ]]; then
+            echo "   $(yellow skip) $kind (set \$$env to include)" >&2
+            continue
+        fi
+        [[ -n "$ref" ]] || continue
+        jq -cn --arg k "$kind" --arg r "$ref" --arg b "$branch" \
+            '{kind:$k, source_ref:$r} + (if $b != "" then {branch:$b} else {} end)'
+    done
+}
+
+# Upload every `upload` / `upload_env` artifact of the target.
+upload_artifacts() {
+    local id="$1" target_json="$2"
+    jq -c '.artifacts[] | select(.upload != null or .upload_env != null)' <<<"$target_json" |
+    while IFS= read -r a; do
+        local kind path env fmt optional
+        kind=$(jq -r '.kind' <<<"$a")
+        env=$(jq -r '.upload_env // empty' <<<"$a")
+        path=$(jq -r '.upload // empty' <<<"$a")
+        fmt=$(jq -r '.plc_format // empty' <<<"$a")
+        optional=$(jq -r '.optional // false' <<<"$a")
+        if [[ -n "$env" && -n "${!env:-}" ]]; then
+            path="${!env}"
+        elif [[ -n "$path" ]]; then
+            path="$ROOT/$path"
+        elif [[ "$optional" == "true" ]]; then
+            echo "   $(yellow skip) $kind (set \$$env to include)" >&2
+            continue
+        fi
+        [[ -f "$path" ]] || { echo "   $(red missing) $path" >&2; return 1; }
+        local form=(-F "file=@${path}" -F "kind=${kind}")
+        [[ -n "$fmt" ]] && form+=(-F "plc_format=${fmt}")
+        api POST "/api/v1/targets/${id}/artifacts/upload" "${form[@]}" >/dev/null
+        echo "   $(green upload) $kind $(basename "$path")"
+    done
+}
+
+seed_target() {
+    local t="$1"
+    local key name type desc
+    key=$(jq -r '.key' <<<"$t")
+    name="${PREFIX}$(jq -r '.name' <<<"$t")"
+    type=$(jq -r '.target_type' <<<"$t")
+    desc=$(jq -r '.description // ""' <<<"$t")
+    echo "== $key  ($type)"
+
+    local arts body resp id
+    arts=$(inline_artifacts "$t" | jq -cs '.')
+    body=$(jq -cn --arg n "$name" --arg tt "$type" --arg d "$desc" --argjson a "$arts" \
+        '{name:$n, target_type:$tt, description:$d, artifacts:$a}')
+    resp=$(api POST "/api/v1/targets" -H 'Content-Type: application/json' -d "$body")
+    id=$(jq -r '.data._id."$oid"' <<<"$resp")
+    echo "   $(green created) $id  $(jq -r '.data.artifacts|length' <<<"$resp") inline artifact(s)"
+
+    upload_artifacts "$id" "$t"
+
+    local det
+    det=$(api POST "/api/v1/targets/${id}/detect" -H 'Content-Type: application/json' -d '{}' || true)
+    if [[ -n "$det" ]]; then
+        echo "   detect → $(jq -r '.data.classification.suggested // "n/a"' <<<"$det")"
+    fi
+
+    if [[ "$DO_SCAN" == 1 ]]; then
+        api POST "/api/v1/targets/${id}/scan" -H 'Content-Type: application/json' -d '{}' >/dev/null
+        echo "   $(green scan) triggered"
+    fi
+}
+
+[[ "$DO_RESET" == 1 ]] && reset_targets
+
+echo "== seeding from $MANIFEST → $AGENT_URL"
+jq -c '.targets[]' "$MANIFEST" | while IFS= read -r t; do
+    key=$(jq -r '.key' <<<"$t")
+    if [[ -n "$ONLY" && ",$ONLY," != *",$key,"* ]]; then
+        continue
+    fi
+    seed_target "$t"
+done
+echo "== done"
Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	20067fcf44	fix(deps): bump h2 0.4.13 -> 0.4.19 (RUSTSEC-2026-0258, unblocks CI audit) CI / Check (push) Skipped CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy Docs (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details CI / Check (pull_request) Successful in 8m59s Details The CI Security Audit step fails on RUSTSEC-2026-0258 — "h2 unbounded empty DATA frames" (DoS), fixed in h2 >= 0.4.16. h2 is a transitive dependency (hyper/reqwest), so this is a lockfile-only bump; no Cargo.toml or code change, diff limited to the single version line. The remaining audit findings (anyhow, git2, lru) are `unsound` warnings, not vulnerabilities, and do not fail the step. Folded into this CI-fix PR because the audit gate blocks every PR from going green, including this one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 18:59:00 +02:00
Sharang ParnerkarandClaude Fable 5	b5c33bdd52	fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI) CI / Check (push) Skipped CI / Deploy Docs (pull_request) Skipped Details CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details CI / Check (pull_request) Failing after 6m53s Details The private git-dependency still pointed at ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which is stale two ways: #231 repointed the host to git.breakpilot.com, and the repo was renamed tramiton -> firmwerk. The CI `insteadOf` rewrite is keyed on git.breakpilot.com, so it never matched the old host and Cargo fell back to a raw SSH clone of a dead host -> "Host key verification failed" -> "failed to get tramiton-core as a dependency". This broke `CI / Check` and every Deploy job on main and all PRs. Repoint the three git-deps (tramiton-core/-repro/-sbom) to ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 = same commit ae4fc137, where the crates are still named tramiton-), and update the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code change. Migrating the deps to the firmwerk- crates at a newer tag is a follow-up. Validated: `cargo fetch` + `cargo metadata --offline` resolve the dep from the new URL; resolved source is git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 18:22:52 +02:00
sharang	8dcdad9fe7	feat(fixtures): curated demo targets + seed script + golden PLC baselines (#187 ) (#232 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Failing after 18s Details CI / Deploy Docs (push) Successful in 1m11s Details	2026-08-31 15:58:16 +00:00
sharang	53bd93c96e	docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) (#233 ) CI / Check (push) Canceled after 0s Details CI / Detect Changes (push) Canceled after 0s Details CI / Deploy Agent (push) Canceled after 0s Details CI / Deploy Dashboard (push) Canceled after 0s Details CI / Deploy Docs (push) Canceled after 0s Details CI / Deploy MCP (push) Canceled after 0s Details	2026-08-31 15:58:11 +00:00
sharang	0834547a74	chore(ci): repoint registry/git/cargo meghsakha.com -> breakpilot.com (#231 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 5s Details CI / Deploy Docs (push) Skipped Details CI / Deploy Dashboard (push) Failing after 4m47s Details CI / Deploy MCP (push) Failing after 15s Details CI / Deploy Agent (push) Failing after 18s Details	2026-08-06 08:42:45 +00:00
sharang	effc3080e0	fix(orchestrator): refresh control_refs on PLC re-scans (#230 ) CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Successful in 3m49s Details CI / Check (push) Skipped Details	2026-07-22 17:06:08 +00:00
sharang	51bab61f77	fix(orchestrator): run semantic control mapping on PLC findings (#229 ) CI / Deploy MCP (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Check (push) Skipped Details CI / Deploy Agent (push) Successful in 4m3s Details	2026-07-22 13:16:53 +00:00
sharang	5bdc35ee92	fix(orchestrator): refresh control_refs on existing findings during re-scan (#228 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Successful in 4m13s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details	2026-07-22 12:24:36 +00:00
sharang	ea516cc054	docs(control-mapping): MCP emission loop + default-on flags (#227 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Skipped Details CI / Deploy Docs (push) Successful in 57s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy MCP (push) Skipped Details	2026-07-22 11:23:51 +00:00
sharang	7d5c95ddb8	fix(mcp): bind tenant to session — bearer context was lost over HTTP (#226 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 2s Details CI / Deploy Agent (push) Skipped Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Successful in 1m57s Details	2026-07-22 09:30:07 +00:00
sharang	3e233da128	feat(controls): promote grounded controls to covered + enable LLM passes by default (#224 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Docs (push) Skipped Details CI / Deploy Agent (push) Successful in 7m53s Details CI / Deploy Dashboard (push) Successful in 7m10s Details CI / Deploy MCP (push) Successful in 1m50s Details	2026-07-22 07:48:51 +00:00
sharang	a72f79e557	ci: fix cosign signing (install fallback, env-style login, portal sign step) (#225 ) CI / Deploy Docs (push) Canceled after 0s Details CI / Check (push) Canceled after 0s Details CI / Detect Changes (push) Canceled after 0s Details CI / Deploy Agent (push) Canceled after 0s Details CI / Deploy Dashboard (push) Canceled after 0s Details CI / Deploy MCP (push) Canceled after 0s Details	2026-07-22 07:46:34 +00:00
sharang	182dec69b8	docs(features): compliance control-mapping pipeline (#223 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Skipped Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Docs (push) Failing after 4s Details	2026-07-22 07:30:10 +00:00
sharang	a25d41c3e5	feat(controls): enrich semantic retrieval query with finding intent + C5 live test (#222 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Failing after 4s Details	2026-07-22 07:14:49 +00:00
sharang	60601d8215	fix(llm): chunk embed() requests under the backend batch cap (#221 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Failing after 5s Details	2026-07-21 15:41:07 +00:00
sharang	a7ff36edf3	feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC) (#220 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 2s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Failing after 4s Details	2026-07-21 13:15:27 +00:00
sharang	4ef257bfe2	feat(controls): B2 — grounded surface checks for absence-based CRA controls (#219 ) CI / Check (push) Skipped Details CI / Deploy MCP (push) Failing after 5s Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Docs (push) Skipped Details CI / Deploy Agent (push) Failing after 5s Details CI / Deploy Dashboard (push) Failing after 4s Details	2026-07-21 12:48:12 +00:00
sharang	38fedc661b	feat(controls): B1 — custom semgrep detectors for 4 CRA controls (#218 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Failing after 4s Details	2026-07-21 12:31:20 +00:00
sharang	36a49cdeac	ci: push images to Harbor (repo.meghsakha.com) + cosign (#216 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Skipped Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details	2026-07-21 12:08:04 +00:00
sharang	0ef2cd1b23	feat(agent): cache control embedding index + auto-wire semantic pass (gated) (#217 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Docs (push) Skipped Details CI / Deploy Agent (push) Failing after 3s Details CI / Deploy Dashboard (push) Failing after 3s Details CI / Deploy MCP (push) Failing after 2s Details	2026-07-21 11:29:16 +00:00
sharang	f516ecf3b5	feat(agent): semantic control mapping — embedding index + region->control retrieval (#215 ) CI / Check (push) Skipped Details CI / Detect Changes (push) Successful in 5s Details CI / Deploy Dashboard (push) Skipped Details CI / Deploy Docs (push) Skipped Details CI / Deploy MCP (push) Skipped Details CI / Deploy Agent (push) Failing after 5s Details	2026-07-21 10:50:21 +00:00