docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) #233

Merged

sharang merged 2 commits from docs/tool-inventory-drift into main 2026-08-31 15:58:13 +00:00

Conversation 0 Commits 2 Files Changed 7

+29 -15

sharang commented 2026-08-31 13:05:09 +00:00

Owner

Copy Link

Copy Source

Docs-only. While reconciling the Certifai requirements spec (Nextcloud Collectives → v0.2) against the code, two stale claims turned up:

• Grype is named in 5 pages (tools, glossary, scanning, sbom, findings) but is neither installed in Dockerfile.agent nor invoked anywhere — CVE matching is pipeline/cve.rs → OSV.dev batch by purl + NVD (CVSS v3.1, CODESYS CPE). Replaced with an accurate "OSV.dev + NVD" section/glossary entry.
• ZAP / nuclei are listed as deterministic detectors in features/control-mapping.md; neither is in the stack. DAST findings come from the in-house compliance-dast agents. Replaced accordingly.

No code changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

Docs-only. While reconciling the Certifai requirements spec (Nextcloud Collectives → v0.2) against the code, two stale claims turned up: - **Grype** is named in 5 pages (tools, glossary, scanning, sbom, findings) but is neither installed in `Dockerfile.agent` nor invoked anywhere — CVE matching is `pipeline/cve.rs` → OSV.dev batch by purl + NVD (CVSS v3.1, CODESYS CPE). Replaced with an accurate "OSV.dev + NVD" section/glossary entry. - **ZAP / nuclei** are listed as deterministic detectors in `features/control-mapping.md`; neither is in the stack. DAST findings come from the in-house `compliance-dast` agents. Replaced accordingly. No code changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

sharang added 1 commit 2026-08-31 13:05:11 +00:00

docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) ... b7b9c812ab

CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS
CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the
in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the
Certifai requirements spec (Collectives) with the code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

sharang added 1 commit 2026-08-31 13:12:44 +00:00

docs: document Nuclei/ZAP as decided deterministic detectors under the agentic DAST (not yet implemented) ... 61c6eab54e

Spec v0.2.1 decision (2026-08-31): keep the agentic DAST/pentest layer, integrate
Nuclei then ZAP baseline underneath as deterministic detectors feeding the
control-map LUT; offline vuln DB (Trivy/Grype) on the on-prem runner trigger.
Clearly marked as planned so the docs stay truthful until the code lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

sharang merged commit 53bd93c96e into main 2026-08-31 15:58:13 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#233