sharang/compliance-scanner-agent

docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) #233

Merged

sharang merged 2 commits from docs/tool-inventory-drift into main

2026-08-31 15:58:13 +00:00

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	61c6eab54e	docs: document Nuclei/ZAP as decided deterministic detectors under the agentic DAST (not yet implemented) CI / Check (push) Skipped CI / Check (pull_request) Failing after 2m55s Details CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy Docs (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details Spec v0.2.1 decision (2026-08-31): keep the agentic DAST/pentest layer, integrate Nuclei then ZAP baseline underneath as deterministic detectors feeding the control-map LUT; offline vuln DB (Trivy/Grype) on the on-prem runner trigger. Clearly marked as planned so the docs stay truthful until the code lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 15:12:41 +02:00
Sharang ParnerkarandClaude Fable 5	b7b9c812ab	docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) CI / Check (push) Skipped CI / Check (pull_request) Failing after 3m1s Details CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy Docs (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the Certifai requirements spec (Collectives) with the code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 15:05:06 +02:00