2026-05-21 - 2026-08-21
Overview
1 Release published by 1 user
Published
v0.3.0
78 Pull requests merged by 1 user
Merged
#231 chore(ci): repoint registry/git/cargo meghsakha.com -> breakpilot.com
Merged
#230 fix(orchestrator): refresh control_refs on PLC re-scans
Merged
#229 fix(orchestrator): run semantic control mapping on PLC findings
Merged
#228 fix(orchestrator): refresh control_refs on existing findings during re-scan
Merged
#227 docs(control-mapping): MCP emission loop + default-on flags
Merged
#226 fix(mcp): bind tenant to session — bearer context was lost over HTTP
Merged
#224 feat(controls): promote grounded controls to covered + enable LLM passes by default
Merged
#225 ci: fix cosign signing (install fallback, env-style login, portal sign step)
Merged
#223 docs(features): compliance control-mapping pipeline
Merged
#222 feat(controls): enrich semantic retrieval query with finding intent + C5 live test
Merged
#221 fix(llm): chunk embed() requests under the backend batch cap
Merged
#220 feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC)
Merged
#219 feat(controls): B2 — grounded surface checks for absence-based CRA controls
Merged
#218 feat(controls): B1 — custom semgrep detectors for 4 CRA controls
Merged
#216 ci: push images to Harbor (repo.meghsakha.com) + cosign
Merged
#217 feat(agent): cache control embedding index + auto-wire semantic pass (gated)
Merged
#215 feat(agent): semantic control mapping — embedding index + region->control retrieval
Merged
#214 feat(oscal): emit unmapped findings as-is + MCP oscal_assessment tool
Merged
#213 feat: control-driven SAST — LUT + grounded LLM triage over tool findings
Merged
#212 feat(oscal): live assessment endpoint POST /api/v1/oscal/assess
Merged
#211 feat(oscal): assessment-results emitter + finding->control linker
Merged
#210 feat(oscal): ingest breakpilot OSCAL catalog via OscalControlsProvider
Merged
#209 feat(werkbank): make the loop runnable — enqueue + artifact serve/fetch (WB-05b)
Merged
#208 refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a)
Merged
#207 feat(werkbank): runner queue endpoints + result persistence (WB-05)
Merged
#206 feat(werkbank): Mongo-backed job queue with lease + visibility timeout (WB-02)
Merged
#205 feat(werkbank): job/result contract in compliance-core (WB-01)
Merged
#193 feat(plc): ephemeral soft-PLC provisioning + program load (#183)
Merged
#185 docs(plc): PLC Runtime Landscape reference + support watch-list
Merged
#184 docs(plc): soft-PLC architecture + CODESYS/Yocto lifecycle diagram
Merged
#182 fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus://
Merged
#181 feat(onboarding): enable opt-in scans from the wizard success step
Merged
#180 feat(cve): match the CODESYS runtime against NVD by CPE
Merged
#179 feat(onboarding): Project-archive PLC format + auto-detect from extension
Merged
#178 fix(plc): scan every PLC-source artifact, not just the first
Merged
#177 fix(upload): raise body-size limit to 512 MiB + surface upload errors
Merged
#176 fix(dashboard): preselect saved type/kind in edit-target form
Merged
#175 feat(ics): EtherNet/IP probe + OT service-discovery port scan [#148]
Merged
#174 feat(ics): OPC UA reachability probe [#148]
Merged
#173 feat(cve): notifications for the PLC control-app SBOM (shared helper) [#166]
Merged
#172 feat(ics): dynamic Modbus/TCP probe for PLC/SPS devices [#148]
Merged
#171 feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) + docs/UI
Merged
#170 feat(plc): control-application SBOM from CODESYS .projectarchive (+CVE) [#166]
Merged
#169 feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML [#165]
Merged
#168 feat(matrix): PlcSps as a composite device target (SBOM/CVE/DAST/pentest) [#164]
Merged
#163 feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix
Merged
#162 feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3)
Merged
#161 refactor: rip out the legacy TrackedRepository / repositories path
Merged
#160 feat(onboarding): input validation + editable targets
Merged
#159 feat(agent): real nix (sandbox=false) for firmware SBOM, replacing nix-portable
Merged
#158 fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build)
Merged
#157 feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2)
Merged
#156 feat(pipeline): analysis-based firmware SBOM from tramiton
Merged
#155 fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count
Merged
#154 fix(onboarding): targets visibility + unified pipeline by default
Merged
#153 feat(onboarding): scan-trigger endpoint + wizard Run-Scan button
Merged
#152 ci: don't cancel-in-progress for main-branch runs (only pull_request)
Merged
#147 fix(ci): authenticate tramiton fetch in dashboard + mcp image builds
Merged
#146 feat(pipeline): run tramiton classification + provision DAST in run_target
Merged
#145 feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE
Merged
#144 feat(dashboard): onboarding wizard UI
Merged
#143 fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys)
Merged
#142 feat(api): onboarding endpoints for unified targets
Merged
#141 feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets)
Merged
#140 ci: Kellnr crates.io mirror + persistent S3-backed sccache
Merged
#138 feat(onboarding): artifact ingest + classifier + suite-integration seams
Merged
#134 feat(onboarding): unified multi-target model + scan matrix foundation
Merged
#94 feat(dashboard): UI for managing MCP tokens
Merged
#96 feat(m7.3): scheduler pulls tenants from registry, env as fallback
Merged
#97 fix(audit): bump quinn-proto + ignore rmcp DNS-rebinding advisory
Merged
#92 feat(m7.3): MCP tenant-scoped bearer tokens
Merged
#95 feat(m7.3): cross-tenant admin HTTP endpoints
Merged
#93 chore(agent): remove stale unscoped webhook routes from API router
Merged
#91 feat(dashboard): proactively refresh expired Keycloak tokens
Merged
#90 fix(dashboard): attach Keycloak token on agent API calls
Merged
#85 feat(m7.1): wire compliance-agent to compliance-core auth + status gate
Merged
#84 fix(m7.1): JWKS refresh-on-failure in auth middleware
Merged
#83 M7.1 smoke harness: lift auth to compliance-core + compliance-smoke service
39 Issues closed from 1 user
Closed
#198 WB-04 · Docker executor + plc-provision job (THIN SLICE)
Closed
#204 WB-10 · Observability & security hardening
Closed
#203 WB-09 · Runner registration, labels & capability-matched routing
Closed
#202 WB-08 · K8s executor, then Shell executor
Closed
#201 WB-07 · On-prem runner mode
Closed
#199 WB-05 · Control-plane cut-over to enqueue plc-provision
Closed
#200 WB-06 · qemu-boot job (firmware dynamic)
Closed
#196 WB-02 · DB-table job queue (control plane)
Closed
#197 WB-03 · Werkbank runner skeleton
Closed
#195 WB-01 · Job + result contract in compliance-core
Closed
#194 Epic · Werkbank — dynamic-execution runner (pull queue, pluggable executors, on-prem)
Closed
#126 ONB-08 · Wizard screen 3 — scan selection + scope/auth
Closed
#133 ONB-15 · Unified scan-pipeline rewrite (feature-flagged run_target path)
Closed
#123 ONB-05 · Onboarding wizard shell — multi-step flow, state, navigation
Closed
#131 ONB-13 · Onboarding API endpoints (target CRUD, artifact upload, detection)
Closed
#132 ONB-14 · Migration + back-compat (fold TrackedRepository / DastTarget in)
Closed
#139 CI: use crates.meghsakha.com (Kellnr) mirror + persistent sccache (Hetzner S3), matching werkpilot
Closed
#32 [medium] gdpr-patterns: Missing data deletion capability
Closed
#31 [medium] gdpr-patterns: Missing data deletion capability
Closed
#29 [medium] semgrep: Service 'mailserver' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temp…
Closed
#54 [medium] semgrep: Service 'mailserver' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temp…
Closed
#27 [medium] semgrep: Dangerously accepting invalid TLS information
Closed
#25 [high] semgrep: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
Closed
#26 [medium] semgrep: Dangerously accepting invalid TLS information
Closed
#24 [high] semgrep: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
Closed
#46 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Closed
#45 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Closed
#44 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Closed
#43 [high] gitleaks: Secret detected: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
Closed
#41 [high] oauth-patterns: OAuth implicit grant flow detected
Closed
#42 [high] oauth-patterns: OAuth implicit grant flow detected
Closed
#38 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Closed
#39 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Closed
#37 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Closed
#36 [medium] gdpr-patterns: Data collection without apparent consent mechanism
Closed
#35 [high] gdpr-patterns: PII data potentially logged
Closed
#33 [high] gdpr-patterns: PII data potentially logged
Closed
#34 [high] gdpr-patterns: PII data potentially logged
Closed
#106 CS-C1 · Encode CRA→62443-4-2 crosswalk as OSCAL catalog
67 Issues created by 1 user
Opened
#99 CS-A2 · Firmware ingest (EMBA + cve-bin-tool + binwalk)
Opened
#98 CS-A1 · Syft/Trivy runner → CycloneDX SBOM
Opened
#100 CS-A3 · SBOM data model + Mongo repo
Opened
#103 CS-B2 · ICS advisory ingest (CISA ICS-CERT CSAF)
Opened
#101 CS-A4 · Dashboard SBOM view
Opened
#102 CS-B1 · CVE matcher (OSV.dev + NVD)
Opened
#104 CS-B3 · LLM VEX triage → OpenVEX
Opened
#105 CS-B4 · VEX review UX (approve/override)
Opened
#107 CS-C2 · Mapping engine (findings → controls → status)
Opened
#106 CS-C1 · Encode CRA→62443-4-2 crosswalk as OSCAL catalog
Opened
#108 CS-C3 · Compliance dashboard (requirement → status → evidence)
Opened
#109 CS-D1 · Evidence aggregator
Opened
#110 CS-D2 · LLM narrative → conformity DRAFT (Pandoc/Typst)
Opened
#111 CS-D3 · Human sign-off gate
Opened
#112 CS-E1 · PLCopen XML / ST parser (eval RuSTy)
Opened
#113 CS-E2 · 3 control-logic security rules
Opened
#114 CS-E3 · LLM remediation hints for lint findings
Opened
#117 CS-F3 · Machine-overview landing
Opened
#115 CS-F1 · Seed demo dataset (one fictional machine)
Opened
#116 CS-F2 · Demo narrative script + reset
Opened
#118 ONB-Epic · Multi-target artifact-aware onboarding wizard
Opened
#119 ONB-01 · Target taxonomy + unified data model (OnboardedTarget/TargetType/Artifact)
Opened
#121 ONB-03 · Artifact-aware classifier / auto-detection (Tramiton detect handoff)
Opened
#120 ONB-02 · Artifact ingest layer (git/zip/firmware/mobile/container/URL/plaintext)
Opened
#123 ONB-05 · Onboarding wizard shell — multi-step flow, state, navigation
Opened
#122 ONB-04 · Scan-applicability matrix (target type × artifacts → SAST/DAST/pentest)
Opened
#125 ONB-07 · Wizard screen 2 — artifact upload/link (type-aware inputs)
Opened
#124 ONB-06 · Wizard screen 1 — target type selection (card grid + auto-detect)
Opened
#126 ONB-08 · Wizard screen 3 — scan selection + scope/auth
Opened
#127 ONB-09 · Wizard screen 4 — review & launch
Opened
#129 ONB-11 · Mobile (Android/iOS) onboarding specifics (APK/AAB/IPA)
Opened
#128 ONB-10 · Firmware / Yocto onboarding specifics (Tramiton + EMBA/binwalk)
Opened
#131 ONB-13 · Onboarding API endpoints (target CRUD, artifact upload, detection)
Opened
#130 ONB-12 · PLC / SPS onboarding specifics (PLCopen XML / ST)
Opened
#132 ONB-14 · Migration + back-compat (fold TrackedRepository / DastTarget in)
Opened
#133 ONB-15 · Unified scan-pipeline rewrite (feature-flagged run_target path)
Opened
#136 ONB-17 · Compliance-scope capture + pluggable ControlsProvider (OSCAL vs breakpilot RAG)
Opened
#135 ONB-16 · Tramiton evidence reconciliation (detect handoff + local evidence + entitlement)
Opened
#137 ONB-18 · Werkpilot remediation hook (downstream consumer)
Opened
#139 CI: use crates.meghsakha.com (Kellnr) mirror + persistent sccache (Hetzner S3), matching werkpilot
Opened
#148 ONB · PLC/SPS dynamic testing — soft-PLC (OpenPLC) + industrial-protocol probing
Opened
#149 ONB · Embedded Linux/Yocto dynamic path — QEMU boot (runqemu/FirmAE) → DAST + pentest
Opened
#150 ONB · Bitbake/Yocto detection (our classifier) + Yocto-native SPDX/cve-check ingest (no tramiton dep)
Opened
#151 ONB · FirmwareStatic scanner: EMBA + binwalk + cve-bin-tool (firmware image analysis)
Opened
#164 ONB · Composite PLC-on-Yocto target: PlcSps offers SBOM/CVE + DAST + pentest (matrix)
Opened
#165 ONB · SAST: CODESYS native project (.project/.projectarchive) + graphical languages (LD/FBD/SFC/CFC)
Opened
#166 ONB · SBOM: control-application dependency SBOM (CODESYS libraries + runtime version) -> CVE
Opened
#167 ONB · CODESYS-on-Yocto customer: end-to-end SBOM/SAST/DAST/pentest coverage tracker
Opened
#183 Epic: Dynamic PLC testing via ephemeral soft-PLC (deploy control logic → ICS + DAST)
Opened
#186 Epic · Certifai → breakpilot-platform integration (post-#183)
Opened
#187 STORY · Demo target fixtures — curated representative targets
Opened
#192 STORY · breakpilot-compliance Qdrant RAG controls as ControlsProvider tools
Opened
#189 STORY · Next.js onboarding app in breakpilot-platform (replace Dioxus)
Opened
#190 STORY · RBAC for onboarding + scanner data (breakpilot-platform RBAC)
Opened
#191 STORY · Externalize findings/SBOM/CVE as API + MCP to platform services
Opened
#188 STORY · Nightly agent regression against the demo targets
Opened
#194 Epic · Werkbank — dynamic-execution runner (pull queue, pluggable executors, on-prem)
Opened
#195 WB-01 · Job + result contract in compliance-core
Opened
#196 WB-02 · DB-table job queue (control plane)
Opened
#197 WB-03 · Werkbank runner skeleton
Opened
#198 WB-04 · Docker executor + plc-provision job (THIN SLICE)
Opened
#199 WB-05 · Control-plane cut-over to enqueue plc-provision
Opened
#200 WB-06 · qemu-boot job (firmware dynamic)
Opened
#202 WB-08 · K8s executor, then Shell executor
Opened
#203 WB-09 · Runner registration, labels & capability-matched routing
Opened
#201 WB-07 · On-prem runner mode
Opened
#204 WB-10 · Observability & security hardening
3 Unresolved Conversations
Open
#59
No request body size limit on API and webhook servers
Open
#30
[medium] gdpr-patterns: Missing data deletion capability
Open
#28
[medium] semgrep: Service 'mailserver' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.