feat(agent): cache control embedding index + auto-wire semantic pass (gated) (#217)

compliance-core/src/config.rs

@@ -75,6 +75,11 @@ pub struct BreakpilotConfig {
     pub token: Option<SecretString>,
     /// Directory for catalog snapshots.
     pub snapshot_dir: String,
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// retrieve nearest controls, grounded-judge). Off by default: it is the
+    /// scale path and stays gated until verified live against a deployed
+    /// master-controls catalog.
+    pub semantic_mapping: bool,
 }
 
 impl Default for BreakpilotConfig {
@@ -83,6 +88,7 @@ impl Default for BreakpilotConfig {
             base_url: None,
             token: None,
             snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
+            semantic_mapping: false,
         }
     }
 }

compliance-core/src/control_check.rs

@@ -14,13 +14,14 @@
 //! The LLM supplies cross-language / cross-stack pattern recognition; this module
 //! supplies the determinism.
 
+use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
 use crate::models::finding::{Finding, Severity};
 use crate::models::scan::ScanType;
 
 /// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ControlCheckSpec {
     /// Stable control id, e.g. `"cra-ai-8"`.
     pub control_id: String,