feat(controls): promote grounded controls to covered + enable LLM passes by default (#224)

compliance-agent/src/controls/scan_triage.rs

@@ -112,9 +112,9 @@ async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, Contro
 /// the grounded judge decide whether the control holds there. Returns net-new
 /// findings, each already tagged with its control and grounded to a real snippet.
 ///
-/// Gated: the orchestrator runs this only when `breakpilot.grounded_control_checks`
-/// is set. Absence detection is the least deterministic path (the judge decides
-/// presence/absence, not a syntactic pattern), so it stays off until tuned live.
+/// The orchestrator runs this when `breakpilot.grounded_control_checks` is set
+/// (on by default). Validated live; it covers the 8 absence-based CRA controls
+/// (the judge decides presence/absence, grounded to a real snippet).
 pub async fn grounded_surface_findings(
     config: &AgentConfig,
     llm: Arc<LlmClient>,
@@ -173,11 +173,10 @@ fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegi
 /// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
 /// of findings that gained a master-control ref.
 ///
-/// Gated: the orchestrator runs this only when `breakpilot.semantic_mapping` is
-/// set (default off, flipped on once the master-controls catalog is live). The
-/// control embedding index is built once and cached to `snapshot_dir` keyed by
-/// corpus hash ([`ControlIndex::load_or_build`]), so only the first scan after a
-/// catalog change pays the embedding cost.
+/// The orchestrator runs this when `breakpilot.semantic_mapping` is set (on by
+/// default). The control embedding index is built once and cached to
+/// `snapshot_dir` keyed by corpus hash ([`ControlIndex::load_or_build`]), so only
+/// the first scan after a catalog change pays the embedding cost.
 pub async fn semantic_stamp_findings(
     config: &AgentConfig,
     llm: Arc<LlmClient>,

compliance-agent/src/pipeline/orchestrator.rs

@@ -232,9 +232,9 @@ impl PipelineOrchestrator {
 
         // Stage 5c: semantic control mapping — scale path for the master-controls
         // corpus (no CWE to LUT on): embed each finding's region, retrieve the
-        // nearest master controls, grounded-judge, and stamp confirmed refs. Gated
-        // (default off) as the corpus embedding + per-finding judging is the heavy
-        // path; enabled once verified live against a deployed master-controls catalog.
+        // nearest master controls, grounded-judge, and stamp confirmed refs. On by
+        // default (validated live); the corpus embedding is cached so only the
+        // first scan after a catalog change pays it.
         if self.config.breakpilot.semantic_mapping {
             self.update_phase(scan_run_id, "semantic_control_mapping")
                 .await;
@@ -256,8 +256,8 @@ impl PipelineOrchestrator {
         // rate limiting, no security logging, no update-signature check) have no
         // syntactic pattern to match, so we retrieve the code surface each governs
         // and let the grounded judge decide whether it holds, producing net-new
-        // findings already tagged + grounded. Gated (default off): absence
-        // detection is the least deterministic path, kept off until tuned live.
+        // findings already tagged + grounded. On by default (validated live); it
+        // covers the 8 absence-based CRA controls.
         if self.config.breakpilot.grounded_control_checks {
             self.update_phase(scan_run_id, "grounded_control_checks")
                 .await;