feat(controls): promote grounded controls to covered + enable LLM passes by default (#224)

2026-07-22 07:48:51 +00:00
parent a72f79e557
commit 3e233da128
7 changed files with 330 additions and 53 deletions
@@ -0,0 +1,125 @@
+//! C5 example 2 — exploratory (not a committed regression test). Four topically
+//! distinct findings, to see whether tuned semantic retrieval maps each to the
+//! right master-control family. Run:
+//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
+//!   cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use compliance_core::models::finding::{Finding, Severity};
+use compliance_core::models::scan::ScanType;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
+}
+
+fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
+    let mut f = Finding::new(
+        "repo-c5b".into(),
+        format!("{file}:{line}"),
+        "semgrep".into(),
+        ScanType::Sast,
+        title.into(),
+        desc.into(),
+        Severity::High,
+    );
+    f.file_path = Some(file.into());
+    f.line_number = Some(line);
+    f
+}
+
+fn write(repo: &std::path::Path, rel: &str, body: &str) {
+    let p = repo.join(rel);
+    if let Some(parent) = p.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    std::fs::write(p, body).unwrap();
+}
+
+#[tokio::test]
+#[ignore = "live: api-dev + LiteLLM"]
+async fn c5b_varied_findings() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+    let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: std::env::temp_dir()
+            .join("c5-oscal-snap")
+            .to_string_lossy()
+            .into_owned(),
+        semantic_mapping: true,
+        grounded_control_checks: false,
+    };
+
+    let repo = std::env::temp_dir().join("c5b-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    write(
+        &repo,
+        "app/db.py",
+        "import sqlite3\n\ndef get_user(username):\n    q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n    return conn.execute(q)\n",
+    );
+    write(
+        &repo,
+        "app/config.py",
+        "# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
+    );
+    write(
+        &repo,
+        "app/net.py",
+        "import requests\n\ndef fetch(url):\n    return requests.get(url, verify=False, timeout=5)\n",
+    );
+    write(
+        &repo,
+        "app/ser.py",
+        "import pickle\n\ndef load_state(blob):\n    return pickle.loads(blob)\n",
+    );
+
+    let mut findings = vec![
+        mk(
+            "app/db.py",
+            4,
+            "SQL injection via string-concatenated query",
+            "User input is concatenated directly into a SQL statement, allowing SQL injection.",
+        ),
+        mk(
+            "app/config.py",
+            2,
+            "Hardcoded API credential in source",
+            "A live API key is hardcoded in source code instead of a secret store.",
+        ),
+        mk(
+            "app/net.py",
+            4,
+            "TLS certificate verification disabled",
+            "requests is called with verify=False, disabling TLS certificate validation.",
+        ),
+        mk(
+            "app/ser.py",
+            3,
+            "Insecure deserialization with pickle.loads",
+            "Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
+        ),
+    ];
+
+    let tagged =
+        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
+            .await;
+    println!("\n=== C5 example 2: varied findings ===");
+    for f in &findings {
+        println!("  {:52} -> {:?}", f.title, f.control_refs);
+    }
+    println!("tagged: {tagged}/4");
+    let _ = std::fs::remove_dir_all(&repo);
+    assert!(tagged >= 1);
+}