feat(controls): enrich semantic retrieval query with finding intent + C5 live test (#222)

compliance-agent/src/controls/scan_triage.rs

@@ -234,13 +234,22 @@ pub async fn semantic_stamp_findings(
         let Some(region) = fetch_region(repo_path, &file, line) else {
             continue;
         };
-        let region_emb = match llm.embed(vec![region.content.clone()]).await {
+        // Retrieve on the finding's intent + the code, not the region alone: two
+        // findings in one file share overlapping windows and otherwise embed alike,
+        // collapsing onto the same controls. The finding's title/description carry
+        // the discriminating signal (e.g. "brute-force protection" vs "weak hash").
+        // The raw `region` still goes to the judge for snippet grounding.
+        let query = format!(
+            "{}\n{}\n\n{}",
+            finding.title, finding.description, region.content
+        );
+        let query_emb = match llm.embed(vec![query]).await {
             Ok(mut embs) => match embs.pop() {
                 Some(v) => v,
                 None => continue,
             },
             Err(e) => {
-                tracing::warn!(error = %e, "region embed failed; skipping finding");
+                tracing::warn!(error = %e, "query embed failed; skipping finding");
                 continue;
             }
         };
@@ -248,7 +257,7 @@ pub async fn semantic_stamp_findings(
             .check(
                 &index,
                 &region,
-                &region_emb,
+                &query_emb,
                 SEMANTIC_TOP_K,
                 &finding.repo_id,
             )

compliance-agent/src/controls/semantic.rs

@@ -22,18 +22,20 @@ impl<J: ControlJudge> SemanticControlChecker<J> {
         Self { judge }
     }
 
-    /// Map a code region to the controls it violates. `region_embedding` is the
-    /// region's embedding (the caller computes it via the LLM); the top-`k`
-    /// nearest controls in `index` are judged and grounded.
+    /// Map a code region to the controls it violates. `query_embedding` is the
+    /// caller-supplied retrieval embedding — typically the finding's intent
+    /// (title/description) plus the region, so retrieval keys on what the finding
+    /// is *about*, not just the ambient code. The top-`k` nearest controls in
+    /// `index` are then judged against the raw `region` and grounded.
     pub async fn check(
         &self,
         index: &ControlIndex,
         region: &CandidateRegion,
-        region_embedding: &[f64],
+        query_embedding: &[f64],
         k: usize,
         repo_id: &str,
     ) -> Vec<Finding> {
-        let candidates = index.nearest(region_embedding, k);
+        let candidates = index.nearest(query_embedding, k);
         let mut findings = Vec::new();
         for spec in &candidates {
             let verdict = self.judge.judge(spec, region).await;