feat: control-driven SAST — LUT + grounded LLM triage over tool findings (#213)

2026-07-21 09:01:51 +00:00
parent 5285fb67ae
commit c6baf72c6d
17 changed files with 1453 additions and 6 deletions
@@ -215,6 +215,21 @@ impl PipelineOrchestrator {
        .await;
        tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");

+        // Stage 5b: control triage — stamp findings with the compliance control(s)
+        // they're evidence for and flag control false positives (grounded LLM over
+        // deterministic tool output). No-op unless breakpilot is configured.
+        self.update_phase(scan_run_id, "control_triage").await;
+        let tagged = crate::controls::triage_repo_findings(
+            &self.config,
+            self.llm.clone(),
+            &repo_path,
+            &mut all_findings,
+        )
+        .await;
+        if tagged > 0 {
+            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
+        }
+
        // Dedup against existing findings and insert new ones
        let mut new_count = 0u32;
        let mut new_findings: Vec<Finding> = Vec::new();