feat: control-driven SAST — LUT + grounded LLM triage over tool findings (#213)

control-map/src/lib.rs

@@ -0,0 +1,163 @@
+//! `control-map` — the deterministic control → scan lookup table (LUT).
+//!
+//! The "transcribing" layer: it maps each compliance control to the static-scan
+//! step(s) that check it, or marks it as needing custom tooling, or as not
+//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
+//! decides coverage. The LLM only enters later, downstream, to triage/ground the
+//! *tool's* findings (that lives in the agent, not here).
+//!
+//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
+//! + query helpers.
+
+use serde::{Deserialize, Serialize};
+
+/// Coverage bucket for a control under static (SAST-family) scanning.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Coverage {
+    /// An existing tool's scan surfaces findings for this control.
+    Covered,
+    /// Code-checkable, but no existing tool digs it out — we must write tooling.
+    NeedsTooling,
+    /// Process / document control — out of static-scan scope.
+    NotCodeCheckable,
+}
+
+/// One tool binding: a scan step that (at least partially) checks a control.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ScanBinding {
+    /// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
+    pub tool: String,
+    /// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
+    pub scan_type: String,
+    /// CWEs whose findings map to this control (used to attach findings back).
+    #[serde(default)]
+    pub cwe: Vec<String>,
+    /// Optional specific rule ids this control keys on.
+    #[serde(default)]
+    pub rules: Vec<String>,
+}
+
+/// One control's entry in the LUT.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlEntry {
+    /// Control id, e.g. `"cra-ai-8"`.
+    pub control: String,
+    /// Human-readable title (for the reviewable view).
+    #[serde(default)]
+    pub title: String,
+    /// Coverage bucket.
+    pub status: Coverage,
+    /// Tool bindings (empty unless `status == Covered`).
+    #[serde(default)]
+    pub scans: Vec<ScanBinding>,
+    /// Reviewer note — why it needs tooling / isn't code-checkable.
+    #[serde(default)]
+    pub note: Option<String>,
+}
+
+/// The control → scan lookup table for one framework.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlMap {
+    pub version: String,
+    pub framework: String,
+    pub controls: Vec<ControlEntry>,
+}
+
+const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
+
+impl ControlMap {
+    /// Load the built-in CRA control map (the embedded, authored LUT).
+    pub fn cra() -> Result<Self, MapError> {
+        Ok(serde_json::from_str(CRA_MAP_JSON)?)
+    }
+
+    /// The coverage entry for a control id, if present.
+    pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
+        self.controls.iter().find(|c| c.control == control_id)
+    }
+
+    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
+    /// raw tool finding back to the control(s) it's evidence for.
+    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
+        self.controls
+            .iter()
+            .filter(|c| {
+                c.scans
+                    .iter()
+                    .any(|s| s.tool == tool && s.cwe.iter().any(|w| w == cwe))
+            })
+            .collect()
+    }
+
+    /// Count of controls in each coverage bucket.
+    pub fn summary(&self) -> CoverageSummary {
+        let mut s = CoverageSummary::default();
+        for c in &self.controls {
+            match c.status {
+                Coverage::Covered => s.covered += 1,
+                Coverage::NeedsTooling => s.needs_tooling += 1,
+                Coverage::NotCodeCheckable => s.not_code_checkable += 1,
+            }
+        }
+        s
+    }
+}
+
+/// Coverage bucket counts.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct CoverageSummary {
+    pub covered: usize,
+    pub needs_tooling: usize,
+    pub not_code_checkable: usize,
+}
+
+impl CoverageSummary {
+    pub fn total(&self) -> usize {
+        self.covered + self.needs_tooling + self.not_code_checkable
+    }
+}
+
+/// Errors loading a control map.
+#[derive(Debug, thiserror::Error)]
+pub enum MapError {
+    #[error("failed to parse control map: {0}")]
+    Parse(#[from] serde_json::Error),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cra_map_loads_all_40_controls() {
+        let map = ControlMap::cra().expect("CRA map should parse");
+        assert_eq!(map.framework, "cra");
+        assert_eq!(map.controls.len(), 40);
+        assert_eq!(map.summary().total(), 40);
+    }
+
+    #[test]
+    fn hardcoded_password_control_is_tool_covered() {
+        let map = ControlMap::cra().unwrap();
+        let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
+        assert_eq!(c.status, Coverage::Covered);
+        assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
+        assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
+    }
+
+    #[test]
+    fn finding_attaches_back_to_control_via_tool_and_cwe() {
+        let map = ControlMap::cra().unwrap();
+        let hits = map.controls_for("semgrep", "CWE-798");
+        assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
+    }
+
+    #[test]
+    fn every_bucket_is_represented() {
+        let s = ControlMap::cra().unwrap().summary();
+        assert!(s.covered > 0);
+        assert!(s.needs_tooling > 0);
+        assert!(s.not_code_checkable > 0);
+    }
+}