sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(agent): control triage — LLM false-positive filter over tool findings

Browse Source 
ControlTriage composes the pipeline: a deterministic tool finding ->
controls_for(tool,cwe) [control-map LUT] -> grounded judge confirms/refutes ->
TriageOutcome { Unmapped | Confirmed([control ids]) | FalsePositive }. The LLM
enters ONLY here, as an FP filter over tool output (ZeroFalse/IRIS), never as the
detector; only judgments grounded to real code survive. Reuses the judge + core
ground gate + control-map. 3 lib tests (confirm/refute/unmapped).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
2026-07-21 10:20:31 +02:00
co-authored by Claude Fable 5
parent b7534d1123
commit f712ba1e60
4 changed files with 188 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compliance-agent/Cargo.toml
+1
View File
@@ -8,6 +8,7 @@ workspace = true
[dependencies]
compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
control-map = { workspace = true }
compliance-graph = { path = "../compliance-graph" }
compliance-dast = { path = "../compliance-dast" }
# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also