78 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	753ecefaae	fix(semgrep): extract CWE from list-form metadata (was always null) ... semgrep emits metadata.cwe as a LIST (e.g. "CWE-798: Use of Hard-coded Credentials"), but the extractor called v.as_str() on it -> always None, so SAST findings never carried a CWE at all (silently breaking control mapping AND the CWE-based dedup). Handle list + bare-string forms and normalise to the CWE-NNN id. Found by the live control-triage end-to-end test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 10:55:00 +02:00
Sharang ParnerkarandClaude Fable 5	075a4cb81b	feat(agent): wire control triage into the scan pipeline (end-to-end SAST) ... After the deterministic tools run, the orchestrator's new control_triage stage stamps each finding with the compliance control(s) it is evidence for and flags control false positives. triage_repo_findings builds control specs from the ingested OSCAL catalog, reads a code window per finding, and runs ControlTriage (control-map LUT -> grounded judge). Adds Finding.control_refs (serde default); the ground gate stamps it. Opt-in via BREAKPILOT_BASE_URL. 2 region tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 10:28:01 +02:00
Sharang ParnerkarandClaude Fable 5	f712ba1e60	feat(agent): control triage — LLM false-positive filter over tool findings ... ControlTriage composes the pipeline: a deterministic tool finding -> controls_for(tool,cwe) [control-map LUT] -> grounded judge confirms/refutes -> TriageOutcome { Unmapped | Confirmed([control ids]) | FalsePositive }. The LLM enters ONLY here, as an FP filter over tool output (ZeroFalse/IRIS), never as the detector; only judgments grounded to real code survive. Reuses the judge + core ground gate + control-map. 3 lib tests (confirm/refute/unmapped). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 10:20:31 +02:00
Sharang ParnerkarandClaude Opus 4.8	d1f42a1a83	feat(agent): grounded control checker — compose judge -> ground gate ... GroundedControlChecker<J: ControlJudge>::check(spec, regions, repo_id) judges each candidate region and keeps only findings that survive the core grounding gate. Generic over the judge so tests drive it with a deterministic stub — the recognize->ground path is proven without an LLM (grounded snippet kept, ungrounded dropped, non-violation yields nothing). 2 lib tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 22:51:57 +02:00
Sharang ParnerkarandClaude Opus 4.8	b0117078f3	feat(agent): control judge — LLM recognize stage (temp 0, verbatim, fail-closed) ... ControlJudge trait + LlmControlJudge: judges one (control, region) with a closed temperature-0 prompt that must quote the offending code VERBATIM; parsing fails closed to non-violation (never a fabricated finding). Behind a trait so the checker stays stub-testable. Its output is re-checked by the core grounding gate, never trusted directly. 3 lib tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 22:50:20 +02:00
sharang	5285fb67ae	feat(oscal): live assessment endpoint POST /api/v1/oscal/assess (#212)	2026-07-20 19:13:47 +00:00
sharang	d4884cfe4f	feat(oscal): ingest breakpilot OSCAL catalog via OscalControlsProvider (#210)	2026-07-20 16:19:09 +00:00
sharang	94c0d51a11	feat(werkbank): make the loop runnable — enqueue + artifact serve/fetch (WB-05b) (#209)	2026-07-17 14:34:00 +00:00
sharang	70a4ee55ab	refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a) (#208)	2026-07-17 12:56:15 +00:00
sharang	91a87677bc	feat(werkbank): runner queue endpoints + result persistence (WB-05) (#207)	2026-07-17 11:42:29 +00:00
sharang	633f945a1e	feat(werkbank): Mongo-backed job queue with lease + visibility timeout (WB-02) (#206)	2026-07-17 09:15:23 +00:00
sharang	7ad7bce9db	feat(plc): dynamic PLC testing via ephemeral soft-PLC (#193)	2026-07-17 07:47:43 +00:00
sharang	0f4c75b6b3	fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus:// (#182)	2026-07-16 21:28:47 +00:00
sharang	097f86243e	feat(cve): match the CODESYS runtime against NVD by CPE (#180)	2026-07-16 20:10:18 +00:00
sharang	4f9e2c2828	fix(plc): scan every PLC-source artifact, not just the first (#178)	2026-07-16 19:59:58 +00:00
sharang	98357cae10	fix(upload): raise body-size limit to 512 MiB + surface upload errors (#177)	2026-07-16 18:03:40 +00:00
sharang	7932f60ab9	feat(ics): EtherNet/IP probe + OT service-discovery port scan (#175)	2026-07-16 16:48:22 +00:00
sharang	b96c4d594c	feat(ics): OPC UA reachability probe (#174)	2026-07-16 16:35:54 +00:00
sharang	d2003eb3c0	feat(cve): notifications for the PLC control-app SBOM (#173)	2026-07-16 16:30:19 +00:00
sharang	77eced8314	feat(ics): dynamic Modbus/TCP probe for PLC/SPS devices (#172)	2026-07-16 16:25:04 +00:00
sharang	a3f3f1d4f5	feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)	2026-07-16 15:47:04 +00:00
sharang	7369e031c4	feat(plc): control-application SBOM from CODESYS .projectarchive (#170)	2026-07-16 15:28:42 +00:00
sharang	386d8457d6	feat(plc): analyse graphical logic (FBD/LD) from PLCopen XML (#169)	2026-07-16 11:43:49 +00:00
sharang	3a53a1d7f2	feat(matrix): PlcSps composite device target (SBOM/CVE/DAST/pentest) (#168)	2026-07-16 10:56:36 +00:00
sharang	afa5c985ee	feat(onboarding): PLC/blob file upload (multipart) + single-file ingest fix (#163)	2026-07-16 09:41:12 +00:00
sharang	6d02b138c6	feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3) (#162)	2026-07-16 08:31:43 +00:00
sharang	a981311413	refactor: rip out the legacy TrackedRepository / repositories path (#161)	2026-07-16 07:25:45 +00:00
sharang	87f240b26f	feat(onboarding): input validation + editable targets (#160)	2026-07-13 17:57:48 +00:00
sharang	71aceafa26	fix(deps): bump tramiton to v0.4.1 (proot-safe firmware build) (#158)	2026-07-13 11:21:43 +00:00
sharang	b12d18d99d	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) (#157)	2026-07-13 10:15:06 +00:00
sharang	eaaafc0621	feat(pipeline): analysis-based firmware SBOM from tramiton (#156)	2026-07-13 08:31:33 +00:00
sharang	0ec5fd8295	fix(dashboard): Findings/SBOM filter by targets + accurate target findings_count (#155)	2026-07-13 07:59:45 +00:00
sharang	bf32b9939a	fix(onboarding): targets visibility + unified pipeline by default (#154)	2026-07-13 07:29:04 +00:00
sharang	669e1f1b03	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button (#153)	2026-07-12 22:19:32 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146)	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145)	2026-07-12 21:31:21 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142)	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141)	2026-07-12 20:11:16 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134)	2026-07-10 13:41:25 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96) ... Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92) ... MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95) ... GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93) ... Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	56482911b8	fix(dashboard): attach Keycloak token on agent API calls (#90)	2026-06-17 18:35:59 +00:00
sharang	183234f9af	feat(m7.1): wire compliance-agent to compliance-core auth + status gate (#85)	2026-06-17 09:36:52 +00:00
sharang	927fbc8ecb	fix: live progress + concurrency for embedding builds (#80)	2026-05-13 10:01:05 +00:00
sharang	e67a13535a	fix: add HTTP timeout to reqwest client and CVE stage timeout (#79)	2026-05-13 07:30:26 +00:00
sharangandSharang Parnerkar	df0063abc0	fix: scanner timeouts, semgrep memory cap, syft remote lookups, Script error (#78) ... ## Summary - **Scan produces no results in Orca** — semgrep (`--config=auto`, unbounded memory) and syft (remote license network calls) were getting OOM-killed or hanging in resource-constrained Orca containers. Scan would "complete" with 0 findings/SBOMs silently because each scanner failure is caught and logged as a warning. - **Dashboard Script error spam** — `document::Script` in Dioxus 0.7 needs a single text node child for inline scripts; `dangerous_inner_html` was invalid and spammed the error log on every unauthenticated page load. ## Changes | File | Change | |------|--------| | `semgrep.rs` | Add `--max-memory 500 --jobs 1`; 10-minute timeout | | `syft.rs` | Remove remote license lookup env vars; 5-minute timeout | | `gitleaks.rs` | 5-minute timeout | | `app_shell.rs` | Fix `dangerous_inner_html` → text child in `document::Script` | ## Test plan - [ ] Trigger a scan on a repo in Orca — findings and SBOM entries should now appear - [ ] Agent logs should show timeout/error warnings rather than silent empty results when tools are killed - [ ] Navigate to dashboard unauthenticated — Script error gone from logs - [ ] Verify scans work end-to-end with `docker compose up` --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #78	2026-05-12 11:27:24 +00:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00