New standalone crate — the 'transcribing' layer that maps each control to the
static-scan step(s) that check it, or marks it needs_tooling / not_code_checkable.
Authored + human-reviewed: no LLM decides coverage. The LLM only triages the
tool's findings downstream (in the agent), never here.
- ControlMap / ControlEntry / ScanBinding / Coverage types + embedded JSON LUT
- query API: coverage(control), controls_for(tool, cwe), summary()
- CRA LUT: 40 controls -> 9 covered (semgrep/gitleaks/syft/osv) / 16 needs_tooling
/ 15 not_code_checkable
- wired into CI (clippy + test). 4 lib tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GroundedControlChecker<J: ControlJudge>::check(spec, regions, repo_id) judges each
candidate region and keeps only findings that survive the core grounding gate.
Generic over the judge so tests drive it with a deterministic stub — the
recognize->ground path is proven without an LLM (grounded snippet kept, ungrounded
dropped, non-violation yields nothing). 2 lib tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ControlJudge trait + LlmControlJudge: judges one (control, region) with a closed
temperature-0 prompt that must quote the offending code VERBATIM; parsing fails
closed to non-violation (never a fabricated finding). Behind a trait so the
checker stays stub-testable. Its output is re-checked by the core grounding gate,
never trusted directly. 3 lib tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The deterministic spine of control-driven checking: turn a text control into a
finding via an LLM used as a grounded pattern-recognizer. ground() admits a
verdict only if its quoted snippet appears verbatim in the retrieved region and
recomputes the finding line from that match (the model's line is discarded), so
a fabricated snippet cannot survive. cache_key() makes verdicts reproducible.
Pure — no LLM, no IO. 4 lib tests incl. fabricated-snippet-dropped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Each deploy job now builds the per-service image, pushes to the
private registry as :latest and :sha, then triggers an HMAC-signed
orca redeploy webhook. Coolify webhooks are no longer used.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
