Extensive feature doc for the compliance control-mapping engine:
- core principle (tools detect, LLM judges/grounds — never detects)
- coverage model + the CRA hybrid (4 semgrep / 8 grounded / 4 not-code-checkable)
- the three mapping paths (LUT 5b / semantic 5c / grounded-surface 5d) with a
mermaid flow, and the shared grounding gate
- semantic retrieval detail incl. the query-enrichment tuning
- two worked examples from the live C5 run (auth file + varied vulns)
- known limitations (absence findings, catch-all controls, corpus noise)
- config flags + an appendix on the master-controls data pipeline war-story
(dump-triplication -> migration 160 dedup; 502 -> 200)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
