feat(werkbank): job/result contract in compliance-core (WB-01)

The shared, dependency-free vocabulary the control plane and the Werkbank execution runner agree on: Job (declarative — TOML on disk, JSON on the wire), JobType (plc-provision/qemu-boot/dast/pentest), Executor (shell/docker/k8s), JobStatus lifecycle, InputRef (blob/url — the artifact resolves on the runner, never through the control plane), JobRuntime, JobCollect, and JobResult (reusing Finding/DastFinding/SbomEntry so the runner produces exactly what the control plane persists). Lives in a mongodb/axum-feature-free module so the runner can depend on compliance-core without the server stack (verified: cargo check -p compliance-core --no-default-features). Tests round-trip through JSON and parse the exact plc-provision + qemu-boot TOML from the Werkbank design doc. First story of the Werkbank epic (sharang/werkbank#1); implements sharang/werkbank#2. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat(plc): dynamic PLC testing via ephemeral soft-PLC (#193 )
2026-07-17 10:24:49 +02:00 · 2026-07-17 07:47:43 +00:00 · 2026-07-16 22:05:39 +00:00 · 2026-07-16 22:00:17 +00:00 · 2026-07-16 21:28:47 +00:00 · 2026-07-16 20:52:50 +00:00
112 changed files with 14083 additions and 1820 deletions
@@ -7,4 +7,17 @@ ignore = [
    # not a realistic attack surface here. Revisit when mongodb bumps hickory.
    "RUSTSEC-2026-0118", # NSEC3 loop, no fix available upstream
    "RUSTSEC-2026-0119", # O(n²) name compression, fixed in hickory-proto >=0.26.1
+
+    # rmcp 0.16.0 — DNS rebinding in Streamable HTTP server transport (missing
+    # Host header validation). Patched in rmcp >= 1.4.0, which is a major API
+    # version jump from our pin; rmcp shipped 0.x → 1.x → 2.x in three months
+    # and the migration touches every tool handler + the auth middleware we
+    # just landed in #92. Threat model in our deployment: the MCP server is
+    # exposed at a public hostname (comp-mcp-dev.meghsakha.com) behind orca's
+    # TLS-terminating ingress with per-tenant bearer auth — the attack model
+    # (browser DNS-rebinding into localhost MCP server) doesn't directly apply.
+    # Defense-in-depth Host-header check is still a worthwhile follow-up.
+    # FOLLOW-UP: bump rmcp to 2.x in a dedicated PR (M7.3 follow-up, sized
+    # multi-hour due to API surface change).
+    "RUSTSEC-2026-0189",
 ]
@@ -34,6 +34,19 @@ SCAN_SCHEDULE=0 0 */6 * * *
 CVE_MONITOR_SCHEDULE=0 0 0 * * *
 GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos

+# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
+# enabled; requires the agent container to have Docker access (socket mount).
+# When on, a PLC/SPS target with control logic but no reachable device gets its
+# logic instantiated on a throwaway OpenPLC, probed, then torn down.
+PLC_RUNTIME_ENABLED=0
+PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
+PLC_RUNTIME_NETWORK=certifai
+PLC_RUNTIME_MEMORY=512m
+PLC_RUNTIME_CPUS=0.5
+PLC_RUNTIME_MAX_LIFETIME_SECS=180
+PLC_RUNTIME_OPENPLC_USER=openplc
+PLC_RUNTIME_OPENPLC_PASSWORD=openplc
+
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001
@@ -9,15 +9,33 @@ on:
 env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
-  # sccache caches compilation artifacts within a job so that compiling
-  # both --features server and --features web shares common crate work.
+  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
+  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
+  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
+  # and HETZNER_S3_SECRET_KEY.
  RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_DIR: /tmp/sccache
+  SCCACHE_BUCKET: breakpilot-sccache
+  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
+  SCCACHE_REGION: auto
+  SCCACHE_S3_USE_SSL: "true"
+  SCCACHE_S3_KEY_PREFIX: compliance-scanner
+  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
+  # compliance-agent depends on tramiton-core via git; use the system git so the
+  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
+  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
+  CARGO_NET_RETRY: "10"
+  CARGO_HTTP_MULTIPLEXING: "false"

-# Cancel in-progress runs for the same branch/PR
+# Cancel superseded PR runs, but NEVER cancel main-branch runs — those build and
+# deploy per-service images, and cancelling one merge's deploy when the next
+# merge lands leaves a service un-deployed (as happened between two back-to-back
+# merges). So cancel-in-progress only for pull_request events.
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 jobs:
  # ---------------------------------------------------------------------------
@@ -36,16 +54,44 @@ jobs:
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
+      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
+      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
+      # replacement only applies to crates.io-sourced crates.
+      - name: Use Kellnr crates.io mirror
+        run: |
+          : "${CARGO_HOME:=/usr/local/cargo}"
+          mkdir -p "$CARGO_HOME"
+          {
+            echo '[source.crates-io]'
+            echo 'replace-with = "kellnr"'
+            echo '[registries.kellnr]'
+            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
+          } >> "$CARGO_HOME/config.toml"
+        env:
+          RUSTC_WRAPPER: ""
      - name: Install tools
        run: |
          rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
          chmod +x /usr/local/bin/sccache
          cargo install cargo-audit --locked
        env:
          RUSTC_WRAPPER: ""

+      # compliance-agent has a git dependency on tramiton-core (a private repo on
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
+      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
+      # with read:repository, owned by a user with access to sharang/tramiton).
+      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
+      - name: Configure git auth for private tramiton dependency
+        run: |
+          git config --global \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            "ssh://git@gitea.meghsakha.com:22222/"
+        env:
+          RUSTC_WRAPPER: ""
+
      # Format (no compilation needed)
      - name: Format
        run: cargo fmt --all --check
@@ -148,13 +194,18 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
+        env:
+          # PAT for fetching the private tramiton-core git dependency during the
+          # image build (injected as a BuildKit secret, never baked into a layer).
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-agent
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -169,13 +220,16 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
+        env:
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-dashboard
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -211,13 +265,16 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
+        env:
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-mcp
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -676,8 +676,10 @@ dependencies = [
 "jsonwebtoken",
 "mongodb",
 "octocrab",
+ "rand 0.9.2",
 "regex",
 "reqwest",
+ "roxmltree",
 "secrecy",
 "serde",
 "serde_json",
@@ -691,6 +693,9 @@ dependencies = [
 "tower-http",
 "tracing",
 "tracing-subscriber",
+ "tramiton-core",
+ "tramiton-repro",
+ "tramiton-sbom",
 "urlencoding",
 "uuid",
 "walkdir",
@@ -718,6 +723,7 @@ dependencies = [
 "sha2",
 "thiserror 2.0.18",
 "tokio",
+ "toml",
 "tracing",
 "tracing-opentelemetry",
 "tracing-subscriber",
@@ -818,12 +824,15 @@ dependencies = [
 "bson",
 "chrono",
 "compliance-core",
+ "dashmap",
 "dotenvy",
+ "hex",
 "mongodb",
 "rmcp",
 "schemars 1.2.1",
 "serde",
 "serde_json",
+ "sha2",
 "thiserror 2.0.18",
 "tokio",
 "tower-http",
@@ -1114,9 +1123,9 @@ dependencies = [

 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
 "crossbeam-utils",
 ]
@@ -3762,6 +3771,15 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "octocrab"
 version = "0.44.1"
@@ -4193,7 +4211,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit",
+ "toml_edit 0.23.10+spec-1.0.0",
 ]

 [[package]]
@@ -4278,9 +4296,9 @@ dependencies = [

 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
 "bytes",
 "getrandom 0.3.4",
@@ -4612,6 +4630,12 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "roxmltree"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
+
 [[package]]
 name = "rust-stemmers"
 version = "1.2.0"
@@ -4992,6 +5016,15 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5190,7 +5223,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
 "proc-macro2",
 "quote",
 "syn",
@@ -5806,6 +5839,27 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5815,6 +5869,20 @@ dependencies = [
 "serde_core",
 ]

+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap 2.13.0",
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5822,7 +5890,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
 "indexmap 2.13.0",
- "toml_datetime",
+ "toml_datetime 0.7.5+spec-1.1.0",
 "toml_parser",
 "winnow",
 ]
@@ -5836,6 +5904,12 @@ dependencies = [
 "winnow",
 ]

+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6082,6 +6156,46 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "tramiton-core"
+version = "0.4.1"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+dependencies = [
+ "serde",
+ "tempfile",
+ "thiserror 1.0.69",
+ "toml",
+ "walkdir",
+]
+
+[[package]]
+name = "tramiton-repro"
+version = "0.4.1"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+dependencies = [
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+ "thiserror 1.0.69",
+ "toml",
+ "tramiton-core",
+ "walkdir",
+]
+
+[[package]]
+name = "tramiton-sbom"
+version = "0.4.1"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+dependencies = [
+ "object",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tramiton-core",
+ "tramiton-repro",
+]
+
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -23,7 +23,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
@@ -34,3 +34,5 @@ zip = { version = "2", features = ["aes-crypto", "deflate"] }
 dashmap = "6"
 tokio-stream = { version = "0.1", features = ["sync"] }
 aes-gcm = "0.10"
+rand = "0.9"
+base64 = "0.22"
@@ -2,7 +2,22 @@ FROM rust:1.94-bookworm AS builder

 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-agent
+# compliance-agent depends on the private tramiton-core git repo. Authenticate
+# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
+# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
+
+# A throwaway stage that packs a real nix store (store paths + the validity DB)
+# into a compressed bootstrap tarball. Only the tarball is copied into the final
+# image, so we don't carry a raw /nix copy layer.
+FROM nixos/nix:latest AS nixseed
+RUN tar -C / -czf /nix-bootstrap.tar.gz nix

 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
@@ -31,7 +46,30 @@ RUN pip3 install --break-system-packages semgrep
 # Install ruff for Python linting
 RUN pip3 install --break-system-packages ruff

+# Real nix for the tramiton reproducible-build firmware SBOM.
+#
+# nix-portable's proot fallback can't run here: user namespaces are blocked by
+# the container's default seccomp/apparmor profile, and orca exposes no way to
+# relax it. So ship a *real* nix and disable its build sandbox
+# (`sandbox = false`) — a plain gcc/make firmware build needs no user namespace,
+# so it runs fine under the locked-down profile with no proot involved.
+#
+# The store is shipped as a bootstrap tarball and seeded onto /nix at first
+# start (see docker/agent-entrypoint.sh), so a persistent /nix volume survives
+# redeploys. A missing/broken nix just falls back to the analysis-only SBOM.
+COPY --from=nixseed /nix-bootstrap.tar.gz /opt/nix-bootstrap.tar.gz
+ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
+RUN mkdir -p /etc/nix && printf '%s\n' \
+      'experimental-features = nix-command flakes' \
+      'sandbox = false' \
+      'build-users-group =' \
+      'substituters = https://cache.nixos.org' \
+      'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
+      > /etc/nix/nix.conf
+
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
+COPY docker/agent-entrypoint.sh /usr/local/bin/agent-entrypoint.sh
+RUN chmod +x /usr/local/bin/agent-entrypoint.sh

 # Copy documentation for the help chat assistant
 COPY --from=builder /app/README.md /app/README.md
@@ -43,5 +81,6 @@ RUN mkdir -p /data/compliance-scanner/ssh

 EXPOSE 3001 3002

-ENTRYPOINT ["compliance-agent"]
+# Seeds /nix (fresh volume) from the bootstrap tarball, then runs the agent.
+ENTRYPOINT ["/usr/local/bin/agent-entrypoint.sh"]

@@ -7,7 +7,16 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-RUN dx build --release --package compliance-dashboard
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the dashboard.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard

 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder

 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-mcp
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the mcp binary.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp

 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
@@ -10,6 +10,16 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
+# Native firmware build/target detection for bare-metal & RTOS artifacts.
+# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
+# available to the onboarding classifier. NOTE: CI must be able to fetch this
+# private repo (see the git-auth step in .gitea/workflows/ci.yml).
+tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+# tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
+# yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
+tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+# tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
+tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -24,7 +34,7 @@ hex = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
 regex = { workspace = true }
-axum = "0.8"
+axum = { version = "0.8", features = ["multipart"] }
 tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
 git2 = "0.20"
 octocrab = "0.44"
@@ -32,6 +42,8 @@ tokio-cron-scheduler = "0.13"
 dotenvy = "0.15"
 hmac = "0.12"
 walkdir = "2"
+# Read-only XML tree parsing for PLCopen project files (POU extraction).
+roxmltree = "0.20"
 base64 = "0.22"
 urlencoding = "2"
 futures-util = "0.3"
@@ -42,6 +54,7 @@ tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
 futures-core = "0.3"
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
+rand = { workspace = true }

 [dev-dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "axum"] }
@@ -52,5 +65,5 @@ tokio = { workspace = true }
 mongodb = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
-axum = "0.8"
+axum = { version = "0.8", features = ["multipart"] }
 tower-http = { version = "0.6", features = ["cors"] }
@@ -63,7 +63,22 @@ impl ComplianceAgent {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run(repo_id, trigger).await
+        orchestrator.run_target(repo_id, trigger).await
+    }
+
+    /// Alias for [`Self::run_scan`] — every scan runs the unified onboarded-target
+    /// pipeline. Kept as a distinct name for the `/targets/{id}/scan` endpoint's
+    /// intent.
+    pub async fn run_target_scan(
+        &self,
+        tenant_id: &str,
+        target_id: &str,
+        trigger: compliance_core::models::ScanTrigger,
+    ) -> Result<(), crate::error::AgentError> {
+        let db = self.db_pool.for_tenant_id(tenant_id).await?;
+        let orchestrator =
+            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+        orchestrator.run_target(target_id, trigger).await
    }

    /// Run a PR review: scan the diff and post review comments.
@@ -76,16 +91,19 @@ impl ComplianceAgent {
        head_sha: &str,
    ) -> Result<(), crate::error::AgentError> {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-        let repo = db
-            .repositories()
-            .find_one(mongodb::bson::doc! {
-                "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id)
-                    .map_err(|e| crate::error::AgentError::Other(e.to_string()))?
-            })
+        let oid = mongodb::bson::oid::ObjectId::parse_str(repo_id)
+            .map_err(|e| crate::error::AgentError::Other(e.to_string()))?;
+        let target = db
+            .onboarded_targets()
+            .find_one(mongodb::bson::doc! { "_id": oid })
            .await?
            .ok_or_else(|| {
-                crate::error::AgentError::Other(format!("Repository {repo_id} not found"))
+                crate::error::AgentError::Other(format!("Target {repo_id} not found"))
            })?;
+        let code = target.code_artifact().ok_or_else(|| {
+            crate::error::AgentError::Other(format!("Target {repo_id} has no code artifact"))
+        })?;
+        let repo = crate::pipeline::repo_view::RepoView::from_target(&target, code);

        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
@@ -146,7 +146,7 @@ pub async fn build_embeddings(
    let agent_clone = (*agent).clone();
    tokio::spawn(async move {
        let repo = match db
-            .repositories()
+            .onboarded_targets()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
            .await
        {
@@ -194,14 +194,22 @@ pub async fn build_embeddings(
                }
            };

+        let code = match repo.code_artifact() {
+            Some(c) => c,
+            None => {
+                tracing::error!("Target {repo_id} has no code artifact for embedding build");
+                return;
+            }
+        };
+        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
        let creds = crate::pipeline::git::RepoCredentials {
            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
+            auth_token: view.auth_token.clone(),
+            auth_username: view.auth_username.clone(),
        };
        let git_ops =
            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
+        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
            Ok(p) => p,
            Err(e) => {
                tracing::error!("Failed to clone repo for embedding build: {e}");
@@ -255,7 +255,7 @@ pub async fn get_file_content(

    // Look up the repository to get repo name
    let repo = db
-        .repositories()
+        .onboarded_targets()
        .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
@@ -317,7 +317,7 @@ pub async fn trigger_build(
    let agent_clone = (*agent).clone();
    tokio::spawn(async move {
        let repo = match db
-            .repositories()
+            .onboarded_targets()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
            .await
        {
@@ -328,14 +328,22 @@ pub async fn trigger_build(
            }
        };

+        let code = match repo.code_artifact() {
+            Some(c) => c,
+            None => {
+                tracing::error!("Target {repo_id} has no code artifact for graph build");
+                return;
+            }
+        };
+        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
        let creds = crate::pipeline::git::RepoCredentials {
            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
+            auth_token: view.auth_token.clone(),
+            auth_username: view.auth_username.clone(),
        };
        let git_ops =
            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
+        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
            Ok(p) => p,
            Err(e) => {
                tracing::error!("Failed to clone repo for graph build: {e}");
@@ -10,6 +10,18 @@ pub async fn health() -> Json<serde_json::Value> {
    Json(serde_json::json!({ "status": "ok" }))
 }

+/// GET /api/v1/settings/ssh-public-key — the agent's SSH deploy public key,
+/// for adding as a read-only deploy key on private git targets.
+#[tracing::instrument(skip_all)]
+pub async fn get_ssh_public_key(
+    axum::extract::Extension(agent): AgentExt,
+) -> Result<Json<serde_json::Value>, axum::http::StatusCode> {
+    let public_path = format!("{}.pub", agent.config.ssh_key_path);
+    let public_key =
+        std::fs::read_to_string(&public_path).map_err(|_| axum::http::StatusCode::NOT_FOUND)?;
+    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
+}
+
 #[tracing::instrument(skip_all)]
 pub async fn stats_overview(
    axum::extract::Extension(agent): AgentExt,
@@ -19,7 +31,7 @@ pub async fn stats_overview(
    let db = &db;

    let total_repositories = db
-        .repositories()
+        .onboarded_targets()
        .count_documents(doc! {})
        .await
        .unwrap_or(0);
@@ -0,0 +1,186 @@
+//! `/api/v1/mcp-tokens` — per-tenant API tokens for the MCP server.
+//!
+//! These are opaque static bearers issued via the dashboard (or a
+//! direct curl with a KC JWT) and copied into LLM clients (Claude
+//! Desktop / Cursor / ChatGPT). The MCP server hashes incoming bearers
+//! and looks them up in the cross-tenant `<prefix>__admin.mcp_tokens`
+//! collection to derive the tenant_id for routing.
+//!
+//! The raw token is shown to the caller exactly once at creation; the
+//! database only ever stores the SHA-256 hash. Revocation is a soft
+//! delete (sets `revoked: true`) so the audit log keeps the record.
+
+use axum::extract::{Extension, Path};
+use axum::http::StatusCode;
+use axum::Json;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use compliance_core::models::{McpToken, McpTokenView};
+use compliance_core::tenant_ctx::TenantCtx;
+use mongodb::bson::doc;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+
+use super::dto::{AgentExt, ApiResponse};
+
+/// Mongo collection name inside the admin DB.
+const COLLECTION: &str = "mcp_tokens";
+
+/// Token prefix the MCP server expects on every bearer.
+const TOKEN_PREFIX: &str = "mcpt_";
+
+/// Bytes of randomness behind each token. 32 → ~256 bits.
+/// Encoded as URL-safe base64 without padding → 43 chars.
+/// Combined with `mcpt_` → 48-char tokens.
+const TOKEN_RAND_BYTES: usize = 32;
+
+#[derive(serde::Deserialize)]
+pub struct CreateMcpTokenRequest {
+    pub name: String,
+}
+
+/// Returned exactly once at creation. The `token` field is gone from
+/// the listing endpoint — the user must save it now.
+#[derive(serde::Serialize)]
+pub struct CreateMcpTokenResponse {
+    pub token: String,
+    pub view: McpTokenView,
+}
+
+/// `POST /api/v1/mcp-tokens` — mint a new token for the caller's tenant.
+#[tracing::instrument(skip_all)]
+pub async fn create_mcp_token(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<CreateMcpTokenRequest>,
+) -> Result<Json<CreateMcpTokenResponse>, StatusCode> {
+    if req.name.trim().is_empty() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    let raw = generate_token();
+    let token_hash = sha256_hex(&raw);
+    let token_prefix: String = raw.chars().take(12).collect();
+
+    let mut token = McpToken {
+        id: None,
+        token_hash,
+        token_prefix,
+        tenant_id: tenant.0.tenant_id.clone(),
+        name: req.name.trim().to_string(),
+        created_by: tenant.0.user_id.clone(),
+        created_at: chrono::Utc::now(),
+        last_used_at: None,
+        revoked: false,
+    };
+
+    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
+    let res = col.insert_one(&token).await.map_err(|e| {
+        tracing::error!("Failed to insert MCP token: {e}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    token.id = res.inserted_id.as_object_id();
+
+    Ok(Json(CreateMcpTokenResponse {
+        view: McpTokenView::from(&token),
+        token: raw,
+    }))
+}
+
+/// `GET /api/v1/mcp-tokens` — list tokens for the caller's tenant.
+/// Hash is never returned; only metadata + the 12-char prefix so the
+/// user can identify which row is which.
+#[tracing::instrument(skip_all)]
+pub async fn list_mcp_tokens(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+) -> Result<Json<ApiResponse<Vec<McpTokenView>>>, StatusCode> {
+    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
+    let mut cursor = col
+        .find(doc! { "tenant_id": &tenant.0.tenant_id })
+        .sort(doc! { "created_at": -1 })
+        .await
+        .map_err(|e| {
+            tracing::error!("Failed to list MCP tokens: {e}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    let mut out = Vec::new();
+    while cursor.advance().await.map_err(|e| {
+        tracing::warn!("MCP tokens cursor advance failed: {e}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })? {
+        match cursor.deserialize_current() {
+            Ok(t) => out.push(McpTokenView::from(&t)),
+            Err(e) => tracing::warn!("Failed to deserialize MCP token: {e}"),
+        }
+    }
+    Ok(Json(ApiResponse {
+        data: out,
+        total: None,
+        page: None,
+    }))
+}
+
+/// `DELETE /api/v1/mcp-tokens/{id}` — revoke (soft delete).
+/// Scoped to the caller's tenant: a user can't revoke another tenant's
+/// token even if they guess its id.
+#[tracing::instrument(skip_all, fields(id = %id))]
+pub async fn revoke_mcp_token(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
+    let result = col
+        .update_one(
+            doc! { "_id": oid, "tenant_id": &tenant.0.tenant_id },
+            doc! { "$set": { "revoked": true } },
+        )
+        .await
+        .map_err(|e| {
+            tracing::error!("Failed to revoke MCP token: {e}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    if result.matched_count == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+    Ok(Json(serde_json::json!({ "status": "revoked" })))
+}
+
+/// 32 bytes random → URL-safe base64 → 43 chars, no padding.
+/// Prefixed with `mcpt_` so the MCP server can sniff the format
+/// before bothering with the DB lookup.
+fn generate_token() -> String {
+    let mut bytes = [0u8; TOKEN_RAND_BYTES];
+    rand::rng().fill_bytes(&mut bytes);
+    format!("{TOKEN_PREFIX}{}", URL_SAFE_NO_PAD.encode(bytes))
+}
+
+fn sha256_hex(s: &str) -> String {
+    let mut h = Sha256::new();
+    h.update(s.as_bytes());
+    hex::encode(h.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generated_tokens_are_unique_and_prefixed() {
+        let a = generate_token();
+        let b = generate_token();
+        assert_ne!(a, b);
+        assert!(a.starts_with(TOKEN_PREFIX));
+        assert!(b.starts_with(TOKEN_PREFIX));
+        // 5 + 43 = 48 chars
+        assert_eq!(a.len(), 5 + 43);
+    }
+
+    #[test]
+    fn sha256_is_stable_and_64_hex() {
+        let h = sha256_hex("mcpt_abc");
+        assert_eq!(h.len(), 64);
+        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
+        assert_eq!(sha256_hex("mcpt_abc"), h);
+    }
+}
@@ -7,10 +7,11 @@ pub mod graph;
 pub mod health;
 pub mod help_chat;
 pub mod issues;
+pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
-pub mod repos;
 pub mod sbom;
 pub mod scans;

@@ -19,6 +20,5 @@ pub use dto::*;
 pub use findings::*;
 pub use health::*;
 pub use issues::*;
-pub use repos::*;
 pub use sbom::*;
 pub use scans::*;
@@ -0,0 +1,614 @@
+//! Onboarding API — CRUD for unified targets, artifact add, classification, and
+//! the scan-applicability matrix. The wizard (and future integrations) drive
+//! onboarding through these endpoints.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use axum::extract::{Extension, Multipart, Path, Query};
+use axum::http::StatusCode;
+use axum::Json;
+use mongodb::bson::{doc, oid::ObjectId, to_bson};
+use serde::{Deserialize, Serialize};
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
+    TargetType,
+};
+use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
+use compliance_core::tenant_ctx::TenantCtx;
+
+use crate::agent::ComplianceAgent;
+use crate::classify::{classify_target, MockFirmwareDetector};
+
+use super::dto::tenant_db;
+use super::{collect_cursor_async, ApiResponse, PaginationParams};
+
+type AgentExt = Extension<Arc<ComplianceAgent>>;
+
+/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
+/// id) from it, so clients never set internal fields.
+#[derive(Deserialize)]
+pub struct ArtifactInput {
+    pub kind: ArtifactKind,
+    pub source_ref: String,
+    #[serde(default)]
+    pub branch: Option<String>,
+    #[serde(default)]
+    pub plc_format: Option<PlcFormat>,
+}
+
+impl ArtifactInput {
+    fn build(&self) -> Artifact {
+        let s = self.source_ref.clone();
+        match self.kind {
+            ArtifactKind::GitRepo => {
+                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
+            }
+            ArtifactKind::LiveUrl => Artifact::live_url(s),
+            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
+            ArtifactKind::SourceArchive => Artifact::source_archive(s),
+            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
+            ArtifactKind::ContainerImage => Artifact::container_image(s),
+            ArtifactKind::PlcProject => {
+                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
+            }
+            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub struct CreateTargetRequest {
+    pub name: String,
+    pub target_type: TargetType,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub artifacts: Vec<ArtifactInput>,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateTargetRequest {
+    pub name: Option<String>,
+    pub target_type: Option<TargetType>,
+    pub scan_config: Option<TargetScanConfig>,
+    pub compliance_profile: Option<ComplianceProfile>,
+    pub scan_schedule: Option<String>,
+    /// Replace the target's artifacts wholesale (used by the dashboard editor).
+    #[serde(default)]
+    pub artifacts: Option<Vec<ArtifactInput>>,
+}
+
+/// One applicable-scan option, serialized for the wizard.
+#[derive(Serialize)]
+pub struct ScanOptionDto {
+    pub scan: String,
+    pub default_on: bool,
+    pub rationale: String,
+    pub required_artifact: Option<String>,
+    pub blocked_reason: Option<String>,
+}
+
+#[derive(Serialize)]
+pub struct ApplicableScansResponse {
+    pub scans: Vec<ScanOptionDto>,
+    pub pentest_supported: bool,
+}
+
+fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
+    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+/// GET /api/v1/targets — list onboarded targets (paginated).
+#[tracing::instrument(skip_all)]
+pub async fn list_targets(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
+    let db = tenant_db(&agent, &tenant).await?;
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = db
+        .onboarded_targets()
+        .count_documents(doc! {})
+        .await
+        .unwrap_or(0);
+    let targets = match db
+        .onboarded_targets()
+        .find(doc! {})
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch onboarded targets: {e}");
+            Vec::new()
+        }
+    };
+    Ok(Json(ApiResponse {
+        data: targets,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+/// POST /api/v1/targets — create an onboarded target.
+#[tracing::instrument(skip_all)]
+pub async fn create_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<CreateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let mut target = OnboardedTarget::new(req.name, req.target_type);
+    target.description = req.description;
+    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
+
+    let db = tenant_db(&agent, &tenant).await?;
+    let res = db
+        .onboarded_targets()
+        .insert_one(&target)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.id = res.inserted_id.as_object_id();
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/targets/{id} — fetch one target.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn get_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// PATCH /api/v1/targets/{id} — update mutable fields.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn update_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+
+    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
+    if let Some(name) = req.name {
+        set.insert("name", name);
+    }
+    if let Some(tt) = req.target_type {
+        set.insert(
+            "target_type",
+            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(sc) = req.scan_config {
+        set.insert(
+            "scan_config",
+            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(cp) = req.compliance_profile {
+        set.insert(
+            "compliance_profile",
+            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(ss) = req.scan_schedule {
+        set.insert("scan_schedule", ss);
+    }
+    if let Some(arts) = req.artifacts {
+        let built: Vec<Artifact> = arts.iter().map(ArtifactInput::build).collect();
+        set.insert(
+            "artifacts",
+            to_bson(&built).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+
+    db.onboarded_targets()
+        .update_one(doc! { "_id": oid }, doc! { "$set": set })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn delete_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    db.onboarded_targets()
+        .delete_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    // Cascade all data keyed by repo_id == target id (best-effort).
+    let db = &db;
+    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db
+        .tracker_issues()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db
+        .impact_analyses()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db
+        .code_embeddings()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db
+        .embedding_builds()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+
+    // DAST targets linked to this target, and all their downstream data.
+    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
+        use futures_util::StreamExt;
+        while let Some(Ok(dt)) = cursor.next().await {
+            let dast_target_id = dt.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !dast_target_id.is_empty() {
+                cascade_delete_dast_target(db, &dast_target_id).await;
+            }
+        }
+    }
+
+    // Pentest sessions linked directly to this target (not via a DAST target).
+    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
+        use futures_util::StreamExt;
+        while let Some(Ok(session)) = cursor.next().await {
+            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !session_id.is_empty() {
+                let _ = db
+                    .attack_chain_nodes()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .pentest_messages()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .dast_findings()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+            }
+        }
+    }
+    let _ = db
+        .pentest_sessions()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+
+    Ok(Json(serde_json::json!({ "status": "deleted" })))
+}
+
+/// Delete a DAST target and everything downstream of it (pentest sessions +
+/// their attack chains / messages / findings, DAST scan runs + findings).
+async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
+    use futures_util::StreamExt;
+    if let Ok(mut cursor) = db
+        .pentest_sessions()
+        .find(doc! { "target_id": target_id })
+        .await
+    {
+        while let Some(Ok(session)) = cursor.next().await {
+            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !session_id.is_empty() {
+                let _ = db
+                    .attack_chain_nodes()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .pentest_messages()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .dast_findings()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+            }
+        }
+    }
+    let _ = db
+        .pentest_sessions()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    let _ = db
+        .dast_findings()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    let _ = db
+        .dast_scan_runs()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
+        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
+    }
+}
+
+/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn add_artifact(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(input): Json<ArtifactInput>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// POST /api/v1/targets/{id}/artifacts/upload — attach an artifact by uploading
+/// its file (PLC project, firmware image, source archive, mobile package). The
+/// bytes are written to the artifact blob store and referenced by `stored_path`,
+/// so ingest resolves them locally (no URL fetch).
+///
+/// Multipart fields: `file` (required), `kind` (required, snake_case
+/// `ArtifactKind`), `plc_format` (optional, for PLC projects).
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn upload_artifact(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    mut multipart: Multipart,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    if db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .is_none()
+    {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let mut kind: Option<ArtifactKind> = None;
+    let mut plc_format: Option<PlcFormat> = None;
+    let mut filename = String::from("upload.bin");
+    let mut bytes: Option<axum::body::Bytes> = None;
+
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|_| StatusCode::BAD_REQUEST)?
+    {
+        match field.name().unwrap_or("") {
+            "kind" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                kind = parse_enum(&v);
+            }
+            "plc_format" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                plc_format = parse_enum(&v);
+            }
+            "file" => {
+                if let Some(fname) = field.file_name() {
+                    filename = fname.to_string();
+                }
+                bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
+            }
+            _ => {}
+        }
+    }
+
+    let (Some(kind), Some(bytes)) = (kind, bytes) else {
+        return Err(StatusCode::BAD_REQUEST);
+    };
+
+    // Store the uploaded bytes under the artifact blob store.
+    let safe_name: String = filename
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
+                c
+            } else {
+                '_'
+            }
+        })
+        .collect();
+    let dir = std::path::Path::new(&agent.config.artifact_store_base_path)
+        .join("uploads")
+        .join(&id);
+    std::fs::create_dir_all(&dir).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let dest = dir.join(format!("{}_{safe_name}", uuid::Uuid::new_v4()));
+    std::fs::write(&dest, bytes.as_ref()).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    // Build the artifact for this kind, referencing the stored file.
+    let mut artifact = match kind {
+        ArtifactKind::PlcProject => Artifact::plc_project(
+            filename.clone(),
+            plc_format.unwrap_or(PlcFormat::PlcopenXml),
+        ),
+        ArtifactKind::FirmwareImage => Artifact::firmware_image(filename.clone()),
+        ArtifactKind::SourceArchive => Artifact::source_archive(filename.clone()),
+        ArtifactKind::MobilePackage => Artifact::mobile_package(filename.clone()),
+        // Non-file kinds (git repo, live URL, container ref, text) use the JSON
+        // add-artifact endpoint, not upload.
+        _ => return Err(StatusCode::BAD_REQUEST),
+    };
+    artifact.stored_path = Some(dest.to_string_lossy().to_string());
+    artifact.size_bytes = Some(bytes.len() as u64);
+
+    let artifact_bson = to_bson(&artifact).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$push": { "artifacts": artifact_bson }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// Deserialize a snake_case enum value from a plain string.
+fn parse_enum<T: for<'de> Deserialize<'de>>(s: &str) -> Option<T> {
+    serde_json::from_value(serde_json::Value::String(s.to_string())).ok()
+}
+
+/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn applicable_scans_for_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    let scans = applicable_scans(&target)
+        .into_iter()
+        .map(|o| ScanOptionDto {
+            scan: o.scan.to_string(),
+            default_on: o.default_on,
+            rationale: o.rationale,
+            required_artifact: o.required_artifact.map(|k| k.to_string()),
+            blocked_reason: o.blocked_reason,
+        })
+        .collect();
+
+    Ok(Json(ApiResponse {
+        data: ApplicableScansResponse {
+            scans,
+            pentest_supported: supports_pentest(target.target_type),
+        },
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
+///
+/// This is the lightweight pass: it classifies from artifact kinds without
+/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
+/// ingest, with tramiton firmware analysis) is a follow-up background step.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn detect_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let mut target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // No ingested working paths here → kind-based classification only; the mock
+    // firmware detector is never invoked (no firmware working path present).
+    let empty = HashMap::new();
+    let detector = MockFirmwareDetector { detection: None };
+    let classification = classify_target(&target, &empty, &detector)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let classification_bson =
+        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.classification = Some(classification);
+
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
+///
+/// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
+/// legacy path). Runs in the background and returns immediately.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn trigger_target_scan(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    // 404 if the target doesn't exist for this tenant.
+    if db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .is_none()
+    {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let agent_clone = (*agent).clone();
+    let tenant_id = tenant.0.tenant_id.clone();
+    tokio::spawn(async move {
+        // Always the unified target pipeline — this endpoint is about an
+        // onboarded target by construction, independent of the global
+        // `unified_pipeline` transition flag used by the legacy paths.
+        if let Err(e) = agent_clone
+            .run_target_scan(
+                &tenant_id,
+                &id,
+                compliance_core::models::ScanTrigger::Manual,
+            )
+            .await
+        {
+            tracing::error!("Manual target scan failed for {id}: {e}");
+        }
+    });
+    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
+}
@@ -113,14 +113,14 @@ pub async fn create_session(
        session.config = Some(config.clone());
        session.repo_id = target.repo_id.clone();

-        // Resolve repo_id from git_repo_url if provided
+        // Resolve repo_id (target id) from git_repo_url if provided
        if let Some(ref git_url) = config.git_repo_url {
-            if let Ok(Some(repo)) = db
-                .repositories()
-                .find_one(doc! { "git_url": git_url })
+            if let Ok(Some(target)) = db
+                .onboarded_targets()
+                .find_one(doc! { "artifacts.source_ref": git_url })
                .await
            {
-                session.repo_id = repo.id.map(|oid| oid.to_hex());
+                session.repo_id = target.id.map(|oid| oid.to_hex());
            }
        }

@@ -380,17 +380,20 @@ pub async fn lookup_repo(
 ) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
    let db = tenant_db(&agent, &tenant).await?;
    let repo = db
-        .repositories()
-        .find_one(doc! { "git_url": &params.url })
+        .onboarded_targets()
+        .find_one(doc! { "artifacts.source_ref": &params.url })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

    let data = match repo {
-        Some(r) => serde_json::json!({
+        Some(r) => {
+            let git = r.code_artifact().and_then(|c| c.git.as_ref());
+            serde_json::json!({
                "name": r.name,
-            "default_branch": r.default_branch,
-            "last_scanned_commit": r.last_scanned_commit,
-        }),
+                "default_branch": git.map(|g| g.default_branch.clone()),
+                "last_scanned_commit": git.and_then(|g| g.last_scanned_commit.clone()),
+            })
+        }
        None => serde_json::Value::Null,
    };

@@ -1,339 +0,0 @@
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::*;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all)]
-pub async fn list_repositories(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> ApiResult<Vec<TrackedRepository>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .repositories()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-
-    let repos = match db
-        .repositories()
-        .find(doc! {})
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch repositories: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: repos,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn add_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<AddRepositoryRequest>,
-) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
-    // Validate repository access before saving
-    let creds = crate::pipeline::git::RepoCredentials {
-        ssh_key_path: Some(agent.config.ssh_key_path.clone()),
-        auth_token: req.auth_token.clone(),
-        auth_username: req.auth_username.clone(),
-    };
-
-    if let Err(e) = crate::pipeline::git::GitOps::test_access(&req.git_url, &creds) {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Cannot access repository: {e}"),
-        ));
-    }
-
-    let mut repo = TrackedRepository::new(req.name, req.git_url);
-    repo.default_branch = req.default_branch;
-    repo.auth_token = req.auth_token;
-    repo.auth_username = req.auth_username;
-    repo.tracker_type = req.tracker_type;
-    repo.tracker_owner = req.tracker_owner;
-    repo.tracker_repo = req.tracker_repo;
-    repo.tracker_token = req.tracker_token;
-    repo.scan_schedule = req.scan_schedule;
-
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-    db.repositories().insert_one(&repo).await.map_err(|_| {
-        (
-            StatusCode::CONFLICT,
-            "Repository already exists".to_string(),
-        )
-    })?;
-
-    Ok(Json(ApiResponse {
-        data: repo,
-        total: None,
-        page: None,
-    }))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn update_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateRepositoryRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut set_doc = doc! { "updated_at": mongodb::bson::DateTime::now() };
-
-    if let Some(name) = &req.name {
-        set_doc.insert("name", name);
-    }
-    if let Some(branch) = &req.default_branch {
-        set_doc.insert("default_branch", branch);
-    }
-    if let Some(token) = &req.auth_token {
-        set_doc.insert("auth_token", token);
-    }
-    if let Some(username) = &req.auth_username {
-        set_doc.insert("auth_username", username);
-    }
-    if let Some(tracker_type) = &req.tracker_type {
-        set_doc.insert("tracker_type", tracker_type.to_string());
-    }
-    if let Some(owner) = &req.tracker_owner {
-        set_doc.insert("tracker_owner", owner);
-    }
-    if let Some(repo) = &req.tracker_repo {
-        set_doc.insert("tracker_repo", repo);
-    }
-    if let Some(token) = &req.tracker_token {
-        set_doc.insert("tracker_token", token);
-    }
-    if let Some(schedule) = &req.scan_schedule {
-        set_doc.insert("scan_schedule", schedule);
-    }
-
-    let result = db
-        .repositories()
-        .update_one(doc! { "_id": oid }, doc! { "$set": set_doc })
-        .await
-        .map_err(|e| {
-            tracing::warn!("Failed to update repository: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    Ok(Json(serde_json::json!({ "status": "updated" })))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn get_ssh_public_key(
-    Extension(agent): AgentExt,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let public_path = format!("{}.pub", agent.config.ssh_key_path);
-    let public_key = std::fs::read_to_string(&public_path).map_err(|_| StatusCode::NOT_FOUND)?;
-    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn trigger_scan(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let agent_clone = (*agent).clone();
-    let tenant_id = tenant.0.tenant_id.clone();
-    tokio::spawn(async move {
-        if let Err(e) = agent_clone
-            .run_scan(&tenant_id, &id, ScanTrigger::Manual)
-            .await
-        {
-            tracing::error!("Manual scan failed for {id}: {e}");
-        }
-    });
-
-    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
-}
-
-/// Return the webhook secret for a repository (used by dashboard to display it)
-pub async fn get_webhook_config(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let repo = db
-        .repositories()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    let tracker_type = repo
-        .tracker_type
-        .as_ref()
-        .map(|t| t.to_string())
-        .unwrap_or_else(|| "gitea".to_string());
-
-    Ok(Json(serde_json::json!({
-        "webhook_secret": repo.webhook_secret,
-        "tracker_type": tracker_type,
-    })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn delete_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    // Delete the repository
-    let result = db
-        .repositories()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    if result.deleted_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    // Cascade delete all related data
-    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .tracker_issues()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .impact_analyses()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .code_embeddings()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .embedding_builds()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    // Cascade delete DAST targets linked to this repo, and all their downstream data
-    // (scan runs, findings, pentest sessions, attack chains, messages)
-    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(target)) = cursor.next().await {
-            let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !target_id.is_empty() {
-                cascade_delete_dast_target(db, &target_id).await;
-            }
-        }
-    }
-
-    // Also delete pentest sessions linked directly to this repo (not via target)
-    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                // Delete DAST findings produced by this session
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    Ok(Json(serde_json::json!({ "status": "deleted" })))
-}
-
-/// Cascade-delete a DAST target and all its downstream data.
-async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
-    // Delete pentest sessions for this target (and their attack chains + messages)
-    if let Ok(mut cursor) = db
-        .pentest_sessions()
-        .find(doc! { "target_id": target_id })
-        .await
-    {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-
-    // Delete DAST scan runs and their findings
-    let _ = db
-        .dast_findings()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-    let _ = db
-        .dast_scan_runs()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-
-    // Delete the target itself
-    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
-        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
-    }
-}
@@ -282,7 +282,7 @@ pub async fn license_summary(
            }
        })
        .collect();
-    summaries.sort_by(|a, b| b.count.cmp(&a.count));
+    summaries.sort_by_key(|s| std::cmp::Reverse(s.count));

    Ok(Json(ApiResponse {
        data: summaries,
@@ -2,7 +2,6 @@ use axum::routing::{delete, get, patch, post};
 use axum::Router;

 use crate::api::handlers;
-use crate::webhooks;

 pub fn build_router() -> Router {
    Router::new()
@@ -12,19 +11,36 @@ pub fn build_router() -> Router {
            "/api/v1/settings/ssh-public-key",
            get(handlers::get_ssh_public_key),
        )
-        .route("/api/v1/repositories", get(handlers::list_repositories))
-        .route("/api/v1/repositories", post(handlers::add_repository))
+        // Unified onboarding targets (#131).
        .route(
-            "/api/v1/repositories/{id}/scan",
-            post(handlers::trigger_scan),
+            "/api/v1/targets",
+            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
        )
        .route(
-            "/api/v1/repositories/{id}",
-            delete(handlers::delete_repository).patch(handlers::update_repository),
+            "/api/v1/targets/{id}",
+            get(handlers::onboarding::get_target)
+                .patch(handlers::onboarding::update_target)
+                .delete(handlers::onboarding::delete_target),
        )
        .route(
-            "/api/v1/repositories/{id}/webhook-config",
-            get(handlers::get_webhook_config),
+            "/api/v1/targets/{id}/artifacts",
+            post(handlers::onboarding::add_artifact),
+        )
+        .route(
+            "/api/v1/targets/{id}/artifacts/upload",
+            post(handlers::onboarding::upload_artifact),
+        )
+        .route(
+            "/api/v1/targets/{id}/applicable-scans",
+            get(handlers::onboarding::applicable_scans_for_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/detect",
+            post(handlers::onboarding::detect_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/scan",
+            post(handlers::onboarding::trigger_target_scan),
        )
        .route("/api/v1/findings", get(handlers::list_findings))
        .route("/api/v1/findings/{id}", get(handlers::get_finding))
@@ -47,6 +63,15 @@ pub fn build_router() -> Router {
        .route("/api/v1/sbom/diff", get(handlers::sbom_diff))
        .route("/api/v1/issues", get(handlers::list_issues))
        .route("/api/v1/scan-runs", get(handlers::list_scan_runs))
+        // MCP token management (per-tenant API tokens for the MCP server)
+        .route(
+            "/api/v1/mcp-tokens",
+            get(handlers::mcp_tokens::list_mcp_tokens).post(handlers::mcp_tokens::create_mcp_token),
+        )
+        .route(
+            "/api/v1/mcp-tokens/{id}",
+            delete(handlers::mcp_tokens::revoke_mcp_token),
+        )
        // Graph API endpoints
        .route("/api/v1/graph/{repo_id}", get(handlers::graph::get_graph))
        .route(
@@ -175,17 +200,10 @@ pub fn build_router() -> Router {
            "/api/v1/pentest/stats",
            get(handlers::pentest::pentest_stats),
        )
-        // Webhook endpoints (proxied through dashboard)
-        .route(
-            "/webhook/github/{repo_id}",
-            post(webhooks::github::handle_github_webhook),
-        )
-        .route(
-            "/webhook/gitlab/{repo_id}",
-            post(webhooks::gitlab::handle_gitlab_webhook),
-        )
-        .route(
-            "/webhook/gitea/{repo_id}",
-            post(webhooks::gitea::handle_gitea_webhook),
-        )
+    // Webhook routes live on the separate webhook server (port 3002,
+    // see crate::webhooks::server). The M7.2-C tenant-in-URL form is
+    // `/webhook/{tenant_id}/{platform}/{repo_id}` and the handlers
+    // expect a (tenant_id, repo_id) path tuple. Anything mounting
+    // them here on the API server would mismatch the handler
+    // signature, so the routes are not exported.
 }
@@ -1,6 +1,6 @@
 use std::sync::Arc;

-use axum::extract::Request;
+use axum::extract::{DefaultBodyLimit, Request};
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
@@ -74,6 +74,9 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A

    let mut app = routes::build_router()
        .merge(admin_router)
+        // Allow large artifact uploads (PLC .projectarchive, firmware images,
+        // mobile packages) — axum's default request-body limit is only 2 MiB.
+        .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
        .layer(Extension(Arc::new(agent.clone())))
        .layer(CorsLayer::permissive())
        .layer(TraceLayer::new_for_http())
@@ -0,0 +1,217 @@
+//! Firmware classification via tramiton.
+//!
+//! tramiton is the company's firmware build/repro engine; we do not re-implement
+//! its detection. We depend on `tramiton-core` directly (same-company IP) and run
+//! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
+//! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
+//! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
+//! tramiton sources nor a real firmware tree.
+
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{DetectedFact, TargetType};
+use compliance_core::traits::ClassifierVerdict;
+
+/// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
+/// Kept small and tramiton-independent so the classifier and the test mock don't
+/// need to construct a full tramiton plan.
+#[derive(Debug, Clone, Default)]
+pub struct FirmwareDetection {
+    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
+    pub provider: String,
+    /// Detection confidence: `low` | `medium` | `high`.
+    pub confidence: String,
+    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
+    pub build_system: String,
+    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
+    pub framework: Option<String>,
+    /// Target board / MCU / arch.
+    pub target: FirmwareTarget,
+    /// Unresolved gaps in the plan.
+    pub gaps: Vec<String>,
+}
+
+/// The detected firmware target (board / MCU / arch).
+#[derive(Debug, Clone, Default)]
+pub struct FirmwareTarget {
+    /// Board name.
+    pub board: Option<String>,
+    /// MCU part.
+    pub mcu: Option<String>,
+    /// Architecture.
+    pub arch: Option<String>,
+}
+
+/// A source of tramiton firmware detection.
+#[allow(async_fn_in_trait)]
+pub trait FirmwareDetector: Send + Sync {
+    /// Run detection over a path, returning a firmware detection if tramiton
+    /// could form a build plan.
+    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
+}
+
+/// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
+/// so it runs on a blocking thread to avoid stalling the async runtime. A path
+/// with no recognizable build system yields `Ok(None)`.
+pub struct TramitonNative;
+
+impl FirmwareDetector for TramitonNative {
+    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
+        let path = path.to_path_buf();
+        let plan = tokio::task::spawn_blocking(move || {
+            let repo = tramiton_core::Repo::new(&path);
+            tramiton_core::provider::analyze(&repo)
+        })
+        .await
+        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
+        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
+        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
+    }
+}
+
+/// Map tramiton's `BuildPlan` onto our minimal detection summary.
+fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
+    FirmwareDetection {
+        provider: bp.provider.clone(),
+        confidence: bp.confidence.to_string(),
+        build_system: bp.build_system.label().to_string(),
+        framework: bp.framework.clone(),
+        target: FirmwareTarget {
+            board: bp.target.board.clone(),
+            mcu: bp.target.mcu.clone(),
+            arch: bp.target.arch.clone(),
+        },
+        gaps: bp.gaps.clone(),
+    }
+}
+
+/// Map a firmware detection to a target type. Framework/build-system signals
+/// distinguish RTOS from bare-metal from Yocto.
+pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
+    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
+    let build_system = det.build_system.to_lowercase();
+    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
+
+    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
+    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
+        TargetType::EmbeddedLinuxYocto
+    } else if RTOS.iter().any(|k| signal.contains(k)) {
+        TargetType::FirmwareRtos
+    } else {
+        TargetType::FirmwareBareMetal
+    }
+}
+
+/// Map tramiton's confidence label to a `[0,1]` score.
+fn confidence_score(label: &str) -> f32 {
+    match label.to_lowercase().as_str() {
+        "high" => 0.9,
+        "medium" => 0.6,
+        "low" => 0.3,
+        _ => 0.4,
+    }
+}
+
+/// Turn a firmware detection into a classifier verdict, carrying the MCU / board
+/// / build-system as facts.
+pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
+    let target_type = detection_to_target_type(det);
+    let mut facts = vec![DetectedFact::new(
+        "build_system",
+        det.build_system.clone(),
+        "tramiton",
+    )];
+    if let Some(fw) = &det.framework {
+        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
+    }
+    if let Some(mcu) = &det.target.mcu {
+        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
+    }
+    if let Some(board) = &det.target.board {
+        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
+    }
+    if let Some(arch) = &det.target.arch {
+        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
+    }
+    ClassifierVerdict {
+        target_type,
+        confidence: confidence_score(&det.confidence),
+        facts,
+        rationale: format!(
+            "tramiton detected build system '{}'{}",
+            det.build_system,
+            det.framework
+                .as_ref()
+                .map(|f| format!(" (framework {f})"))
+                .unwrap_or_default()
+        ),
+    }
+}
+
+/// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
+pub struct MockFirmwareDetector {
+    /// The detection to return (or `None` for "no detection").
+    pub detection: Option<FirmwareDetection>,
+}
+
+impl FirmwareDetector for MockFirmwareDetector {
+    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
+        Ok(self.detection.clone())
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
+        FirmwareDetection {
+            provider: build_system.to_string(),
+            confidence: "high".to_string(),
+            build_system: build_system.to_string(),
+            framework: framework.map(|s| s.to_string()),
+            target: FirmwareTarget {
+                mcu: Some("stm32f429".to_string()),
+                ..Default::default()
+            },
+            gaps: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn zephyr_maps_to_rtos() {
+        assert_eq!(
+            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
+            TargetType::FirmwareRtos
+        );
+    }
+
+    #[test]
+    fn bare_cmake_maps_to_bare_metal() {
+        assert_eq!(
+            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
+            TargetType::FirmwareBareMetal
+        );
+    }
+
+    #[test]
+    fn bitbake_maps_to_yocto() {
+        assert_eq!(
+            detection_to_target_type(&detection("bitbake", None)),
+            TargetType::EmbeddedLinuxYocto
+        );
+    }
+
+    #[test]
+    fn verdict_carries_mcu_fact_and_confidence() {
+        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
+        assert_eq!(v.target_type, TargetType::FirmwareRtos);
+        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
+        assert!(v
+            .facts
+            .iter()
+            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
+    }
+}
@@ -0,0 +1,357 @@
+//! Heuristic target-type classification from artifact kinds and source markers.
+//!
+//! Complements the tramiton firmware detector: this handles web / backend /
+//! mobile / desktop / PLC by sniffing manifest files and file extensions in the
+//! ingested code trees, plus strong priors from the artifact kinds themselves
+//! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
+
+use std::collections::HashSet;
+use std::fs;
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
+use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+
+/// Max directory depth scanned for marker files.
+const SCAN_DEPTH: usize = 2;
+
+/// Markers collected from a code tree.
+#[derive(Default)]
+struct Markers {
+    files: HashSet<String>,
+    dirs: HashSet<String>,
+    exts: HashSet<String>,
+}
+
+impl Markers {
+    fn has_file(&self, name: &str) -> bool {
+        self.files.contains(name)
+    }
+    fn has_ext(&self, ext: &str) -> bool {
+        self.exts.contains(ext)
+    }
+    fn any_dir_ends_with(&self, suffix: &str) -> bool {
+        self.dirs.iter().any(|d| d.ends_with(suffix))
+    }
+}
+
+/// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
+fn collect_markers(root: &Path) -> Markers {
+    let mut m = Markers::default();
+    scan_dir(root, 0, &mut m);
+    m
+}
+
+fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        let name = entry.file_name().to_string_lossy().to_lowercase();
+        if path.is_dir() {
+            m.dirs.insert(name);
+            if depth < SCAN_DEPTH {
+                scan_dir(&path, depth + 1, m);
+            }
+        } else {
+            if let Some(ext) = path.extension() {
+                m.exts.insert(ext.to_string_lossy().to_lowercase());
+            }
+            m.files.insert(name);
+        }
+    }
+}
+
+/// Whether a `package.json` at `root` looks like a front-end app.
+fn package_json_is_frontend(root: &Path) -> bool {
+    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
+        return false;
+    };
+    let c = content.to_lowercase();
+    ["react", "next", "vue", "@angular", "svelte", "vite"]
+        .iter()
+        .any(|f| c.contains(f))
+}
+
+/// The heuristic classifier: artifact-kind priors + source-tree markers.
+pub struct HeuristicClassifier;
+
+impl HeuristicClassifier {
+    /// Verdicts from the artifact kinds alone (no filesystem needed).
+    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
+        let mut out = Vec::new();
+        for a in input.artifacts {
+            let lower = a.source_ref.to_lowercase();
+            match a.kind {
+                ArtifactKind::PlcProject => out.push(verdict(
+                    TargetType::PlcSps,
+                    0.85,
+                    "PLC project artifact",
+                    vec![],
+                )),
+                ArtifactKind::MobilePackage => {
+                    let (tt, why) = if lower.ends_with(".ipa") {
+                        (TargetType::IosApp, "iOS package (.ipa)")
+                    } else {
+                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
+                    };
+                    out.push(verdict(tt, 0.85, why, vec![]));
+                }
+                ArtifactKind::ContainerImage => out.push(verdict(
+                    TargetType::BackendService,
+                    0.4,
+                    "container image",
+                    vec![],
+                )),
+                ArtifactKind::FirmwareImage => out.push(verdict(
+                    TargetType::FirmwareBareMetal,
+                    0.35,
+                    "firmware image (pending tramiton detection)",
+                    vec![],
+                )),
+                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
+                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
+                }
+                _ => {}
+            }
+        }
+        out
+    }
+
+    /// Verdicts from scanning the ingested code trees for manifest markers.
+    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
+        let mut out = Vec::new();
+        for a in input.artifacts {
+            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
+                continue;
+            }
+            let Some(path) = input.working_paths.get(&a.id) else {
+                continue;
+            };
+            let m = collect_markers(path);
+
+            // Mobile (checked first — strongest signal).
+            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
+                out.push(verdict(
+                    TargetType::AndroidApp,
+                    0.8,
+                    "Android manifest / gradle",
+                    facts_lang("kotlin/java"),
+                ));
+            }
+            if m.any_dir_ends_with(".xcodeproj")
+                || m.has_file("info.plist")
+                || m.has_file("podfile")
+                || m.has_ext("ipa")
+            {
+                out.push(verdict(
+                    TargetType::IosApp,
+                    0.8,
+                    "Xcode project / Info.plist",
+                    facts_lang("swift/objc"),
+                ));
+            }
+            // Desktop.
+            if m.has_ext("sln")
+                || m.has_ext("csproj")
+                || m.has_ext("vcxproj")
+                || m.has_ext("desktop")
+            {
+                out.push(verdict(
+                    TargetType::DesktopApp,
+                    0.7,
+                    "desktop project files",
+                    facts_lang("dotnet/native"),
+                ));
+            }
+            // PLC.
+            if m.has_ext("st") {
+                out.push(verdict(
+                    TargetType::PlcSps,
+                    0.8,
+                    "Structured Text sources",
+                    facts_lang("iec-61131-3"),
+                ));
+            }
+            // Web vs backend from package.json.
+            if m.has_file("package.json") {
+                if package_json_is_frontend(path) {
+                    out.push(verdict(
+                        TargetType::WebApp,
+                        0.65,
+                        "package.json with a front-end framework",
+                        facts_lang("javascript"),
+                    ));
+                } else {
+                    out.push(verdict(
+                        TargetType::BackendService,
+                        0.55,
+                        "package.json (no front-end framework)",
+                        facts_lang("javascript"),
+                    ));
+                }
+            }
+            // Backend languages.
+            for (file, lang) in [
+                ("cargo.toml", "rust"),
+                ("go.mod", "go"),
+                ("pom.xml", "java"),
+                ("requirements.txt", "python"),
+                ("pyproject.toml", "python"),
+            ] {
+                if m.has_file(file) {
+                    out.push(verdict(
+                        TargetType::BackendService,
+                        0.6,
+                        "backend build manifest",
+                        facts_lang(lang),
+                    ));
+                }
+            }
+            // Container-only.
+            if m.has_file("dockerfile") && out.is_empty() {
+                out.push(verdict(
+                    TargetType::BackendService,
+                    0.4,
+                    "Dockerfile",
+                    facts_lang("container"),
+                ));
+            }
+        }
+        out
+    }
+}
+
+impl TargetClassifier for HeuristicClassifier {
+    fn name(&self) -> &str {
+        "heuristic"
+    }
+
+    async fn classify(
+        &self,
+        input: &ClassificationInput<'_>,
+    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
+        let mut out = self.kind_priors(input);
+        out.extend(self.source_verdicts(input));
+        Ok(out)
+    }
+}
+
+fn verdict(
+    target_type: TargetType,
+    confidence: f32,
+    rationale: &str,
+    facts: Vec<DetectedFact>,
+) -> ClassifierVerdict {
+    ClassifierVerdict {
+        target_type,
+        confidence,
+        facts,
+        rationale: rationale.to_string(),
+    }
+}
+
+fn facts_lang(lang: &str) -> Vec<DetectedFact> {
+    vec![DetectedFact::new("language", lang, "heuristic")]
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::Artifact;
+    use std::collections::HashMap;
+    use std::path::PathBuf;
+
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
+        let scratch = Scratch::new();
+        setup(&scratch.0);
+        let artifact = Artifact::git_repo("https://git/x", "main");
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let artifacts = vec![artifact];
+        let input = ClassificationInput {
+            artifacts: &artifacts,
+            working_paths: &wp,
+            description: None,
+        };
+        HeuristicClassifier
+            .classify(&input)
+            .await
+            .expect("classify")
+    }
+
+    #[tokio::test]
+    async fn frontend_package_json_is_webapp() {
+        let v = classify_tree(|root| {
+            fs::write(
+                root.join("package.json"),
+                r#"{"dependencies":{"react":"18"}}"#,
+            )
+            .unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
+    }
+
+    #[tokio::test]
+    async fn cargo_toml_is_backend() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
+        })
+        .await;
+        assert!(v
+            .iter()
+            .any(|x| x.target_type == TargetType::BackendService));
+    }
+
+    #[tokio::test]
+    async fn android_manifest_is_android() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
+    }
+
+    #[tokio::test]
+    async fn structured_text_is_plc() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
+    }
+
+    #[tokio::test]
+    async fn ipa_artifact_prior_is_ios() {
+        let artifacts = vec![Artifact::mobile_package("app.ipa")];
+        let wp = HashMap::new();
+        let input = ClassificationInput {
+            artifacts: &artifacts,
+            working_paths: &wp,
+            description: None,
+        };
+        let v = HeuristicClassifier
+            .classify(&input)
+            .await
+            .expect("classify");
+        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
+    }
+}
@@ -0,0 +1,226 @@
+//! Target classification.
+//!
+//! Runs the classifier registry over a target's artifacts and their ingested
+//! working paths, then merges and ranks the verdicts into a [`Classification`].
+//! The registry is the heuristic classifier (artifact kinds + source markers)
+//! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
+
+mod firmware;
+mod language;
+
+pub use firmware::{
+    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
+};
+pub use language::HeuristicClassifier;
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{
+    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
+};
+use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+
+use firmware::detection_to_verdict;
+
+/// Classify a target from its artifacts and their ingested working paths, using
+/// the heuristic classifier plus the tramiton firmware detector. Verdicts are
+/// merged (max confidence per target type) and ranked into a [`Classification`].
+pub async fn classify_target<D: FirmwareDetector>(
+    target: &OnboardedTarget,
+    working_paths: &HashMap<String, PathBuf>,
+    firmware_detector: &D,
+) -> Result<Classification, CoreError> {
+    let input = ClassificationInput {
+        artifacts: &target.artifacts,
+        working_paths,
+        description: target.description.as_deref(),
+    };
+
+    let mut verdicts = Vec::new();
+    let mut detected_by = Vec::new();
+
+    let heuristic = HeuristicClassifier.classify(&input).await?;
+    if !heuristic.is_empty() {
+        detected_by.push("heuristic".to_string());
+    }
+    verdicts.extend(heuristic);
+
+    // Tramiton firmware detection over firmware / code working paths.
+    let mut tramiton_used = false;
+    for artifact in &target.artifacts {
+        if !matches!(
+            artifact.kind,
+            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+        ) {
+            continue;
+        }
+        let Some(path) = working_paths.get(&artifact.id) else {
+            continue;
+        };
+        if let Some(detection) = firmware_detector.detect(path).await? {
+            verdicts.push(detection_to_verdict(&detection));
+            tramiton_used = true;
+        }
+    }
+    if tramiton_used {
+        detected_by.push("tramiton".to_string());
+    }
+
+    Ok(rank(verdicts, detected_by, target.target_type))
+}
+
+/// Merge verdicts by target type (keeping the max confidence and its rationale),
+/// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
+/// Falls back to the declared type when no verdict is produced.
+fn rank(
+    verdicts: Vec<ClassifierVerdict>,
+    detected_by: Vec<String>,
+    fallback: TargetType,
+) -> Classification {
+    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
+    let mut facts: Vec<DetectedFact> = Vec::new();
+    for verdict in verdicts {
+        for fact in verdict.facts {
+            if !facts
+                .iter()
+                .any(|e| e.key == fact.key && e.value == fact.value)
+            {
+                facts.push(fact);
+            }
+        }
+        let entry = best
+            .entry(verdict.target_type)
+            .or_insert((0.0, String::new()));
+        if verdict.confidence > entry.0 {
+            *entry = (verdict.confidence, verdict.rationale);
+        }
+    }
+
+    let mut candidates: Vec<TargetTypeCandidate> = best
+        .into_iter()
+        .map(
+            |(target_type, (confidence, rationale))| TargetTypeCandidate {
+                target_type,
+                confidence,
+                rationale,
+            },
+        )
+        .collect();
+    // Descending confidence; ties broken by type name for deterministic ordering.
+    candidates.sort_by(|a, b| {
+        b.confidence
+            .partial_cmp(&a.confidence)
+            .unwrap_or(std::cmp::Ordering::Equal)
+            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
+    });
+
+    let suggested = candidates
+        .first()
+        .map(|c| c.target_type)
+        .unwrap_or(fallback);
+
+    Classification {
+        suggested,
+        candidates,
+        facts,
+        detected_by,
+        detected_at: chrono::Utc::now(),
+        confirmed: false,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::Artifact;
+    use std::fs;
+    use std::path::Path;
+
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn no_firmware() -> MockFirmwareDetector {
+        MockFirmwareDetector { detection: None }
+    }
+
+    #[tokio::test]
+    async fn backend_repo_classifies_as_backend() {
+        let scratch = Scratch::new();
+        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
+
+        let artifact = Artifact::git_repo("https://git/x", "main");
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
+        target.artifacts.push(artifact);
+
+        let c = classify_target(&target, &wp, &no_firmware())
+            .await
+            .expect("classify");
+        assert_eq!(c.suggested, TargetType::BackendService);
+        assert!(c.detected_by.contains(&"heuristic".to_string()));
+        assert!(!c.confirmed);
+    }
+
+    #[tokio::test]
+    async fn firmware_detector_verdict_ranks_top() {
+        let scratch = Scratch::new();
+        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
+
+        let artifact =
+            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
+        target.artifacts.push(artifact);
+
+        let detector = MockFirmwareDetector {
+            detection: Some(FirmwareDetection {
+                provider: "zephyr".to_string(),
+                confidence: "high".to_string(),
+                build_system: "zephyr".to_string(),
+                framework: Some("zephyr".to_string()),
+                target: FirmwareTarget {
+                    mcu: Some("nrf52840".to_string()),
+                    ..Default::default()
+                },
+                gaps: vec![],
+            }),
+        };
+
+        let c = classify_target(&target, &wp, &detector)
+            .await
+            .expect("classify");
+        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
+        assert_eq!(c.suggested, TargetType::FirmwareRtos);
+        assert!(c.detected_by.contains(&"tramiton".to_string()));
+        assert!(c.facts.iter().any(|f| f.key == "mcu"));
+    }
+
+    #[tokio::test]
+    async fn no_signal_falls_back_to_declared_type() {
+        let scratch = Scratch::new();
+        let _ = Path::new(&scratch.0);
+        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
+        let wp = HashMap::new();
+        let c = classify_target(&target, &wp, &no_firmware())
+            .await
+            .expect("classify");
+        assert_eq!(c.suggested, TargetType::DesktopApp);
+        assert!(c.candidates.is_empty());
+    }
+}
@@ -1,3 +1,4 @@
+use compliance_core::config::PlcRuntimeConfig;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;

@@ -45,6 +46,8 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
            .unwrap_or_else(|| "0 0 * * * *".to_string()),
        git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
            .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
+        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
+            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
        ssh_key_path: env_var_opt("SSH_KEY_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
        keycloak_url: env_var_opt("KEYCLOAK_URL"),
@@ -61,5 +64,28 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
        pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
        admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
        tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
+        plc_runtime: load_plc_runtime_config(),
    })
 }
+
+/// Build the ephemeral soft-PLC provisioning config from the environment,
+/// falling back to [`PlcRuntimeConfig::default`] for any unset knob. Disabled
+/// unless `PLC_RUNTIME_ENABLED` is truthy — it requires Docker access.
+fn load_plc_runtime_config() -> PlcRuntimeConfig {
+    let d = PlcRuntimeConfig::default();
+    PlcRuntimeConfig {
+        enabled: env_var_opt("PLC_RUNTIME_ENABLED")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.enabled),
+        image: env_var_opt("PLC_RUNTIME_IMAGE").unwrap_or(d.image),
+        network: env_var_opt("PLC_RUNTIME_NETWORK").unwrap_or(d.network),
+        memory: env_var_opt("PLC_RUNTIME_MEMORY").unwrap_or(d.memory),
+        cpus: env_var_opt("PLC_RUNTIME_CPUS").unwrap_or(d.cpus),
+        max_lifetime_secs: env_var_opt("PLC_RUNTIME_MAX_LIFETIME_SECS")
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(d.max_lifetime_secs),
+        openplc_user: env_var_opt("PLC_RUNTIME_OPENPLC_USER").unwrap_or(d.openplc_user),
+        openplc_password: env_secret_opt("PLC_RUNTIME_OPENPLC_PASSWORD")
+            .unwrap_or(d.openplc_password),
+    }
+}
@@ -141,6 +141,25 @@ impl DatabasePool {
        &self.client
    }

+    /// Cross-tenant admin database used by features that intentionally
+    /// span tenants (today: MCP bearer tokens — each token row carries
+    /// a `tenant_id` and the MCP server reads them to route requests).
+    ///
+    /// The name `<db_prefix>__admin` (double underscore) is reserved —
+    /// the sanitizer never produces it for a normal tenant DB because
+    /// the natural format is `<db_prefix>_<sanitized_tenant_id>` (one
+    /// underscore) and tenant_ids would have to start with `_admin` to
+    /// collide. New tenant provisioning should reject such ids.
+    pub fn admin_db(&self) -> mongodb::Database {
+        self.client.database(&self.admin_db_name())
+    }
+
+    /// Name of the admin database — public so tests / operators can
+    /// drop it via the raw client.
+    pub fn admin_db_name(&self) -> String {
+        format!("{}__admin", self.db_prefix)
+    }
+
    /// List every Mongo database currently belonging to this pool,
    /// identified by the `<db_prefix>_` prefix. The result is the raw
    /// database names — opening one for offboarding/cleanup goes
@@ -160,6 +179,23 @@ impl DatabasePool {
            .collect())
    }

+    /// Tenant ids for every provisioned tenant database, derived by stripping
+    /// the `<prefix>_` from the database names. Skips the admin database
+    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
+    /// at the cluster level and cannot be recovered here — in practice tenant
+    /// ids are UUIDs and never hit that path. Used by the migration CLI's
+    /// `--all` mode.
+    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
+        let prefix = format!("{}_", self.db_prefix);
+        Ok(self
+            .list_tenant_db_names()
+            .await?
+            .into_iter()
+            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
+            .filter(|id| !id.starts_with('_'))
+            .collect())
+    }
+
    /// Drop the database for a specific tenant. Used by GDPR delete
    /// and tenant offboarding. Idempotent — dropping a non-existent
    /// database is a no-op at the driver level.
@@ -213,16 +249,6 @@ impl Database {
    }

    pub async fn ensure_indexes(&self) -> Result<(), AgentError> {
-        // repositories: unique git_url
-        self.repositories()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "git_url": 1 })
-                    .options(IndexOptions::builder().unique(true).build())
-                    .build(),
-            )
-            .await?;
-
        // findings: unique fingerprint
        self.findings()
            .create_index(
@@ -409,14 +435,40 @@ impl Database {
            )
            .await?;

+        // onboarded_targets: multikey on artifact source ref (webhook + dedupe
+        // lookup). Non-unique — "one git URL per tenant" is enforced in the
+        // create handler, since a unique multikey index on an array field has
+        // null-collision caveats.
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "artifacts.source_ref": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // onboarded_targets: multikey on artifact kind
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "artifacts.kind": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // onboarded_targets: target_type filter
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "target_type": 1 })
+                    .build(),
+            )
+            .await?;
+
        tracing::info!("Database indexes ensured");
        Ok(())
    }

-    pub fn repositories(&self) -> Collection<TrackedRepository> {
-        self.inner.collection("repositories")
-    }
-
    pub fn findings(&self) -> Collection<Finding> {
        self.inner.collection("findings")
    }
@@ -465,6 +517,20 @@ impl Database {
        self.inner.collection("dast_targets")
    }

+    /// The unified onboarding targets that replace `repositories` and
+    /// `dast_targets`. Ids are preserved from the legacy collections during
+    /// migration so downstream `repo_id` / `target_id` references keep resolving.
+    pub fn onboarded_targets(&self) -> Collection<OnboardedTarget> {
+        self.inner.collection("onboarded_targets")
+    }
+
+    /// A typed handle to an arbitrary collection by name. For bookkeeping
+    /// collections without a dedicated model (e.g. `schema_migrations`,
+    /// `onboarding_migration_log`).
+    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
+        self.inner.collection(name)
+    }
+
    pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
        self.inner.collection("dast_scan_runs")
    }
@@ -0,0 +1,154 @@
+//! Content-addressed blob storage and archive extraction for ingest.
+//!
+//! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
+//! digest; per-run working directories live under `<base>/work/`.
+
+use std::fs::{self, File};
+use std::io::{self, Read};
+use std::path::{Path, PathBuf};
+
+use sha2::{Digest, Sha256};
+
+use crate::error::AgentError;
+
+/// Read buffer size for streaming hashes/copies (64 KiB).
+const BUF_LEN: usize = 64 * 1024;
+
+/// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
+/// byte length. Streams so large firmware images never load fully into memory.
+pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
+    let mut file = File::open(path)?;
+    let mut hasher = Sha256::new();
+    let mut buf = [0u8; BUF_LEN];
+    let mut total: u64 = 0;
+    loop {
+        let n = file.read(&mut buf)?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buf[..n]);
+        total += n as u64;
+    }
+    Ok((hex::encode(hasher.finalize()), total))
+}
+
+/// Copy `src` into the content-addressed blob store under `base`, returning the
+/// stored path. Idempotent: an already-present blob is not rewritten.
+pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
+    if sha.len() < 2 {
+        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
+    }
+    let dir = base.join("blobs").join(&sha[0..2]);
+    fs::create_dir_all(&dir)?;
+    let dest = dir.join(sha);
+    if !dest.exists() {
+        fs::copy(src, &dest)?;
+    }
+    Ok(dest)
+}
+
+/// Extract a zip archive into `dest` (created if needed). `enclosed_name`
+/// sanitizes each entry path, so this is safe against zip-slip traversal.
+pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
+    let file = File::open(archive)?;
+    let mut zip =
+        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
+    fs::create_dir_all(dest)?;
+    for i in 0..zip.len() {
+        let mut entry = zip
+            .by_index(i)
+            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
+        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
+        let Some(rel) = entry.enclosed_name() else {
+            continue;
+        };
+        let out = dest.join(rel);
+        if entry.is_dir() {
+            fs::create_dir_all(&out)?;
+        } else {
+            if let Some(parent) = out.parent() {
+                fs::create_dir_all(parent)?;
+            }
+            let mut outfile = File::create(&out)?;
+            io::copy(&mut entry, &mut outfile)?;
+        }
+    }
+    Ok(())
+}
+
+/// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
+pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
+    base.join("work").join(target_id).join(artifact_id)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    /// A unique scratch directory, removed on drop.
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir scratch");
+            Self(p)
+        }
+        fn path(&self) -> &Path {
+            &self.0
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn hash_is_stable_and_reports_size() {
+        let dir = Scratch::new();
+        let f = dir.path().join("a.bin");
+        fs::write(&f, b"hello world").expect("write");
+        let (sha, size) = hash_file(&f).expect("hash");
+        assert_eq!(size, 11);
+        // Known SHA-256 of "hello world".
+        assert_eq!(
+            sha,
+            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
+        );
+    }
+
+    #[test]
+    fn store_is_content_addressed_and_idempotent() {
+        let base = Scratch::new();
+        let src = base.path().join("src.bin");
+        fs::write(&src, b"payload").expect("write");
+        let (sha, _) = hash_file(&src).expect("hash");
+        let p1 = store_file(base.path(), &src, &sha).expect("store");
+        let p2 = store_file(base.path(), &src, &sha).expect("store again");
+        assert_eq!(p1, p2);
+        assert!(p1.ends_with(&sha));
+        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
+        assert_eq!(fs::read(&p1).expect("read"), b"payload");
+    }
+
+    #[test]
+    fn extract_zip_writes_entries() {
+        let base = Scratch::new();
+        let archive = base.path().join("a.zip");
+        {
+            let file = File::create(&archive).expect("create");
+            let mut w = zip::ZipWriter::new(file);
+            let opts: zip::write::SimpleFileOptions = Default::default();
+            w.start_file("dir/hello.txt", opts).expect("start");
+            io::Write::write_all(&mut w, b"hi").expect("write");
+            w.finish().expect("finish");
+        }
+        let dest = base.path().join("out");
+        extract_zip(&archive, &dest).expect("extract");
+        assert_eq!(
+            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
+            "hi"
+        );
+    }
+}
@@ -0,0 +1,416 @@
+//! Artifact ingest.
+//!
+//! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
+//! path plus recorded metadata (content hash, size, discovered facts) that the
+//! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
+//! is also the reconciliation key against sibling products (a firmware sha256
+//! matches tramiton's `Artifact.sha256`).
+
+mod blob;
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
+use compliance_core::AgentConfig;
+
+use crate::error::AgentError;
+use crate::pipeline::git::{GitOps, RepoCredentials};
+
+/// The paths and identifiers an ingest needs. Decoupled from the full
+/// [`AgentConfig`] so ingest is testable without a complete config.
+pub struct IngestContext<'a> {
+    /// Base directory for content-addressed blobs and working dirs.
+    pub artifact_store_base: &'a Path,
+    /// Base directory for git clones.
+    pub git_clone_base: &'a str,
+    /// Default SSH key path (used when an artifact provides none).
+    pub ssh_key_path: &'a str,
+    /// The id of the target these artifacts belong to (namespaces working dirs).
+    pub target_id: &'a str,
+}
+
+impl<'a> IngestContext<'a> {
+    /// Build an ingest context from the agent config for a given target.
+    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
+        Self {
+            artifact_store_base: Path::new(&config.artifact_store_base_path),
+            git_clone_base: &config.git_clone_base_path,
+            ssh_key_path: &config.ssh_key_path,
+            target_id,
+        }
+    }
+}
+
+/// The result of ingesting one artifact.
+pub struct IngestedArtifact {
+    /// The artifact this corresponds to ([`Artifact::id`]).
+    pub artifact_id: String,
+    /// The artifact kind.
+    pub kind: ArtifactKind,
+    /// Local working path (clone dir, extracted dir, or blob file). `None` for
+    /// artifacts with no on-disk form (live URL, plaintext, container ref).
+    pub working_path: Option<PathBuf>,
+    /// SHA-256 of the content (blobs) or git head SHA (git repos).
+    pub content_hash: Option<String>,
+    /// Stored blob size in bytes, when applicable.
+    pub size_bytes: Option<u64>,
+    /// Facts discovered during ingest.
+    pub facts: Vec<DetectedFact>,
+}
+
+/// All ingested artifacts for a target, keyed by artifact id.
+pub struct IngestSet {
+    /// The ingested artifacts, keyed by [`Artifact::id`].
+    pub by_artifact: HashMap<String, IngestedArtifact>,
+}
+
+impl IngestSet {
+    /// The working paths of every ingested artifact that has one — the input the
+    /// classifier expects.
+    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
+        self.by_artifact
+            .iter()
+            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
+            .collect()
+    }
+
+    /// The ingest result for a specific artifact.
+    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
+        self.by_artifact.get(artifact_id)
+    }
+}
+
+/// Ingest every artifact on a target.
+pub fn ingest_all(
+    target: &OnboardedTarget,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestSet, AgentError> {
+    let mut by_artifact = HashMap::new();
+    for artifact in &target.artifacts {
+        let ingested = ingest_artifact(artifact, ctx)?;
+        by_artifact.insert(artifact.id.clone(), ingested);
+    }
+    Ok(IngestSet { by_artifact })
+}
+
+/// Ingest a single artifact, dispatching on its kind.
+pub fn ingest_artifact(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestedArtifact, AgentError> {
+    match artifact.kind {
+        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
+        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
+            ingest_blob(artifact, ctx, true)
+        }
+        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
+        ArtifactKind::ContainerImage => Ok(metadata_only(
+            artifact,
+            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
+        )),
+        ArtifactKind::LiveUrl => Ok(metadata_only(
+            artifact,
+            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
+        )),
+        ArtifactKind::PlaintextDescription => Ok(metadata_only(
+            artifact,
+            DetectedFact::new(
+                "description_len",
+                artifact.source_ref.len().to_string(),
+                "ingest",
+            ),
+        )),
+    }
+}
+
+/// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
+fn ingest_git(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestedArtifact, AgentError> {
+    let creds = credentials_for(artifact, ctx.ssh_key_path);
+    let git_ops = GitOps::new(ctx.git_clone_base, creds);
+    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
+    let head = GitOps::get_head_sha(&repo_path).ok();
+    Ok(IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: Some(repo_path),
+        content_hash: head,
+        size_bytes: None,
+        facts: Vec::new(),
+    })
+}
+
+/// Store a blob artifact content-addressed. When `extract` is set and the blob
+/// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
+/// working directory; otherwise the working path is the stored blob.
+fn ingest_blob(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+    extract: bool,
+) -> Result<IngestedArtifact, AgentError> {
+    let base = ctx.artifact_store_base;
+    let src = local_source(artifact)?;
+    let (sha, size) = blob::hash_file(&src)?;
+    let stored = blob::store_file(base, &src, &sha)?;
+
+    let mut facts = Vec::new();
+    let working_path = if extract {
+        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
+        match blob::extract_zip(&stored, &dest) {
+            Ok(()) => dest,
+            Err(e) => {
+                // Not a zip container — this is a single uploaded file (e.g. a
+                // `.st`/`.xml` PLC project or a `.tar.gz`). The content-addressed
+                // blob has no extension, so materialize it into a working dir
+                // under its original name; extension-based scanners (PLC) can then
+                // discover it and report a readable path.
+                facts.push(DetectedFact::new(
+                    "archive_unextracted",
+                    e.to_string(),
+                    "ingest",
+                ));
+                match materialize_single(&stored, &dest, &blob_file_name(artifact)) {
+                    Ok(dir) => dir,
+                    Err(copy_err) => {
+                        facts.push(DetectedFact::new(
+                            "materialize_failed",
+                            copy_err.to_string(),
+                            "ingest",
+                        ));
+                        stored.clone()
+                    }
+                }
+            }
+        }
+    } else {
+        stored.clone()
+    };
+
+    Ok(IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: Some(working_path),
+        content_hash: Some(sha),
+        size_bytes: Some(size),
+        facts,
+    })
+}
+
+/// Copy a stored blob into `dest`/`name`, returning `dest`. Used when an
+/// "extractable" artifact turns out to be a single file rather than an archive.
+fn materialize_single(stored: &Path, dest: &Path, name: &str) -> Result<PathBuf, AgentError> {
+    std::fs::create_dir_all(dest)?;
+    std::fs::copy(stored, dest.join(name))?;
+    Ok(dest.to_path_buf())
+}
+
+/// A safe, single-segment file name for an artifact, preserving the original
+/// extension so scanners can identify it. Derives from `source_ref` (the
+/// uploaded/original file name); `file_name` strips any directory components,
+/// so this is traversal-safe. Falls back to the artifact id.
+fn blob_file_name(artifact: &Artifact) -> String {
+    Path::new(&artifact.source_ref)
+        .file_name()
+        .and_then(|n| n.to_str())
+        .map(str::to_string)
+        .filter(|s| !s.is_empty())
+        .unwrap_or_else(|| format!("artifact-{}", artifact.id))
+}
+
+/// An artifact with no on-disk form: record a single fact, no hash/path.
+fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
+    IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: None,
+        content_hash: None,
+        size_bytes: None,
+        facts: vec![fact],
+    }
+}
+
+/// The local file backing a blob artifact: its `stored_path` if already
+/// uploaded, else its `source_ref` interpreted as a filesystem path.
+fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
+    let path = artifact
+        .stored_path
+        .as_deref()
+        .unwrap_or(artifact.source_ref.as_str());
+    let path = PathBuf::from(path);
+    if !path.exists() {
+        return Err(AgentError::Other(format!(
+            "artifact {} source not found at {}",
+            artifact.id,
+            path.display()
+        )));
+    }
+    Ok(path)
+}
+
+/// Build git credentials from an artifact's auth plus a default SSH key path.
+fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
+    let auth = artifact.auth.as_ref();
+    RepoCredentials {
+        ssh_key_path: auth
+            .and_then(|a| a.ssh_key_path.clone())
+            .or_else(|| Some(default_ssh_key_path.to_string())),
+        auth_token: auth.and_then(|a| a.secret.clone()),
+        auth_username: auth.and_then(|a| a.username.clone()),
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{ArtifactAuth, TargetType};
+
+    /// A unique scratch directory, removed on drop.
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
+            std::fs::create_dir_all(&p).expect("mkdir scratch");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
+        IngestContext {
+            artifact_store_base: store,
+            git_clone_base: "/tmp/cs-ingest-test-repos",
+            ssh_key_path: "/tmp/cs-ingest-test-ssh",
+            target_id,
+        }
+    }
+
+    #[test]
+    fn firmware_blob_is_hashed_and_stored() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let fw = scratch.0.join("fw.bin");
+        std::fs::write(&fw, b"firmware-bytes").expect("write");
+
+        let ctx = ctx_for(&store, "t1");
+        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+
+        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
+        assert_eq!(out.size_bytes, Some(14));
+        let sha = out.content_hash.expect("hash");
+        assert_eq!(sha.len(), 64);
+        // working path is the content-addressed blob
+        let wp = out.working_path.expect("working path");
+        assert!(wp.starts_with(store.join("blobs")));
+    }
+
+    #[test]
+    fn live_url_has_no_blob() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let ctx = ctx_for(&store, "t1");
+        let artifact = Artifact::live_url("https://example.com");
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+        assert!(out.working_path.is_none());
+        assert!(out.content_hash.is_none());
+        assert!(out.facts.iter().any(|f| f.key == "live_url"));
+    }
+
+    #[test]
+    fn ingest_all_collects_working_paths() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let fw = scratch.0.join("fw.bin");
+        std::fs::write(&fw, b"abc").expect("write");
+        let ctx = ctx_for(&store, "t1");
+
+        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
+        target
+            .artifacts
+            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
+        target.artifacts.push(Artifact::live_url("https://x"));
+
+        let set = ingest_all(&target, &ctx).expect("ingest all");
+        assert_eq!(set.by_artifact.len(), 2);
+        // Only the firmware artifact yields a working path.
+        assert_eq!(set.working_paths().len(), 1);
+    }
+
+    #[test]
+    fn credentials_prefer_artifact_auth() {
+        let mut artifact = Artifact::git_repo("https://git/x", "main");
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        let creds = credentials_for(&artifact, "/default/ssh/key");
+        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
+        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
+    }
+
+    #[test]
+    fn credentials_fall_back_to_default_ssh_key() {
+        let artifact = Artifact::git_repo("git@host:x.git", "main");
+        let creds = credentials_for(&artifact, "/default/ssh/key");
+        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
+        assert!(creds.auth_token.is_none());
+    }
+
+    /// A single uploaded PLC file (not an archive) must land in a working dir
+    /// under its original name so the PLC scanner can discover it by extension
+    /// and report a readable path — the demo's upload → scan path.
+    #[test]
+    fn single_uploaded_plc_file_is_materialized_and_scannable() {
+        use compliance_core::models::PlcFormat;
+
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        // Simulate the upload handler: bytes written to an `uploads/` path,
+        // `source_ref` carrying the original (clean) file name.
+        let uploads = scratch.0.join("uploads");
+        std::fs::create_dir_all(&uploads).expect("mkdir uploads");
+        let uploaded = uploads.join("a1b2c3_pump_station.st");
+        std::fs::write(
+            &uploaded,
+            "PROGRAM P\nVAR\n  ApiKey : STRING := 'sk-live-1234';\nEND_VAR\nEND_PROGRAM\n",
+        )
+        .expect("write st");
+
+        let mut artifact = Artifact::plc_project("pump_station.st", PlcFormat::StructuredText);
+        artifact.stored_path = Some(uploaded.to_string_lossy().to_string());
+
+        let ctx = ctx_for(&store, "t-plc");
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+
+        // Working path is a directory (not the extensionless blob) holding the
+        // file under its original name.
+        let wp = out.working_path.expect("working path");
+        assert!(wp.is_dir(), "expected a working dir, got {wp:?}");
+        assert!(wp.join("pump_station.st").is_file());
+
+        // The PLC scanner finds the hardcoded credential and reports a clean path.
+        let findings = crate::pipeline::plc::analyze_tree(&wp, "t-plc");
+        assert!(
+            !findings.is_empty(),
+            "scanner should flag the uploaded file"
+        );
+        assert!(findings
+            .iter()
+            .any(|f| f.rule_id.as_deref() == Some("plc-hardcoded-credential")));
+        assert_eq!(
+            findings[0].file_path.as_deref(),
+            Some("pump_station.st"),
+            "finding should reference the original file name"
+        );
+    }
+}
@@ -2,9 +2,11 @@

 pub mod agent;
 pub mod api;
+pub mod classify;
 pub mod config;
 pub mod database;
 pub mod error;
+pub mod ingest;
 pub mod llm;
 pub mod pentest;
 pub mod pipeline;
@@ -328,6 +328,7 @@ mod tests {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: String::new(),
+            artifact_store_base_path: String::new(),
            ssh_key_path: String::new(),
            keycloak_url: None,
            keycloak_realm: None,
@@ -341,6 +342,7 @@ mod tests {
            pentest_imap_password: None,
            admin_api_token: None,
            tenant_registry_url: None,
+            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
        }
    }

@@ -204,6 +204,202 @@ impl CveScanner {

        Ok(results)
    }
+
+    /// Match the CODESYS **runtime** component against NVD by CPE.
+    ///
+    /// CODESYS advisories (the CoDe16 cluster and friends) are indexed in NVD by
+    /// CPE (`cpe:2.3:a:codesys:control*`) keyed off the *runtime* version — not by
+    /// the internal `Cmp*`/`Sys*` library names OSV-by-purl would look up. So we
+    /// find the runtime SBOM entry, pull every `cpe:2.3:a:codesys:*` CVE from NVD,
+    /// and keep the ones whose affected-version range covers our runtime version.
+    /// Best-effort: returns empty without an NVD key, on a network error, or when
+    /// no CODESYS runtime component is present.
+    pub async fn scan_codesys(&self, repo_id: &str, entries: &mut [SbomEntry]) -> Vec<CveAlert> {
+        let Some((name, version)) = codesys_runtime(entries) else {
+            return Vec::new();
+        };
+        let url = "https://services.nvd.nist.gov/rest/json/cves/2.0\
+                   ?virtualMatchString=cpe:2.3:a:codesys";
+        let mut req = self.http.get(url);
+        if let Some(key) = &self.nvd_api_key {
+            req = req.header("apiKey", key.as_str());
+        }
+        let body: serde_json::Value = match req.send().await {
+            Ok(r) if r.status().is_success() => match r.json().await {
+                Ok(b) => b,
+                Err(e) => {
+                    tracing::warn!("CODESYS NVD parse failed: {e}");
+                    return Vec::new();
+                }
+            },
+            Ok(r) => {
+                tracing::warn!("CODESYS NVD returned {}", r.status());
+                return Vec::new();
+            }
+            Err(e) => {
+                tracing::warn!("CODESYS NVD request failed: {e}");
+                return Vec::new();
+            }
+        };
+
+        let matched = parse_codesys_nvd(&body, &version);
+        let mut alerts = Vec::new();
+        for cve in matched {
+            if let Some(e) = entries
+                .iter_mut()
+                .find(|e| e.name == name && e.version == version)
+            {
+                e.known_vulnerabilities.push(VulnRef {
+                    id: cve.id.clone(),
+                    source: "nvd".to_string(),
+                    severity: None,
+                    url: Some(format!("https://nvd.nist.gov/vuln/detail/{}", cve.id)),
+                });
+            }
+            let mut alert = CveAlert::new(
+                cve.id,
+                repo_id.to_string(),
+                name.clone(),
+                version.clone(),
+                CveSource::Nvd,
+            );
+            alert.summary = cve.summary;
+            alert.cvss_score = cve.cvss;
+            alerts.push(alert);
+        }
+        tracing::info!(runtime = %name, version = %version, cves = alerts.len(), "CODESYS CVE match");
+        alerts
+    }
+}
+
+/// The CODESYS runtime component (name + version) from an SBOM, if present. The
+/// runtime carries the version CODESYS advisories key off; the internal library
+/// components do not.
+fn codesys_runtime(entries: &[SbomEntry]) -> Option<(String, String)> {
+    entries
+        .iter()
+        .find(|e| e.package_manager == "codesys" && e.name.starts_with("CODESYS Control"))
+        .map(|e| (e.name.clone(), e.version.clone()))
+}
+
+/// A parsed NVD CVE that affects the CODESYS runtime.
+struct CodesysCve {
+    id: String,
+    summary: Option<String>,
+    cvss: Option<f64>,
+}
+
+/// Version constraints from an NVD `cpeMatch` node.
+#[derive(Default)]
+struct CpeRange {
+    exact: Option<String>,
+    start_incl: Option<String>,
+    start_excl: Option<String>,
+    end_incl: Option<String>,
+    end_excl: Option<String>,
+}
+
+/// Parse an NVD CVE-list response and keep the CVEs whose CODESYS CPE match covers
+/// `runtime_version`.
+fn parse_codesys_nvd(body: &serde_json::Value, runtime_version: &str) -> Vec<CodesysCve> {
+    let mut out = Vec::new();
+    let Some(vulns) = body["vulnerabilities"].as_array() else {
+        return out;
+    };
+    for v in vulns {
+        let cve = &v["cve"];
+        let Some(id) = cve["id"].as_str() else {
+            continue;
+        };
+        let covered = cve["configurations"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .flat_map(|c| c["nodes"].as_array().into_iter().flatten())
+            .flat_map(|n| n["cpeMatch"].as_array().into_iter().flatten())
+            .any(|cm| {
+                cm["vulnerable"].as_bool() == Some(true)
+                    && cm["criteria"]
+                        .as_str()
+                        .is_some_and(|c| c.contains(":codesys:"))
+                    && version_matches(runtime_version, &cpe_range(cm))
+            });
+        if covered {
+            let summary = cve["descriptions"]
+                .as_array()
+                .and_then(|d| d.iter().find(|x| x["lang"].as_str() == Some("en")))
+                .and_then(|x| x["value"].as_str())
+                .map(String::from);
+            let cvss = cve["metrics"]["cvssMetricV31"]
+                .as_array()
+                .and_then(|m| m.first())
+                .and_then(|m| m["cvssData"]["baseScore"].as_f64());
+            out.push(CodesysCve {
+                id: id.to_string(),
+                summary,
+                cvss,
+            });
+        }
+    }
+    out
+}
+
+/// Build a [`CpeRange`] from an NVD `cpeMatch` object.
+fn cpe_range(cm: &serde_json::Value) -> CpeRange {
+    let exact = cm["criteria"]
+        .as_str()
+        .and_then(cpe_version)
+        .filter(|v| v != "*" && v != "-" && !v.is_empty());
+    CpeRange {
+        exact,
+        start_incl: cm["versionStartIncluding"].as_str().map(String::from),
+        start_excl: cm["versionStartExcluding"].as_str().map(String::from),
+        end_incl: cm["versionEndIncluding"].as_str().map(String::from),
+        end_excl: cm["versionEndExcluding"].as_str().map(String::from),
+    }
+}
+
+/// The version field (6th component) of a CPE 2.3 string.
+fn cpe_version(criteria: &str) -> Option<String> {
+    criteria.split(':').nth(5).map(String::from)
+}
+
+/// Whether `v` satisfies a CPE version range.
+fn version_matches(v: &str, r: &CpeRange) -> bool {
+    use std::cmp::Ordering::{Equal, Greater, Less};
+    if let Some(exact) = &r.exact {
+        return cmp_dotted(v, exact) == Equal;
+    }
+    let mut ok = true;
+    if let Some(s) = &r.start_incl {
+        ok &= cmp_dotted(v, s) != Less;
+    }
+    if let Some(s) = &r.start_excl {
+        ok &= cmp_dotted(v, s) == Greater;
+    }
+    if let Some(e) = &r.end_incl {
+        ok &= cmp_dotted(v, e) != Greater;
+    }
+    if let Some(e) = &r.end_excl {
+        ok &= cmp_dotted(v, e) == Less;
+    }
+    ok
+}
+
+/// Compare two dotted numeric versions (`4.17.0.0` vs `4.9.0.0`); missing
+/// components count as 0, non-numeric components as 0.
+fn cmp_dotted(a: &str, b: &str) -> std::cmp::Ordering {
+    let pa: Vec<u64> = a.split('.').map(|x| x.parse().unwrap_or(0)).collect();
+    let pb: Vec<u64> = b.split('.').map(|x| x.parse().unwrap_or(0)).collect();
+    for i in 0..pa.len().max(pb.len()) {
+        let x = pa.get(i).copied().unwrap_or(0);
+        let y = pb.get(i).copied().unwrap_or(0);
+        match x.cmp(&y) {
+            std::cmp::Ordering::Equal => continue,
+            other => return other,
+        }
+    }
+    std::cmp::Ordering::Equal
 }

 #[derive(serde::Deserialize)]
@@ -228,3 +424,90 @@ struct OsvVuln {
    summary: Option<String>,
    severity: Option<String>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cmp::Ordering::{Equal, Greater, Less};
+
+    fn entry(name: &str, ver: &str, pm: &str) -> SbomEntry {
+        SbomEntry::new("t".into(), name.into(), ver.into(), pm.into())
+    }
+
+    #[test]
+    fn finds_the_codesys_runtime_component() {
+        let entries = vec![
+            entry("Standard", "3.5.18.0", "codesys"),
+            entry("CODESYS Control for Linux ARM SL", "4.17.0.0", "codesys"),
+        ];
+        assert_eq!(
+            codesys_runtime(&entries),
+            Some(("CODESYS Control for Linux ARM SL".into(), "4.17.0.0".into()))
+        );
+        // Internal library components are not the runtime.
+        assert!(codesys_runtime(&[entry("Util", "3.5.21.0", "codesys")]).is_none());
+    }
+
+    #[test]
+    fn dotted_version_comparison() {
+        assert_eq!(cmp_dotted("4.17.0.0", "4.9.0.0"), Greater);
+        assert_eq!(cmp_dotted("4.9.0.0", "4.17.0.0"), Less);
+        assert_eq!(cmp_dotted("3.5.18.0", "3.5.18.0"), Equal);
+        assert_eq!(cmp_dotted("4.2", "4.2.0.0"), Equal); // missing components = 0
+    }
+
+    #[test]
+    fn version_range_matching() {
+        let end_excl = CpeRange {
+            end_excl: Some("4.9.0.0".into()),
+            ..Default::default()
+        };
+        assert!(!version_matches("4.17.0.0", &end_excl)); // patched
+        assert!(version_matches("4.5.0.0", &end_excl)); // affected
+
+        let exact = CpeRange {
+            exact: Some("3.5.16.0".into()),
+            ..Default::default()
+        };
+        assert!(version_matches("3.5.16.0", &exact));
+        assert!(!version_matches("3.5.17.0", &exact));
+
+        let span = CpeRange {
+            start_incl: Some("3.0.0.0".into()),
+            end_incl: Some("3.5.16.0".into()),
+            ..Default::default()
+        };
+        assert!(version_matches("3.5.16.0", &span));
+        assert!(!version_matches("3.5.17.0", &span));
+    }
+
+    #[test]
+    fn parses_nvd_and_matches_by_runtime_version() {
+        // Two CODESYS CVEs: one affects < 4.9 (our 4.17 is patched), one affects
+        // <= 4.20 (our 4.17 is affected). Only the latter should match.
+        let body = serde_json::json!({
+          "vulnerabilities": [
+            {"cve": {"id":"CVE-2023-0001",
+              "descriptions":[{"lang":"en","value":"old CmpBlkDrvTcp bug"}],
+              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":7.5}}]},
+              "configurations":[{"nodes":[{"cpeMatch":[
+                {"vulnerable":true,
+                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
+                 "versionEndExcluding":"4.9.0.0"}
+              ]}]}]}},
+            {"cve": {"id":"CVE-2024-0002",
+              "descriptions":[{"lang":"en","value":"recent runtime bug"}],
+              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":9.8}}]},
+              "configurations":[{"nodes":[{"cpeMatch":[
+                {"vulnerable":true,
+                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
+                 "versionEndIncluding":"4.20.0.0"}
+              ]}]}]}}
+          ]
+        });
+        let matched = parse_codesys_nvd(&body, "4.17.0.0");
+        let ids: Vec<&str> = matched.iter().map(|c| c.id.as_str()).collect();
+        assert_eq!(ids, vec!["CVE-2024-0002"]);
+        assert_eq!(matched[0].cvss, Some(9.8));
+    }
+}
@@ -0,0 +1,152 @@
+//! Firmware SBOM via tramiton.
+//!
+//! Phase 2 (full, the default): drive a **reproducible build** with tramiton's
+//! `NixBackend` — `analyze` → `seal_and_build` → a sealed lock whose libraries
+//! are pinned and whose firmware artifact carries a content hash — then render
+//! the SBOM from the lock plus deep binary SCA of pre-compiled inputs. This is
+//! the complete bill of materials (toolchain + every fetched library + the
+//! firmware image), the same one `tramiton sbom` produces.
+//!
+//! Phase 1 fallback (analysis-only): when no nix backend is available or the
+//! build fails, fall back to the resolvable libraries + toolchain from the build
+//! plan alone (no build). A scan therefore always yields *something*, and a nix
+//! that can't run in the deployment never breaks a scan.
+
+use std::path::Path;
+
+use compliance_core::models::{SbomEntry, TargetType};
+use tramiton_repro::ReproBackend;
+use tramiton_sbom::ComponentKind;
+
+/// Whether firmware SBOM applies to this target family.
+pub fn is_firmware_target(target_type: TargetType) -> bool {
+    matches!(
+        target_type,
+        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos | TargetType::EmbeddedLinuxYocto
+    )
+}
+
+/// Build SBOM entries for a firmware target from its source tree. Prefers a full
+/// reproducible build (sealed lock); falls back to analysis-only. Returns an
+/// empty vector when tramiton cannot even form a build plan.
+pub async fn firmware_sbom_entries(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let p = path.to_path_buf();
+    let repo = repo_id.to_string();
+    // The whole analyze → seal → build → render sequence is blocking (it shells
+    // out to nix), so keep it off the async runtime. Bound it: a firmware build
+    // that hangs must not wedge the scan (the orphaned task is abandoned).
+    let handle = tokio::task::spawn_blocking(move || build_sbom_blocking(&p, &repo));
+    match tokio::time::timeout(std::time::Duration::from_secs(900), handle).await {
+        Ok(Ok(entries)) => entries,
+        Ok(Err(e)) => {
+            tracing::warn!(repo_id, error = %e, "Firmware SBOM: task join error");
+            Vec::new()
+        }
+        Err(_) => {
+            tracing::warn!(repo_id, "Firmware SBOM: build exceeded 15m; skipping");
+            Vec::new()
+        }
+    }
+}
+
+fn build_sbom_blocking(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let repo = tramiton_core::Repo::new(path);
+    let plan = match tramiton_core::provider::analyze(&repo) {
+        Ok(Some(bp)) => bp,
+        Ok(None) => return Vec::new(),
+        Err(e) => {
+            tracing::warn!(repo_id, error = %e, "Firmware SBOM: tramiton analyze failed");
+            return Vec::new();
+        }
+    };
+
+    // Phase 2: reproducible build → sealed lock → complete SBOM.
+    if let Some(backend) = tramiton_repro::NixBackend::detect() {
+        match tramiton_repro::seal_and_build(&backend, &plan, path) {
+            Ok(lock) => {
+                let mut sbom = tramiton_sbom::Sbom::from_lock(&lock, repo_id);
+                // Deep binary SCA of any pre-compiled inputs in the tree.
+                sbom.components.extend(tramiton_sbom::binary::scan(path));
+                let entries = sbom_to_entries(&sbom, repo_id);
+                tracing::info!(
+                    repo_id,
+                    backend = backend.name(),
+                    count = entries.len(),
+                    "Firmware SBOM: sealed reproducible build"
+                );
+                return entries;
+            }
+            Err(e) => {
+                tracing::warn!(repo_id, error = %e, "Firmware SBOM: reproducible build failed; falling back to analysis-only")
+            }
+        }
+    } else {
+        tracing::info!(
+            repo_id,
+            "Firmware SBOM: no nix backend available; analysis-only SBOM"
+        );
+    }
+
+    // Phase 1 fallback: analysis-only (toolchain + resolvable libraries).
+    analysis_entries(&plan, repo_id)
+}
+
+/// Map a rendered [`tramiton_sbom::Sbom`] (primary firmware + components) into
+/// our [`SbomEntry`] rows. Source-file (`File`) components are dropped — they are
+/// build inputs, not a dependency inventory.
+fn sbom_to_entries(sbom: &tramiton_sbom::Sbom, repo_id: &str) -> Vec<SbomEntry> {
+    let mut entries = Vec::new();
+    if let Some(primary) = &sbom.primary {
+        entries.push(component_to_entry(primary, repo_id));
+    }
+    for c in &sbom.components {
+        if matches!(c.kind, ComponentKind::File) {
+            continue;
+        }
+        entries.push(component_to_entry(c, repo_id));
+    }
+    entries
+}
+
+fn component_to_entry(c: &tramiton_sbom::Component, repo_id: &str) -> SbomEntry {
+    let manager = match c.kind {
+        ComponentKind::Firmware => "firmware",
+        ComponentKind::Library => "library",
+        ComponentKind::Toolchain => "toolchain",
+        ComponentKind::File => "file",
+    };
+    let mut entry = SbomEntry::new(
+        repo_id.to_string(),
+        c.name.clone(),
+        c.version.clone().unwrap_or_default(),
+        manager.to_string(),
+    );
+    entry.purl = c.source.clone();
+    entry
+}
+
+/// Analysis-only components from the build plan: the cross-toolchain plus the
+/// resolvable fetched libraries, without a build.
+fn analysis_entries(bp: &tramiton_core::BuildPlan, repo_id: &str) -> Vec<SbomEntry> {
+    let mut entries = Vec::new();
+    if let Some(id) = bp.toolchain.id.clone() {
+        let version = bp.toolchain.version.clone().unwrap_or_default();
+        entries.push(SbomEntry::new(
+            repo_id.to_string(),
+            id,
+            version,
+            "toolchain".to_string(),
+        ));
+    }
+    for lib in tramiton_repro::lock::libraries_from_inputs(&bp.inputs) {
+        let mut entry = SbomEntry::new(
+            repo_id.to_string(),
+            lib.name,
+            lib.revision,
+            "library".to_string(),
+        );
+        entry.purl = lib.source;
+        entries.push(entry);
+    }
+    entries
+}
@@ -80,7 +80,10 @@ impl GitOps {

    #[tracing::instrument(skip_all, fields(repo_name = %repo_name))]
    pub fn clone_or_fetch(&self, git_url: &str, repo_name: &str) -> Result<PathBuf, AgentError> {
-        let repo_path = self.base_path.join(repo_name);
+        // Names can contain slashes or other path-hostile characters (a target
+        // named after a repo path, say); collapse to one safe directory segment
+        // so the clone path never nests or breaks.
+        let repo_path = self.base_path.join(sanitize_repo_dir(repo_name));

        if repo_path.exists() {
            tracing::info!("fetching updates for existing repo");
@@ -135,7 +138,7 @@ impl GitOps {
    /// Build credentials from agent config + per-repo overrides
    pub fn make_repo_credentials(
        config: &compliance_core::AgentConfig,
-        repo: &compliance_core::models::TrackedRepository,
+        repo: &crate::pipeline::repo_view::RepoView,
    ) -> RepoCredentials {
        RepoCredentials {
            ssh_key_path: Some(config.ssh_key_path.clone()),
@@ -253,3 +256,46 @@ pub struct DiffFile {
    pub path: String,
    pub hunks: String,
 }
+
+/// Collapse a repository name into a single filesystem-safe directory segment.
+/// Names may carry slashes or other path-hostile characters (a target named
+/// after a repo path, for instance); those would otherwise nest or break the
+/// clone path, so map anything outside `[A-Za-z0-9._-]` to `_`.
+fn sanitize_repo_dir(name: &str) -> String {
+    let mapped: String = name
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' {
+                c
+            } else {
+                '_'
+            }
+        })
+        .collect();
+    let trimmed = mapped.trim_matches(|c| c == '.' || c == '_');
+    if trimmed.is_empty() {
+        "repo".to_string()
+    } else {
+        trimmed.to_string()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::sanitize_repo_dir;
+
+    #[test]
+    fn sanitizes_path_hostile_names() {
+        assert_eq!(
+            sanitize_repo_dir("zephyr-example-app"),
+            "zephyr-example-app"
+        );
+        assert_eq!(
+            sanitize_repo_dir("ChristianRinn/bare_metal_stm32f411xe"),
+            "ChristianRinn_bare_metal_stm32f411xe"
+        );
+        assert_eq!(sanitize_repo_dir("../../etc/passwd"), "etc_passwd");
+        assert_eq!(sanitize_repo_dir("a b:c"), "a_b_c");
+        assert_eq!(sanitize_repo_dir("///"), "repo");
+    }
+}
@@ -0,0 +1,95 @@
+//! Minimal EtherNet/IP (CIP) reachability probe.
+//!
+//! Sends an EtherNet/IP encapsulation **ListIdentity** command (0x0063) over TCP
+//! 44818 and checks for a valid encapsulation reply — confirming a CIP device
+//! without opening a session or writing anything.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Outcome of an EtherNet/IP handshake probe.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct EnipProbe {
+    /// A TCP connection to the port was established.
+    pub reachable: bool,
+    /// The endpoint returned a valid EtherNet/IP encapsulation reply.
+    pub is_enip: bool,
+}
+
+/// Probe an EtherNet/IP endpoint with a ListIdentity request. Read-only.
+pub async fn probe(host: &str, port: u16, budget: Duration) -> EnipProbe {
+    let mut out = EnipProbe::default();
+    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
+        return out;
+    };
+    out.reachable = true;
+
+    // Encapsulation header (24 bytes): command(2) length(2) session(4) status(4)
+    // context(8) options(4). ListIdentity = command 0x0063, everything else zero.
+    let mut req = vec![0u8; 24];
+    req[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
+    if timeout(budget, stream.write_all(&req))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+
+    let mut hdr = [0u8; 24];
+    if timeout(budget, stream.read_exact(&mut hdr))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+    let command = u16::from_le_bytes([hdr[0], hdr[1]]);
+    let status = u32::from_le_bytes([hdr[8], hdr[9], hdr[10], hdr[11]]);
+    // Echoed command + success status = a valid EtherNet/IP encapsulation reply.
+    if command == 0x0063 && status == 0 {
+        out.is_enip = true;
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    async fn mock_server() -> std::net::SocketAddr {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        tokio::spawn(async move {
+            let (mut sock, _) = listener.accept().await.expect("accept");
+            let mut req = [0u8; 24];
+            if sock.read_exact(&mut req).await.is_err() {
+                return;
+            }
+            // Reply: echo command 0x0063, status 0, no data.
+            let mut hdr = vec![0u8; 24];
+            hdr[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
+            let _ = sock.write_all(&hdr).await;
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn probe_detects_an_ethernetip_device() {
+        let addr = mock_server().await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.reachable && p.is_enip);
+    }
+
+    #[tokio::test]
+    async fn probe_reports_unreachable_for_a_closed_port() {
+        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
+        assert!(!p.reachable && !p.is_enip);
+    }
+}
@@ -0,0 +1,306 @@
+//! Dynamic ICS (industrial control system) probing for PLC/SPS targets.
+//!
+//! Where the control-logic scanner is static (over ST / PLCopen XML), this probes
+//! the *running* device over industrial protocols and reports exposed /
+//! unauthenticated control interfaces. It is read-only: it never writes to a live
+//! process. Modbus/TCP and OPC UA are implemented; EtherNet-IP is a follow-on.
+
+pub mod ethernetip;
+pub mod modbus;
+pub mod opcua;
+pub mod portscan;
+
+use std::time::Duration;
+
+use compliance_core::models::{Finding, ScanType, Severity};
+
+use crate::pipeline::dedup;
+
+/// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
+const MODBUS_PORT: u16 = 502;
+const OPCUA_PORT: u16 = 4840;
+const ENIP_PORT: u16 = 44818;
+
+/// Probe a PLC/SPS device's industrial-protocol surface and return findings.
+/// Read-only. Deep-probes Modbus/TCP, OPC UA and EtherNet/IP, plus a service
+/// discovery scan of the remaining OT / insecure-management ports. `endpoint` is
+/// the target's live-URL / host reference.
+pub async fn probe_target(endpoint: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let (host, modbus_port) = parse_endpoint(endpoint);
+    let mut findings = modbus_findings(&host, modbus_port, repo_id, budget).await;
+    findings.extend(opcua_findings(&host, OPCUA_PORT, repo_id, budget).await);
+    findings.extend(enip_findings(&host, ENIP_PORT, repo_id, budget).await);
+    findings.extend(portscan_findings(&host, repo_id, budget).await);
+    findings
+}
+
+/// Findings from probing the Modbus/TCP surface.
+async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let probe = modbus::probe(host, port, budget).await;
+    let mut findings = Vec::new();
+    if !probe.speaks_modbus {
+        // Not reachable, or the port does not speak Modbus — nothing to report.
+        return findings;
+    }
+    let target = format!("{host}:{port}");
+
+    // Reachable Modbus/TCP = unauthenticated, cleartext control access by design.
+    let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed", &target]);
+    let mut f = Finding::new(
+        repo_id.to_string(),
+        fp,
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "Modbus/TCP control interface exposed without authentication".to_string(),
+        format!(
+            "The device at {target} answers Modbus/TCP requests. Modbus/TCP has no \
+             authentication or encryption in the protocol, so any host that can reach this \
+             port can read and write process variables (coils/registers) and disrupt the \
+             controlled process."
+        ),
+        Severity::Critical,
+    );
+    f.rule_id = Some("ics-modbus-exposed".to_string());
+    f.cwe = Some("CWE-306".to_string());
+    f.remediation = Some(
+        "Restrict the Modbus/TCP port to a trusted control network (segmentation / \
+         firewall / VPN), never expose it to IT or the internet, and prefer an authenticated \
+         transport (e.g. Modbus/TLS) or a secure protocol gateway where available."
+            .to_string(),
+    );
+    findings.push(f);
+
+    if let Some(dev) = &probe.device {
+        let details = [
+            dev.vendor.as_deref(),
+            dev.product.as_deref(),
+            dev.revision.as_deref(),
+        ]
+        .into_iter()
+        .flatten()
+        .collect::<Vec<_>>()
+        .join(" / ");
+        let fp = dedup::compute_fingerprint(&[repo_id, "ics-device-disclosure", &target]);
+        let mut f = Finding::new(
+            repo_id.to_string(),
+            fp,
+            "ics-probe".to_string(),
+            ScanType::IcsProbe,
+            "PLC device identity disclosed over Modbus".to_string(),
+            format!(
+                "The device at {target} discloses its identity via Modbus Read Device \
+                 Identification: {details}. This aids fingerprinting and targeting of \
+                 known-vulnerable firmware/runtime versions."
+            ),
+            Severity::Low,
+        );
+        f.rule_id = Some("ics-device-disclosure".to_string());
+        f.cwe = Some("CWE-200".to_string());
+        f.remediation = Some(
+            "Limit network reach to the device; Modbus device identification cannot be \
+             disabled, so exposure is bounded by network segmentation."
+                .to_string(),
+        );
+        findings.push(f);
+    }
+
+    // Exposed process points: coils / holding registers that a read enumerated
+    // and that, over unauthenticated Modbus/TCP, are also writable. This is the
+    // concrete attack surface behind the exposure — the live variables an
+    // attacker can overwrite. (Read-only to detect: we never write.)
+    let coils = probe.coils_readable.unwrap_or(0);
+    let registers = probe.holding_registers_readable.unwrap_or(0);
+    if coils > 0 || registers > 0 {
+        let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed-points", &target]);
+        let mut f = Finding::new(
+            repo_id.to_string(),
+            fp,
+            "ics-probe".to_string(),
+            ScanType::IcsProbe,
+            "Writable process points exposed over unauthenticated Modbus/TCP".to_string(),
+            format!(
+                "Reading the device at {target} enumerated {coils} coil(s) and {registers} \
+                 holding register(s). Coils and holding registers are read/write process points \
+                 in Modbus, so any host that can reach this port can not only read but overwrite \
+                 live process state (force coils, change setpoints) without authentication."
+            ),
+            Severity::High,
+        );
+        f.rule_id = Some("ics-modbus-exposed-points".to_string());
+        f.cwe = Some("CWE-306".to_string());
+        f.remediation = Some(
+            "Segment the Modbus/TCP port to a trusted control network; where the device \
+             supports it use Modbus/TLS or an authenticating protocol gateway; restrict which \
+             function codes and register ranges are reachable from outside the control zone."
+                .to_string(),
+        );
+        findings.push(f);
+    }
+    findings
+}
+
+/// Findings from probing the OPC UA surface (default port 4840). A reachability
+/// probe only: it flags an exposed OPC UA server for review of its security
+/// policy / authentication (deep SecurityPolicy analysis is a follow-on).
+async fn opcua_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let probe = opcua::probe(host, port, budget).await;
+    let mut findings = Vec::new();
+    if !probe.is_opcua {
+        return findings;
+    }
+    let target = format!("{host}:{port}");
+    let fp = dedup::compute_fingerprint(&[repo_id, "ics-opcua-exposed", &target]);
+    let mut f = Finding::new(
+        repo_id.to_string(),
+        fp,
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "OPC UA server exposed on the network".to_string(),
+        format!(
+            "An OPC UA server answers at {target}. Verify it enforces message security \
+             (a SecurityPolicy other than None) and rejects anonymous sessions — the common \
+             default of SecurityPolicy None + an Anonymous user token allows unauthenticated, \
+             unencrypted read/write of the server's address space."
+        ),
+        Severity::Medium,
+    );
+    f.rule_id = Some("ics-opcua-exposed".to_string());
+    f.cwe = Some("CWE-319".to_string());
+    f.remediation = Some(
+        "Restrict OPC UA (4840) to a trusted network; require a signed & encrypted \
+         SecurityPolicy (Basic256Sha256 or better) with certificate / username \
+         authentication, and disable the Anonymous user token."
+            .to_string(),
+    );
+    findings.push(f);
+    findings
+}
+
+/// Findings from probing the EtherNet/IP (CIP) surface (default port 44818).
+async fn enip_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let probe = ethernetip::probe(host, port, budget).await;
+    if !probe.is_enip {
+        return Vec::new();
+    }
+    let target = format!("{host}:{port}");
+    let fp = dedup::compute_fingerprint(&[repo_id, "ics-ethernetip-exposed", &target]);
+    let mut f = Finding::new(
+        repo_id.to_string(),
+        fp,
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "EtherNet/IP (CIP) interface exposed on the network".to_string(),
+        format!(
+            "The device at {target} answers EtherNet/IP (CIP) requests. EtherNet/IP has no \
+             authentication in the base protocol, so a host that can reach it can enumerate \
+             and interact with the device's control objects."
+        ),
+        Severity::High,
+    );
+    f.rule_id = Some("ics-ethernetip-exposed".to_string());
+    f.cwe = Some("CWE-306".to_string());
+    f.remediation = Some(
+        "Restrict EtherNet/IP (44818/2222) to a trusted control network; use CIP Security \
+         (encryption + authentication) on devices that support it."
+            .to_string(),
+    );
+    vec![f]
+}
+
+/// Findings from the service-discovery port scan of the remaining OT /
+/// insecure-management surface.
+async fn portscan_findings(host: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let open = portscan::scan(host, portscan::KNOWN_PORTS, budget).await;
+    open.into_iter()
+        .map(|kp| {
+            let target = format!("{host}:{}", kp.port);
+            let (title, severity, cwe, description) = match kp.kind {
+                portscan::PortKind::Ics => (
+                    format!("ICS service exposed: {}", kp.service),
+                    Severity::High,
+                    "CWE-306",
+                    format!(
+                        "{target} exposes {} ({}). Industrial protocols are typically \
+                         unauthenticated, so network reach implies control access.",
+                        kp.service, kp.note
+                    ),
+                ),
+                portscan::PortKind::InsecureMgmt => (
+                    format!("Cleartext service exposed: {}", kp.service),
+                    Severity::Medium,
+                    "CWE-319",
+                    format!(
+                        "{target} exposes {} ({}), which transmits credentials and data in \
+                         cleartext.",
+                        kp.service, kp.note
+                    ),
+                ),
+            };
+            let fp = dedup::compute_fingerprint(&[repo_id, "ics-service-exposed", &target]);
+            let mut f = Finding::new(
+                repo_id.to_string(),
+                fp,
+                "ics-probe".to_string(),
+                ScanType::IcsProbe,
+                title,
+                description,
+                severity,
+            );
+            f.rule_id = Some("ics-service-exposed".to_string());
+            f.cwe = Some(cwe.to_string());
+            f.remediation = Some(
+                "Restrict the service to a trusted network segment; disable it if unused; \
+                 replace cleartext protocols (Telnet/FTP) with SSH/SFTP."
+                    .to_string(),
+            );
+            f
+        })
+        .collect()
+}
+
+/// Extract `(host, port)` from a target reference. Modbus lives on its own port
+/// (502 by default), independent of any HTTP/WebVisu URL, so unless the reference
+/// explicitly carries `modbus://host:port` or a bare `host:port`, we probe 502.
+fn parse_endpoint(endpoint: &str) -> (String, u16) {
+    let s = endpoint.trim();
+    let (scheme, rest) = match s.split_once("://") {
+        Some((sch, r)) => (Some(sch.to_ascii_lowercase()), r),
+        None => (None, s),
+    };
+    let hostport = rest.split(['/', '?']).next().unwrap_or(rest);
+    let (host, port) = match hostport.rsplit_once(':') {
+        Some((h, p)) => (h.to_string(), p.parse::<u16>().ok()),
+        None => (hostport.to_string(), None),
+    };
+    let port = match (scheme.as_deref(), port) {
+        // Explicit Modbus port, or a bare host:port the user chose.
+        (Some("modbus"), Some(p)) | (None, Some(p)) => p,
+        // An http(s)/WebVisu URL (or no port): Modbus is on its own port.
+        _ => MODBUS_PORT,
+    };
+    (host, port)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::parse_endpoint;
+
+    #[test]
+    fn endpoint_parsing_picks_the_modbus_port() {
+        assert_eq!(parse_endpoint("10.0.0.5"), ("10.0.0.5".into(), 502));
+        assert_eq!(parse_endpoint("10.0.0.5:1502"), ("10.0.0.5".into(), 1502));
+        assert_eq!(
+            parse_endpoint("modbus://plc.local:5020"),
+            ("plc.local".into(), 5020)
+        );
+        // A WebVisu URL: the http port is ignored; Modbus is on 502.
+        assert_eq!(
+            parse_endpoint("http://plc.local:8080/webvisu"),
+            ("plc.local".into(), 502)
+        );
+        assert_eq!(
+            parse_endpoint("https://plc.local/"),
+            ("plc.local".into(), 502)
+        );
+    }
+}
@@ -0,0 +1,262 @@
+//! Minimal Modbus/TCP client for dynamic ICS probing.
+//!
+//! Modbus/TCP (port 502) has no authentication or encryption in the protocol, so
+//! an endpoint that answers requests is, by design, open to any host that can
+//! reach it. The probe only *reads* — a Read Holding Registers request and a Read
+//! Device Identification request — and never writes to the live process.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Outcome of probing a Modbus/TCP endpoint.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct ModbusProbe {
+    /// A TCP connection to the port was established.
+    pub reachable: bool,
+    /// The endpoint answered a Modbus request (a normal reply or a Modbus
+    /// exception) — i.e. it speaks Modbus, unauthenticated.
+    pub speaks_modbus: bool,
+    /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
+    pub device: Option<DeviceId>,
+    /// Coils returned by a Read Coils of the first block, if that address range
+    /// exists. Coils are read/write process bits, so an exposed block is an
+    /// unauthenticated write surface on the live process.
+    pub coils_readable: Option<u16>,
+    /// Holding registers returned by a Read Holding Registers of the first block,
+    /// if that range exists. Holding registers are read/write process words.
+    pub holding_registers_readable: Option<u16>,
+}
+
+/// Vendor / product / revision from Read Device Identification.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct DeviceId {
+    pub vendor: Option<String>,
+    pub product: Option<String>,
+    pub revision: Option<String>,
+}
+
+/// How many coils / holding registers to request when enumerating the exposed
+/// process surface. Read-only: a normal reply means the block exists and is,
+/// over unauthenticated Modbus/TCP, also writable.
+const ENUM_QTY: u16 = 16;
+
+/// Probe a Modbus/TCP endpoint. Read-only: issues Read Holding Registers, Read
+/// Coils, and Read Device Identification requests; never writes to the device.
+pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
+    let mut out = ModbusProbe::default();
+    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
+        return out; // unreachable
+    };
+    out.reachable = true;
+
+    // Read Holding Registers (FC 0x03), unit 1, addr 0 — a benign read that also
+    // enumerates the exposed register block.
+    let rhr = [0x03u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
+    if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
+        // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
+        if matches!(resp.first(), Some(0x03) | Some(0x83)) {
+            out.speaks_modbus = true;
+        }
+        if resp.first() == Some(&0x03) {
+            out.holding_registers_readable = Some(register_count_from_reply(&resp));
+        }
+    }
+
+    // Read Coils (FC 0x01), addr 0 — enumerates the exposed coil (bit) block.
+    let rc = [0x01u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
+    if let Some(resp) = txn(&mut stream, 1, &rc, budget).await {
+        if matches!(resp.first(), Some(0x01) | Some(0x81)) {
+            out.speaks_modbus = true;
+        }
+        if resp.first() == Some(&0x01) {
+            out.coils_readable = Some(coil_count_from_reply(&resp));
+        }
+    }
+
+    // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
+    let rdi = [0x2Bu8, 0x0E, 0x01, 0x00];
+    if let Some(resp) = txn(&mut stream, 1, &rdi, budget).await {
+        if resp.first() == Some(&0x2B) {
+            out.speaks_modbus = true;
+            out.device = parse_device_id(&resp);
+        }
+    }
+    out
+}
+
+/// Coils reported by a Read Coils reply `[0x01, byte_count, data…]` (8 per byte).
+fn coil_count_from_reply(pdu: &[u8]) -> u16 {
+    pdu.get(1).map(|&b| u16::from(b) * 8).unwrap_or(0)
+}
+
+/// Registers reported by a Read Holding Registers reply `[0x03, byte_count,
+/// data…]` (2 bytes per register).
+fn register_count_from_reply(pdu: &[u8]) -> u16 {
+    pdu.get(1).map(|&b| u16::from(b) / 2).unwrap_or(0)
+}
+
+/// Send one Modbus PDU and return the response PDU (function code + data), or
+/// `None` on timeout / malformed reply.
+async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
+    // MBAP header: transaction id (2) + protocol id (2) = 0 + length (2) + unit (1),
+    // then the PDU. `length` counts the unit byte plus the PDU.
+    let len = (pdu.len() + 1) as u16;
+    let mut frame = Vec::with_capacity(7 + pdu.len());
+    frame.extend_from_slice(&[0x00, 0x01]); // transaction id
+    frame.extend_from_slice(&[0x00, 0x00]); // protocol id
+    frame.extend_from_slice(&len.to_be_bytes());
+    frame.push(unit);
+    frame.extend_from_slice(pdu);
+    timeout(budget, stream.write_all(&frame)).await.ok()?.ok()?;
+
+    let mut hdr = [0u8; 7];
+    timeout(budget, stream.read_exact(&mut hdr))
+        .await
+        .ok()?
+        .ok()?;
+    // Reject non-Modbus replies (protocol id must be 0).
+    if hdr[2] != 0 || hdr[3] != 0 {
+        return None;
+    }
+    let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
+    if !(2..=260).contains(&plen) {
+        return None;
+    }
+    let mut body = vec![0u8; plen - 1]; // minus the unit id already in hdr[6]
+    timeout(budget, stream.read_exact(&mut body))
+        .await
+        .ok()?
+        .ok()?;
+    Some(body)
+}
+
+/// Parse vendor / product / revision from a Read Device Identification PDU:
+/// `[0x2B, 0x0E, readDevIdCode, conformity, moreFollows, nextObjId, numObjects,
+/// (objId, len, bytes…)…]`.
+fn parse_device_id(pdu: &[u8]) -> Option<DeviceId> {
+    if pdu.len() < 7 {
+        return None;
+    }
+    let num = pdu[6] as usize;
+    let mut i = 7;
+    let mut dev = DeviceId::default();
+    for _ in 0..num {
+        if i + 2 > pdu.len() {
+            break;
+        }
+        let id = pdu[i];
+        let l = pdu[i + 1] as usize;
+        i += 2;
+        if i + l > pdu.len() {
+            break;
+        }
+        let val = String::from_utf8_lossy(&pdu[i..i + l]).trim().to_string();
+        i += l;
+        match id {
+            0x00 => dev.vendor = Some(val),
+            0x01 => dev.product = Some(val),
+            0x02 => dev.revision = Some(val),
+            _ => {}
+        }
+    }
+    if dev == DeviceId::default() {
+        None
+    } else {
+        Some(dev)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    /// A one-shot mock Modbus/TCP server that answers a Read Holding Registers
+    /// request and a Read Device Identification request on one connection.
+    async fn mock_server(with_device: bool) -> std::net::SocketAddr {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        tokio::spawn(async move {
+            let (mut sock, _) = listener.accept().await.expect("accept");
+            loop {
+                let mut hdr = [0u8; 7];
+                if sock.read_exact(&mut hdr).await.is_err() {
+                    break;
+                }
+                let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
+                let mut pdu = vec![0u8; plen - 1];
+                if sock.read_exact(&mut pdu).await.is_err() {
+                    break;
+                }
+                let reply_pdu: Vec<u8> = match pdu.first() {
+                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register (byte_count 2)
+                    Some(0x01) => vec![0x01, 0x02, 0xFF, 0xFF], // 16 coils (byte_count 2)
+                    Some(0x2B) if with_device => vec![
+                        0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
+                        0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
+                        0x01, 0x03, b'P', b'L', b'C', // product
+                    ],
+                    _ => vec![pdu[0] | 0x80, 0x01], // exception
+                };
+                let len = (reply_pdu.len() + 1) as u16;
+                let mut frame = vec![hdr[0], hdr[1], 0x00, 0x00];
+                frame.extend_from_slice(&len.to_be_bytes());
+                frame.push(hdr[6]);
+                frame.extend_from_slice(&reply_pdu);
+                if sock.write_all(&frame).await.is_err() {
+                    break;
+                }
+            }
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn probe_detects_a_modbus_endpoint_and_reads_device_id() {
+        let addr = mock_server(true).await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.reachable && p.speaks_modbus);
+        let dev = p.device.expect("device id");
+        assert_eq!(dev.vendor.as_deref(), Some("ACME"));
+        assert_eq!(dev.product.as_deref(), Some("PLC"));
+    }
+
+    #[tokio::test]
+    async fn probe_enumerates_exposed_process_points() {
+        let addr = mock_server(false).await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.speaks_modbus);
+        // The mock returns a 2-byte holding-register block (1 register) and a
+        // 2-byte coil block (16 coils).
+        assert_eq!(p.holding_registers_readable, Some(1));
+        assert_eq!(p.coils_readable, Some(16));
+    }
+
+    #[test]
+    fn reply_counts_decode_byte_counts() {
+        assert_eq!(register_count_from_reply(&[0x03, 0x08]), 4); // 8 bytes → 4 regs
+        assert_eq!(coil_count_from_reply(&[0x01, 0x03]), 24); // 3 bytes → 24 coils
+        assert_eq!(register_count_from_reply(&[0x03]), 0); // malformed → 0
+    }
+
+    #[tokio::test]
+    async fn probe_reports_unreachable_for_a_closed_port() {
+        // 127.0.0.1:1 is (almost certainly) closed.
+        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
+        assert!(!p.reachable && !p.speaks_modbus);
+    }
+
+    #[test]
+    fn parses_device_identification_objects() {
+        let pdu = [
+            0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x01, // 1 object
+            0x02, 0x05, b'v', b'1', b'.', b'2', b'3', // revision
+        ];
+        let dev = parse_device_id(&pdu).expect("device");
+        assert_eq!(dev.revision.as_deref(), Some("v1.23"));
+        assert!(dev.vendor.is_none());
+    }
+}
@@ -0,0 +1,131 @@
+//! Minimal OPC UA reachability probe.
+//!
+//! Speaks just the OPC UA Connection Protocol (UACP) handshake — a `HEL` (Hello)
+//! message, expecting an `ACK` (or `ERR`) reply — to confirm an OPC UA server is
+//! listening (default port 4840). It does **not** open a secure channel or make
+//! service calls; deep analysis of the server's SecurityPolicy / user-token
+//! policies (the common `None` + `Anonymous` misconfiguration) is a follow-on best
+//! done with a full OPC UA stack.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Outcome of an OPC UA handshake probe.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct OpcUaProbe {
+    /// A TCP connection to the port was established.
+    pub reachable: bool,
+    /// The endpoint replied to the UACP Hello (`ACK`) or rejected it (`ERR`) —
+    /// either way it speaks OPC UA.
+    pub is_opcua: bool,
+}
+
+/// Probe an OPC UA endpoint with a UACP Hello. Read-only handshake only.
+pub async fn probe(host: &str, port: u16, budget: Duration) -> OpcUaProbe {
+    let mut out = OpcUaProbe::default();
+    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
+        return out;
+    };
+    out.reachable = true;
+
+    let hello = hello_message(&format!("opc.tcp://{host}:{port}"));
+    if timeout(budget, stream.write_all(&hello))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+
+    // Read the 3-byte message type of the reply: ACK (accepted) or ERR (rejected
+    // our hello) both prove the peer speaks the OPC UA connection protocol.
+    let mut mt = [0u8; 3];
+    if timeout(budget, stream.read_exact(&mut mt))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+    if &mt == b"ACK" || &mt == b"ERR" {
+        out.is_opcua = true;
+    }
+    out
+}
+
+/// Build a UACP `HEL` (Hello) message advertising our buffer sizes + endpoint URL.
+fn hello_message(endpoint_url: &str) -> Vec<u8> {
+    let url = endpoint_url.as_bytes();
+    let mut m = Vec::with_capacity(32 + url.len());
+    m.extend_from_slice(b"HELF");
+    m.extend_from_slice(&0u32.to_le_bytes()); // message size — patched below
+    m.extend_from_slice(&0u32.to_le_bytes()); // ProtocolVersion
+    m.extend_from_slice(&65536u32.to_le_bytes()); // ReceiveBufferSize
+    m.extend_from_slice(&65536u32.to_le_bytes()); // SendBufferSize
+    m.extend_from_slice(&0u32.to_le_bytes()); // MaxMessageSize (0 = no limit)
+    m.extend_from_slice(&0u32.to_le_bytes()); // MaxChunkCount
+    m.extend_from_slice(&(url.len() as i32).to_le_bytes()); // EndpointUrl length
+    m.extend_from_slice(url);
+    let size = m.len() as u32;
+    m[4..8].copy_from_slice(&size.to_le_bytes());
+    m
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    /// A mock OPC UA server that reads the Hello and replies with an `ACK` frame.
+    async fn mock_server() -> std::net::SocketAddr {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        tokio::spawn(async move {
+            let (mut sock, _) = listener.accept().await.expect("accept");
+            // Read the Hello header (8 bytes) to learn the size, then drain it.
+            let mut hdr = [0u8; 8];
+            if sock.read_exact(&mut hdr).await.is_err() {
+                return;
+            }
+            let size = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
+            let mut rest = vec![0u8; size.saturating_sub(8)];
+            let _ = sock.read_exact(&mut rest).await;
+            // Reply: ACK + size + 5 u32 fields.
+            let mut ack = Vec::new();
+            ack.extend_from_slice(b"ACKF");
+            ack.extend_from_slice(&28u32.to_le_bytes());
+            for _ in 0..5 {
+                ack.extend_from_slice(&0u32.to_le_bytes());
+            }
+            let _ = sock.write_all(&ack).await;
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn probe_detects_an_opcua_server() {
+        let addr = mock_server().await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.reachable && p.is_opcua);
+    }
+
+    #[tokio::test]
+    async fn probe_reports_unreachable_for_a_closed_port() {
+        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
+        assert!(!p.reachable && !p.is_opcua);
+    }
+
+    #[test]
+    fn hello_message_is_well_formed() {
+        let m = hello_message("opc.tcp://h:4840");
+        assert_eq!(&m[0..4], b"HELF");
+        // The embedded size equals the actual length.
+        let size = u32::from_le_bytes([m[4], m[5], m[6], m[7]]) as usize;
+        assert_eq!(size, m.len());
+    }
+}
@@ -0,0 +1,137 @@
+//! TCP service discovery for a device.
+//!
+//! Connect-scans a curated set of OT/ICS and insecure-management ports and reports
+//! the ones that are open. The deep protocol probes own Modbus (502), OPC UA
+//! (4840) and EtherNet/IP (44818); this surfaces the *rest* of the industrial and
+//! cleartext-management surface (Siemens S7, DNP3, CODESYS programming, Telnet, …).
+
+use std::time::Duration;
+
+use futures_util::future::join_all;
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Whether an open port is an industrial protocol or an insecure management service.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PortKind {
+    /// An industrial control protocol (typically unauthenticated).
+    Ics,
+    /// A cleartext management service (credentials/data in the clear).
+    InsecureMgmt,
+}
+
+/// A well-known port worth flagging when open.
+#[derive(Debug, Clone, Copy)]
+pub struct KnownPort {
+    pub port: u16,
+    pub service: &'static str,
+    pub kind: PortKind,
+    pub note: &'static str,
+}
+
+/// The curated scan list. Excludes 502 / 4840 / 44818 — those have dedicated deep
+/// probes (Modbus, OPC UA, EtherNet/IP) that report richer findings.
+pub const KNOWN_PORTS: &[KnownPort] = &[
+    KnownPort {
+        port: 102,
+        service: "S7comm / ISO-TSAP",
+        kind: PortKind::Ics,
+        note: "Siemens S7 PLC communication",
+    },
+    KnownPort {
+        port: 20000,
+        service: "DNP3",
+        kind: PortKind::Ics,
+        note: "SCADA / DNP3",
+    },
+    KnownPort {
+        port: 1911,
+        service: "Niagara Fox",
+        kind: PortKind::Ics,
+        note: "Tridium Niagara building automation",
+    },
+    KnownPort {
+        port: 11740,
+        service: "CODESYS",
+        kind: PortKind::Ics,
+        note: "CODESYS programming protocol",
+    },
+    KnownPort {
+        port: 1962,
+        service: "PCWorx",
+        kind: PortKind::Ics,
+        note: "Phoenix Contact PCWorx",
+    },
+    KnownPort {
+        port: 9600,
+        service: "OMRON FINS",
+        kind: PortKind::Ics,
+        note: "Omron FINS",
+    },
+    KnownPort {
+        port: 789,
+        service: "Red Lion Crimson",
+        kind: PortKind::Ics,
+        note: "Red Lion controllers",
+    },
+    KnownPort {
+        port: 23,
+        service: "Telnet",
+        kind: PortKind::InsecureMgmt,
+        note: "cleartext remote shell",
+    },
+    KnownPort {
+        port: 21,
+        service: "FTP",
+        kind: PortKind::InsecureMgmt,
+        note: "cleartext file transfer",
+    },
+];
+
+/// Connect-scan `ports` on `host` (concurrently) and return those that accept a
+/// TCP connection.
+pub async fn scan<'a>(host: &str, ports: &'a [KnownPort], budget: Duration) -> Vec<&'a KnownPort> {
+    let checks = ports.iter().map(|kp| async move {
+        let open = timeout(budget, TcpStream::connect((host, kp.port)))
+            .await
+            .map(|r| r.is_ok())
+            .unwrap_or(false);
+        (kp, open)
+    });
+    join_all(checks)
+        .await
+        .into_iter()
+        .filter_map(|(kp, open)| open.then_some(kp))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    #[tokio::test]
+    async fn scan_reports_only_open_ports() {
+        // Bind one port (open) and pick another that is closed.
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let open_port = listener.local_addr().expect("addr").port();
+
+        let ports = [
+            KnownPort {
+                port: open_port,
+                service: "test-open",
+                kind: PortKind::Ics,
+                note: "",
+            },
+            KnownPort {
+                port: 1,
+                service: "test-closed",
+                kind: PortKind::InsecureMgmt,
+                note: "",
+            },
+        ];
+        let found = scan("127.0.0.1", &ports, Duration::from_millis(500)).await;
+        let services: Vec<&str> = found.iter().map(|p| p.service).collect();
+        assert_eq!(services, vec!["test-open"]);
+    }
+}
@@ -1,5 +1,6 @@
 use mongodb::bson::doc;

+use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;

 use super::orchestrator::{extract_base_url, PipelineOrchestrator};
@@ -10,7 +11,7 @@ use crate::trackers;
 impl PipelineOrchestrator {
    /// Build an issue tracker client from a repository's tracker configuration.
    /// Returns `None` if the repo has no tracker configured.
-    pub(super) fn build_tracker(&self, repo: &TrackedRepository) -> Option<TrackerDispatch> {
+    pub(super) fn build_tracker(&self, repo: &RepoView) -> Option<TrackerDispatch> {
        let tracker_type = repo.tracker_type.as_ref()?;
        // Per-repo token takes precedence, fall back to global config
        match tracker_type {
@@ -81,7 +82,7 @@ impl PipelineOrchestrator {
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
    pub(super) async fn create_tracker_issues(
        &self,
-        repo: &TrackedRepository,
+        repo: &RepoView,
        repo_id: &str,
        new_findings: &[Finding],
    ) -> Result<(), AgentError> {
@@ -1,14 +1,19 @@
 pub mod code_review;
 pub mod cve;
 pub mod dedup;
+pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
+pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
+pub mod plan;
+pub mod plc;
 mod pr_review;
+pub mod repo_view;
 pub mod sbom;
 pub mod semgrep;
 mod tracker_dispatch;
@@ -15,6 +15,8 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
+use crate::pipeline::plan::build_scan_plan;
+use crate::pipeline::repo_view::RepoView;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;

@@ -50,72 +52,8 @@ impl PipelineOrchestrator {
        }
    }

-    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, trigger = ?trigger))]
-    pub async fn run(&self, repo_id: &str, trigger: ScanTrigger) -> Result<(), AgentError> {
-        // Look up the repository
-        let repo = self
-            .db
-            .repositories()
-            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id).map_err(|e| AgentError::Other(e.to_string()))? })
-            .await?
-            .ok_or_else(|| AgentError::Other(format!("Repository {repo_id} not found")))?;
-
-        // Create scan run
-        let scan_run = ScanRun::new(repo_id.to_string(), trigger);
-        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
-        let scan_run_id = insert
-            .inserted_id
-            .as_object_id()
-            .map(|id| id.to_hex())
-            .unwrap_or_default();
-
-        let result = self.run_pipeline(&repo, &scan_run_id).await;
-
-        // Update scan run status
-        match &result {
-            Ok(count) => {
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! {
-                            "$set": {
-                                "status": "completed",
-                                "current_phase": "completed",
-                                "new_findings_count": *count as i64,
-                                "completed_at": mongodb::bson::DateTime::now(),
-                            }
-                        },
-                    )
-                    .await?;
-            }
-            Err(e) => {
-                tracing::error!(repo_id, error = %e, "Scan pipeline failed");
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! {
-                            "$set": {
-                                "status": "failed",
-                                "error_message": e.to_string(),
-                                "completed_at": mongodb::bson::DateTime::now(),
-                            }
-                        },
-                    )
-                    .await?;
-            }
-        }
-
-        result.map(|_| ())
-    }
-
    #[tracing::instrument(skip_all, fields(repo_id = repo.name.as_str()))]
-    async fn run_pipeline(
-        &self,
-        repo: &TrackedRepository,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
+    async fn run_pipeline(&self, repo: &RepoView, scan_run_id: &str) -> Result<u32, AgentError> {
        let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();

        // Stage 0: Change detection
@@ -129,7 +67,6 @@ impl PipelineOrchestrator {
            return Ok(0);
        }

-        let current_sha = GitOps::get_head_sha(&repo_path)?;
        let mut all_findings: Vec<Finding> = Vec::new();

        // Stage 1: Semgrep SAST
@@ -322,68 +259,13 @@ impl PipelineOrchestrator {
                .await?;
        }

-        // Persist CVE alerts and create notifications
-        {
-            use compliance_core::models::notification::{parse_severity, CveNotification};
-
-            let repo_name = repo.name.clone();
-            let mut new_notif_count = 0u32;
-
-            for alert in &cve_alerts {
-                // Upsert the alert
-                let filter = doc! {
-                    "cve_id": &alert.cve_id,
-                    "repo_id": &alert.repo_id,
-                };
-                let update = mongodb::bson::to_document(alert)
-                    .map(|d| doc! { "$set": d })
-                    .unwrap_or_else(|_| doc! {});
-                self.db
-                    .cve_alerts()
-                    .update_one(filter, update)
-                    .upsert(true)
+        // Persist CVE alerts and create notifications (shared with the PLC path).
+        let new_notif_count = self
+            .persist_cve_alerts(&repo_id, &repo.name, &cve_alerts)
            .await?;
-
-                // Create notification (dedup by cve_id + repo + package + version)
-                let notif_filter = doc! {
-                    "cve_id": &alert.cve_id,
-                    "repo_id": &alert.repo_id,
-                    "package_name": &alert.affected_package,
-                    "package_version": &alert.affected_version,
-                };
-                let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
-                let mut notification = CveNotification::new(
-                    alert.cve_id.clone(),
-                    repo_id.clone(),
-                    repo_name.clone(),
-                    alert.affected_package.clone(),
-                    alert.affected_version.clone(),
-                    severity,
-                );
-                notification.cvss_score = alert.cvss_score;
-                notification.summary = alert.summary.clone();
-                notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
-
-                let notif_update = doc! {
-                    "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
-                };
-                if let Ok(result) = self
-                    .db
-                    .cve_notifications()
-                    .update_one(notif_filter, notif_update)
-                    .upsert(true)
-                    .await
-                {
-                    if result.upserted_id.is_some() {
-                        new_notif_count += 1;
-                    }
-                }
-            }
-
        if new_notif_count > 0 {
            tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
        }
-        }

        // Stage 6: Issue Creation
        tracing::info!("[{repo_id}] Stage 6: Issue Creation");
@@ -395,20 +277,9 @@ impl PipelineOrchestrator {
            tracing::warn!("[{repo_id}] Issue creation failed: {e}");
        }

-        // Stage 7: Update repository
-        self.db
-            .repositories()
-            .update_one(
-                doc! { "_id": repo.id },
-                doc! {
-                    "$set": {
-                        "last_scanned_commit": &current_sha,
-                        "updated_at": mongodb::bson::DateTime::now(),
-                    },
-                    "$inc": { "findings_count": new_count as i64 },
-                },
-            )
-            .await?;
+        // The onboarded target's findings_count and the git artifact's
+        // last_scanned_commit watermark are persisted by `finalize_target` after
+        // `run_pipeline` returns.

        // Stage 8: DAST (async, optional — only if a DastTarget is configured)
        tracing::info!("[{repo_id}] Stage 8: Checking for DAST targets");
@@ -419,6 +290,728 @@ impl PipelineOrchestrator {
        Ok(new_count)
    }

+    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
+    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
+    /// `onboarded_targets` and dispatches by the scan plan.
+    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
+    pub async fn run_target(
+        &self,
+        target_id: &str,
+        trigger: ScanTrigger,
+    ) -> Result<(), AgentError> {
+        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
+            .map_err(|e| AgentError::Other(e.to_string()))?;
+        let target = self
+            .db
+            .onboarded_targets()
+            .find_one(doc! { "_id": oid })
+            .await?
+            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
+
+        let scan_run = ScanRun::new(target_id.to_string(), trigger);
+        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
+        let scan_run_id = insert
+            .inserted_id
+            .as_object_id()
+            .map(|id| id.to_hex())
+            .unwrap_or_default();
+
+        let result = self.run_target_pipeline(&target, &scan_run_id).await;
+        match &result {
+            Ok(count) => {
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "completed",
+                            "current_phase": "completed",
+                            "new_findings_count": *count as i64,
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+                // Refresh the target's cached findings count. The shared pipeline
+                // (Stage 7) increments `repositories`, which the unified path does
+                // not use, so set the accurate total on the target itself.
+                let total = self
+                    .db
+                    .findings()
+                    .count_documents(doc! { "repo_id": target_id })
+                    .await
+                    .unwrap_or(*count as u64);
+                self.db
+                    .onboarded_targets()
+                    .update_one(
+                        doc! { "_id": oid },
+                        doc! { "$set": {
+                            "findings_count": total as i64,
+                            "updated_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+            Err(e) => {
+                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "failed",
+                            "error_message": e.to_string(),
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+        }
+        result.map(|_| ())
+    }
+
+    /// Run the applicable scans for a target. For a code target this reuses the
+    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
+    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
+    /// follow-ups (#128/#129/#130). Returns the number of new findings.
+    async fn run_target_pipeline(
+        &self,
+        target: &OnboardedTarget,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
+        let plan = build_scan_plan(target);
+        tracing::info!(
+            target_id = %target_id,
+            target_type = %target.target_type,
+            planned_steps = plan.steps.len(),
+            "Unified pipeline: scan plan built"
+        );
+
+        // Ingest + classify (tramiton for firmware) and store the detected type.
+        self.classify_and_store(target, &target_id, scan_run_id)
+            .await;
+        // Provision a DAST target from a LiveUrl artifact so DAST fires for
+        // wizard-created targets, not just migrated ones.
+        self.ensure_dast_target(target, &plan).await;
+
+        // PLC/SPS targets: the control-logic scan consumes the PLC source (an
+        // uploaded PlcProject *or* a git repo / source archive of PLCopen XML / ST
+        // exports), so it takes over the code artifact — we don't also run the
+        // SAST pipeline over it. A PLC device is reachable, so DAST still runs
+        // against a WebVisu / exposed endpoint when one is provisioned.
+        let mut new_count = 0u32;
+        let plc = plan.has(ScanType::PlcControlLogic);
+        let ics = plan.has(ScanType::IcsProbe);
+        if plc {
+            new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
+            // Provision-and-test (#183): with the control logic but no reachable
+            // device, instantiate it on an ephemeral soft-PLC and probe that
+            // instead of the customer's OT network. Opt-in (needs Docker) and only
+            // when there is no live URL to probe directly. Never fails the scan.
+            if self.config.plc_runtime.enabled && target.live_url().is_none() {
+                match self
+                    .run_provisioned_plc_test(target, &target_id, scan_run_id)
+                    .await
+                {
+                    Ok(n) => new_count += n,
+                    Err(e) => {
+                        tracing::warn!(target_id = %target_id, error = %e, "provision-and-test failed")
+                    }
+                }
+            }
+        }
+        if ics {
+            new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
+        }
+        if plc || ics {
+            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint, but
+            // only when DAST is actually planned — a device reachable only over an
+            // industrial protocol (e.g. modbus://) has no web surface to crawl, and
+            // running DAST there just fails at reconnaissance. Gating here (not only
+            // at provisioning) also stops a DAST target left over from an earlier
+            // run from re-triggering. The control-logic scan already consumed the
+            // code artifact, so the SAST pipeline is not re-run.
+            if plan.has(ScanType::Dast) {
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+            }
+            return Ok(new_count);
+        }
+
+        match target.code_artifact() {
+            Some(code) if code.kind == ArtifactKind::GitRepo => {
+                let repo = RepoView::from_target(target, code);
+                let n = self.run_pipeline(&repo, scan_run_id).await?;
+                self.finalize_target(target, &repo, n).await?;
+                new_count += n;
+            }
+            Some(_) => {
+                tracing::warn!(
+                    target_id = %target_id,
+                    "Unified pipeline: source-archive scanning not yet wired; skipping"
+                );
+            }
+            None => {
+                // No code to scan (a migrated DAST target). Firmware/mobile static
+                // scanners land in #128/#129; DAST for a running URL works when a
+                // DastTarget row exists (provisioned above from a LiveUrl, or from
+                // a migrated target).
+                tracing::info!(
+                    target_id = %target_id,
+                    "Unified pipeline: no code artifact; attempting DAST"
+                );
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Analyze a PLC/SPS project (Structured Text / PLCopen XML) for
+    /// control-logic security issues and persist the new findings.
+    async fn run_plc_scan(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        tracing::info!(target_id, "[{target_id}] PLC control-logic analysis");
+        self.update_phase(scan_run_id, "plc_analysis").await;
+
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
+        // Every PLC-source artifact on the target: dedicated PLC projects plus any
+        // code artifacts (git repo / source archive) holding PLCopen XML / ST
+        // exports. A target can carry several (e.g. one POU export per file).
+        let sources: Vec<&Artifact> = target
+            .artifacts
+            .iter()
+            .filter(|a| {
+                matches!(
+                    a.kind,
+                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+                )
+            })
+            .collect();
+        if sources.is_empty() {
+            tracing::warn!(target_id, "PLC scan: no PLC source artifact");
+            return Ok(0);
+        }
+
+        let mut all_findings = Vec::new();
+        let mut all_sbom: Vec<SbomEntry> = Vec::new();
+        let mut sbom_seen = std::collections::BTreeSet::new();
+        for a in &sources {
+            let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
+                continue;
+            };
+            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
+            // Control-application SBOM: CODESYS libraries + runtime from a
+            // `.projectarchive` (uploaded, or committed in the working tree).
+            let archive = a
+                .stored_path
+                .clone()
+                .unwrap_or_else(|| a.source_ref.clone());
+            for e in crate::pipeline::plc::sbom::collect_sbom(
+                std::path::Path::new(&archive),
+                &path,
+                target_id,
+            ) {
+                if sbom_seen.insert((e.name.clone(), e.version.clone())) {
+                    all_sbom.push(e);
+                }
+            }
+        }
+        tracing::info!(
+            target_id,
+            artifacts = sources.len(),
+            found = all_findings.len(),
+            "PLC control-logic analysis complete"
+        );
+
+        let mut new_count = 0u32;
+        for mut finding in all_findings {
+            finding.scan_run_id = Some(scan_run_id.to_string());
+            if self
+                .db
+                .findings()
+                .find_one(doc! { "fingerprint": &finding.fingerprint })
+                .await?
+                .is_none()
+            {
+                self.db.findings().insert_one(&finding).await?;
+                new_count += 1;
+            }
+        }
+
+        if !all_sbom.is_empty() {
+            if let Err(e) = self
+                .persist_control_app_sbom(target_id, &target.name, all_sbom)
+                .await
+            {
+                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Provision-and-test (#183): instantiate the target's control logic on an
+    /// ephemeral soft-PLC (OpenPLC), start it, probe the provisioned Modbus
+    /// endpoint, and tear the instance down. Used when a PLC/SPS target has the
+    /// control logic but no reachable live device to probe directly. Guarded by
+    /// `plc_runtime.enabled` (needs Docker); persists the same [`ScanType::IcsProbe`]
+    /// findings as a live probe.
+    async fn run_provisioned_plc_test(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        self.update_phase(scan_run_id, "plc_provision").await;
+
+        // Locate a loadable control-logic program among the PLC-source artifacts
+        // (same selection as the static PLC scan: dedicated PLC projects plus code
+        // artifacts holding PLCopen XML / ST exports).
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
+        let program = target
+            .artifacts
+            .iter()
+            .filter(|a| {
+                matches!(
+                    a.kind,
+                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+                )
+            })
+            .find_map(|a| {
+                let path = ingest_set
+                    .get(&a.id)
+                    .and_then(|ia| ia.working_path.clone())?;
+                crate::pipeline::plc::runtime::extract_program(&path)
+            });
+        let Some(program) = program else {
+            tracing::info!(
+                target_id,
+                "provision-and-test: no loadable control-logic program"
+            );
+            return Ok(0);
+        };
+
+        let http = crate::pipeline::plc::runtime::http_client()?;
+        let provisioner =
+            crate::pipeline::plc::runtime::DockerSoftPlc::new(self.config.plc_runtime.clone());
+        let outcome = crate::pipeline::plc::runtime::provision_and_test(
+            &provisioner,
+            &http,
+            &self.config.plc_runtime,
+            &program,
+            target_id,
+        )
+        .await?;
+        tracing::info!(
+            target_id,
+            found = outcome.findings.len(),
+            dast = outcome.dast.is_some(),
+            "provision-and-test complete"
+        );
+
+        let mut new_count = 0u32;
+        for mut finding in outcome.findings {
+            finding.scan_run_id = Some(scan_run_id.to_string());
+            if self
+                .db
+                .findings()
+                .find_one(doc! { "fingerprint": &finding.fingerprint })
+                .await?
+                .is_none()
+            {
+                self.db.findings().insert_one(&finding).await?;
+                new_count += 1;
+            }
+        }
+
+        // Persist the DAST scan of the provisioned web endpoint, linked to this
+        // scan run (mirrors `maybe_trigger_dast`).
+        if let Some(dast) = outcome.dast {
+            let mut scan_run = dast.scan_run;
+            scan_run.sast_scan_run_id = Some(scan_run_id.to_string());
+            if let Err(e) = self.db.dast_scan_runs().insert_one(&scan_run).await {
+                tracing::warn!(target_id, error = %e, "failed to store provisioned DAST scan run");
+            }
+            for finding in &dast.findings {
+                if let Err(e) = self.db.dast_findings().insert_one(finding).await {
+                    tracing::warn!(target_id, error = %e, "failed to store provisioned DAST finding");
+                }
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
+    /// and persist findings for exposed / unauthenticated control access. The
+    /// probe is read-only; it targets the Modbus port of the target's live URL.
+    async fn run_ics_probe(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        self.update_phase(scan_run_id, "ics_probe").await;
+        let Some(endpoint) = target.live_url().map(|a| a.source_ref.clone()) else {
+            tracing::warn!(target_id, "ICS probe: no live URL");
+            return Ok(0);
+        };
+        // Short per-request budget so an unreachable device doesn't stall the scan.
+        let budget = std::time::Duration::from_secs(5);
+        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
+        tracing::info!(
+            target_id,
+            endpoint = %endpoint,
+            found = findings.len(),
+            "ICS probe complete"
+        );
+        let mut new_count = 0u32;
+        for mut finding in findings {
+            finding.scan_run_id = Some(scan_run_id.to_string());
+            if self
+                .db
+                .findings()
+                .find_one(doc! { "fingerprint": &finding.fingerprint })
+                .await?
+                .is_none()
+            {
+                self.db.findings().insert_one(&finding).await?;
+                new_count += 1;
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Store a control-application SBOM (CODESYS libraries + runtime) for a target
+    /// and match it against known CVEs. Scoped to `package_manager = "codesys"` so
+    /// it refreshes on re-scan and coexists with any firmware/source SBOM. The
+    /// runtime `Cmp*` / `3SLicense` components carry real CODESYS advisories, so
+    /// this is where PLC-device CVE coverage comes from.
+    async fn persist_control_app_sbom(
+        &self,
+        target_id: &str,
+        target_name: &str,
+        mut entries: Vec<SbomEntry>,
+    ) -> Result<(), AgentError> {
+        if entries.is_empty() {
+            return Ok(());
+        }
+        self.db
+            .sbom_entries()
+            .delete_many(doc! { "repo_id": target_id, "package_manager": "codesys" })
+            .await?;
+
+        let cve_scanner = CveScanner::new(
+            self.http.clone(),
+            self.config.searxng_url.clone(),
+            self.config.nvd_api_key.as_ref().map(|k| {
+                use secrecy::ExposeSecret;
+                k.expose_secret().to_string()
+            }),
+        );
+        let mut alerts = match tokio::time::timeout(
+            std::time::Duration::from_secs(600),
+            cve_scanner.scan_dependencies(target_id, &mut entries),
+        )
+        .await
+        {
+            Ok(Ok(a)) => a,
+            Ok(Err(e)) => {
+                tracing::warn!(target_id, error = %e, "control-app CVE scan failed");
+                Vec::new()
+            }
+            Err(_) => {
+                tracing::warn!(target_id, "control-app CVE scan timed out");
+                Vec::new()
+            }
+        };
+        // OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
+        // live in NVD keyed by CPE + runtime version. Add those (best-effort).
+        if let Ok(codesys) = tokio::time::timeout(
+            std::time::Duration::from_secs(120),
+            cve_scanner.scan_codesys(target_id, &mut entries),
+        )
+        .await
+        {
+            alerts.extend(codesys);
+        } else {
+            tracing::warn!(target_id, "CODESYS CVE match timed out");
+        }
+
+        for entry in &entries {
+            let filter = doc! {
+                "repo_id": &entry.repo_id,
+                "name": &entry.name,
+                "version": &entry.version,
+            };
+            if let Ok(d) = mongodb::bson::to_document(entry) {
+                self.db
+                    .sbom_entries()
+                    .update_one(filter, doc! { "$set": d })
+                    .upsert(true)
+                    .await?;
+            }
+        }
+        let new_notifs = self
+            .persist_cve_alerts(target_id, target_name, &alerts)
+            .await?;
+        tracing::info!(
+            target_id,
+            components = entries.len(),
+            alerts = alerts.len(),
+            notifications = new_notifs,
+            "control-app SBOM stored"
+        );
+        Ok(())
+    }
+
+    /// Upsert CVE alerts for a target and create dedup'd CVE notifications;
+    /// returns the number of newly-created notifications. Shared by the SAST
+    /// pipeline and the PLC control-app SBOM path, so every SBOM source (source,
+    /// firmware, CODESYS libraries/runtime) raises the same notifications.
+    async fn persist_cve_alerts(
+        &self,
+        repo_id: &str,
+        repo_name: &str,
+        alerts: &[CveAlert],
+    ) -> Result<u32, AgentError> {
+        use compliance_core::models::notification::{parse_severity, CveNotification};
+
+        let mut new_notif = 0u32;
+        for alert in alerts {
+            let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
+            let update = mongodb::bson::to_document(alert)
+                .map(|d| doc! { "$set": d })
+                .unwrap_or_else(|_| doc! {});
+            self.db
+                .cve_alerts()
+                .update_one(filter, update)
+                .upsert(true)
+                .await?;
+
+            // Dedup notifications by cve + repo + package + version.
+            let notif_filter = doc! {
+                "cve_id": &alert.cve_id,
+                "repo_id": &alert.repo_id,
+                "package_name": &alert.affected_package,
+                "package_version": &alert.affected_version,
+            };
+            let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
+            let mut notification = CveNotification::new(
+                alert.cve_id.clone(),
+                repo_id.to_string(),
+                repo_name.to_string(),
+                alert.affected_package.clone(),
+                alert.affected_version.clone(),
+                severity,
+            );
+            notification.cvss_score = alert.cvss_score;
+            notification.summary = alert.summary.clone();
+            notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
+            let notif_update = doc! {
+                "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
+            };
+            if let Ok(result) = self
+                .db
+                .cve_notifications()
+                .update_one(notif_filter, notif_update)
+                .upsert(true)
+                .await
+            {
+                if result.upserted_id.is_some() {
+                    new_notif += 1;
+                }
+            }
+        }
+        Ok(new_notif)
+    }
+
+    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
+    /// heuristics otherwise), and store the detected classification on the target.
+    /// Best-effort — never fails the scan.
+    async fn classify_and_store(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) {
+        self.update_phase(scan_run_id, "classification").await;
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = match crate::ingest::ingest_all(target, &ctx) {
+            Ok(set) => set,
+            Err(e) => {
+                tracing::warn!(target_id, error = %e, "Unified pipeline: ingest for classification failed");
+                return;
+            }
+        };
+        let working_paths = ingest_set.working_paths();
+        match crate::classify::classify_target(
+            target,
+            &working_paths,
+            &crate::classify::TramitonNative,
+        )
+        .await
+        {
+            Ok(classification) => {
+                tracing::info!(
+                    target_id,
+                    suggested = %classification.suggested,
+                    "Unified pipeline: classified target"
+                );
+                if let (Some(oid), Ok(bson)) = (target.id, mongodb::bson::to_bson(&classification))
+                {
+                    let _ = self
+                        .db
+                        .onboarded_targets()
+                        .update_one(
+                            doc! { "_id": oid },
+                            doc! { "$set": { "classification": bson } },
+                        )
+                        .await;
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
+            }
+        }
+
+        // Analysis-based firmware SBOM: for embedded targets, derive components
+        // (resolved libraries + cross-toolchain) from tramiton's build-plan
+        // analysis over the already-ingested source — no build, no binary
+        // upload. Best-effort; empty when no build plan forms.
+        if crate::pipeline::firmware_sbom::is_firmware_target(target.target_type) {
+            if let Some(code) = target.code_artifact() {
+                if let Some(path) = working_paths.get(&code.id) {
+                    let entries =
+                        crate::pipeline::firmware_sbom::firmware_sbom_entries(path, target_id)
+                            .await;
+                    if !entries.is_empty() {
+                        let _ = self
+                            .db
+                            .sbom_entries()
+                            .delete_many(doc! { "repo_id": target_id })
+                            .await;
+                        for entry in &entries {
+                            let filter = doc! {
+                                "repo_id": &entry.repo_id,
+                                "name": &entry.name,
+                                "version": &entry.version,
+                            };
+                            if let Ok(d) = mongodb::bson::to_document(entry) {
+                                let _ = self
+                                    .db
+                                    .sbom_entries()
+                                    .update_one(filter, doc! { "$set": d })
+                                    .upsert(true)
+                                    .await;
+                            }
+                        }
+                        tracing::info!(
+                            target_id,
+                            count = entries.len(),
+                            "Firmware SBOM: stored components from tramiton analysis"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
+    /// `DastTarget` (keyed by `repo_id` = target id) so the existing DAST trigger
+    /// fires for wizard-created targets. Idempotent.
+    async fn ensure_dast_target(
+        &self,
+        target: &OnboardedTarget,
+        plan: &crate::pipeline::plan::ScanPlan,
+    ) {
+        if !plan.has(ScanType::Dast) {
+            return;
+        }
+        let (Some(url), Some(oid)) = (target.live_url(), target.id) else {
+            return;
+        };
+        let target_id = oid.to_hex();
+        if self
+            .db
+            .dast_targets()
+            .find_one(doc! { "repo_id": &target_id })
+            .await
+            .ok()
+            .flatten()
+            .is_some()
+        {
+            return; // already provisioned
+        }
+        let kind = url
+            .web
+            .as_ref()
+            .map(|w| w.target_kind.clone())
+            .unwrap_or(DastTargetType::WebApp);
+        let mut dast = DastTarget::new(target.name.clone(), url.source_ref.clone(), kind);
+        dast.repo_id = Some(target_id);
+        if let Some(web) = &url.web {
+            dast.excluded_paths = web.excluded_paths.clone();
+            dast.max_crawl_depth = web.max_crawl_depth;
+            dast.rate_limit = web.rate_limit;
+            dast.allow_destructive = web.allow_destructive;
+        }
+        if let Some(auth) = &url.auth {
+            dast.auth_config = Some(DastAuthConfig {
+                method: auth.method.clone(),
+                login_url: auth.login_url.clone(),
+                username: auth.username.clone(),
+                password: None,
+                token: auth.secret.clone(),
+                headers: auth.headers.clone(),
+            });
+        }
+        if let Err(e) = self.db.dast_targets().insert_one(&dast).await {
+            tracing::warn!(error = %e, "Unified pipeline: failed to provision DAST target");
+        }
+    }
+
+    /// Sync the onboarded-target document after a scan: bump `findings_count`
+    /// and advance the git artifact's `last_scanned_commit` watermark.
+    async fn finalize_target(
+        &self,
+        target: &OnboardedTarget,
+        repo: &RepoView,
+        new_count: u32,
+    ) -> Result<(), AgentError> {
+        let oid = match target.id {
+            Some(id) => id,
+            None => return Ok(()),
+        };
+        self.db
+            .onboarded_targets()
+            .update_one(
+                doc! { "_id": oid },
+                doc! {
+                    "$inc": { "findings_count": new_count as i64 },
+                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
+                },
+            )
+            .await?;
+
+        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
+        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
+            self.db
+                .onboarded_targets()
+                .update_one(
+                    doc! { "_id": oid, "artifacts.id": &code.id },
+                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
+                )
+                .await?;
+        }
+        Ok(())
+    }
+
    pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
            let _ = self
@@ -460,3 +1053,50 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
        None
    }
 }
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{
+        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
+    };
+
+    #[test]
+    fn repo_view_preserves_id_git_auth_and_tracker() {
+        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
+        target.id = Some(mongodb::bson::oid::ObjectId::new());
+        target.findings_count = 3;
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: Some(TrackerType::Gitea),
+            owner: Some("acme".to_string()),
+            repo: Some("web".to_string()),
+            token: Some("tt".to_string()),
+        });
+
+        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
+        if let Some(git) = artifact.git.as_mut() {
+            git.last_scanned_commit = Some("abc123".to_string());
+        }
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        target.artifacts.push(artifact);
+
+        let code = target.code_artifact().expect("code artifact");
+        let repo = RepoView::from_target(&target, code);
+
+        assert_eq!(repo.id, target.id); // preserved
+        assert_eq!(repo.git_url, "https://git/acme.git");
+        assert_eq!(repo.default_branch, "develop");
+        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
+        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
+        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
+        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
+        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
+        assert_eq!(repo.findings_count, 3);
+    }
+}
@@ -215,7 +215,7 @@ fn scan_with_patterns(
                        repo_id.to_string(),
                        fingerprint,
                        scanner_name.to_string(),
-                        scan_type.clone(),
+                        scan_type,
                        pattern.title.clone(),
                        pattern.description.clone(),
                        pattern.severity.clone(),
@@ -0,0 +1,214 @@
+//! The scan plan.
+//!
+//! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
+//! list of scans to run, each bound to the artifact it consumes. It intersects
+//! the scan-applicability matrix ([`applicable_scans`]) with the target's
+//! `scan_config` overrides: a scan runs when its required artifact is present and
+//! it is either on by default or explicitly enabled, and is not explicitly
+//! disabled. This is the decision engine the unified pipeline (`run_target`)
+//! executes.
+
+use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
+use compliance_core::scan_matrix::applicable_scans;
+
+/// One scan to run, bound to the artifact it operates on.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ScanStep {
+    /// The scan to run.
+    pub scan_type: ScanType,
+    /// The pipeline phase to report while it runs.
+    pub phase: ScanPhase,
+    /// The id of the artifact this scan consumes ([`Artifact::id`]).
+    pub artifact_id: String,
+}
+
+/// The ordered set of scans to run for a target.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct ScanPlan {
+    /// The scans, in matrix order.
+    pub steps: Vec<ScanStep>,
+}
+
+impl ScanPlan {
+    /// Whether the plan contains a step for the given scan type.
+    pub fn has(&self, scan: ScanType) -> bool {
+        self.steps.iter().any(|s| s.scan_type == scan)
+    }
+
+    /// Whether the plan is empty (nothing to run).
+    pub fn is_empty(&self) -> bool {
+        self.steps.is_empty()
+    }
+}
+
+/// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
+/// bound to the artifact it consumes. Scans whose required artifact is absent, or
+/// that are disabled, or off-by-default and not explicitly enabled, are dropped.
+pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
+    let enabled = &target.scan_config.enabled_scans;
+    let disabled = &target.scan_config.disabled_scans;
+
+    let mut steps = Vec::new();
+    for option in applicable_scans(target) {
+        // Required artifact missing → not runnable.
+        if option.blocked_reason.is_some() {
+            continue;
+        }
+        // Explicit opt-out wins.
+        if disabled.contains(&option.scan) {
+            continue;
+        }
+        // Run if on by default, or explicitly enabled.
+        if !option.default_on && !enabled.contains(&option.scan) {
+            continue;
+        }
+        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
+            continue;
+        };
+        steps.push(ScanStep {
+            scan_type: option.scan,
+            phase: phase_for(option.scan),
+            artifact_id: artifact.id.clone(),
+        });
+    }
+    ScanPlan { steps }
+}
+
+/// Resolve the artifact a scan consumes. A "code" requirement (represented by
+/// `GitRepo`) is satisfied by a git repo *or* a source archive. The PLC
+/// control-logic requirement (represented by `PlcProject`) prefers an uploaded
+/// PLC project but also accepts a code artifact — a git repo / source archive
+/// holding PLCopen XML / ST exports.
+fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
+    match required {
+        Some(ArtifactKind::GitRepo) => target.code_artifact(),
+        Some(ArtifactKind::PlcProject) => target
+            .first_of(ArtifactKind::PlcProject)
+            .or_else(|| target.code_artifact()),
+        Some(kind) => target.first_of(kind),
+        None => target.code_artifact().or_else(|| target.artifacts.first()),
+    }
+}
+
+/// The pipeline phase reported while a given scan runs.
+fn phase_for(scan: ScanType) -> ScanPhase {
+    match scan {
+        ScanType::Sast => ScanPhase::Sast,
+        ScanType::Sbom => ScanPhase::SbomGeneration,
+        ScanType::Cve => ScanPhase::CveScanning,
+        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
+        ScanType::SecretDetection => ScanPhase::SecretDetection,
+        ScanType::Lint => ScanPhase::LintScanning,
+        ScanType::CodeReview => ScanPhase::CodeReview,
+        ScanType::Graph => ScanPhase::GraphBuilding,
+        ScanType::Dast => ScanPhase::DastScanning,
+        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
+        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
+        ScanType::MobileStatic => ScanPhase::MobileStatic,
+        ScanType::ContainerScan => ScanPhase::ContainerScan,
+        ScanType::IcsProbe => ScanPhase::IcsProbe,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{PlcFormat, TargetType};
+
+    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("t".to_string(), target_type);
+        t.artifacts = artifacts;
+        t
+    }
+
+    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
+        plan.steps.iter().find(|s| s.scan_type == scan)
+    }
+
+    #[test]
+    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
+        let code = Artifact::git_repo("https://git/x", "main");
+        let url = Artifact::live_url("https://x");
+        let (code_id, url_id) = (code.id.clone(), url.id.clone());
+        let t = target(TargetType::WebApp, vec![code, url]);
+
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, code_id);
+        assert_eq!(sast.phase, ScanPhase::Sast);
+        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
+        assert_eq!(dast.artifact_id, url_id);
+    }
+
+    #[test]
+    fn webapp_without_url_omits_dast() {
+        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.has(ScanType::Sast));
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn code_scan_binds_to_source_archive_when_no_git_repo() {
+        let arc = Artifact::source_archive("src.zip");
+        let arc_id = arc.id.clone();
+        let t = target(TargetType::BackendService, vec![arc]);
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, arc_id);
+    }
+
+    #[test]
+    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
+        let fw = Artifact::firmware_image("fw.bin");
+        let fw_id = fw.id.clone();
+        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
+        let plan = build_scan_plan(&t);
+        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
+        assert_eq!(sbom.artifact_id, fw_id);
+        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn plc_plans_only_control_logic() {
+        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
+        let t = target(TargetType::PlcSps, vec![plc]);
+        let plan = build_scan_plan(&t);
+        assert_eq!(plan.steps.len(), 1);
+        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
+        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
+    }
+
+    #[test]
+    fn plc_control_logic_binds_to_a_git_repo() {
+        // A CODESYS project in git (PLCopen XML / ST exports) with no uploaded
+        // PlcProject: control-logic still plans, bound to the git artifact.
+        let git = Artifact::git_repo("https://git/plc", "main");
+        let git_id = git.id.clone();
+        let t = target(TargetType::PlcSps, vec![git]);
+        let plan = build_scan_plan(&t);
+        let step = step_for(&plan, ScanType::PlcControlLogic).expect("control-logic planned");
+        assert_eq!(step.artifact_id, git_id, "PLC scan binds to the git repo");
+    }
+
+    #[test]
+    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
+        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        t.scan_config.disabled_scans = vec![ScanType::Lint];
+        // CodeReview is off by default for web; enable it explicitly.
+        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
+        let plan = build_scan_plan(&t);
+        assert!(!plan.has(ScanType::Lint));
+        assert!(plan.has(ScanType::CodeReview));
+        assert!(plan.has(ScanType::Sast));
+    }
+
+    #[test]
+    fn no_code_artifact_yields_empty_plan_for_web() {
+        let t = target(TargetType::WebApp, vec![]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.is_empty());
+    }
+}
@@ -0,0 +1,226 @@
+//! Abstract syntax tree for IEC 61131-3 Structured Text (ST).
+//!
+//! This is the security-relevant subset: POUs with their variable declarations
+//! and statement bodies, enough to run semantic control-logic rules over. It is
+//! deliberately not a full language model — declarations we don't reason about
+//! (e.g. exotic type definitions) are parsed loosely and kept as raw text.
+
+/// A Program Organization Unit: a PROGRAM, FUNCTION, or FUNCTION_BLOCK.
+#[derive(Debug, Clone)]
+pub struct Pou {
+    pub name: String,
+    pub kind: PouKind,
+    /// The declared variables, across all VAR_* sections.
+    pub vars: Vec<VarDecl>,
+    /// The statement body.
+    pub body: Vec<Stmt>,
+    /// 1-based line where the POU header appears (in the source that was parsed).
+    pub line: u32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PouKind {
+    Program,
+    Function,
+    FunctionBlock,
+}
+
+impl PouKind {
+    pub fn label(self) -> &'static str {
+        match self {
+            PouKind::Program => "PROGRAM",
+            PouKind::Function => "FUNCTION",
+            PouKind::FunctionBlock => "FUNCTION_BLOCK",
+        }
+    }
+}
+
+/// A single declared variable.
+#[derive(Debug, Clone)]
+pub struct VarDecl {
+    pub name: String,
+    pub section: VarSection,
+    /// The declared type as written (e.g. `BOOL`, `INT`, `ARRAY[0..9] OF INT`).
+    pub type_name: String,
+    /// Whether the type is an ARRAY, and its declared bounds `(lo, hi)` when
+    /// they are literal integers — used by the array-bounds rule.
+    pub array_bounds: Option<(i64, i64)>,
+    /// The initializer expression, if any (`:= <expr>`).
+    pub init: Option<Expr>,
+    pub line: u32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum VarSection {
+    Var,
+    Input,
+    Output,
+    InOut,
+    Global,
+    Temp,
+    External,
+}
+
+/// A statement.
+#[derive(Debug, Clone)]
+pub enum Stmt {
+    Assign {
+        target: Expr,
+        value: Expr,
+        line: u32,
+    },
+    If {
+        /// (condition, body) for IF and each ELSIF, in order.
+        branches: Vec<(Expr, Vec<Stmt>)>,
+        else_body: Option<Vec<Stmt>>,
+        line: u32,
+    },
+    Case {
+        selector: Expr,
+        /// (label expressions, body) per CASE arm.
+        arms: Vec<(Vec<Expr>, Vec<Stmt>)>,
+        else_body: Option<Vec<Stmt>>,
+        line: u32,
+    },
+    For {
+        var: String,
+        from: Expr,
+        to: Expr,
+        by: Option<Expr>,
+        body: Vec<Stmt>,
+        line: u32,
+    },
+    While {
+        cond: Expr,
+        body: Vec<Stmt>,
+        line: u32,
+    },
+    Repeat {
+        body: Vec<Stmt>,
+        until: Expr,
+        line: u32,
+    },
+    /// A bare call statement, e.g. `TON1(IN := x, PT := T#5s);`.
+    Call {
+        callee: String,
+        args: Vec<CallArg>,
+        line: u32,
+    },
+    Return {
+        line: u32,
+    },
+    Exit {
+        line: u32,
+    },
+    /// `JMP label;` — an unstructured jump.
+    Jump {
+        label: String,
+        line: u32,
+    },
+    /// `label:` — a jump target.
+    Label {
+        name: String,
+        line: u32,
+    },
+}
+
+/// One argument in a call: positional (`name: None`) or named (`X := expr`).
+#[derive(Debug, Clone)]
+pub struct CallArg {
+    pub name: Option<String>,
+    pub value: Expr,
+}
+
+/// An expression.
+#[derive(Debug, Clone)]
+pub enum Expr {
+    Int(i64, u32),
+    Real(f64, u32),
+    Bool(bool, u32),
+    /// A string literal, with the unquoted contents.
+    Str(String, u32),
+    /// A duration / date / time literal, kept as raw text (`T#5s`, `DT#...`).
+    Time(String, u32),
+    Ident(String, u32),
+    /// `base[index]`.
+    Index {
+        base: Box<Expr>,
+        index: Box<Expr>,
+        line: u32,
+    },
+    /// `base.field`.
+    Member {
+        base: Box<Expr>,
+        field: String,
+        line: u32,
+    },
+    Unary {
+        op: UnOp,
+        expr: Box<Expr>,
+        line: u32,
+    },
+    Binary {
+        op: BinOp,
+        lhs: Box<Expr>,
+        rhs: Box<Expr>,
+        line: u32,
+    },
+    /// A function call used as an expression, e.g. `LIMIT(a, b, c)`.
+    Call {
+        callee: String,
+        args: Vec<CallArg>,
+        line: u32,
+    },
+}
+
+impl Expr {
+    /// The 1-based source line this expression starts on.
+    pub fn line(&self) -> u32 {
+        match self {
+            Expr::Int(_, l)
+            | Expr::Real(_, l)
+            | Expr::Bool(_, l)
+            | Expr::Str(_, l)
+            | Expr::Time(_, l)
+            | Expr::Ident(_, l)
+            | Expr::Index { line: l, .. }
+            | Expr::Member { line: l, .. }
+            | Expr::Unary { line: l, .. }
+            | Expr::Binary { line: l, .. }
+            | Expr::Call { line: l, .. } => *l,
+        }
+    }
+
+    /// If this expression is a plain identifier, its name.
+    pub fn as_ident(&self) -> Option<&str> {
+        match self {
+            Expr::Ident(name, _) => Some(name.as_str()),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum UnOp {
+    Not,
+    Neg,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BinOp {
+    Add,
+    Sub,
+    Mul,
+    Div,
+    Mod,
+    Pow,
+    Eq,
+    Ne,
+    Lt,
+    Le,
+    Gt,
+    Ge,
+    And,
+    Or,
+    Xor,
+}
@@ -0,0 +1,372 @@
+//! Lexer for IEC 61131-3 Structured Text.
+//!
+//! Tokenizes ST source into a flat token stream with 1-based line numbers.
+//! Keywords are case-insensitive. Handles `(* *)` and `//` comments, `'..'` and
+//! `".."` strings (with `''`/`""` escapes), based integers (`16#FF`, `2#1010`),
+//! and duration/date literals (`T#5s`, `DT#...`) kept as raw text.
+
+/// A lexed token with its source line.
+#[derive(Debug, Clone)]
+pub struct Token {
+    pub kind: Tok,
+    pub line: u32,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Tok {
+    Int(i64),
+    Real(f64),
+    Str(String),
+    Time(String),
+    Bool(bool),
+    Ident(String),
+    Kw(Keyword),
+    Assign, // :=
+    Plus,   // +
+    Minus,  // -
+    Star,   // *
+    Slash,  // /
+    Power,  // **
+    LParen, // (
+    RParen, // )
+    LBrack, // [
+    RBrack, // ]
+    Dot,    // .
+    DotDot, // ..
+    Comma,  // ,
+    Semi,   // ;
+    Colon,  // :
+    Lt,     // <
+    Le,     // <=
+    Gt,     // >
+    Ge,     // >=
+    Eq,     // =
+    Ne,     // <>
+    Amp,    // &
+    Eof,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Keyword {
+    Program,
+    EndProgram,
+    Function,
+    EndFunction,
+    FunctionBlock,
+    EndFunctionBlock,
+    Var,
+    VarInput,
+    VarOutput,
+    VarInOut,
+    VarGlobal,
+    VarTemp,
+    VarExternal,
+    Constant,
+    EndVar,
+    Array,
+    Of,
+    If,
+    Then,
+    Elsif,
+    Else,
+    EndIf,
+    Case,
+    EndCase,
+    For,
+    To,
+    By,
+    Do,
+    EndFor,
+    While,
+    EndWhile,
+    Repeat,
+    Until,
+    EndRepeat,
+    Return,
+    Exit,
+    Jmp,
+    Not,
+    And,
+    Or,
+    Xor,
+    Mod,
+    Type,
+    EndType,
+    Struct,
+    EndStruct,
+}
+
+fn keyword_from(word: &str) -> Option<Keyword> {
+    use Keyword::*;
+    Some(match word.to_ascii_uppercase().as_str() {
+        "PROGRAM" => Program,
+        "END_PROGRAM" => EndProgram,
+        "FUNCTION" => Function,
+        "END_FUNCTION" => EndFunction,
+        "FUNCTION_BLOCK" => FunctionBlock,
+        "END_FUNCTION_BLOCK" => EndFunctionBlock,
+        "VAR" => Var,
+        "VAR_INPUT" => VarInput,
+        "VAR_OUTPUT" => VarOutput,
+        "VAR_IN_OUT" => VarInOut,
+        "VAR_GLOBAL" => VarGlobal,
+        "VAR_TEMP" => VarTemp,
+        "VAR_EXTERNAL" => VarExternal,
+        "CONSTANT" => Constant,
+        "END_VAR" => EndVar,
+        "ARRAY" => Array,
+        "OF" => Of,
+        "IF" => If,
+        "THEN" => Then,
+        "ELSIF" => Elsif,
+        "ELSE" => Else,
+        "END_IF" => EndIf,
+        "CASE" => Case,
+        "END_CASE" => EndCase,
+        "FOR" => For,
+        "TO" => To,
+        "BY" => By,
+        "DO" => Do,
+        "END_FOR" => EndFor,
+        "WHILE" => While,
+        "END_WHILE" => EndWhile,
+        "REPEAT" => Repeat,
+        "UNTIL" => Until,
+        "END_REPEAT" => EndRepeat,
+        "RETURN" => Return,
+        "EXIT" => Exit,
+        "JMP" => Jmp,
+        "NOT" => Not,
+        "AND" => And,
+        "OR" => Or,
+        "XOR" => Xor,
+        "MOD" => Mod,
+        "TYPE" => Type,
+        "END_TYPE" => EndType,
+        "STRUCT" => Struct,
+        "END_STRUCT" => EndStruct,
+        _ => return None,
+    })
+}
+
+/// Tokenize `src`. Unknown characters are skipped (best-effort — a scanner must
+/// not die on odd input).
+pub fn lex(src: &str) -> Vec<Token> {
+    let chars: Vec<char> = src.chars().collect();
+    let mut i = 0usize;
+    let mut line = 1u32;
+    let mut out = Vec::new();
+
+    let bump_line = |c: char, line: &mut u32| {
+        if c == '\n' {
+            *line += 1;
+        }
+    };
+
+    while i < chars.len() {
+        let c = chars[i];
+
+        // Whitespace.
+        if c.is_whitespace() {
+            bump_line(c, &mut line);
+            i += 1;
+            continue;
+        }
+
+        // Line comment: //
+        if c == '/' && i + 1 < chars.len() && chars[i + 1] == '/' {
+            while i < chars.len() && chars[i] != '\n' {
+                i += 1;
+            }
+            continue;
+        }
+
+        // Block comment: (* ... *)
+        if c == '(' && i + 1 < chars.len() && chars[i + 1] == '*' {
+            i += 2;
+            while i + 1 < chars.len() && !(chars[i] == '*' && chars[i + 1] == ')') {
+                bump_line(chars[i], &mut line);
+                i += 1;
+            }
+            i = (i + 2).min(chars.len());
+            continue;
+        }
+
+        let tok_line = line;
+
+        // String literal: '...' or "..."
+        if c == '\'' || c == '"' {
+            let quote = c;
+            i += 1;
+            let mut s = String::new();
+            while i < chars.len() {
+                let ch = chars[i];
+                if ch == quote {
+                    // Doubled quote is an escaped quote.
+                    if i + 1 < chars.len() && chars[i + 1] == quote {
+                        s.push(quote);
+                        i += 2;
+                        continue;
+                    }
+                    i += 1;
+                    break;
+                }
+                bump_line(ch, &mut line);
+                s.push(ch);
+                i += 1;
+            }
+            out.push(Token {
+                kind: Tok::Str(s),
+                line: tok_line,
+            });
+            continue;
+        }
+
+        // Identifier / keyword / time literal / boolean.
+        if c.is_ascii_alphabetic() || c == '_' {
+            let start = i;
+            while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
+                i += 1;
+            }
+            let word: String = chars[start..i].iter().collect();
+
+            // Duration/date/time literal prefix: T#, TIME#, DT#, D#, TOD#, LT# ...
+            if i < chars.len() && chars[i] == '#' {
+                let up = word.to_ascii_uppercase();
+                if matches!(
+                    up.as_str(),
+                    "T" | "TIME" | "DT" | "D" | "TOD" | "LT" | "DATE"
+                ) {
+                    let lit_start = start;
+                    i += 1; // consume '#'
+                    while i < chars.len()
+                        && (chars[i].is_ascii_alphanumeric()
+                            || chars[i] == '.'
+                            || chars[i] == '_'
+                            || chars[i] == ':')
+                    {
+                        i += 1;
+                    }
+                    let lit: String = chars[lit_start..i].iter().collect();
+                    out.push(Token {
+                        kind: Tok::Time(lit),
+                        line: tok_line,
+                    });
+                    continue;
+                }
+            }
+
+            let kind = match word.to_ascii_uppercase().as_str() {
+                "TRUE" => Tok::Bool(true),
+                "FALSE" => Tok::Bool(false),
+                _ => match keyword_from(&word) {
+                    Some(kw) => Tok::Kw(kw),
+                    None => Tok::Ident(word),
+                },
+            };
+            out.push(Token {
+                kind,
+                line: tok_line,
+            });
+            continue;
+        }
+
+        // Number: decimal, real, or based (16#..., 2#...).
+        if c.is_ascii_digit() {
+            let start = i;
+            while i < chars.len() && (chars[i].is_ascii_digit() || chars[i] == '_') {
+                i += 1;
+            }
+            // Based literal: <base>#<digits>
+            if i < chars.len() && chars[i] == '#' {
+                let base_str: String = chars[start..i].iter().filter(|c| **c != '_').collect();
+                i += 1;
+                let dstart = i;
+                while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
+                    i += 1;
+                }
+                let digits: String = chars[dstart..i].iter().filter(|c| **c != '_').collect();
+                let radix = base_str.parse::<u32>().unwrap_or(10);
+                let val = i64::from_str_radix(&digits, radix.clamp(2, 36)).unwrap_or(0);
+                out.push(Token {
+                    kind: Tok::Int(val),
+                    line: tok_line,
+                });
+                continue;
+            }
+            // Real: has a '.' (not '..') or exponent.
+            let is_real =
+                i < chars.len() && chars[i] == '.' && !(i + 1 < chars.len() && chars[i + 1] == '.');
+            if is_real {
+                i += 1;
+                while i < chars.len() && (chars[i].is_ascii_digit() || chars[i] == '_') {
+                    i += 1;
+                }
+                let raw: String = chars[start..i].iter().filter(|c| **c != '_').collect();
+                out.push(Token {
+                    kind: Tok::Real(raw.parse().unwrap_or(0.0)),
+                    line: tok_line,
+                });
+                continue;
+            }
+            let raw: String = chars[start..i].iter().filter(|c| **c != '_').collect();
+            out.push(Token {
+                kind: Tok::Int(raw.parse().unwrap_or(0)),
+                line: tok_line,
+            });
+            continue;
+        }
+
+        // Operators / punctuation (longest match first).
+        let two: String = chars[i..(i + 2).min(chars.len())].iter().collect();
+        let kind = match two.as_str() {
+            ":=" => Some(Tok::Assign),
+            "<=" => Some(Tok::Le),
+            ">=" => Some(Tok::Ge),
+            "<>" => Some(Tok::Ne),
+            ".." => Some(Tok::DotDot),
+            "**" => Some(Tok::Power),
+            _ => None,
+        };
+        if let Some(k) = kind {
+            out.push(Token {
+                kind: k,
+                line: tok_line,
+            });
+            i += 2;
+            continue;
+        }
+        let one = match c {
+            '+' => Some(Tok::Plus),
+            '-' => Some(Tok::Minus),
+            '*' => Some(Tok::Star),
+            '/' => Some(Tok::Slash),
+            '(' => Some(Tok::LParen),
+            ')' => Some(Tok::RParen),
+            '[' => Some(Tok::LBrack),
+            ']' => Some(Tok::RBrack),
+            '.' => Some(Tok::Dot),
+            ',' => Some(Tok::Comma),
+            ';' => Some(Tok::Semi),
+            ':' => Some(Tok::Colon),
+            '<' => Some(Tok::Lt),
+            '>' => Some(Tok::Gt),
+            '=' => Some(Tok::Eq),
+            '&' => Some(Tok::Amp),
+            _ => None,
+        };
+        if let Some(k) = one {
+            out.push(Token {
+                kind: k,
+                line: tok_line,
+            });
+        }
+        i += 1;
+    }
+
+    out.push(Token {
+        kind: Tok::Eof,
+        line,
+    });
+    out
+}
@@ -0,0 +1,235 @@
+//! PLC control-logic security scanner for IEC 61131-3 targets.
+//!
+//! Parses Structured Text (raw `.st`/`.scl`/`.exp` files and PLCopen-XML
+//! projects) into an AST and runs semantic control-logic security rules over it.
+//! Implements [`ScanType::PlcControlLogic`].
+
+pub mod ast;
+pub mod lexer;
+pub mod parser;
+pub mod plcopen;
+pub mod rules;
+pub mod runtime;
+pub mod sbom;
+
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{Finding, ScanType};
+use compliance_core::traits::{ScanOutput, Scanner};
+
+use crate::pipeline::dedup;
+
+/// Scanner for `ScanType::PlcControlLogic`.
+pub struct PlcControlLogicScanner;
+
+impl Scanner for PlcControlLogicScanner {
+    fn name(&self) -> &str {
+        "plc-control-logic"
+    }
+
+    fn scan_type(&self) -> ScanType {
+        ScanType::PlcControlLogic
+    }
+
+    #[tracing::instrument(skip_all)]
+    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
+        let findings = analyze_tree(repo_path, repo_id);
+        Ok(ScanOutput {
+            findings,
+            sbom_entries: Vec::new(),
+        })
+    }
+}
+
+/// Walk a PLC project tree and produce findings.
+pub(crate) fn analyze_tree(root: &Path, repo_id: &str) -> Vec<Finding> {
+    let mut findings = Vec::new();
+    for entry in walkdir::WalkDir::new(root)
+        .into_iter()
+        .filter_map(|e| e.ok())
+    {
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        let path = entry.path();
+        let ext = path
+            .extension()
+            .and_then(|e| e.to_str())
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
+        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
+        if !is_st && !is_xml {
+            continue;
+        }
+        let Ok(content) = std::fs::read_to_string(path) else {
+            continue;
+        };
+        let pous = if is_xml {
+            plcopen::parse_plcopen(&content)
+        } else {
+            parser::parse(&content)
+        };
+        if pous.is_empty() {
+            continue;
+        }
+        let rel = path
+            .strip_prefix(root)
+            .unwrap_or(path)
+            .to_string_lossy()
+            .to_string();
+        for pou in &pous {
+            for hit in rules::analyze(pou) {
+                let line_s = hit.line.to_string();
+                let fingerprint =
+                    dedup::compute_fingerprint(&[repo_id, &rel, hit.rule_id, &pou.name, &line_s]);
+                let mut f = Finding::new(
+                    repo_id.to_string(),
+                    fingerprint,
+                    "plc-control-logic".to_string(),
+                    ScanType::PlcControlLogic,
+                    hit.title,
+                    hit.description,
+                    hit.severity,
+                );
+                f.file_path = Some(rel.clone());
+                f.line_number = Some(hit.line);
+                f.rule_id = Some(hit.rule_id.to_string());
+                f.cwe = hit.cwe.map(String::from);
+                f.remediation = Some(hit.remediation.to_string());
+                findings.push(f);
+            }
+        }
+    }
+    findings
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashSet;
+    use std::path::PathBuf;
+
+    fn demo_dir() -> PathBuf {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .parent()
+            .expect("workspace root")
+            .join("examples/plc-demo")
+    }
+
+    #[test]
+    fn scans_demo_project_end_to_end() {
+        let findings = analyze_tree(&demo_dir(), "demo-target");
+        assert!(!findings.is_empty(), "demo project should produce findings");
+
+        let rules: HashSet<&str> = findings
+            .iter()
+            .filter_map(|f| f.rule_id.as_deref())
+            .collect();
+        for r in [
+            "plc-hardcoded-credential",
+            "plc-default-password",
+            "plc-safety-bypass",
+            "plc-array-unchecked-index",
+            "plc-insecure-comm",
+            "plc-insecure-protocol-port",
+            "plc-unstructured-jump",
+            "plc-division-by-zero",
+        ] {
+            assert!(rules.contains(r), "expected rule {r}; got {rules:?}");
+        }
+
+        // Every finding is well-formed for storage.
+        for f in &findings {
+            assert_eq!(f.repo_id, "demo-target");
+            assert!(f.file_path.is_some(), "finding needs a file");
+            assert!(f.line_number.is_some(), "finding needs a line");
+        }
+
+        // The guarded division (IF ScaleFactor <> 0.0) must not be double-counted:
+        // exactly one division-by-zero (the unguarded MeasuredFlow divide).
+        let div0 = findings
+            .iter()
+            .filter(|f| f.rule_id.as_deref() == Some("plc-division-by-zero"))
+            .count();
+        assert_eq!(div0, 1, "only the unguarded division should be flagged");
+    }
+
+    /// The realistic OpenPLC-style traffic-light sample is mostly sound control
+    /// logic: the scanner must surface its few genuine defects and stay quiet on
+    /// the timed state machine and the guarded duty-cycle division.
+    #[test]
+    fn realistic_sample_flags_only_real_issues() {
+        let all = analyze_tree(&demo_dir(), "demo-target");
+        let tl: Vec<_> = all
+            .iter()
+            .filter(|f| {
+                f.file_path
+                    .as_deref()
+                    .is_some_and(|p| p.ends_with("traffic_light.st"))
+            })
+            .collect();
+        assert!(!tl.is_empty(), "traffic_light.st should produce findings");
+
+        let rules: HashSet<&str> = tl.iter().filter_map(|f| f.rule_id.as_deref()).collect();
+        // The three planted defects: hardcoded SCADA password, cleartext Modbus
+        // master (no auth), and a maintenance mode that drops the PedPermit.
+        for r in [
+            "plc-hardcoded-credential",
+            "plc-insecure-comm",
+            "plc-safety-bypass",
+        ] {
+            assert!(rules.contains(r), "expected rule {r}; got {rules:?}");
+        }
+        // Modbus/TCP on 502 is also an insecure-protocol port.
+        assert!(rules.contains("plc-insecure-protocol-port"));
+
+        // Low false positives: the guarded `IF LampCount <> 0` division and the
+        // JMP-free state machine must not trip anything.
+        assert_eq!(
+            tl.iter()
+                .filter(|f| f.rule_id.as_deref() == Some("plc-division-by-zero"))
+                .count(),
+            0,
+            "the guarded duty-cycle division must not be flagged"
+        );
+        assert!(
+            !rules.contains("plc-unstructured-jump"),
+            "the CASE state machine uses no JMP"
+        );
+    }
+
+    /// Graphical logic must be analysed too: an FBD POU (blocks + in/out
+    /// variables) is translated to synthetic ST, so the same rules fire on the
+    /// cleartext Modbus block, the hardcoded HMI password and the safety write.
+    #[test]
+    fn fbd_graphical_body_is_analysed() {
+        let all = analyze_tree(&demo_dir(), "demo-target");
+        let fbd: Vec<_> = all
+            .iter()
+            .filter(|f| {
+                f.file_path
+                    .as_deref()
+                    .is_some_and(|p| p.ends_with("pump_fbd.xml"))
+            })
+            .collect();
+        assert!(
+            !fbd.is_empty(),
+            "pump_fbd.xml (FBD) should produce findings"
+        );
+
+        let rules: HashSet<&str> = fbd.iter().filter_map(|f| f.rule_id.as_deref()).collect();
+        for r in [
+            "plc-insecure-comm",          // Modbus_TCP_Master(AUTH := FALSE)
+            "plc-insecure-protocol-port", // PORT := 502
+            "plc-hardcoded-credential",   // HmiPassword := 'admin123'
+            "plc-safety-bypass",          // Safety_Enable := FALSE
+        ] {
+            assert!(
+                rules.contains(r),
+                "expected rule {r} from FBD; got {rules:?}"
+            );
+        }
+    }
+}
@@ -0,0 +1,766 @@
+//! Recursive-descent parser for the security-relevant subset of Structured Text.
+//!
+//! Tolerant by design: it parses the POUs, variable sections, and statement
+//! bodies it understands, and skips (with statement/POU-level recovery) anything
+//! it does not, so a single odd construct never sinks the whole file.
+
+use super::ast::*;
+use super::lexer::{Keyword as K, Tok, Token};
+
+pub struct Parser {
+    toks: Vec<Token>,
+    pos: usize,
+}
+
+impl Parser {
+    pub fn new(toks: Vec<Token>) -> Self {
+        Self { toks, pos: 0 }
+    }
+
+    // ── token helpers ──────────────────────────────────────────────
+    fn peek(&self) -> &Tok {
+        &self.toks[self.pos.min(self.toks.len() - 1)].kind
+    }
+    fn line(&self) -> u32 {
+        self.toks[self.pos.min(self.toks.len() - 1)].line
+    }
+    fn at_end(&self) -> bool {
+        matches!(self.peek(), Tok::Eof)
+    }
+    fn advance(&mut self) -> Tok {
+        let t = self.toks[self.pos.min(self.toks.len() - 1)].kind.clone();
+        if self.pos < self.toks.len() - 1 {
+            self.pos += 1;
+        }
+        t
+    }
+    fn eat(&mut self, t: &Tok) -> bool {
+        if self.peek() == t {
+            self.advance();
+            true
+        } else {
+            false
+        }
+    }
+    fn eat_kw(&mut self, k: K) -> bool {
+        if matches!(self.peek(), Tok::Kw(x) if *x == k) {
+            self.advance();
+            true
+        } else {
+            false
+        }
+    }
+    fn at_kw(&self, k: K) -> bool {
+        matches!(self.peek(), Tok::Kw(x) if *x == k)
+    }
+    fn ident(&mut self) -> Option<String> {
+        if let Tok::Ident(s) = self.peek() {
+            let s = s.clone();
+            self.advance();
+            Some(s)
+        } else {
+            None
+        }
+    }
+
+    // ── top level ──────────────────────────────────────────────────
+    /// Parse every POU in the token stream.
+    pub fn parse_units(&mut self) -> Vec<Pou> {
+        let mut pous = Vec::new();
+        while !self.at_end() {
+            match self.peek() {
+                Tok::Kw(K::Program) => {
+                    self.advance();
+                    if let Some(p) = self.parse_pou(PouKind::Program, K::EndProgram) {
+                        pous.push(p);
+                    }
+                }
+                Tok::Kw(K::Function) => {
+                    self.advance();
+                    if let Some(p) = self.parse_pou(PouKind::Function, K::EndFunction) {
+                        pous.push(p);
+                    }
+                }
+                Tok::Kw(K::FunctionBlock) => {
+                    self.advance();
+                    if let Some(p) = self.parse_pou(PouKind::FunctionBlock, K::EndFunctionBlock) {
+                        pous.push(p);
+                    }
+                }
+                // Skip TYPE...END_TYPE and anything else at top level.
+                _ => {
+                    self.advance();
+                }
+            }
+        }
+        pous
+    }
+
+    fn parse_pou(&mut self, kind: PouKind, end: K) -> Option<Pou> {
+        let line = self.line();
+        let name = self.ident().unwrap_or_else(|| "<anonymous>".to_string());
+        // Optional `: return_type` for functions.
+        if self.eat(&Tok::Colon) {
+            let _ = self.advance(); // return type token
+        }
+
+        let mut vars = Vec::new();
+        // Variable sections precede the body.
+        while let Some(section) = self.var_section_kw() {
+            self.advance();
+            let _ = self.eat_kw(K::Constant); // CONSTANT is informational for our rules
+            self.parse_var_decls(section, &mut vars);
+        }
+
+        // Body statements until END_<kind>.
+        let mut body = Vec::new();
+        while !self.at_end() && !self.at_kw(end) {
+            if let Some(s) = self.parse_stmt() {
+                body.push(s);
+            }
+        }
+        self.eat_kw(end);
+
+        Some(Pou {
+            name,
+            kind,
+            vars,
+            body,
+            line,
+        })
+    }
+
+    fn var_section_kw(&self) -> Option<VarSection> {
+        match self.peek() {
+            Tok::Kw(K::Var) => Some(VarSection::Var),
+            Tok::Kw(K::VarInput) => Some(VarSection::Input),
+            Tok::Kw(K::VarOutput) => Some(VarSection::Output),
+            Tok::Kw(K::VarInOut) => Some(VarSection::InOut),
+            Tok::Kw(K::VarGlobal) => Some(VarSection::Global),
+            Tok::Kw(K::VarTemp) => Some(VarSection::Temp),
+            Tok::Kw(K::VarExternal) => Some(VarSection::External),
+            _ => None,
+        }
+    }
+
+    fn parse_var_decls(&mut self, section: VarSection, out: &mut Vec<VarDecl>) {
+        while !self.at_end() && !self.at_kw(K::EndVar) {
+            let line = self.line();
+            // names: a, b, c
+            let mut names = Vec::new();
+            match self.ident() {
+                Some(n) => names.push(n),
+                None => {
+                    // Not a declaration we understand — skip to next ; or END_VAR.
+                    self.sync_decl();
+                    continue;
+                }
+            }
+            while self.eat(&Tok::Comma) {
+                if let Some(n) = self.ident() {
+                    names.push(n);
+                }
+            }
+            if !self.eat(&Tok::Colon) {
+                self.sync_decl();
+                continue;
+            }
+            let (type_name, array_bounds) = self.parse_type();
+            let init = if self.eat(&Tok::Assign) {
+                Some(self.parse_expr())
+            } else {
+                None
+            };
+            self.eat(&Tok::Semi);
+            for n in names {
+                out.push(VarDecl {
+                    name: n,
+                    section,
+                    type_name: type_name.clone(),
+                    array_bounds,
+                    init: init.clone(),
+                    line,
+                });
+            }
+        }
+        self.eat_kw(K::EndVar);
+    }
+
+    /// Parse a (possibly ARRAY) type, returning its rendered name and literal
+    /// bounds when present.
+    fn parse_type(&mut self) -> (String, Option<(i64, i64)>) {
+        if self.eat_kw(K::Array) {
+            let mut bounds = None;
+            if self.eat(&Tok::LBrack) {
+                let lo = self.int_lit();
+                self.eat(&Tok::DotDot);
+                let hi = self.int_lit();
+                if let (Some(lo), Some(hi)) = (lo, hi) {
+                    bounds = Some((lo, hi));
+                }
+                // Skip any further dimensions / tokens to the closing bracket.
+                while !self.at_end() && !self.eat(&Tok::RBrack) {
+                    self.advance();
+                }
+            }
+            self.eat_kw(K::Of);
+            let elem = self.type_ident();
+            (format!("ARRAY OF {elem}"), bounds)
+        } else {
+            (self.type_ident(), None)
+        }
+    }
+
+    fn type_ident(&mut self) -> String {
+        // Types can be qualified idents; keep it simple: one token, plus any
+        // string-length suffix like STRING[80].
+        let base = match self.advance() {
+            Tok::Ident(s) => s,
+            Tok::Kw(_) => "TYPE".to_string(),
+            other => format!("{other:?}"),
+        };
+        if self.eat(&Tok::LBrack) {
+            while !self.at_end() && !self.eat(&Tok::RBrack) {
+                self.advance();
+            }
+        }
+        base
+    }
+
+    fn int_lit(&mut self) -> Option<i64> {
+        match self.peek() {
+            Tok::Int(n) => {
+                let n = *n;
+                self.advance();
+                Some(n)
+            }
+            Tok::Minus => {
+                self.advance();
+                if let Tok::Int(n) = self.peek() {
+                    let n = -*n;
+                    self.advance();
+                    Some(n)
+                } else {
+                    None
+                }
+            }
+            _ => None,
+        }
+    }
+
+    fn sync_decl(&mut self) {
+        while !self.at_end() && !self.eat(&Tok::Semi) && !self.at_kw(K::EndVar) {
+            self.advance();
+        }
+    }
+    fn sync_stmt(&mut self) {
+        while !self.at_end() && !self.eat(&Tok::Semi) {
+            // Stop at block terminators so recovery doesn't swallow structure.
+            if matches!(
+                self.peek(),
+                Tok::Kw(
+                    K::EndIf
+                        | K::EndFor
+                        | K::EndWhile
+                        | K::EndCase
+                        | K::EndRepeat
+                        | K::EndProgram
+                        | K::EndFunction
+                        | K::EndFunctionBlock
+                        | K::Else
+                        | K::Elsif
+                )
+            ) {
+                return;
+            }
+            self.advance();
+        }
+    }
+
+    // ── statements ─────────────────────────────────────────────────
+    fn parse_stmt(&mut self) -> Option<Stmt> {
+        let line = self.line();
+        match self.peek().clone() {
+            Tok::Semi => {
+                self.advance();
+                None
+            }
+            Tok::Kw(K::If) => self.parse_if(),
+            Tok::Kw(K::Case) => self.parse_case(),
+            Tok::Kw(K::For) => self.parse_for(),
+            Tok::Kw(K::While) => self.parse_while(),
+            Tok::Kw(K::Repeat) => self.parse_repeat(),
+            Tok::Kw(K::Return) => {
+                self.advance();
+                self.eat(&Tok::Semi);
+                Some(Stmt::Return { line })
+            }
+            Tok::Kw(K::Exit) => {
+                self.advance();
+                self.eat(&Tok::Semi);
+                Some(Stmt::Exit { line })
+            }
+            Tok::Kw(K::Jmp) => {
+                self.advance();
+                let label = self.ident().unwrap_or_default();
+                self.eat(&Tok::Semi);
+                Some(Stmt::Jump { label, line })
+            }
+            Tok::Ident(name) => {
+                // Could be `label:`, `call(...)`, or an assignment.
+                // Lookahead: ident ':' (not ':=') → label.
+                if matches!(
+                    self.toks.get(self.pos + 1).map(|t| &t.kind),
+                    Some(Tok::Colon)
+                ) && !matches!(self.toks.get(self.pos + 2).map(|t| &t.kind), Some(Tok::Eq))
+                {
+                    self.advance(); // ident
+                    self.advance(); // ':'
+                    return Some(Stmt::Label { name, line });
+                }
+                let lhs = self.parse_expr();
+                if self.eat(&Tok::Assign) {
+                    let value = self.parse_expr();
+                    self.eat(&Tok::Semi);
+                    Some(Stmt::Assign {
+                        target: lhs,
+                        value,
+                        line,
+                    })
+                } else if let Expr::Call { callee, args, .. } = lhs {
+                    self.eat(&Tok::Semi);
+                    Some(Stmt::Call { callee, args, line })
+                } else {
+                    // Bare expression / FB invocation without args recognized —
+                    // skip to the terminator.
+                    self.sync_stmt();
+                    None
+                }
+            }
+            _ => {
+                self.sync_stmt();
+                None
+            }
+        }
+    }
+
+    fn parse_block_until(&mut self, terms: &[K]) -> Vec<Stmt> {
+        let mut body = Vec::new();
+        while !self.at_end() && !terms.iter().any(|k| self.at_kw(*k)) {
+            if let Some(s) = self.parse_stmt() {
+                body.push(s);
+            }
+        }
+        body
+    }
+
+    fn parse_if(&mut self) -> Option<Stmt> {
+        let line = self.line();
+        self.eat_kw(K::If);
+        let mut branches = Vec::new();
+        let cond = self.parse_expr();
+        self.eat_kw(K::Then);
+        let body = self.parse_block_until(&[K::Elsif, K::Else, K::EndIf]);
+        branches.push((cond, body));
+        while self.eat_kw(K::Elsif) {
+            let c = self.parse_expr();
+            self.eat_kw(K::Then);
+            let b = self.parse_block_until(&[K::Elsif, K::Else, K::EndIf]);
+            branches.push((c, b));
+        }
+        let else_body = if self.eat_kw(K::Else) {
+            Some(self.parse_block_until(&[K::EndIf]))
+        } else {
+            None
+        };
+        self.eat_kw(K::EndIf);
+        self.eat(&Tok::Semi);
+        Some(Stmt::If {
+            branches,
+            else_body,
+            line,
+        })
+    }
+
+    fn parse_case(&mut self) -> Option<Stmt> {
+        let line = self.line();
+        self.eat_kw(K::Case);
+        let selector = self.parse_expr();
+        self.eat_kw(K::Of);
+        let mut arms = Vec::new();
+        let mut else_body = None;
+        while !self.at_end() && !self.at_kw(K::EndCase) {
+            if self.eat_kw(K::Else) {
+                else_body = Some(self.parse_block_until(&[K::EndCase]));
+                break;
+            }
+            // labels: expr {, expr} :
+            let mut labels = vec![self.parse_expr()];
+            while self.eat(&Tok::Comma) {
+                labels.push(self.parse_expr());
+            }
+            self.eat(&Tok::Colon);
+            let body = self.parse_block_until(&[K::EndCase, K::Else]);
+            arms.push((labels, body));
+        }
+        self.eat_kw(K::EndCase);
+        self.eat(&Tok::Semi);
+        Some(Stmt::Case {
+            selector,
+            arms,
+            else_body,
+            line,
+        })
+    }
+
+    fn parse_for(&mut self) -> Option<Stmt> {
+        let line = self.line();
+        self.eat_kw(K::For);
+        let var = self.ident().unwrap_or_default();
+        self.eat(&Tok::Assign);
+        let from = self.parse_expr();
+        self.eat_kw(K::To);
+        let to = self.parse_expr();
+        let by = if self.eat_kw(K::By) {
+            Some(self.parse_expr())
+        } else {
+            None
+        };
+        self.eat_kw(K::Do);
+        let body = self.parse_block_until(&[K::EndFor]);
+        self.eat_kw(K::EndFor);
+        self.eat(&Tok::Semi);
+        Some(Stmt::For {
+            var,
+            from,
+            to,
+            by,
+            body,
+            line,
+        })
+    }
+
+    fn parse_while(&mut self) -> Option<Stmt> {
+        let line = self.line();
+        self.eat_kw(K::While);
+        let cond = self.parse_expr();
+        self.eat_kw(K::Do);
+        let body = self.parse_block_until(&[K::EndWhile]);
+        self.eat_kw(K::EndWhile);
+        self.eat(&Tok::Semi);
+        Some(Stmt::While { cond, body, line })
+    }
+
+    fn parse_repeat(&mut self) -> Option<Stmt> {
+        let line = self.line();
+        self.eat_kw(K::Repeat);
+        let body = self.parse_block_until(&[K::Until, K::EndRepeat]);
+        self.eat_kw(K::Until);
+        let until = self.parse_expr();
+        self.eat_kw(K::EndRepeat);
+        self.eat(&Tok::Semi);
+        Some(Stmt::Repeat { body, until, line })
+    }
+
+    // ── expressions (precedence climbing) ──────────────────────────
+    pub fn parse_expr(&mut self) -> Expr {
+        self.parse_or()
+    }
+
+    fn parse_or(&mut self) -> Expr {
+        let mut lhs = self.parse_and();
+        loop {
+            let op = match self.peek() {
+                Tok::Kw(K::Or) => BinOp::Or,
+                Tok::Kw(K::Xor) => BinOp::Xor,
+                _ => break,
+            };
+            let line = self.line();
+            self.advance();
+            let rhs = self.parse_and();
+            lhs = Expr::Binary {
+                op,
+                lhs: Box::new(lhs),
+                rhs: Box::new(rhs),
+                line,
+            };
+        }
+        lhs
+    }
+
+    fn parse_and(&mut self) -> Expr {
+        let mut lhs = self.parse_cmp();
+        while matches!(self.peek(), Tok::Kw(K::And) | Tok::Amp) {
+            let op = BinOp::And;
+            let line = self.line();
+            self.advance();
+            let rhs = self.parse_cmp();
+            lhs = Expr::Binary {
+                op,
+                lhs: Box::new(lhs),
+                rhs: Box::new(rhs),
+                line,
+            };
+        }
+        lhs
+    }
+
+    fn parse_cmp(&mut self) -> Expr {
+        let mut lhs = self.parse_add();
+        loop {
+            let op = match self.peek() {
+                Tok::Eq => BinOp::Eq,
+                Tok::Ne => BinOp::Ne,
+                Tok::Lt => BinOp::Lt,
+                Tok::Le => BinOp::Le,
+                Tok::Gt => BinOp::Gt,
+                Tok::Ge => BinOp::Ge,
+                _ => break,
+            };
+            let line = self.line();
+            self.advance();
+            let rhs = self.parse_add();
+            lhs = Expr::Binary {
+                op,
+                lhs: Box::new(lhs),
+                rhs: Box::new(rhs),
+                line,
+            };
+        }
+        lhs
+    }
+
+    fn parse_add(&mut self) -> Expr {
+        let mut lhs = self.parse_mul();
+        loop {
+            let op = match self.peek() {
+                Tok::Plus => BinOp::Add,
+                Tok::Minus => BinOp::Sub,
+                _ => break,
+            };
+            let line = self.line();
+            self.advance();
+            let rhs = self.parse_mul();
+            lhs = Expr::Binary {
+                op,
+                lhs: Box::new(lhs),
+                rhs: Box::new(rhs),
+                line,
+            };
+        }
+        lhs
+    }
+
+    fn parse_mul(&mut self) -> Expr {
+        let mut lhs = self.parse_unary();
+        loop {
+            let op = match self.peek() {
+                Tok::Star => BinOp::Mul,
+                Tok::Slash => BinOp::Div,
+                Tok::Kw(K::Mod) => BinOp::Mod,
+                Tok::Power => BinOp::Pow,
+                _ => break,
+            };
+            let line = self.line();
+            self.advance();
+            let rhs = self.parse_unary();
+            lhs = Expr::Binary {
+                op,
+                lhs: Box::new(lhs),
+                rhs: Box::new(rhs),
+                line,
+            };
+        }
+        lhs
+    }
+
+    fn parse_unary(&mut self) -> Expr {
+        let line = self.line();
+        match self.peek() {
+            Tok::Kw(K::Not) => {
+                self.advance();
+                Expr::Unary {
+                    op: UnOp::Not,
+                    expr: Box::new(self.parse_unary()),
+                    line,
+                }
+            }
+            Tok::Minus => {
+                self.advance();
+                Expr::Unary {
+                    op: UnOp::Neg,
+                    expr: Box::new(self.parse_unary()),
+                    line,
+                }
+            }
+            _ => self.parse_postfix(),
+        }
+    }
+
+    fn parse_postfix(&mut self) -> Expr {
+        let mut e = self.parse_primary();
+        loop {
+            let line = self.line();
+            match self.peek() {
+                Tok::LBrack => {
+                    self.advance();
+                    let index = self.parse_expr();
+                    self.eat(&Tok::RBrack);
+                    e = Expr::Index {
+                        base: Box::new(e),
+                        index: Box::new(index),
+                        line,
+                    };
+                }
+                Tok::Dot => {
+                    self.advance();
+                    let field = self.ident().unwrap_or_default();
+                    e = Expr::Member {
+                        base: Box::new(e),
+                        field,
+                        line,
+                    };
+                }
+                _ => break,
+            }
+        }
+        e
+    }
+
+    fn parse_primary(&mut self) -> Expr {
+        let line = self.line();
+        match self.advance() {
+            Tok::Int(n) => Expr::Int(n, line),
+            Tok::Real(r) => Expr::Real(r, line),
+            Tok::Bool(b) => Expr::Bool(b, line),
+            Tok::Str(s) => Expr::Str(s, line),
+            Tok::Time(t) => Expr::Time(t, line),
+            Tok::LParen => {
+                let e = self.parse_expr();
+                self.eat(&Tok::RParen);
+                e
+            }
+            Tok::Ident(name) => {
+                if self.eat(&Tok::LParen) {
+                    let args = self.parse_call_args();
+                    Expr::Call {
+                        callee: name,
+                        args,
+                        line,
+                    }
+                } else {
+                    Expr::Ident(name, line)
+                }
+            }
+            // Unrecognized start of expression — yield a placeholder identifier.
+            _ => Expr::Ident(String::new(), line),
+        }
+    }
+
+    fn parse_call_args(&mut self) -> Vec<CallArg> {
+        let mut args = Vec::new();
+        if self.eat(&Tok::RParen) {
+            return args;
+        }
+        loop {
+            // Named arg: ident := expr  (peek two tokens).
+            if let Tok::Ident(name) = self.peek().clone() {
+                if matches!(
+                    self.toks.get(self.pos + 1).map(|t| &t.kind),
+                    Some(Tok::Assign)
+                ) {
+                    self.advance(); // ident
+                    self.advance(); // :=
+                    let value = self.parse_expr();
+                    args.push(CallArg {
+                        name: Some(name),
+                        value,
+                    });
+                    if self.eat(&Tok::Comma) {
+                        continue;
+                    }
+                    break;
+                }
+            }
+            let value = self.parse_expr();
+            args.push(CallArg { name: None, value });
+            if self.eat(&Tok::Comma) {
+                continue;
+            }
+            break;
+        }
+        self.eat(&Tok::RParen);
+        args
+    }
+}
+
+/// Parse ST source into its POUs.
+pub fn parse(src: &str) -> Vec<Pou> {
+    let toks = super::lexer::lex(src);
+    Parser::new(toks).parse_units()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const SAMPLE: &str = r#"
+PROGRAM Main
+VAR
+    idx : INT;
+    pw : STRING := 'admin123';
+    buf : ARRAY[0..9] OF INT;
+    ok : BOOL := FALSE;
+END_VAR
+    // a comment
+    IF idx > 0 THEN
+        buf[idx] := idx * 2;
+    ELSE
+        JMP done;
+    END_IF;
+    Comm(IP := '10.0.0.1', PORT := 502);
+done:
+    ok := TRUE;
+END_PROGRAM
+"#;
+
+    #[test]
+    fn parses_program_vars_and_body() {
+        let pous = parse(SAMPLE);
+        assert_eq!(pous.len(), 1, "one POU");
+        let p = &pous[0];
+        assert_eq!(p.name, "Main");
+        assert_eq!(p.kind, PouKind::Program);
+        // vars: idx, pw, buf, ok
+        assert_eq!(p.vars.len(), 4);
+        let pw = p.vars.iter().find(|v| v.name == "pw").expect("pw");
+        assert!(matches!(&pw.init, Some(Expr::Str(s, _)) if s == "admin123"));
+        let buf = p.vars.iter().find(|v| v.name == "buf").expect("buf");
+        assert_eq!(buf.array_bounds, Some((0, 9)));
+        // body has an IF, a Call, a Label, and an Assign
+        assert!(p.body.iter().any(|s| matches!(s, Stmt::If { .. })));
+        assert!(p
+            .body
+            .iter()
+            .any(|s| matches!(s, Stmt::Call { callee, .. } if callee == "Comm")));
+        assert!(p
+            .body
+            .iter()
+            .any(|s| matches!(s, Stmt::Label { name, .. } if name == "done")));
+    }
+
+    #[test]
+    fn jmp_inside_if_is_captured() {
+        let pous = parse(SAMPLE);
+        let p = &pous[0];
+        // find the IF, check its else branch has a JMP
+        let has_jmp = p.body.iter().any(|s| match s {
+            Stmt::If { else_body, .. } => else_body
+                .as_ref()
+                .map(|b| b.iter().any(|s| matches!(s, Stmt::Jump { .. })))
+                .unwrap_or(false),
+            _ => false,
+        });
+        assert!(has_jmp, "JMP should be parsed inside the ELSE branch");
+    }
+}
@@ -0,0 +1,418 @@
+//! PLCopen XML → Structured Text POUs.
+//!
+//! A PLCopen project stores each POU as `<pou name=".." pouType="..">` with an
+//! `<interface>` (typed variable sections) and a `<body>` in one of the IEC
+//! 61131-3 languages. We reconstruct an equivalent Structured-Text source for
+//! each POU (a `VAR` block from the interface + statements from the body) and run
+//! it through the ST parser, so raw `.st` files and PLCopen projects — textual or
+//! graphical — flow through one analysis path.
+//!
+//! Body languages:
+//! - **ST** — taken verbatim.
+//! - **FBD / LD** — the graphical network is translated to synthetic ST: blocks
+//!   become calls (`TypeName(pin := arg, …)`), out-variables / coils become
+//!   assignments, with input pins resolved by tracing connections. This lets the
+//!   semantic rules see comm calls, hardcoded arguments and safety writes that
+//!   live in graphical logic, not just in text.
+//! - **SFC** — the step/transition graph itself is skipped; the ST/FBD/LD bodies
+//!   embedded in its actions and transitions are still translated.
+
+use std::collections::HashMap;
+
+use roxmltree::Node;
+
+use super::ast::Pou;
+use super::parser;
+
+/// Parse every POU out of a PLCopen XML document (ST, FBD or LD bodies).
+pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
+    let doc = match roxmltree::Document::parse(xml) {
+        Ok(d) => d,
+        Err(_) => return Vec::new(),
+    };
+    let mut pous = Vec::new();
+    for pou in doc.descendants().filter(|n| n.has_tag_name("pou")) {
+        let name = pou.attribute("name").unwrap_or("pou").to_string();
+        let pou_type = pou.attribute("pouType").unwrap_or("program");
+
+        let Some(body) = reconstruct_body(pou) else {
+            continue;
+        };
+        if body.trim().is_empty() {
+            continue;
+        }
+
+        let var_block = build_var_block(pou);
+        let kw = match pou_type.to_ascii_lowercase().as_str() {
+            "function" => "FUNCTION",
+            "functionblock" | "functionblocktype" => "FUNCTION_BLOCK",
+            _ => "PROGRAM",
+        };
+        let synthetic = format!("{kw} {name}\n{var_block}{body}\nEND_{kw}\n");
+        pous.extend(parser::parse(&synthetic));
+    }
+    pous
+}
+
+/// Case-insensitive tag match (PLCopen uses `FBD`/`LD`/`ST`, CODESYS may vary).
+fn tag_is(n: &Node, name: &str) -> bool {
+    n.tag_name().name().eq_ignore_ascii_case(name)
+}
+
+/// Reconstruct a POU's body as Structured Text, whatever language it is written
+/// in. Concatenates every language body found under `<body>` (SFC actions and
+/// transitions carry their own ST/FBD/LD sub-bodies).
+fn reconstruct_body(pou: Node) -> Option<String> {
+    let mut out = String::new();
+    for body in pou.descendants().filter(|n| tag_is(n, "body")) {
+        for lang in body.children().filter(|n| n.is_element()) {
+            let piece = match lang.tag_name().name().to_ascii_uppercase().as_str() {
+                "ST" | "IL" => collect_text(lang),
+                "FBD" | "LD" => translate_network(lang),
+                _ => continue,
+            };
+            if !piece.trim().is_empty() {
+                out.push_str(&piece);
+                if !piece.ends_with('\n') {
+                    out.push('\n');
+                }
+            }
+        }
+    }
+    if out.trim().is_empty() {
+        None
+    } else {
+        Some(out)
+    }
+}
+
+// ── graphical (FBD / LD) → synthetic ST ────────────────────────────────
+
+/// Translate one FBD/LD network into ST statements: blocks → calls,
+/// out-variables and coils → assignments.
+fn translate_network(net: Node) -> String {
+    let by_id = index_local_ids(net);
+    let mut out = String::new();
+    for el in net.children().filter(|n| n.is_element()) {
+        let stmt = match el.tag_name().name().to_ascii_lowercase().as_str() {
+            "block" => block_call(el, &by_id).map(|c| format!("{c};")),
+            "outvariable" => out_assignment(el, &by_id),
+            "coil" => coil_assignment(el, &by_id),
+            _ => None,
+        };
+        if let Some(s) = stmt {
+            out.push_str(&s);
+            out.push('\n');
+        }
+    }
+    out
+}
+
+/// Index every element in a network by its `localId` so connections resolve.
+fn index_local_ids<'a, 'input>(net: Node<'a, 'input>) -> HashMap<String, Node<'a, 'input>> {
+    net.descendants()
+        .filter(|n| n.is_element())
+        .filter_map(|n| n.attribute("localId").map(|id| (id.to_string(), n)))
+        .collect()
+}
+
+/// Build a call expression for a block: `TypeName(pin := arg, …)`.
+fn block_call(block: Node, by_id: &HashMap<String, Node>) -> Option<String> {
+    let ty = block.attribute("typeName")?;
+    let mut args = Vec::new();
+    if let Some(inputs) = block.children().find(|n| tag_is(n, "inputVariables")) {
+        for v in inputs.children().filter(|n| tag_is(n, "variable")) {
+            let Some(expr) = input_expr(v, by_id, 0) else {
+                continue;
+            };
+            match v.attribute("formalParameter") {
+                Some(pin) if !pin.is_empty() => args.push(format!("{pin} := {expr}")),
+                _ => args.push(expr),
+            }
+        }
+    }
+    Some(format!("{ty}({})", args.join(", ")))
+}
+
+/// `target := <traced expression>;` for an FBD out-variable.
+fn out_assignment(outvar: Node, by_id: &HashMap<String, Node>) -> Option<String> {
+    let target = expression_text(outvar)?;
+    let value = input_expr(outvar, by_id, 0).unwrap_or_else(|| "0".to_string());
+    Some(format!("{target} := {value};"))
+}
+
+/// `coil := <traced rung expression>;` for an LD coil (negated → `NOT (…)`).
+fn coil_assignment(coil: Node, by_id: &HashMap<String, Node>) -> Option<String> {
+    let target = child_text(coil, "variable")?;
+    let rung = input_expr(coil, by_id, 0).unwrap_or_else(|| "TRUE".to_string());
+    let negated = matches!(coil.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
+    let rhs = if negated {
+        format!("NOT ({rung})")
+    } else {
+        rung
+    };
+    Some(format!("{target} := {rhs};"))
+}
+
+/// Resolve the expression feeding `node`'s single input connection.
+fn input_expr(node: Node, by_id: &HashMap<String, Node>, depth: u8) -> Option<String> {
+    let refid = ref_local_id(node)?;
+    Some(expr_for(&refid, by_id, depth))
+}
+
+/// Build the ST expression produced by the element with this `localId`.
+fn expr_for(local_id: &str, by_id: &HashMap<String, Node>, depth: u8) -> String {
+    if depth > 24 {
+        return "0".to_string();
+    }
+    let Some(node) = by_id.get(local_id) else {
+        return format!("__net{local_id}");
+    };
+    match node.tag_name().name().to_ascii_lowercase().as_str() {
+        "invariable" | "inoutvariable" => {
+            expression_text(*node).unwrap_or_else(|| format!("__net{local_id}"))
+        }
+        // A block feeding another element: reference it by a synthetic result
+        // name; the block is emitted as its own call statement, so we neither
+        // duplicate the call nor lose it.
+        "block" => format!("__blk{local_id}"),
+        "contact" => {
+            let var = child_text(*node, "variable").unwrap_or_else(|| "TRUE".to_string());
+            let negated =
+                matches!(node.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
+            let term = if negated { format!("NOT {var}") } else { var };
+            match ref_local_id(*node) {
+                Some(up) => {
+                    let upstream = expr_for(&up, by_id, depth + 1);
+                    if upstream == "TRUE" {
+                        term
+                    } else {
+                        format!("({upstream} AND {term})")
+                    }
+                }
+                None => term,
+            }
+        }
+        "leftpowerrail" => "TRUE".to_string(),
+        _ => format!("__net{local_id}"),
+    }
+}
+
+/// The `refLocalId` of `node`'s first input connection, if any.
+fn ref_local_id(node: Node) -> Option<String> {
+    node.descendants()
+        .find(|n| tag_is(n, "connectionPointIn"))
+        .and_then(|cpi| cpi.descendants().find(|n| tag_is(n, "connection")))
+        .and_then(|c| c.attribute("refLocalId"))
+        .map(|s| s.to_string())
+}
+
+/// Text of a node's `<expression>` child (variable name or literal).
+fn expression_text(node: Node) -> Option<String> {
+    let e = node.children().find(|n| tag_is(n, "expression"))?;
+    let t = collect_text(e).trim().to_string();
+    if t.is_empty() {
+        None
+    } else {
+        Some(t)
+    }
+}
+
+/// Text of a named child element (e.g. `<variable>` of a contact/coil).
+fn child_text(node: Node, name: &str) -> Option<String> {
+    let c = node.children().find(|n| tag_is(n, name))?;
+    let t = collect_text(c).trim().to_string();
+    if t.is_empty() {
+        None
+    } else {
+        Some(t)
+    }
+}
+
+/// Concatenate the text of a node's descendant text nodes (bodies are often
+/// wrapped in `<xhtml>` and may contain multiple text runs). Only text nodes are
+/// gathered: an element's `.text()` would re-yield its first child's text, which
+/// (with the text node itself) would duplicate every value.
+fn collect_text(node: Node) -> String {
+    node.descendants()
+        .filter(|n| n.is_text())
+        .filter_map(|n| n.text())
+        .collect::<String>()
+}
+
+/// Build an ST `VAR … END_VAR` block from a POU's `<interface>` variable
+/// sections, so declarations (types, initial values) reach the rules.
+fn build_var_block(pou: Node) -> String {
+    let Some(interface) = pou.children().find(|n| n.has_tag_name("interface")) else {
+        return String::new();
+    };
+    let mut out = String::from("VAR\n");
+    let mut any = false;
+    for container in interface.children().filter(|n| n.is_element()) {
+        // localVars / inputVars / outputVars / inOutVars / tempVars / globalVars / externalVars
+        if !container.tag_name().name().ends_with("Vars") {
+            continue;
+        }
+        for var in container.children().filter(|n| n.has_tag_name("variable")) {
+            let Some(vname) = var.attribute("name") else {
+                continue;
+            };
+            let ty = var
+                .children()
+                .find(|n| n.has_tag_name("type"))
+                .map(type_name)
+                .unwrap_or_else(|| "BOOL".to_string());
+            let init = var
+                .children()
+                .find(|n| n.has_tag_name("initialValue"))
+                .and_then(initial_value);
+            match init {
+                Some(v) => out.push_str(&format!("  {vname} : {ty} := {v};\n")),
+                None => out.push_str(&format!("  {vname} : {ty};\n")),
+            }
+            any = true;
+        }
+    }
+    out.push_str("END_VAR\n");
+    if any {
+        out
+    } else {
+        String::new()
+    }
+}
+
+/// Render a PLCopen `<type>` element as an ST type string.
+fn type_name(type_node: Node) -> String {
+    let Some(inner) = type_node.children().find(|n| n.is_element()) else {
+        return "BOOL".to_string();
+    };
+    let tag = inner.tag_name().name();
+    match tag {
+        "derived" => inner.attribute("name").unwrap_or("DERIVED").to_string(),
+        "array" => {
+            let dim = inner.children().find(|n| n.has_tag_name("dimension"));
+            let (lo, hi) = dim
+                .map(|d| {
+                    (
+                        d.attribute("lower").unwrap_or("0").to_string(),
+                        d.attribute("upper").unwrap_or("0").to_string(),
+                    )
+                })
+                .unwrap_or_else(|| ("0".to_string(), "0".to_string()));
+            let base = inner
+                .children()
+                .find(|n| n.has_tag_name("baseType"))
+                .map(type_name)
+                .unwrap_or_else(|| "INT".to_string());
+            format!("ARRAY[{lo}..{hi}] OF {base}")
+        }
+        "string" | "wstring" => "STRING".to_string(),
+        // BOOL, INT, DINT, REAL, TIME, ... — the tag name is the ST type.
+        other => other.to_ascii_uppercase(),
+    }
+}
+
+/// Extract an initial value as an ST literal (quoting strings).
+fn initial_value(iv: Node) -> Option<String> {
+    let simple = iv.descendants().find(|n| n.has_tag_name("simpleValue"))?;
+    let raw = simple.attribute("value")?.trim().to_string();
+    if raw.is_empty() {
+        return None;
+    }
+    // Numbers / booleans / time literals pass through; everything else is a
+    // string literal.
+    let is_scalar = raw.eq_ignore_ascii_case("true")
+        || raw.eq_ignore_ascii_case("false")
+        || raw.starts_with(['T', 't', 'D', 'd']) && raw.contains('#')
+        || raw
+            .chars()
+            .all(|c| c.is_ascii_digit() || c == '.' || c == '-' || c == '+');
+    if is_scalar || raw.starts_with('\'') || raw.starts_with('"') {
+        Some(raw)
+    } else {
+        Some(format!("'{}'", raw.replace('\'', "''")))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::parse_plcopen;
+    use crate::pipeline::plc::rules;
+    use std::collections::HashSet;
+
+    fn rule_ids(xml: &str) -> HashSet<&'static str> {
+        parse_plcopen(xml)
+            .iter()
+            .flat_map(rules::analyze)
+            .map(|h| h.rule_id)
+            .collect()
+    }
+
+    /// A Ladder Diagram network: a rung (power rail → contact → coil) plus an
+    /// insecure comm block. Coils/contacts translate to assignments; the block
+    /// translates to a call so the port rule fires.
+    #[test]
+    fn ld_coil_and_block_translate_and_are_analysed() {
+        let xml = r#"<?xml version="1.0"?>
+<project xmlns="http://www.plcopen.org/xml/tc6_0201">
+ <types><pous>
+  <pou name="Rung" pouType="program">
+   <interface><localVars>
+     <variable name="Motor"><type><BOOL/></type></variable>
+   </localVars></interface>
+   <body><LD>
+     <leftPowerRail localId="0"/>
+     <contact localId="1"><variable>Start</variable>
+       <connectionPointIn><connection refLocalId="0"/></connectionPointIn></contact>
+     <coil localId="2"><variable>Motor</variable>
+       <connectionPointIn><connection refLocalId="1"/></connectionPointIn></coil>
+     <inVariable localId="3"><expression>21</expression></inVariable>
+     <inVariable localId="4"><expression>FALSE</expression></inVariable>
+     <block localId="10" typeName="Ftp_Send">
+       <inputVariables>
+         <variable formalParameter="PORT">
+           <connectionPointIn><connection refLocalId="3"/></connectionPointIn></variable>
+         <variable formalParameter="ENCRYPT">
+           <connectionPointIn><connection refLocalId="4"/></connectionPointIn></variable>
+       </inputVariables>
+     </block>
+   </LD></body>
+  </pou>
+ </pous></types>
+</project>"#;
+        let ids = rule_ids(xml);
+        // Ftp_Send(PORT := 21, ENCRYPT := FALSE) — port 21 is an insecure protocol.
+        assert!(
+            ids.contains("plc-insecure-protocol-port"),
+            "LD block should flag port 21; got {ids:?}"
+        );
+    }
+
+    /// Doubled-text regression: a graphical expression must be extracted once,
+    /// so literals like `502` and `FALSE` stay intact (not `502502`/`FALSEFALSE`).
+    #[test]
+    fn graphical_expression_text_is_not_duplicated() {
+        let xml = r#"<?xml version="1.0"?>
+<project xmlns="http://www.plcopen.org/xml/tc6_0201">
+ <types><pous>
+  <pou name="Comm" pouType="program">
+   <body><FBD>
+     <inVariable localId="1"><expression>502</expression></inVariable>
+     <inVariable localId="2"><expression>FALSE</expression></inVariable>
+     <block localId="10" typeName="Modbus_TCP_Master">
+       <inputVariables>
+         <variable formalParameter="PORT">
+           <connectionPointIn><connection refLocalId="1"/></connectionPointIn></variable>
+         <variable formalParameter="AUTH">
+           <connectionPointIn><connection refLocalId="2"/></connectionPointIn></variable>
+       </inputVariables>
+     </block>
+   </FBD></body>
+  </pou>
+ </pous></types>
+</project>"#;
+        let ids = rule_ids(xml);
+        assert!(ids.contains("plc-insecure-protocol-port")); // PORT := 502 (not 502502)
+        assert!(ids.contains("plc-insecure-comm")); // AUTH := FALSE (not FALSEFALSE)
+    }
+}
@@ -0,0 +1,632 @@
+//! Semantic control-logic security rules over the Structured Text AST.
+//!
+//! Each rule walks the parsed [`Pou`] and yields [`RuleHit`]s the scanner turns
+//! into findings. Rules reason over structure (declarations, assignments, calls,
+//! array accesses, division, jumps) rather than raw text, so they see through
+//! formatting and comments.
+
+use std::collections::{HashMap, HashSet};
+
+use compliance_core::models::Severity;
+
+use super::ast::*;
+
+/// One rule match within a POU.
+pub struct RuleHit {
+    pub line: u32,
+    pub severity: Severity,
+    pub rule_id: &'static str,
+    pub title: String,
+    pub description: String,
+    pub cwe: Option<&'static str>,
+    pub remediation: &'static str,
+}
+
+/// Run every rule over a POU.
+pub fn analyze(pou: &Pou) -> Vec<RuleHit> {
+    let mut hits = Vec::new();
+    let ctx = Ctx::build(pou);
+
+    // Declaration-level rules.
+    for v in &pou.vars {
+        if let Some(init) = &v.init {
+            check_credential_binding(&v.name, init, &pou.name, &mut hits);
+            check_default_password(init, &v.name, &pou.name, &mut hits);
+        }
+    }
+
+    // Body walk.
+    walk(&pou.body, pou, &ctx, &GuardSet::default(), &mut hits);
+    hits
+}
+
+/// Per-POU context precomputed once.
+struct Ctx {
+    /// Names declared in VAR_INPUT (untrusted / externally driven).
+    input_vars: HashSet<String>,
+    /// Array variable name → declared (lo, hi) bounds.
+    arrays: HashMap<String, (i64, i64)>,
+}
+
+impl Ctx {
+    fn build(pou: &Pou) -> Self {
+        let mut input_vars = HashSet::new();
+        let mut arrays = HashMap::new();
+        for v in &pou.vars {
+            if v.section == VarSection::Input {
+                input_vars.insert(v.name.to_ascii_lowercase());
+            }
+            if let Some(b) = v.array_bounds {
+                arrays.insert(v.name.to_ascii_lowercase(), b);
+            }
+        }
+        Self { input_vars, arrays }
+    }
+}
+
+/// Variables proven non-zero on the current control-flow path (from enclosing
+/// `IF`/`WHILE` conditions), so guarded divisions aren't false-flagged.
+#[derive(Default, Clone)]
+struct GuardSet {
+    nonzero: HashSet<String>,
+}
+
+impl GuardSet {
+    fn with(&self, names: Vec<String>) -> Self {
+        let mut g = self.clone();
+        g.nonzero.extend(names);
+        g
+    }
+    fn is_nonzero(&self, name: &str) -> bool {
+        self.nonzero.contains(name)
+    }
+}
+
+/// Variable names a condition proves non-zero (`v <> 0`, `v > 0`, `v >= 1`,
+/// `v < 0`, and conjunctions thereof).
+fn guards_from_cond(cond: &Expr) -> Vec<String> {
+    let mut out = Vec::new();
+    collect_nonzero(cond, &mut out);
+    out
+}
+
+fn collect_nonzero(e: &Expr, out: &mut Vec<String>) {
+    let Expr::Binary { op, lhs, rhs, .. } = e else {
+        return;
+    };
+    let is_zero = |x: &Expr| {
+        matches!(x, Expr::Int(0, _)) || matches!(x, Expr::Real(r, _) if r.abs() < f64::EPSILON)
+    };
+    let int_of = |x: &Expr| match x {
+        Expr::Int(n, _) => Some(*n),
+        _ => None,
+    };
+    match op {
+        BinOp::And => {
+            collect_nonzero(lhs, out);
+            collect_nonzero(rhs, out);
+        }
+        BinOp::Ne => {
+            if let (Some(v), true) = (lhs.as_ident(), is_zero(rhs)) {
+                out.push(v.to_ascii_lowercase());
+            }
+            if let (true, Some(v)) = (is_zero(lhs), rhs.as_ident()) {
+                out.push(v.to_ascii_lowercase());
+            }
+        }
+        BinOp::Gt | BinOp::Lt => {
+            // v > 0  or  v < 0
+            if let (Some(v), true) = (lhs.as_ident(), is_zero(rhs)) {
+                out.push(v.to_ascii_lowercase());
+            }
+        }
+        BinOp::Ge => {
+            // v >= n, n >= 1
+            if let (Some(v), Some(n)) = (lhs.as_ident(), int_of(rhs)) {
+                if n >= 1 {
+                    out.push(v.to_ascii_lowercase());
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+// ── the walker ─────────────────────────────────────────────────────
+fn walk(stmts: &[Stmt], pou: &Pou, ctx: &Ctx, guards: &GuardSet, hits: &mut Vec<RuleHit>) {
+    for s in stmts {
+        match s {
+            Stmt::Assign {
+                target,
+                value,
+                line,
+            } => {
+                check_safety_bypass(target, value, *line, &pou.name, hits);
+                // A string bound to a secret-looking target is a credential.
+                if let Some(name) = flatten_ident(target) {
+                    check_credential_binding(&name, value, &pou.name, hits);
+                    check_default_password(value, &name, &pou.name, hits);
+                }
+                walk_expr(target, pou, ctx, guards, hits);
+                walk_expr(value, pou, ctx, guards, hits);
+            }
+            Stmt::Call { callee, args, line } => {
+                check_insecure_comm(callee, args, *line, &pou.name, hits);
+                check_credentials_in_call(callee, args, *line, &pou.name, hits);
+                for a in args {
+                    walk_expr(&a.value, pou, ctx, guards, hits);
+                }
+            }
+            Stmt::Jump { label, line } => hits.push(RuleHit {
+                line: *line,
+                severity: Severity::Medium,
+                rule_id: "plc-unstructured-jump",
+                title: "Unstructured jump (JMP) in control logic".to_string(),
+                description: format!(
+                    "POU `{}` uses `JMP {label}`. Unstructured jumps make control flow hard to \
+                     verify and can bypass safety interlocks or leave outputs in an undefined \
+                     state on unexpected paths.",
+                    pou.name
+                ),
+                cwe: Some("CWE-691"),
+                remediation: "Replace JMP with structured constructs (IF/CASE/loops); reserve \
+                              jumps for well-reviewed state machines only.",
+            }),
+            Stmt::If {
+                branches,
+                else_body,
+                ..
+            } => {
+                for (cond, body) in branches {
+                    walk_expr(cond, pou, ctx, guards, hits);
+                    let child = guards.with(guards_from_cond(cond));
+                    walk(body, pou, ctx, &child, hits);
+                }
+                if let Some(b) = else_body {
+                    walk(b, pou, ctx, guards, hits);
+                }
+            }
+            Stmt::Case {
+                selector,
+                arms,
+                else_body,
+                ..
+            } => {
+                walk_expr(selector, pou, ctx, guards, hits);
+                for (labels, body) in arms {
+                    for l in labels {
+                        walk_expr(l, pou, ctx, guards, hits);
+                    }
+                    walk(body, pou, ctx, guards, hits);
+                }
+                if let Some(b) = else_body {
+                    walk(b, pou, ctx, guards, hits);
+                }
+            }
+            Stmt::For {
+                from, to, by, body, ..
+            } => {
+                walk_expr(from, pou, ctx, guards, hits);
+                walk_expr(to, pou, ctx, guards, hits);
+                if let Some(b) = by {
+                    walk_expr(b, pou, ctx, guards, hits);
+                }
+                walk(body, pou, ctx, guards, hits);
+            }
+            Stmt::While { cond, body, .. } => {
+                walk_expr(cond, pou, ctx, guards, hits);
+                let child = guards.with(guards_from_cond(cond));
+                walk(body, pou, ctx, &child, hits);
+            }
+            Stmt::Repeat { body, until, .. } => {
+                walk(body, pou, ctx, guards, hits);
+                walk_expr(until, pou, ctx, guards, hits);
+            }
+            Stmt::Return { .. } | Stmt::Exit { .. } | Stmt::Label { .. } => {}
+        }
+    }
+}
+
+fn walk_expr(e: &Expr, pou: &Pou, ctx: &Ctx, guards: &GuardSet, hits: &mut Vec<RuleHit>) {
+    match e {
+        Expr::Index { base, index, line } => {
+            check_array_bounds(base, index, *line, ctx, &pou.name, hits);
+            walk_expr(base, pou, ctx, guards, hits);
+            walk_expr(index, pou, ctx, guards, hits);
+        }
+        Expr::Binary { op, lhs, rhs, line } => {
+            if matches!(op, BinOp::Div | BinOp::Mod) {
+                check_division(rhs, *line, &pou.name, guards, hits);
+            }
+            walk_expr(lhs, pou, ctx, guards, hits);
+            walk_expr(rhs, pou, ctx, guards, hits);
+        }
+        Expr::Unary { expr, .. } => walk_expr(expr, pou, ctx, guards, hits),
+        Expr::Member { base, .. } => walk_expr(base, pou, ctx, guards, hits),
+        Expr::Call { args, .. } => {
+            for a in args {
+                walk_expr(&a.value, pou, ctx, guards, hits);
+            }
+        }
+        _ => {}
+    }
+}
+
+// ── individual rules ───────────────────────────────────────────────
+const SECRET_HINTS: &[&str] = &[
+    "password",
+    "passwd",
+    "pwd",
+    "secret",
+    "apikey",
+    "api_key",
+    "token",
+    "credential",
+    "privkey",
+    "private_key",
+    "passphrase",
+];
+
+const DEFAULT_PASSWORDS: &[&str] = &[
+    "admin",
+    "administrator",
+    "password",
+    "passwd",
+    "1234",
+    "12345",
+    "123456",
+    "0000",
+    "1111",
+    "root",
+    "default",
+    "admin123",
+    "changeme",
+    "letmein",
+    "guest",
+    "user",
+    "system",
+    "plc",
+    "codesys",
+];
+
+const COMM_FB_HINTS: &[&str] = &[
+    "modbus", "tcp", "udp", "socket", "mqtt", "opcua", "opc_ua", "ethernet", "ethip", "enip",
+    "dnp3", "ftp", "telnet", "http", "send", "connect", "sock", "comm", "profinet", "s7",
+];
+
+/// Insecure cleartext service ports.
+const INSECURE_PORTS: &[i64] = &[21, 23, 80, 502, 20000, 44818, 102];
+
+fn check_credential_binding(var_name: &str, value: &Expr, pou: &str, hits: &mut Vec<RuleHit>) {
+    let name = var_name.to_ascii_lowercase();
+    let looks_secret = SECRET_HINTS.iter().any(|h| name.contains(h));
+    if looks_secret {
+        if let Expr::Str(s, line) = value {
+            if !s.is_empty() {
+                hits.push(RuleHit {
+                    line: *line,
+                    severity: Severity::High,
+                    rule_id: "plc-hardcoded-credential",
+                    title: "Hardcoded credential in PLC program".to_string(),
+                    description: format!(
+                        "POU `{pou}` binds a hardcoded secret to `{var_name}`. Credentials \
+                         embedded in control logic are extracted trivially from a project export \
+                         or a firmware dump and cannot be rotated without a redeploy."
+                    ),
+                    cwe: Some("CWE-798"),
+                    remediation: "Store secrets outside the program (secure parameter store / \
+                                  operator-entered, retained-but-protected memory); never commit \
+                                  them to the POU.",
+                });
+            }
+        }
+    }
+}
+
+fn check_default_password(value: &Expr, var_name: &str, pou: &str, hits: &mut Vec<RuleHit>) {
+    if let Expr::Str(s, line) = value {
+        let lower = s.to_ascii_lowercase();
+        if DEFAULT_PASSWORDS.contains(&lower.as_str()) {
+            hits.push(RuleHit {
+                line: *line,
+                severity: Severity::Critical,
+                rule_id: "plc-default-password",
+                title: "Default/weak password in PLC program".to_string(),
+                description: format!(
+                    "POU `{pou}` uses the well-known default/weak password `{s}` (bound to \
+                     `{var_name}`). Default PLC credentials are the first thing an attacker tries."
+                ),
+                cwe: Some("CWE-1393"),
+                remediation:
+                    "Require a strong, unique, operator-set password; block commissioning \
+                              until the default is changed.",
+            });
+        }
+    }
+}
+
+fn check_credentials_in_call(
+    callee: &str,
+    args: &[CallArg],
+    line: u32,
+    pou: &str,
+    hits: &mut Vec<RuleHit>,
+) {
+    for a in args {
+        if let Some(name) = &a.name {
+            let n = name.to_ascii_lowercase();
+            if SECRET_HINTS.iter().any(|h| n.contains(h)) {
+                if let Expr::Str(s, l) = &a.value {
+                    if !s.is_empty() {
+                        hits.push(RuleHit {
+                            line: *l,
+                            severity: Severity::High,
+                            rule_id: "plc-hardcoded-credential",
+                            title: "Hardcoded credential passed to a function block".to_string(),
+                            description: format!(
+                                "POU `{pou}` passes a hardcoded secret as `{name}` to `{callee}`."
+                            ),
+                            cwe: Some("CWE-798"),
+                            remediation: "Supply credentials from protected configuration at \
+                                          runtime, not as a literal argument.",
+                        });
+                    }
+                }
+            }
+        }
+    }
+    let _ = line;
+}
+
+fn check_safety_bypass(target: &Expr, value: &Expr, line: u32, pou: &str, hits: &mut Vec<RuleHit>) {
+    let Some(name) = flatten_ident(target) else {
+        return;
+    };
+    let n = name.to_ascii_lowercase();
+    let safety = [
+        "safety",
+        "estop",
+        "e_stop",
+        "emergency",
+        "interlock",
+        "guard",
+        "permit",
+    ]
+    .iter()
+    .any(|h| n.contains(h));
+    let watchdog = n.contains("watchdog") || n.contains("wdt");
+    // A safety enable / interlock / watchdog signal driven to FALSE or 0 in
+    // application logic is a bypass (e.g. `Safety_Enable := FALSE`, `Watchdog_Kick := 0`).
+    let disabling = matches!(value, Expr::Bool(false, _)) || matches!(value, Expr::Int(0, _));
+    if (safety || watchdog) && disabling {
+        hits.push(RuleHit {
+            line,
+            severity: Severity::Critical,
+            rule_id: "plc-safety-bypass",
+            title: "Safety interlock / watchdog disabled in logic".to_string(),
+            description: format!(
+                "POU `{pou}` disables a safety-related signal (`{name}`) in program logic. \
+                 Bypassing interlocks or watchdogs in code defeats the plant's protective \
+                 functions and is a direct hazard."
+            ),
+            cwe: Some("CWE-1384"),
+            remediation: "Never disable safety functions from application logic; safety must be \
+                          handled by a certified safety controller / hard-wired circuit.",
+        });
+    }
+}
+
+fn check_array_bounds(
+    base: &Expr,
+    index: &Expr,
+    line: u32,
+    ctx: &Ctx,
+    pou: &str,
+    hits: &mut Vec<RuleHit>,
+) {
+    // Only reason about arrays we know the bounds of.
+    let Some(arr_name) = base.as_ident() else {
+        return;
+    };
+    if !ctx.arrays.contains_key(&arr_name.to_ascii_lowercase()) {
+        return;
+    }
+    // Index by an untrusted input variable → potential out-of-bounds access.
+    if let Some(idx_name) = index.as_ident() {
+        if ctx.input_vars.contains(&idx_name.to_ascii_lowercase()) {
+            hits.push(RuleHit {
+                line,
+                severity: Severity::High,
+                rule_id: "plc-array-unchecked-index",
+                title: "Array indexed by unvalidated input".to_string(),
+                description: format!(
+                    "POU `{pou}` indexes array `{arr_name}` with the input variable `{idx_name}` \
+                     without a validated bounds check. An out-of-range index corrupts adjacent \
+                     memory or faults the PLC (loss of control)."
+                ),
+                cwe: Some("CWE-129"),
+                remediation: "Clamp or validate the index against the array bounds (e.g. \
+                              `LIMIT`/explicit `IF idx >= lo AND idx <= hi`) before the access.",
+            });
+        }
+    }
+}
+
+fn check_division(
+    divisor: &Expr,
+    line: u32,
+    pou: &str,
+    guards: &GuardSet,
+    hits: &mut Vec<RuleHit>,
+) {
+    // A divisor proven non-zero by an enclosing guard is safe.
+    if let Expr::Ident(name, _) = divisor {
+        if guards.is_nonzero(&name.to_ascii_lowercase()) {
+            return;
+        }
+    }
+    // Flag division by a variable (could be zero); nonzero literals are fine.
+    let risky = matches!(
+        divisor,
+        Expr::Ident(_, _) | Expr::Member { .. } | Expr::Index { .. } | Expr::Int(0, _)
+    );
+    if risky {
+        hits.push(RuleHit {
+            line,
+            severity: Severity::Medium,
+            rule_id: "plc-division-by-zero",
+            title: "Division by a variable without a zero-guard".to_string(),
+            description: format!(
+                "POU `{pou}` divides by a variable that is not proven non-zero. A zero divisor \
+                 raises a PLC exception and can halt the scan cycle (denial of control)."
+            ),
+            cwe: Some("CWE-369"),
+            remediation: "Guard the divisor (`IF d <> 0 THEN …`) or use a safe-divide helper that \
+                          returns a defined value for a zero denominator.",
+        });
+    }
+}
+
+fn check_insecure_comm(
+    callee: &str,
+    args: &[CallArg],
+    line: u32,
+    pou: &str,
+    hits: &mut Vec<RuleHit>,
+) {
+    let c = callee.to_ascii_lowercase();
+    let is_comm = COMM_FB_HINTS.iter().any(|h| c.contains(h));
+    if !is_comm {
+        return;
+    }
+    // Auth/encryption explicitly disabled.
+    for a in args {
+        if let Some(name) = &a.name {
+            let n = name.to_ascii_lowercase();
+            let security_flag = ["auth", "secure", "encrypt", "tls", "ssl", "authentication"]
+                .iter()
+                .any(|h| n.contains(h));
+            if security_flag && matches!(a.value, Expr::Bool(false, _)) {
+                hits.push(RuleHit {
+                    line,
+                    severity: Severity::High,
+                    rule_id: "plc-insecure-comm",
+                    title: "Network communication with security disabled".to_string(),
+                    description: format!(
+                        "POU `{pou}` calls `{callee}` with `{name} := FALSE`, disabling \
+                         authentication/encryption on an industrial network link."
+                    ),
+                    cwe: Some("CWE-319"),
+                    remediation: "Enable authentication + transport encryption; segment OT \
+                                  networks and restrict the endpoint to trusted peers.",
+                });
+            }
+        }
+        // Well-known cleartext port literal.
+        if let Expr::Int(p, _) = &a.value {
+            if INSECURE_PORTS.contains(p) {
+                hits.push(RuleHit {
+                    line,
+                    severity: Severity::Medium,
+                    rule_id: "plc-insecure-protocol-port",
+                    title: "Cleartext industrial protocol port".to_string(),
+                    description: format!(
+                        "POU `{pou}` opens `{callee}` on port {p}, a well-known cleartext OT \
+                         protocol port with no built-in authentication or encryption."
+                    ),
+                    cwe: Some("CWE-319"),
+                    remediation: "Front the protocol with a secure gateway/VPN, or use the \
+                                  authenticated/encrypted variant; never expose it to untrusted \
+                                  networks.",
+                });
+            }
+        }
+    }
+    let _ = line;
+}
+
+/// The dotted/base identifier of an lvalue expression (`a`, `a.b` → `a.b`,
+/// `a[i]` → `a`), for name-based rules.
+fn flatten_ident(e: &Expr) -> Option<String> {
+    match e {
+        Expr::Ident(n, _) => Some(n.clone()),
+        Expr::Member { base, field, .. } => flatten_ident(base).map(|b| format!("{b}.{field}")),
+        Expr::Index { base, .. } => flatten_ident(base),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::pipeline::plc::parser;
+
+    const VULN: &str = r#"
+FUNCTION_BLOCK CommCtrl
+VAR_INPUT
+    cmdIndex : INT;
+END_VAR
+VAR
+    Password : STRING := 'admin123';
+    buffer : ARRAY[0..15] OF INT;
+    Safety_Enable : BOOL := TRUE;
+    divisor : INT;
+    result : INT;
+END_VAR
+    Safety_Enable := FALSE;
+    result := 100 / divisor;
+    buffer[cmdIndex] := 1;
+    Modbus_Connect(IP := '192.168.0.10', PORT := 502, AUTH := FALSE);
+    IF cmdIndex > 100 THEN
+        JMP fault;
+    END_IF;
+fault:
+    result := 0;
+END_FUNCTION_BLOCK
+"#;
+
+    fn rule_ids(src: &str) -> Vec<&'static str> {
+        parser::parse(src)
+            .iter()
+            .flat_map(analyze)
+            .map(|h| h.rule_id)
+            .collect()
+    }
+
+    #[test]
+    fn vulnerable_program_triggers_every_rule() {
+        let ids = rule_ids(VULN);
+        for expected in [
+            "plc-hardcoded-credential",
+            "plc-default-password",
+            "plc-safety-bypass",
+            "plc-division-by-zero",
+            "plc-array-unchecked-index",
+            "plc-insecure-comm",
+            "plc-insecure-protocol-port",
+            "plc-unstructured-jump",
+        ] {
+            assert!(
+                ids.contains(&expected),
+                "expected rule {expected}, got {ids:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn clean_program_has_no_findings() {
+        let clean = r#"
+PROGRAM Clean
+VAR
+    a : INT := 5;
+    b : INT := 3;
+    total : INT;
+END_VAR
+    IF b <> 0 THEN
+        total := a / b;
+    END_IF;
+END_PROGRAM
+"#;
+        assert!(rule_ids(clean).is_empty(), "clean program should be quiet");
+    }
+}
@@ -0,0 +1,423 @@
+//! Dynamic PLC testing via an ephemeral soft-PLC (#183).
+//!
+//! When a PLC/SPS target ships control logic but no reachable live device, the
+//! agent instantiates that logic itself instead of trying to reach the customer's
+//! OT network: it provisions a throwaway soft-PLC (OpenPLC) container in-cluster,
+//! loads the program, starts the runtime, probes it over industrial protocols,
+//! then tears the instance down. No customer network access, sandboxed, and
+//! reproducible — destructive tests become safe because the target is ours.
+//!
+//! - [`provision`] owns the container lifecycle (sub-task 1 + 5).
+//! - [`openplc`] loads the program into the running instance (sub-task 2).
+//! - [`provision_and_test`] composes them with a hard deadline and guaranteed
+//!   teardown, and runs the ICS probe against the provisioned endpoint.
+
+pub mod openplc;
+pub mod provision;
+
+use std::path::Path;
+use std::time::Duration;
+
+use secrecy::ExposeSecret;
+
+use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
+use compliance_core::models::Finding;
+use compliance_core::PlcRuntimeConfig;
+
+use crate::error::AgentError;
+
+pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
+
+/// The result of a DAST scan against a provisioned web endpoint.
+#[derive(Debug)]
+pub struct DastRunResult {
+    /// The scan-run record (linked to the onboarded target).
+    pub scan_run: DastScanRun,
+    /// The DAST findings.
+    pub findings: Vec<DastFinding>,
+}
+
+/// Everything a provision-and-test run produced: the ICS-probe findings plus, if
+/// it ran, the DAST scan of the provisioned web endpoint. The caller persists
+/// both — keeping this a plain data return means the whole run is portable to a
+/// remote execution backend that just hands the results back.
+#[derive(Debug, Default)]
+pub struct ProvisionOutcome {
+    /// ICS-probe findings from the provisioned Modbus endpoint.
+    pub findings: Vec<Finding>,
+    /// DAST scan of the provisioned web endpoint, if it ran.
+    pub dast: Option<DastRunResult>,
+}
+
+/// A control-logic program ready to load into a soft-PLC: the source text plus a
+/// cosmetic file name (OpenPLC re-stores it under its own name).
+#[derive(Debug, Clone)]
+pub struct PlcProgram {
+    /// The original file name (for the upload form; OpenPLC renames on storage).
+    pub file_name: String,
+    /// The program source — Structured Text or PLCopen XML.
+    pub source: String,
+}
+
+/// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
+/// isolates the OpenPLC session (its Flask login cookie) from every other scan.
+pub fn http_client() -> Result<reqwest::Client, AgentError> {
+    reqwest::Client::builder()
+        .cookie_store(true)
+        .timeout(Duration::from_secs(30))
+        .build()
+        .map_err(AgentError::Http)
+}
+
+/// Pick the control-logic program to run from an ingested PLC source tree.
+///
+/// OpenPLC runs one program, so we choose the best single candidate: a complete
+/// Structured Text program (one carrying a `CONFIGURATION` block) is ideal;
+/// failing that the largest ST file; failing that a PLCopen XML export. Returns
+/// `None` when the tree holds no loadable control logic.
+pub fn extract_program(root: &Path) -> Option<PlcProgram> {
+    let mut st: Vec<(String, String)> = Vec::new();
+    let mut xml: Vec<(String, String)> = Vec::new();
+    for entry in walkdir::WalkDir::new(root)
+        .into_iter()
+        .filter_map(Result::ok)
+    {
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        let path = entry.path();
+        let ext = path
+            .extension()
+            .and_then(|e| e.to_str())
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
+        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
+        if !is_st && !is_xml {
+            continue;
+        }
+        let Ok(content) = std::fs::read_to_string(path) else {
+            continue;
+        };
+        let name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("program")
+            .to_string();
+        if is_st {
+            st.push((name, content));
+        } else if looks_like_plcopen(&content) {
+            xml.push((name, content));
+        }
+    }
+
+    if let Some((name, source)) = st.iter().find(|(_, c)| has_configuration(c)) {
+        return Some(PlcProgram {
+            file_name: name.clone(),
+            source: source.clone(),
+        });
+    }
+    if let Some((name, source)) = st.iter().max_by_key(|(_, c)| c.len()) {
+        return Some(PlcProgram {
+            file_name: name.clone(),
+            source: source.clone(),
+        });
+    }
+    xml.into_iter()
+        .max_by_key(|(_, c)| c.len())
+        .map(|(file_name, source)| PlcProgram { file_name, source })
+}
+
+/// Whether an ST source is a complete, runnable program (has a `CONFIGURATION`).
+fn has_configuration(source: &str) -> bool {
+    source.to_ascii_uppercase().contains("CONFIGURATION")
+}
+
+/// Whether an XML file looks like a PLCopen project export.
+fn looks_like_plcopen(source: &str) -> bool {
+    let lower = source.to_ascii_lowercase();
+    lower.contains("<project") || lower.contains("plcopen")
+}
+
+/// Provision an ephemeral soft-PLC, load `program`, start it, probe it over
+/// industrial protocols, and tear it down. Returns the ICS-probe findings.
+///
+/// Teardown is guaranteed: the load/probe work runs under a hard deadline
+/// (`max_lifetime_secs`) and the instance is removed afterwards on every path —
+/// success, error, or deadline expiry.
+pub async fn provision_and_test<P: SoftPlc>(
+    provisioner: &P,
+    http: &reqwest::Client,
+    cfg: &PlcRuntimeConfig,
+    program: &PlcProgram,
+    target_id: &str,
+) -> Result<ProvisionOutcome, AgentError> {
+    let handle = provisioner.provision(target_id).await?;
+    tracing::info!(
+        target_id,
+        instance = %handle.name,
+        modbus = %handle.modbus_endpoint,
+        "provisioned ephemeral soft-PLC"
+    );
+
+    let deadline = Duration::from_secs(cfg.max_lifetime_secs);
+    let result = tokio::time::timeout(
+        deadline,
+        run_dynamic_test(http, cfg, program, target_id, &handle),
+    )
+    .await;
+
+    // Guaranteed teardown — runs on success, error, and deadline expiry. The
+    // inner future is panic-free (the workspace lint bans unwrap/expect), so no
+    // unwind can skip this; a container leaked by an agent *crash* is swept by
+    // the next run's stale reaper.
+    provisioner.teardown(&handle).await;
+
+    match result {
+        Ok(inner) => inner,
+        Err(_) => {
+            tracing::warn!(
+                target_id,
+                instance = %handle.name,
+                "provision-and-test hit the lifetime deadline; torn down"
+            );
+            Ok(ProvisionOutcome::default())
+        }
+    }
+}
+
+/// The load → start → probe → DAST body, run under the caller's deadline.
+async fn run_dynamic_test(
+    http: &reqwest::Client,
+    cfg: &PlcRuntimeConfig,
+    program: &PlcProgram,
+    target_id: &str,
+    handle: &ProvisionedRuntime,
+) -> Result<ProvisionOutcome, AgentError> {
+    let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
+    openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
+
+    let compile_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
+    openplc::load_and_start(
+        http,
+        &handle.webvisu_url,
+        &cfg.openplc_user,
+        cfg.openplc_password.expose_secret(),
+        program,
+        compile_budget,
+    )
+    .await?;
+
+    // Give the runtime a moment to open the Modbus/TCP server before probing.
+    tokio::time::sleep(Duration::from_secs(3)).await;
+
+    let probe_budget = Duration::from_secs(5);
+    let findings =
+        crate::pipeline::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
+    tracing::info!(
+        target_id,
+        instance = %handle.name,
+        found = findings.len(),
+        "provision-and-test probe complete"
+    );
+
+    // DAST the provisioned web endpoint (independently bounded so it can't eat
+    // the whole lifetime). On the OpenPLC substrate this is OpenPLC's own web UI,
+    // not a customer HMI — the CODESYS-runtime follow-up raises the fidelity —
+    // but it proves the deploy→run→probe→DAST loop end to end.
+    let dast_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
+    let dast = match tokio::time::timeout(dast_budget, run_webvisu_dast(handle, target_id)).await {
+        Ok(d) => d,
+        Err(_) => {
+            tracing::warn!(target_id, instance = %handle.name, "provision-and-test DAST timed out");
+            None
+        }
+    };
+
+    Ok(ProvisionOutcome { findings, dast })
+}
+
+/// Run a bounded DAST scan against the provisioned web endpoint and tag the
+/// results with our target id. Best-effort — a DAST failure never fails the run.
+async fn run_webvisu_dast(handle: &ProvisionedRuntime, target_id: &str) -> Option<DastRunResult> {
+    let mut dt = DastTarget::new(
+        "provisioned-webvisu".to_string(),
+        handle.webvisu_url.clone(),
+        DastTargetType::WebApp,
+    );
+    dt.repo_id = Some(target_id.to_string());
+    dt.max_crawl_depth = 2; // shallow — the instance is ephemeral
+
+    let orchestrator = compliance_dast::DastOrchestrator::new(100);
+    match orchestrator.run_scan(&dt, Vec::new()).await {
+        Ok((mut scan_run, mut findings)) => {
+            scan_run.target_id = target_id.to_string();
+            for f in &mut findings {
+                f.target_id = target_id.to_string();
+            }
+            tracing::info!(
+                target_id,
+                instance = %handle.name,
+                dast_findings = findings.len(),
+                "provision-and-test DAST complete"
+            );
+            Some(DastRunResult { scan_run, findings })
+        }
+        Err(e) => {
+            tracing::warn!(target_id, instance = %handle.name, error = %e, "provision-and-test DAST failed");
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
+
+    /// A scratch dir removed on drop.
+    struct Scratch(std::path::PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-plc-rt-{}", uuid::Uuid::new_v4()));
+            std::fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn extract_prefers_a_complete_st_program() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("fragment.st"), "PROGRAM P\nEND_PROGRAM\n").expect("w");
+        std::fs::write(
+            s.0.join("full.st"),
+            "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION Config0\n  RESOURCE R\nEND_CONFIGURATION\n",
+        )
+        .expect("w");
+        let prog = extract_program(&s.0).expect("program");
+        assert_eq!(prog.file_name, "full.st");
+        assert!(prog.source.contains("CONFIGURATION"));
+    }
+
+    #[test]
+    fn extract_falls_back_to_largest_st_then_plcopen() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("small.st"), "PROGRAM A\nEND_PROGRAM\n").expect("w");
+        std::fs::write(
+            s.0.join("big.st"),
+            "PROGRAM B\nVAR x : INT; y : INT; z : INT; END_VAR\nEND_PROGRAM\n",
+        )
+        .expect("w");
+        let prog = extract_program(&s.0).expect("program");
+        assert_eq!(
+            prog.file_name, "big.st",
+            "largest ST wins when none complete"
+        );
+
+        // Only a PLCopen XML present.
+        let s2 = Scratch::new();
+        std::fs::write(
+            s2.0.join("proj.xml"),
+            "<?xml version='1.0'?><project xmlns='http://www.plcopen.org/xml/tc6_0201'><pou/></project>",
+        )
+        .expect("w");
+        let prog2 = extract_program(&s2.0).expect("program");
+        assert_eq!(prog2.file_name, "proj.xml");
+    }
+
+    #[test]
+    fn extract_returns_none_without_control_logic() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("readme.md"), "# not a plc program").expect("w");
+        std::fs::write(s.0.join("data.xml"), "<config><db/></config>").expect("w");
+        assert!(extract_program(&s.0).is_none());
+    }
+
+    /// A fake provisioner recording provision/teardown calls, for lifecycle tests.
+    struct FakeSoftPlc {
+        provisions: Arc<AtomicUsize>,
+        teardowns: Arc<AtomicUsize>,
+        fail_provision: bool,
+    }
+
+    impl SoftPlc for FakeSoftPlc {
+        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, AgentError> {
+            self.provisions.fetch_add(1, Ordering::SeqCst);
+            if self.fail_provision {
+                return Err(AgentError::Other("provision failed".into()));
+            }
+            // Unreachable address so run_dynamic_test blocks on readiness until the
+            // deadline fires — exercising the teardown-on-deadline path.
+            Ok(ProvisionedRuntime {
+                name: "fake-plc".into(),
+                modbus_endpoint: "fake-plc:502".into(),
+                webvisu_url: "http://fake-plc.invalid:8080".into(),
+            })
+        }
+        async fn teardown(&self, _handle: &ProvisionedRuntime) {
+            self.teardowns.fetch_add(1, Ordering::SeqCst);
+        }
+    }
+
+    fn short_cfg() -> PlcRuntimeConfig {
+        PlcRuntimeConfig {
+            enabled: true,
+            max_lifetime_secs: 1, // keep the deadline path fast
+            ..PlcRuntimeConfig::default()
+        }
+    }
+
+    #[tokio::test]
+    async fn teardown_runs_even_when_the_test_never_completes() {
+        let provisions = Arc::new(AtomicUsize::new(0));
+        let teardowns = Arc::new(AtomicUsize::new(0));
+        let fake = FakeSoftPlc {
+            provisions: provisions.clone(),
+            teardowns: teardowns.clone(),
+            fail_provision: false,
+        };
+        let http = http_client().expect("client");
+        let prog = PlcProgram {
+            file_name: "p.st".into(),
+            source: "PROGRAM P\nEND_PROGRAM\n".into(),
+        };
+        let out = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1")
+            .await
+            .expect("ok on deadline");
+        assert!(out.findings.is_empty(), "deadline path yields no findings");
+        assert!(out.dast.is_none(), "deadline path runs no DAST");
+        assert_eq!(provisions.load(Ordering::SeqCst), 1);
+        assert_eq!(teardowns.load(Ordering::SeqCst), 1, "teardown must run");
+    }
+
+    #[tokio::test]
+    async fn provision_failure_propagates_and_skips_teardown() {
+        let provisions = Arc::new(AtomicUsize::new(0));
+        let teardowns = Arc::new(AtomicUsize::new(0));
+        let fake = FakeSoftPlc {
+            provisions: provisions.clone(),
+            teardowns: teardowns.clone(),
+            fail_provision: true,
+        };
+        let http = http_client().expect("client");
+        let prog = PlcProgram {
+            file_name: "p.st".into(),
+            source: String::new(),
+        };
+        let err = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1").await;
+        assert!(err.is_err(), "provision failure propagates");
+        assert_eq!(provisions.load(Ordering::SeqCst), 1);
+        assert_eq!(
+            teardowns.load(Ordering::SeqCst),
+            0,
+            "nothing to tear down when provisioning failed"
+        );
+    }
+}
@@ -0,0 +1,254 @@
+//! Loading a control-logic program into a provisioned OpenPLC (#183, sub-task 2).
+//!
+//! Drives the OpenPLC v3 web UI over HTTP to turn a static control-logic artifact
+//! into a *running* PLC: log in, upload the program, save it, compile it (MatIEC),
+//! and start the runtime — at which point OpenPLC opens its Modbus/TCP server on
+//! 502 and the ICS probe has something to talk to. The endpoint sequence mirrors
+//! the OpenPLC web UI: `POST /login` → `POST /upload-program` (which hands back a
+//! server-assigned `prog_file`) → `POST /upload-program-action` →
+//! `GET /compile-program?file=<prog_file>` → `GET /start_plc`.
+
+use std::time::Duration;
+
+use crate::error::AgentError;
+
+use super::PlcProgram;
+
+/// Default OpenPLC program name/description recorded in its UI.
+const PROG_NAME: &str = "certifai-provisioned";
+const PROG_DESCR: &str = "Uploaded by the Certifai provision-and-test scan";
+
+/// Poll interval while waiting for readiness / compilation.
+const POLL_INTERVAL: Duration = Duration::from_secs(2);
+
+/// Wait until the OpenPLC web UI answers (any non-5xx reply to `/login`), or the
+/// budget elapses. A freshly-started container needs a few seconds to boot.
+pub async fn wait_ready(
+    http: &reqwest::Client,
+    base_url: &str,
+    budget: Duration,
+) -> Result<(), AgentError> {
+    let login = format!("{base_url}/login");
+    let outcome = tokio::time::timeout(budget, async {
+        loop {
+            if let Ok(resp) = http.get(&login).send().await {
+                if !resp.status().is_server_error() {
+                    return;
+                }
+            }
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    })
+    .await;
+    outcome.map_err(|_| AgentError::Other(format!("OpenPLC at {base_url} did not become ready")))
+}
+
+/// Log in, upload the program, compile it, and start the runtime. On success the
+/// OpenPLC Modbus/TCP server is listening on 502.
+pub async fn load_and_start(
+    http: &reqwest::Client,
+    base_url: &str,
+    user: &str,
+    password: &str,
+    program: &PlcProgram,
+    compile_budget: Duration,
+) -> Result<(), AgentError> {
+    login(http, base_url, user, password).await?;
+    let prog_file = upload_program(http, base_url, program).await?;
+    save_program(http, base_url, &prog_file).await?;
+    compile(http, base_url, &prog_file, compile_budget).await?;
+    start(http, base_url).await?;
+    Ok(())
+}
+
+/// `POST /login` — establishes the session cookie (the client must have a cookie
+/// store; see the provision-and-test entry point).
+async fn login(
+    http: &reqwest::Client,
+    base_url: &str,
+    user: &str,
+    password: &str,
+) -> Result<(), AgentError> {
+    let resp = http
+        .post(format!("{base_url}/login"))
+        .form(&[("username", user), ("password", password)])
+        .send()
+        .await?;
+    if resp.status().is_server_error() {
+        return Err(AgentError::Other(format!(
+            "OpenPLC login failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// `POST /upload-program` (multipart `file`) — OpenPLC stores the program under a
+/// server-assigned name and returns it in a hidden `prog_file` form field, which
+/// we parse out for the follow-up save/compile steps.
+async fn upload_program(
+    http: &reqwest::Client,
+    base_url: &str,
+    program: &PlcProgram,
+) -> Result<String, AgentError> {
+    let part = reqwest::multipart::Part::text(program.source.clone())
+        .file_name(program.file_name.clone())
+        .mime_str("application/octet-stream")?;
+    let form = reqwest::multipart::Form::new().part("file", part);
+    let resp = http
+        .post(format!("{base_url}/upload-program"))
+        .multipart(form)
+        .send()
+        .await?;
+    let html = resp.text().await?;
+    parse_prog_file(&html).ok_or_else(|| {
+        AgentError::Other("OpenPLC upload did not return a prog_file handle".to_string())
+    })
+}
+
+/// `POST /upload-program-action` — records the uploaded program in OpenPLC's
+/// program list. `epoch_time` must be close to the server's clock (OpenPLC
+/// rejects stale timestamps), so we send the current time.
+async fn save_program(
+    http: &reqwest::Client,
+    base_url: &str,
+    prog_file: &str,
+) -> Result<(), AgentError> {
+    let epoch = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+        .to_string();
+    let resp = http
+        .post(format!("{base_url}/upload-program-action"))
+        .form(&[
+            ("prog_name", PROG_NAME),
+            ("prog_descr", PROG_DESCR),
+            ("prog_file", prog_file),
+            ("epoch_time", &epoch),
+        ])
+        .send()
+        .await?;
+    if resp.status().is_server_error() {
+        return Err(AgentError::Other(format!(
+            "OpenPLC save-program failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// `GET /compile-program?file=<prog_file>` then poll `/compilation-logs` until
+/// MatIEC reports it finished (or the budget elapses). Errors if compilation
+/// finishes with errors — a program that won't compile can't be started.
+async fn compile(
+    http: &reqwest::Client,
+    base_url: &str,
+    prog_file: &str,
+    budget: Duration,
+) -> Result<(), AgentError> {
+    http.get(format!("{base_url}/compile-program"))
+        .query(&[("file", prog_file)])
+        .send()
+        .await?;
+
+    let logs_url = format!("{base_url}/compilation-logs");
+    let outcome = tokio::time::timeout(budget, async {
+        loop {
+            if let Ok(resp) = http.get(&logs_url).send().await {
+                if let Ok(text) = resp.text().await {
+                    if compilation_finished(&text) {
+                        return !compilation_failed(&text);
+                    }
+                }
+            }
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    })
+    .await;
+    match outcome {
+        Ok(true) => Ok(()),
+        Ok(false) => Err(AgentError::Other(
+            "OpenPLC compilation finished with errors".to_string(),
+        )),
+        Err(_) => Err(AgentError::Other(
+            "OpenPLC compilation did not finish in time".to_string(),
+        )),
+    }
+}
+
+/// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
+async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), AgentError> {
+    let resp = http.get(format!("{base_url}/start_plc")).send().await?;
+    if resp.status().is_server_error() {
+        return Err(AgentError::Other(format!(
+            "OpenPLC start_plc failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// Extract the server-assigned `prog_file` from the `/upload-program` response,
+/// which embeds it in a hidden input. Attribute order varies, so accept both
+/// `value=… name='prog_file'` and `name='prog_file' … value=…`.
+fn parse_prog_file(html: &str) -> Option<String> {
+    // The OpenPLC template renders `value='<name>.st' id='prog_file'
+    // name='prog_file'`. Match the value bound to that input, either order.
+    let value_then_name =
+        regex::Regex::new(r#"(?is)value=['"]([^'"]+)['"][^>]*name=['"]prog_file['"]"#).ok()?;
+    if let Some(c) = value_then_name.captures(html) {
+        return c.get(1).map(|m| m.as_str().to_string());
+    }
+    let name_then_value =
+        regex::Regex::new(r#"(?is)name=['"]prog_file['"][^>]*value=['"]([^'"]+)['"]"#).ok()?;
+    name_then_value
+        .captures(html)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().to_string())
+}
+
+/// Whether the MatIEC compilation log shows the build has finished (either way).
+fn compilation_finished(log: &str) -> bool {
+    log.contains("Compilation finished")
+}
+
+/// Whether a finished compilation ended in failure.
+fn compilation_failed(log: &str) -> bool {
+    log.contains("Compilation finished with errors")
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_prog_file_value_then_name() {
+        let html = "<form><input type='hidden' value='483927.st' id='prog_file' \
+                    name='prog_file'/></form>";
+        assert_eq!(parse_prog_file(html), Some("483927.st".to_string()));
+    }
+
+    #[test]
+    fn parses_prog_file_name_then_value() {
+        let html = r#"<input name="prog_file" id="prog_file" value="12.st" />"#;
+        assert_eq!(parse_prog_file(html), Some("12.st".to_string()));
+    }
+
+    #[test]
+    fn parse_prog_file_none_when_absent() {
+        assert_eq!(parse_prog_file("<html>no form here</html>"), None);
+    }
+
+    #[test]
+    fn compilation_predicates() {
+        assert!(!compilation_finished("Compiling..."));
+        assert!(compilation_finished(
+            "...\nCompilation finished successfully!\n"
+        ));
+        assert!(compilation_finished("Compilation finished with errors!"));
+        assert!(compilation_failed("Compilation finished with errors!"));
+        assert!(!compilation_failed("Compilation finished successfully!"));
+    }
+}
@@ -0,0 +1,306 @@
+//! Ephemeral soft-PLC container lifecycle (#183, sub-task 1 + 5).
+//!
+//! Provisions a throwaway OpenPLC container per scan, isolated on the agent's own
+//! Docker network with hard resource caps and **no host port exposure**, then
+//! guarantees teardown. The container is reachable in-cluster only, by its name
+//! (the shared user-defined network's embedded DNS resolves it); it is never
+//! published to the host.
+//!
+//! The `docker` argv is produced by pure functions so provisioning is unit-tested
+//! without a Docker daemon — only the thin [`run_docker`] wrapper touches the OS.
+//! It requires the agent's runtime to have Docker access (a socket mount), which
+//! is why the whole path is gated behind [`PlcRuntimeConfig::enabled`].
+
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use compliance_core::PlcRuntimeConfig;
+
+use crate::error::AgentError;
+
+/// The Modbus/TCP port an OpenPLC instance opens once a program is running.
+const MODBUS_PORT: u16 = 502;
+/// The OpenPLC web-UI / WebVisu port.
+const WEBVISU_PORT: u16 = 8080;
+
+/// Label key marking a container as an ephemeral PLC runtime we own.
+const OWNER_LABEL_KEY: &str = "certifai.ephemeral";
+/// Label value for our ephemeral PLC runtimes.
+const OWNER_LABEL_VALUE: &str = "plc-runtime";
+
+/// A running ephemeral soft-PLC instance. Reachable in-cluster by `name`.
+#[derive(Debug, Clone)]
+pub struct ProvisionedRuntime {
+    /// The container name — also its in-network DNS alias.
+    pub name: String,
+    /// `name:502` — the Modbus/TCP endpoint the ICS probe targets.
+    pub modbus_endpoint: String,
+    /// `http://name:8080` — the WebVisu / OpenPLC web UI.
+    pub webvisu_url: String,
+}
+
+/// A source of ephemeral soft-PLC instances. Abstracted so the provision-and-test
+/// orchestration is unit-testable with a fake that never touches Docker.
+pub trait SoftPlc {
+    /// Start a fresh instance for a target and return its handle.
+    fn provision(
+        &self,
+        target_id: &str,
+    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, AgentError>> + Send;
+
+    /// Tear an instance down. Best-effort and idempotent — never fails the scan.
+    fn teardown(&self, handle: &ProvisionedRuntime)
+        -> impl std::future::Future<Output = ()> + Send;
+}
+
+/// Provisions OpenPLC instances by shelling out to the Docker CLI.
+pub struct DockerSoftPlc {
+    cfg: PlcRuntimeConfig,
+}
+
+impl DockerSoftPlc {
+    /// Build a provisioner from the PLC-runtime config.
+    pub fn new(cfg: PlcRuntimeConfig) -> Self {
+        Self { cfg }
+    }
+}
+
+impl SoftPlc for DockerSoftPlc {
+    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, AgentError> {
+        // Best-effort sweep of any container leaked by a crashed earlier run
+        // before we add another. Only removes instances past their max lifetime,
+        // so it can never disturb a concurrent run.
+        reap_stale(&self.cfg, now_epoch()).await;
+
+        let name = instance_name(target_id, now_epoch(), &random_suffix());
+        let args = run_args(&self.cfg, &name, target_id);
+        let out = run_docker(&args).await?;
+        if !out.status.success() {
+            return Err(AgentError::Other(format!(
+                "docker run for soft-PLC {name} failed: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            )));
+        }
+        Ok(ProvisionedRuntime {
+            modbus_endpoint: format!("{name}:{MODBUS_PORT}"),
+            webvisu_url: format!("http://{name}:{WEBVISU_PORT}"),
+            name,
+        })
+    }
+
+    async fn teardown(&self, handle: &ProvisionedRuntime) {
+        match run_docker(&rm_args(&handle.name)).await {
+            Ok(out) if out.status.success() => {
+                tracing::info!(instance = %handle.name, "soft-PLC instance torn down");
+            }
+            Ok(out) => tracing::warn!(
+                instance = %handle.name,
+                "soft-PLC teardown non-zero exit: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            ),
+            Err(e) => {
+                tracing::warn!(instance = %handle.name, error = %e, "soft-PLC teardown failed")
+            }
+        }
+    }
+}
+
+/// Seconds since the Unix epoch (0 if the clock is before 1970, which never
+/// happens in practice).
+fn now_epoch() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+/// A short random, docker-name-safe suffix.
+fn random_suffix() -> String {
+    uuid::Uuid::new_v4().simple().to_string()
+}
+
+/// A unique, docker-safe container name that encodes the creation epoch (for the
+/// stale reaper) and the target it belongs to. Shape:
+/// `certifai-plc-<epoch>-<target12>-<rand6>`.
+fn instance_name(target_id: &str, epoch: u64, rand: &str) -> String {
+    let short: String = target_id
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .take(12)
+        .collect();
+    let rand: String = rand
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .take(6)
+        .collect();
+    format!("certifai-plc-{epoch}-{short}-{rand}")
+}
+
+/// The creation epoch encoded in an instance name, if it is one of ours.
+fn parse_epoch(name: &str) -> Option<u64> {
+    name.strip_prefix("certifai-plc-")?
+        .split('-')
+        .next()?
+        .parse()
+        .ok()
+}
+
+/// The `docker run` argv for an ephemeral soft-PLC: detached, joined to the
+/// agent's network, resource-capped, hardened, labelled for reaping, and — by
+/// omitting any `-p` — never published to the host.
+fn run_args(cfg: &PlcRuntimeConfig, name: &str, target_id: &str) -> Vec<String> {
+    vec![
+        "run".into(),
+        "-d".into(),
+        "--name".into(),
+        name.into(),
+        "--network".into(),
+        cfg.network.clone(),
+        "--memory".into(),
+        cfg.memory.clone(),
+        "--cpus".into(),
+        cfg.cpus.clone(),
+        "--pids-limit".into(),
+        "512".into(),
+        "--security-opt".into(),
+        "no-new-privileges".into(),
+        "--stop-timeout".into(),
+        "5".into(),
+        "--label".into(),
+        format!("{OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
+        "--label".into(),
+        format!("certifai.target={target_id}"),
+        cfg.image.clone(),
+    ]
+}
+
+/// The `docker rm -f` argv that stops and removes an instance.
+fn rm_args(name: &str) -> Vec<String> {
+    vec!["rm".into(), "-f".into(), name.into()]
+}
+
+/// The `docker ps` argv listing the names of every ephemeral PLC container we own.
+fn reap_list_args() -> Vec<String> {
+    vec![
+        "ps".into(),
+        "-a".into(),
+        "--filter".into(),
+        format!("label={OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
+        "--format".into(),
+        "{{.Names}}".into(),
+    ]
+}
+
+/// Remove any ephemeral PLC container older than twice the configured max
+/// lifetime — i.e. one a crashed run leaked. The generous threshold guarantees a
+/// container from a *live* run (still within its own deadline) is never swept.
+/// Best-effort: any Docker error (e.g. no daemon) is ignored.
+async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
+    let cutoff = cfg.max_lifetime_secs.saturating_mul(2);
+    let Ok(out) = run_docker(&reap_list_args()).await else {
+        return;
+    };
+    if !out.status.success() {
+        return;
+    }
+    let names = String::from_utf8_lossy(&out.stdout);
+    for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
+        let Some(epoch) = parse_epoch(name) else {
+            continue;
+        };
+        if now.saturating_sub(epoch) > cutoff {
+            tracing::warn!(instance = %name, "reaping stale soft-PLC instance");
+            let _ = run_docker(&rm_args(name)).await;
+        }
+    }
+}
+
+/// Run a `docker` subcommand, capturing its output.
+async fn run_docker(args: &[String]) -> Result<std::process::Output, AgentError> {
+    tokio::process::Command::new("docker")
+        .args(args)
+        .output()
+        .await
+        .map_err(AgentError::Io)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn cfg() -> PlcRuntimeConfig {
+        PlcRuntimeConfig {
+            enabled: true,
+            image: "registry.example.com/openplc:latest".into(),
+            network: "certifai".into(),
+            memory: "512m".into(),
+            cpus: "0.5".into(),
+            max_lifetime_secs: 180,
+            ..PlcRuntimeConfig::default()
+        }
+    }
+
+    #[test]
+    fn instance_name_is_unique_docker_safe_and_reaper_parseable() {
+        let a = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "abcdef123456");
+        assert_eq!(a, "certifai-plc-1700000000-64f0aabbccdd-abcdef");
+        assert_eq!(parse_epoch(&a), Some(1_700_000_000));
+        // Docker names: only [A-Za-z0-9_.-].
+        assert!(a
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')));
+        // A different random suffix yields a different name for the same target.
+        let b = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "zzzzzz999999");
+        assert_ne!(a, b);
+    }
+
+    #[test]
+    fn parse_epoch_rejects_foreign_names() {
+        assert_eq!(parse_epoch("some-other-container"), None);
+        assert_eq!(parse_epoch("certifai-plc-notanumber-x"), None);
+    }
+
+    #[test]
+    fn run_args_cap_resources_harden_label_and_never_publish_a_port() {
+        let args = run_args(&cfg(), "certifai-plc-1-t-r", "target-123");
+        // No host port publishing.
+        assert!(!args.iter().any(|a| a == "-p" || a == "--publish"));
+        // Detached.
+        assert!(args.contains(&"-d".to_string()));
+        // Joined to the agent's own network.
+        let net = args.iter().position(|a| a == "--network").expect("network");
+        assert_eq!(args[net + 1], "certifai");
+        // Resource caps.
+        let mem = args.iter().position(|a| a == "--memory").expect("memory");
+        assert_eq!(args[mem + 1], "512m");
+        let cpu = args.iter().position(|a| a == "--cpus").expect("cpus");
+        assert_eq!(args[cpu + 1], "0.5");
+        assert!(args.iter().any(|a| a == "--pids-limit"));
+        // Hardening.
+        let so = args
+            .iter()
+            .position(|a| a == "--security-opt")
+            .expect("secopt");
+        assert_eq!(args[so + 1], "no-new-privileges");
+        // Ownership + target labels for reaping / attribution.
+        assert!(args.contains(&"certifai.ephemeral=plc-runtime".to_string()));
+        assert!(args.contains(&"certifai.target=target-123".to_string()));
+        // Image is last.
+        assert_eq!(
+            args.last().map(String::as_str),
+            Some("registry.example.com/openplc:latest")
+        );
+    }
+
+    #[test]
+    fn rm_args_force_remove() {
+        assert_eq!(rm_args("x"), vec!["rm", "-f", "x"]);
+    }
+
+    #[test]
+    fn reap_list_filters_by_owner_label() {
+        let args = reap_list_args();
+        assert!(args.contains(&"label=certifai.ephemeral=plc-runtime".to_string()));
+        assert!(args.contains(&"{{.Names}}".to_string()));
+    }
+}
@@ -0,0 +1,253 @@
+//! Control-application dependency SBOM from a CODESYS `.projectarchive`.
+//!
+//! A `.projectarchive` is a ZIP that bundles the project plus its referenced
+//! libraries and the target runtime. Each referenced library is an entry whose
+//! path segment follows the CODESYS convention
+//! `Name, Major.Minor.Patch.Build (Company)` (e.g. `Standard, 3.5.18.0 (System)`,
+//! `CSV Utility SL, 1.9.0.0 (CODESYS)`); the runtime appears as a device-descriptor
+//! entry `CODESYS Control … <version> …`. We enumerate those entries — no binary
+//! parsing — and emit SBOM components tagged `pkg:codesys/…`, so the CVE pipeline
+//! can match them (the runtime `Cmp*` / `3SLicense` components carry real CODESYS
+//! CVEs).
+
+use std::collections::BTreeSet;
+use std::path::{Path, PathBuf};
+
+use compliance_core::models::SbomEntry;
+
+/// Collect the control-application SBOM from every `.projectarchive` reachable for
+/// a target: the ingested artifact file itself (an uploaded archive), plus any
+/// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
+/// extracted source archive that ships the archive alongside its PLCopen XML / ST
+/// exports. Deduplicated by (name, version).
+pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let mut archives: Vec<PathBuf> = Vec::new();
+    if artifact_file.is_file() {
+        archives.push(artifact_file.to_path_buf());
+    }
+    for entry in walkdir::WalkDir::new(working_path)
+        .max_depth(8)
+        .into_iter()
+        .filter_map(|e| e.ok())
+    {
+        let p = entry.path();
+        if entry.file_type().is_file()
+            && p.extension()
+                .and_then(|x| x.to_str())
+                .is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
+        {
+            archives.push(p.to_path_buf());
+        }
+    }
+    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
+    let mut out = Vec::new();
+    for a in archives {
+        for e in projectarchive_sbom(&a, repo_id) {
+            if seen.insert((e.name.clone(), e.version.clone())) {
+                out.push(e);
+            }
+        }
+    }
+    out
+}
+
+/// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
+/// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
+/// `.st`/`.xml` project, which carries no library manifest).
+pub fn projectarchive_sbom(archive: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let Ok(file) = std::fs::File::open(archive) else {
+        return Vec::new();
+    };
+    let Ok(mut zip) = zip::ZipArchive::new(file) else {
+        return Vec::new();
+    };
+    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
+    let mut entries = Vec::new();
+    for i in 0..zip.len() {
+        let Ok(entry) = zip.by_index(i) else {
+            continue;
+        };
+        // Entry paths use `\` (Windows-authored) and/or `/` separators; the
+        // component id is one path segment.
+        for seg in entry.name().split(['/', '\\']) {
+            if let Some((name, version)) = parse_library(seg).or_else(|| parse_runtime(seg)) {
+                if seen.insert((name.clone(), version.clone())) {
+                    let mut e = SbomEntry::new(
+                        repo_id.to_string(),
+                        name.clone(),
+                        version.clone(),
+                        "codesys".to_string(),
+                    );
+                    e.purl = Some(format!(
+                        "pkg:codesys/{}@{version}",
+                        name.replace(' ', "%20")
+                    ));
+                    entries.push(e);
+                }
+            }
+        }
+    }
+    entries
+}
+
+/// `Name, X.Y.Z.W (Company)` → (name, version).
+fn parse_library(seg: &str) -> Option<(String, String)> {
+    let seg = seg.trim();
+    // Company is the trailing "(…)".
+    let open = seg.rfind(" (")?;
+    let rest = &seg[open + 2..];
+    let close = rest.find(')')?;
+    if rest[..close].trim().is_empty() {
+        return None;
+    }
+    let head = seg[..open].trim(); // "Name, X.Y.Z.W"
+    let comma = head.rfind(", ")?;
+    let name = head[..comma].trim().to_string();
+    let version = head[comma + 2..].trim().to_string();
+    if name.is_empty() || !is_dotted_version(&version) {
+        return None;
+    }
+    Some((name, version))
+}
+
+/// Device-descriptor entry `CODESYS Control … X.Y.Z.W …` → (runtime name, version).
+fn parse_runtime(seg: &str) -> Option<(String, String)> {
+    let seg = seg.trim();
+    if !seg.starts_with("CODESYS Control") {
+        return None;
+    }
+    let version = seg
+        .split_whitespace()
+        .find(|t| is_dotted_version(t))?
+        .to_string();
+    // The runtime name is the first field, before the run of padding spaces that
+    // precede the descriptor's numeric columns.
+    let name = seg.split("  ").next().unwrap_or(seg).trim().to_string();
+    if name.is_empty() {
+        return None;
+    }
+    Some((name, version))
+}
+
+/// A dotted numeric version with at least 3 components (`3.5.18.0`, `4.17.0.0`).
+fn is_dotted_version(s: &str) -> bool {
+    let parts: Vec<&str> = s.split('.').collect();
+    parts.len() >= 3
+        && parts
+            .iter()
+            .all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+    use std::io::Write;
+
+    /// Build a synthetic `.projectarchive` (zip) mirroring the real CODESYS entry
+    /// naming (verified against Proemion/codesys-examples): a native `.project`,
+    /// referenced libraries as `Name, Version (Company)` segments, and a runtime
+    /// device descriptor.
+    fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
+        let path = dir.join("App.projectarchive");
+        write_synthetic_archive(&path);
+        path
+    }
+
+    fn write_synthetic_archive(path: &Path) {
+        let file = std::fs::File::create(path).expect("create");
+        let mut zip = zip::ZipWriter::new(file);
+        let opts: zip::write::SimpleFileOptions = Default::default();
+        let names = [
+            "App.project",
+            r"{b0b5}\App.Device.Plc.compileinfo",
+            r"{e179}\Standard, 3.5.18.0 (System)   standard.compiled-library-v3",
+            r"{e179}\Util, 3.5.21.0 (System)   util.compiled-library-v3",
+            r"{e179}\CSV Utility SL, 1.9.0.0 (CODESYS)   csv utility sl.compiled-library-v3",
+            r"{e179}\3SLicense, 3.5.20.0 (CODESYS)   3slicense.compiled-library-v3",
+            r"{0c63}\CODESYS Control for Linux ARM SL     0000 0006     4.17.0.0     4096     .zip",
+        ];
+        for n in names {
+            zip.start_file(n, opts).expect("start");
+            zip.write_all(b"x").expect("write");
+        }
+        zip.finish().expect("finish");
+    }
+
+    #[test]
+    fn extracts_libraries_and_runtime_from_projectarchive() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&tmp).expect("mkdir");
+        let archive = synthetic_archive(&tmp);
+
+        let entries = projectarchive_sbom(&archive, "plc-target");
+        let by_name: HashMap<&str, &SbomEntry> =
+            entries.iter().map(|e| (e.name.as_str(), e)).collect();
+
+        // Libraries with their versions.
+        assert_eq!(
+            by_name.get("Standard").map(|e| e.version.as_str()),
+            Some("3.5.18.0")
+        );
+        assert_eq!(
+            by_name.get("Util").map(|e| e.version.as_str()),
+            Some("3.5.21.0")
+        );
+        assert_eq!(
+            by_name.get("CSV Utility SL").map(|e| e.version.as_str()),
+            Some("1.9.0.0"),
+            "multi-word library names must parse"
+        );
+        assert!(by_name.contains_key("3SLicense"));
+
+        // The runtime, from the device descriptor.
+        assert_eq!(
+            by_name
+                .get("CODESYS Control for Linux ARM SL")
+                .map(|e| e.version.as_str()),
+            Some("4.17.0.0")
+        );
+
+        // Every component is CODESYS-tagged with a purl the CVE pipeline can match,
+        // and the native `.project` / compileinfo are not mistaken for components.
+        for e in &entries {
+            assert_eq!(e.package_manager, "codesys");
+            assert!(e.purl.as_deref().unwrap_or("").starts_with("pkg:codesys/"));
+        }
+        assert!(!by_name.contains_key("App"));
+
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
+        let src = tmp.join("clone/src");
+        std::fs::create_dir_all(&src).expect("mkdir");
+        // Simulate a git clone that commits the archive alongside its exports.
+        write_synthetic_archive(&src.join("PumpStation.projectarchive"));
+
+        // The artifact "file" is a git URL (not a real file), so the SBOM must
+        // come from walking the cloned tree.
+        let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
+        let names: std::collections::HashSet<&str> =
+            entries.iter().map(|e| e.name.as_str()).collect();
+        assert!(
+            names.contains("Standard"),
+            "found libs in the committed archive"
+        );
+        assert!(names.contains("CODESYS Control for Linux ARM SL"));
+
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn non_zip_file_yields_no_sbom() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&tmp).expect("mkdir");
+        let st = tmp.join("prog.st");
+        std::fs::write(&st, "PROGRAM P\nVAR x : INT; END_VAR\nEND_PROGRAM\n").expect("write");
+        assert!(projectarchive_sbom(&st, "t").is_empty());
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+}
@@ -1,3 +1,4 @@
+use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;

 use super::dedup::compute_fingerprint;
@@ -14,7 +15,7 @@ impl PipelineOrchestrator {
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, pr_number))]
    pub async fn run_pr_review(
        &self,
-        repo: &TrackedRepository,
+        repo: &RepoView,
        repo_id: &str,
        pr_number: u64,
        base_sha: &str,
@@ -0,0 +1,74 @@
+//! `RepoView` — an internal, non-persisted view of a code target for the scan
+//! pipeline.
+//!
+//! It replaces the old persisted `TrackedRepository` model. The pipeline
+//! (SAST → SBOM → CVE → triage → issues → DAST, and PR review) only ever needs a
+//! flat bundle of git + issue-tracker + auth fields; those are projected from an
+//! [`OnboardedTarget`] and its code [`Artifact`] by [`RepoView::from_target`].
+//! Nothing here is written to Mongo — onboarded targets are the sole persisted
+//! entity.
+
+use compliance_core::models::{Artifact, OnboardedTarget, TrackerType};
+
+/// A flat, pipeline-facing view of a code target. Built from an onboarded
+/// target; never persisted.
+#[derive(Debug, Clone)]
+pub struct RepoView {
+    /// The onboarded target's id (used as `repo_id` across findings/sbom/etc.).
+    pub id: Option<mongodb::bson::oid::ObjectId>,
+    pub name: String,
+    pub git_url: String,
+    pub default_branch: String,
+    pub local_path: Option<String>,
+    pub scan_schedule: Option<String>,
+    pub webhook_enabled: bool,
+    pub webhook_secret: Option<String>,
+    pub tracker_type: Option<TrackerType>,
+    pub tracker_owner: Option<String>,
+    pub tracker_repo: Option<String>,
+    pub tracker_token: Option<String>,
+    pub auth_token: Option<String>,
+    pub auth_username: Option<String>,
+    pub last_scanned_commit: Option<String>,
+    pub findings_count: u32,
+}
+
+impl RepoView {
+    /// Project an onboarded target + its code artifact into a pipeline view.
+    pub fn from_target(target: &OnboardedTarget, code: &Artifact) -> Self {
+        let mut view = Self {
+            id: target.id,
+            name: target.name.clone(),
+            git_url: code.source_ref.clone(),
+            default_branch: "main".to_string(),
+            local_path: None,
+            scan_schedule: target.scan_schedule.clone(),
+            webhook_enabled: target.webhook_enabled,
+            webhook_secret: target.webhook_secret.clone(),
+            tracker_type: None,
+            tracker_owner: None,
+            tracker_repo: None,
+            tracker_token: None,
+            auth_token: None,
+            auth_username: None,
+            last_scanned_commit: None,
+            findings_count: target.findings_count,
+        };
+        if let Some(git) = &code.git {
+            view.default_branch = git.default_branch.clone();
+            view.last_scanned_commit = git.last_scanned_commit.clone();
+            view.local_path = git.local_path.clone();
+        }
+        if let Some(auth) = &code.auth {
+            view.auth_token = auth.secret.clone();
+            view.auth_username = auth.username.clone();
+        }
+        if let Some(it) = &target.scan_config.issue_tracker {
+            view.tracker_type = it.tracker_type.clone();
+            view.tracker_owner = it.owner.clone();
+            view.tracker_repo = it.repo.clone();
+            view.tracker_token = it.token.clone();
+        }
+        view
+    }
+}
@@ -288,25 +288,25 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
        None => return,
    };

-    let cursor = match db.repositories().find(doc! {}).await {
+    let cursor = match db.onboarded_targets().find(doc! {}).await {
        Ok(c) => c,
        Err(e) => {
-            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list targets for tenant '{tenant_id}': {e}");
            return;
        }
    };

-    let repos: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+    let targets: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;

-    for repo in repos {
-        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+    for target in targets {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
        if let Err(e) = agent
-            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
+            .run_target_scan(tenant_id, &target_id, ScanTrigger::Scheduled)
            .await
        {
            tracing::error!(
                "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                repo.name
+                target.name
            );
        }
    }
@@ -348,7 +348,7 @@ async fn monitor_cves(agent: &ComplianceAgent, tenant_id: &str) {
        std::collections::HashMap::new();
    for rid in &repo_ids {
        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(rid) {
-            if let Ok(Some(repo)) = db.repositories().find_one(doc! { "_id": oid }).await {
+            if let Ok(Some(repo)) = db.onboarded_targets().find_one(doc! { "_id": oid }).await {
                repo_names.insert(rid.clone(), repo.name.clone());
            }
        }
@@ -31,7 +31,7 @@ pub async fn handle_gitea_webhook(
        }
    };
    let repo = match db
-        .repositories()
+        .onboarded_targets()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -31,7 +31,7 @@ pub async fn handle_github_webhook(
        }
    };
    let repo = match db
-        .repositories()
+        .onboarded_targets()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -27,7 +27,7 @@ pub async fn handle_gitlab_webhook(
        }
    };
    let repo = match db
-        .repositories()
+        .onboarded_targets()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -25,8 +25,9 @@ impl TestServer {
        let mongodb_uri = std::env::var("TEST_MONGODB_URI")
            .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());

-        // Unique database name per test run to avoid collisions
-        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
+        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);

        let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
            .await
@@ -44,6 +45,7 @@ impl TestServer {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
            github_token: None,
            github_webhook_secret: None,
@@ -68,6 +70,7 @@ impl TestServer {
            pentest_imap_password: None,
            admin_api_token: None,
            tenant_registry_url: None,
+            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
        };

        let agent = ComplianceAgent::new(config, db_pool);
@@ -113,15 +113,16 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
    // Create a repo
    let resp = server
        .post(
-            "/api/v1/repositories",
+            "/api/v1/targets",
            &json!({
                "name": "cascade-test",
-                "git_url": "https://github.com/example/cascade-test.git",
+                "target_type": "web_app",
+                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/cascade-test.git", "branch": "main" }],
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();

    // Insert DAST target linked to repo
    let target_id = insert_dast_target(&server, &repo_id, "cascade-target").await;
@@ -140,9 +141,7 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
    assert_eq!(count_docs(&server, "dast_findings").await, 1);

    // Delete the repo
-    let resp = server
-        .delete(&format!("/api/v1/repositories/{repo_id}"))
-        .await;
+    let resp = server.delete(&format!("/api/v1/targets/{repo_id}")).await;
    assert_eq!(resp.status(), 200);

    // All downstream data should be gone
@@ -161,15 +160,16 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
    // Create a repo
    let resp = server
        .post(
-            "/api/v1/repositories",
+            "/api/v1/targets",
            &json!({
                "name": "sast-cascade",
-                "git_url": "https://github.com/example/sast-cascade.git",
+                "target_type": "web_app",
+                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/sast-cascade.git", "branch": "main" }],
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();

    // Insert SAST finding and SBOM entry
    let mongodb_uri = std::env::var("TEST_MONGODB_URI")
@@ -209,9 +209,7 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
    assert_eq!(count_docs(&server, "sbom_entries").await, 1);

    // Delete repo
-    server
-        .delete(&format!("/api/v1/repositories/{repo_id}"))
-        .await;
+    server.delete(&format!("/api/v1/targets/{repo_id}")).await;

    // Both should be gone
    assert_eq!(count_docs(&server, "findings").await, 0);
@@ -2,5 +2,5 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
-mod repositories;
+mod onboarding;
 mod stats;
@@ -0,0 +1,115 @@
+use crate::common::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn create_list_and_applicable_scans() {
+    let server = TestServer::start().await;
+
+    // Initially empty.
+    let resp = server.get("/api/v1/targets").await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Create a web-app target with a git repo + a live URL.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "acme-web",
+                "target_type": "web_app",
+                "artifacts": [
+                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
+                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
+                ]
+            }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    assert!(!id.is_empty());
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
+
+    // List returns it.
+    let resp = server.get("/api/v1/targets").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 1);
+
+    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
+    let resp = server
+        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let scans = body["data"]["scans"].as_array().unwrap();
+    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
+    assert!(names.contains(&"sast"));
+    assert!(names.contains(&"dast"));
+    assert_eq!(body["data"]["pentest_supported"], true);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn detect_classifies_a_plc_target() {
+    let server = TestServer::start().await;
+
+    // A PLC project artifact is a strong kind-based signal.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "line-controller",
+                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
+                "artifacts": [
+                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
+                ]
+            }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    let resp = server
+        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn add_artifact_and_delete_target() {
+    let server = TestServer::start().await;
+
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({ "name": "svc", "target_type": "backend_service" }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    // Attach a git repo.
+    let resp = server
+        .post(
+            &format!("/api/v1/targets/{id}/artifacts"),
+            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
+
+    // Delete it.
+    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 200);
+    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 404);
+
+    server.cleanup().await;
+}
@@ -1,110 +0,0 @@
-use crate::common::TestServer;
-use serde_json::json;
-
-#[tokio::test]
-async fn add_and_list_repository() {
-    let server = TestServer::start().await;
-
-    // Initially empty
-    let resp = server.get("/api/v1/repositories").await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    // Add a repository
-    let resp = server
-        .post(
-            "/api/v1/repositories",
-            &json!({
-                "name": "test-repo",
-                "git_url": "https://github.com/example/test-repo.git",
-            }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
-    assert!(!repo_id.is_empty());
-
-    // List should now return 1
-    let resp = server.get("/api/v1/repositories").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let repos = body["data"].as_array().unwrap();
-    assert_eq!(repos.len(), 1);
-    assert_eq!(repos[0]["name"], "test-repo");
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn add_duplicate_repository_fails() {
-    let server = TestServer::start().await;
-
-    let payload = json!({
-        "name": "dup-repo",
-        "git_url": "https://github.com/example/dup-repo.git",
-    });
-
-    // First add succeeds
-    let resp = server.post("/api/v1/repositories", &payload).await;
-    assert_eq!(resp.status(), 200);
-
-    // Second add with same git_url should fail (unique index)
-    let resp = server.post("/api/v1/repositories", &payload).await;
-    assert_ne!(resp.status(), 200);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn delete_repository() {
-    let server = TestServer::start().await;
-
-    // Add a repo
-    let resp = server
-        .post(
-            "/api/v1/repositories",
-            &json!({
-                "name": "to-delete",
-                "git_url": "https://github.com/example/to-delete.git",
-            }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap();
-
-    // Delete it
-    let resp = server
-        .delete(&format!("/api/v1/repositories/{repo_id}"))
-        .await;
-    assert_eq!(resp.status(), 200);
-
-    // List should be empty again
-    let resp = server.get("/api/v1/repositories").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn delete_nonexistent_repository_returns_404() {
-    let server = TestServer::start().await;
-
-    let resp = server
-        .delete("/api/v1/repositories/000000000000000000000000")
-        .await;
-    assert_eq!(resp.status(), 404);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn delete_invalid_id_returns_400() {
-    let server = TestServer::start().await;
-
-    let resp = server.delete("/api/v1/repositories/not-a-valid-id").await;
-    assert_eq!(resp.status(), 400);
-
-    server.cleanup().await;
-}
@@ -5,13 +5,14 @@ use serde_json::json;
 async fn stats_overview_reflects_inserted_data() {
    let server = TestServer::start().await;

-    // Add a repo
+    // Add a target
    server
        .post(
-            "/api/v1/repositories",
+            "/api/v1/targets",
            &json!({
                "name": "stats-repo",
-                "git_url": "https://github.com/example/stats-repo.git",
+                "target_type": "web_app",
+                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/stats-repo.git", "branch": "main" }],
            }),
        )
        .await;
@@ -11,7 +11,7 @@
 #![allow(clippy::expect_used, clippy::unwrap_used)]

 use compliance_agent::database::DatabasePool;
-use compliance_core::models::TrackedRepository;
+use compliance_core::models::{Artifact, OnboardedTarget, TargetType};
 use compliance_core::{OrgRole, TenantContext, TenantStatus};
 use mongodb::bson::doc;

@@ -28,27 +28,12 @@ fn ctx(tenant_id: &str, slug: &str) -> TenantContext {
    }
 }

-fn fixture_repo(name: &str, git_url: &str) -> TrackedRepository {
-    TrackedRepository {
-        id: None,
-        name: name.to_string(),
-        git_url: git_url.to_string(),
-        default_branch: "main".to_string(),
-        local_path: None,
-        scan_schedule: None,
-        webhook_enabled: false,
-        webhook_secret: None,
-        tracker_type: None,
-        tracker_owner: None,
-        tracker_repo: None,
-        tracker_token: None,
-        auth_token: None,
-        auth_username: None,
-        last_scanned_commit: None,
-        findings_count: 0,
-        created_at: chrono::Utc::now(),
-        updated_at: chrono::Utc::now(),
-    }
+fn fixture_repo(name: &str, git_url: &str) -> OnboardedTarget {
+    let mut target = OnboardedTarget::new(name.to_string(), TargetType::WebApp);
+    target
+        .artifacts
+        .push(Artifact::git_repo(git_url.to_string(), "main".to_string()));
+    target
 }

 #[tokio::test]
@@ -71,12 +56,12 @@ async fn pool_isolates_tenants_at_driver_level() {

    // Write distinct repos into each tenant's database.
    acme_db
-        .repositories()
+        .onboarded_targets()
        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
        .await
        .expect("insert acme");
    globex_db
-        .repositories()
+        .onboarded_targets()
        .insert_one(fixture_repo(
            "globex-platform",
            "git@example.com:globex/platform.git",
@@ -173,12 +158,12 @@ async fn admin_helpers_list_and_drop_tenant_dbs() {
    let acme_db = pool.for_tenant(&acme).await.expect("acme db");
    let globex_db = pool.for_tenant(&globex).await.expect("globex db");
    acme_db
-        .repositories()
+        .onboarded_targets()
        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
        .await
        .expect("insert acme");
    globex_db
-        .repositories()
+        .onboarded_targets()
        .insert_one(fixture_repo("globex-app", "git@example.com:globex/app.git"))
        .await
        .expect("insert globex");
@@ -284,9 +269,9 @@ fn short_id() -> String {
 }

 /// Drain a `repositories` find cursor on the given tenant database.
-async fn collect(db: &compliance_agent::database::Database) -> Vec<TrackedRepository> {
+async fn collect(db: &compliance_agent::database::Database) -> Vec<OnboardedTarget> {
    let mut cursor = db
-        .repositories()
+        .onboarded_targets()
        .find(doc! {})
        .await
        .expect("find repositories");
@@ -50,3 +50,7 @@ axum = { version = "0.8", optional = true }
 jsonwebtoken = { version = "9", optional = true }
 reqwest = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
+
+[dev-dependencies]
+# Parse the declarative TOML job specs in the Werkbank contract tests.
+toml = "0.8"
@@ -24,6 +24,9 @@ pub struct AgentConfig {
    pub scan_schedule: String,
    pub cve_monitor_schedule: String,
    pub git_clone_base_path: String,
+    /// Base directory for content-addressed artifact blobs and per-run working
+    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
+    pub artifact_store_base_path: String,
    pub ssh_key_path: String,
    pub keycloak_url: Option<String>,
    pub keycloak_realm: Option<String>,
@@ -46,6 +49,57 @@ pub struct AgentConfig {
    /// of tenants to iterate. When `None` or unreachable, scheduler
    /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
    pub tenant_registry_url: Option<String>,
+    /// Ephemeral soft-PLC provisioning for dynamic PLC testing (#183). Off by
+    /// default: it needs Docker access in the agent's runtime, which is a
+    /// deployment opt-in.
+    pub plc_runtime: PlcRuntimeConfig,
+}
+
+/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
+///
+/// When a PLC/SPS target ships control logic but no reachable live device, the
+/// agent can instantiate that logic itself: spin up a throwaway soft-PLC
+/// (OpenPLC) container in-cluster, load the program, start the runtime, probe it
+/// over industrial protocols, then tear it down. This struct carries the knobs
+/// for that container's lifecycle and the OpenPLC web-UI credentials used to
+/// upload the program.
+#[derive(Clone, Debug)]
+pub struct PlcRuntimeConfig {
+    /// Master switch. Provision-and-test does nothing unless this is set — it
+    /// shells out to `docker`, which requires the agent container to have Docker
+    /// access (socket mount), an explicit deployment decision.
+    pub enabled: bool,
+    /// Container image for the ephemeral soft-PLC (OpenPLC).
+    pub image: String,
+    /// Docker network the instance joins. Must be the agent's own network so it
+    /// is reachable in-cluster by container name and never published to the host.
+    pub network: String,
+    /// Memory cap passed to `docker run --memory` (e.g. `512m`).
+    pub memory: String,
+    /// CPU cap passed to `docker run --cpus` (e.g. `0.5`).
+    pub cpus: String,
+    /// Hard ceiling on a provisioned instance's lifetime. Teardown is guaranteed
+    /// no later than this even if a load/probe step hangs.
+    pub max_lifetime_secs: u64,
+    /// OpenPLC web-UI username for the program upload (image default `openplc`).
+    pub openplc_user: String,
+    /// OpenPLC web-UI password (image default `openplc`).
+    pub openplc_password: SecretString,
+}
+
+impl Default for PlcRuntimeConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            image: "registry.meghsakha.com/openplc:latest".to_string(),
+            network: "certifai".to_string(),
+            memory: "512m".to_string(),
+            cpus: "0.5".to_string(),
+            max_lifetime_secs: 180,
+            openplc_user: "openplc".to_string(),
+            openplc_password: SecretString::from("openplc".to_string()),
+        }
+    }
 }

 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -2,6 +2,7 @@ pub mod config;
 pub mod db;
 pub mod error;
 pub mod models;
+pub mod scan_matrix;
 #[cfg(feature = "telemetry")]
 pub mod telemetry;
 pub mod tenant;
@@ -12,6 +13,6 @@ pub mod auth;
 #[cfg(feature = "axum")]
 pub mod tenant_ctx;

-pub use config::{AgentConfig, DashboardConfig};
+pub use config::{AgentConfig, DashboardConfig, PlcRuntimeConfig};
 pub use error::CoreError;
 pub use tenant::{OrgRole, TenantContext, TenantStatus};
@@ -0,0 +1,69 @@
+//! Per-tenant API tokens used by `compliance-mcp` to authenticate MCP
+//! HTTP requests on behalf of LLM clients (Claude Desktop, Cursor,
+//! ChatGPT, etc.) that can't run a Keycloak OIDC flow.
+//!
+//! Tokens are opaque strings of the form `mcpt_<44 url-safe random
+//! chars>`. The raw value is shown to the user exactly once at
+//! creation; the database only ever sees the SHA-256 hash. Lookups go
+//! through the cross-tenant `<prefix>__admin.mcp_tokens` collection
+//! and return the `tenant_id` the MCP server should route to.
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+/// Persisted token metadata. `token_hash` is the SHA-256 hex of the
+/// raw token; the raw token itself is never stored.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpToken {
+    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
+    pub id: Option<bson::oid::ObjectId>,
+    /// SHA-256 hex of the raw token. Unique index in the collection.
+    pub token_hash: String,
+    /// First 8 chars of the raw token — purely for UI display so users
+    /// can identify which token is which without re-issuing.
+    pub token_prefix: String,
+    /// Routes to `<db_prefix>_<tenant_id>` on MCP requests.
+    pub tenant_id: String,
+    /// User-given label, e.g. "Claude Desktop" or "Sharang's laptop".
+    pub name: String,
+    /// Keycloak `sub` of the user who created this token, for audit.
+    pub created_by: String,
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub created_at: DateTime<Utc>,
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_used_at: Option<DateTime<Utc>>,
+    /// Soft-delete flag. A revoked token doc stays around for audit
+    /// but never authenticates.
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+/// Public projection of a token — never includes the hash.
+/// Returned by `GET /api/v1/mcp-tokens`.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpTokenView {
+    pub id: String,
+    pub name: String,
+    /// `mcpt_xxxx…` so the user can identify which row is which.
+    pub token_prefix: String,
+    pub created_by: String,
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub created_at: DateTime<Utc>,
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_used_at: Option<DateTime<Utc>>,
+    pub revoked: bool,
+}
+
+impl From<&McpToken> for McpTokenView {
+    fn from(t: &McpToken) -> Self {
+        Self {
+            id: t.id.map(|o| o.to_hex()).unwrap_or_default(),
+            name: t.name.clone(),
+            token_prefix: t.token_prefix.clone(),
+            created_by: t.created_by.clone(),
+            created_at: t.created_at,
+            last_used_at: t.last_used_at,
+            revoked: t.revoked,
+        }
+    }
+}
@@ -7,12 +7,15 @@ pub mod finding;
 pub mod graph;
 pub mod issue;
 pub mod mcp;
+pub mod mcp_token;
 pub mod notification;
+pub mod onboarding;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
 pub mod scan;
 pub(crate) mod serde_helpers;
+pub mod werkbank;

 pub use auth::AuthInfo;
 pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
@@ -28,13 +31,23 @@ pub use graph::{
 };
 pub use issue::{IssueStatus, TrackerIssue, TrackerType};
 pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
+pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
+pub use onboarding::{
+    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
+    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
+    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
+    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
+};
 pub use pentest::{
    AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
    PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
    PentestStatus, PentestStrategy, SeverityDistribution, TestUserRecord, TesterInfo,
    ToolCallRecord,
 };
-pub use repository::{ScanTrigger, TrackedRepository};
+pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
+pub use werkbank::{
+    DastCollect, Executor, InputRef, Job, JobCollect, JobResult, JobRuntime, JobStatus, JobType,
+};
@@ -0,0 +1,756 @@
+//! The unified onboarding model.
+//!
+//! An [`OnboardedTarget`] is the single source of truth for anything the scanner
+//! can analyze. It records *what kind of software* the target is ([`TargetType`]),
+//! the concrete [`Artifact`]s that were provided for it (a git repo, a firmware
+//! image, a live URL, a PLC project, ...), the classifier's verdict, and the scan
+//! configuration. It replaces the older git-only `TrackedRepository` and the
+//! standalone `DastTarget`, both of which fold into this type as artifacts.
+
+use std::collections::HashMap;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::dast::{DastAuthConfig, DastTargetType};
+use super::issue::TrackerType;
+use super::pentest::{Environment, PentestConfig, PentestStrategy};
+use super::scan::ScanType;
+
+/// The family of software a target belongs to.
+///
+/// Targets look endlessly varied but fall into a small enumerable set classified
+/// by where the analyzable signal lives. This drives the scan-applicability
+/// matrix and the onboarding wizard's type selection.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum TargetType {
+    /// Browser-facing web application (front end + server).
+    WebApp,
+    /// Headless backend service / API (REST, GraphQL, gRPC).
+    BackendService,
+    /// Desktop application (Windows/macOS/Linux GUI or CLI binary).
+    DesktopApp,
+    /// Android application (APK / AAB).
+    AndroidApp,
+    /// iOS application (IPA).
+    IosApp,
+    /// Bare-metal embedded firmware (no operating system).
+    FirmwareBareMetal,
+    /// Embedded firmware running on an RTOS (Zephyr, FreeRTOS, ...).
+    FirmwareRtos,
+    /// Embedded Linux built with Yocto / OpenEmbedded (BSP + image).
+    EmbeddedLinuxYocto,
+    /// Programmable logic controller software (IEC 61131-3, PLCopen / SPS).
+    PlcSps,
+}
+
+impl std::fmt::Display for TargetType {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::WebApp => write!(f, "web_app"),
+            Self::BackendService => write!(f, "backend_service"),
+            Self::DesktopApp => write!(f, "desktop_app"),
+            Self::AndroidApp => write!(f, "android_app"),
+            Self::IosApp => write!(f, "ios_app"),
+            Self::FirmwareBareMetal => write!(f, "firmware_bare_metal"),
+            Self::FirmwareRtos => write!(f, "firmware_rtos"),
+            Self::EmbeddedLinuxYocto => write!(f, "embedded_linux_yocto"),
+            Self::PlcSps => write!(f, "plc_sps"),
+        }
+    }
+}
+
+/// The kind of artifact provided for a target.
+///
+/// Which scans are possible is a function of the target type *and* which of
+/// these are present (SAST needs code, DAST needs a running URL, and so on).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ArtifactKind {
+    /// A git repository (cloned for static analysis).
+    GitRepo,
+    /// A source archive (zip / tarball) with no live git remote.
+    SourceArchive,
+    /// A firmware image or binary blob.
+    FirmwareImage,
+    /// A mobile package: Android APK/AAB or iOS IPA.
+    MobilePackage,
+    /// An OCI/Docker container image reference.
+    ContainerImage,
+    /// A reachable running instance (base URL / endpoint) for dynamic testing.
+    LiveUrl,
+    /// A PLC project: PLCopen XML or Structured Text source.
+    PlcProject,
+    /// Free-form plaintext describing the target (feeds classification only).
+    PlaintextDescription,
+}
+
+impl std::fmt::Display for ArtifactKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::GitRepo => write!(f, "git_repo"),
+            Self::SourceArchive => write!(f, "source_archive"),
+            Self::FirmwareImage => write!(f, "firmware_image"),
+            Self::MobilePackage => write!(f, "mobile_package"),
+            Self::ContainerImage => write!(f, "container_image"),
+            Self::LiveUrl => write!(f, "live_url"),
+            Self::PlcProject => write!(f, "plc_project"),
+            Self::PlaintextDescription => write!(f, "plaintext_description"),
+        }
+    }
+}
+
+/// Credentials attached to an artifact.
+///
+/// This folds both `TrackedRepository`'s git auth (`auth_token` / `auth_username`
+/// / SSH key) and `DastAuthConfig`'s HTTP auth (form / bearer / cookie) into one
+/// shape so a single artifact carries whatever it needs to be fetched or probed.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ArtifactAuth {
+    /// Auth method: `none` | `token` | `basic` | `bearer` | `cookie` | `form` | `ssh`.
+    #[serde(default)]
+    pub method: String,
+    /// Username (git user, basic-auth user, or `x-access-token` for PATs).
+    pub username: Option<String>,
+    /// The secret credential: PAT, password, or bearer token. Encrypted at rest.
+    pub secret: Option<String>,
+    /// Path to an SSH private key for git-over-SSH.
+    pub ssh_key_path: Option<String>,
+    /// Login URL for form-based authentication.
+    pub login_url: Option<String>,
+    /// Extra headers to send when authenticating / probing.
+    pub headers: Option<HashMap<String, String>>,
+}
+
+impl From<DastAuthConfig> for ArtifactAuth {
+    fn from(c: DastAuthConfig) -> Self {
+        Self {
+            method: c.method,
+            username: c.username,
+            // Prefer a bearer token; otherwise fall back to the password.
+            secret: c.token.or(c.password),
+            ssh_key_path: None,
+            login_url: c.login_url,
+            headers: c.headers,
+        }
+    }
+}
+
+/// Git-specific configuration for a [`ArtifactKind::GitRepo`] artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct GitArtifactConfig {
+    /// Branch to scan.
+    pub default_branch: String,
+    /// Commit SHA of the last completed scan (change-detection watermark).
+    pub last_scanned_commit: Option<String>,
+    /// Local clone path once the repo has been fetched.
+    pub local_path: Option<String>,
+}
+
+impl GitArtifactConfig {
+    /// Config for a fresh git artifact on the given branch.
+    pub fn on_branch(branch: impl Into<String>) -> Self {
+        Self {
+            default_branch: branch.into(),
+            last_scanned_commit: None,
+            local_path: None,
+        }
+    }
+}
+
+impl Default for GitArtifactConfig {
+    fn default() -> Self {
+        Self::on_branch("main")
+    }
+}
+
+/// Dynamic-analysis configuration for a [`ArtifactKind::LiveUrl`] artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WebArtifactConfig {
+    /// Whether the endpoint is a web app, REST API, or GraphQL API.
+    pub target_kind: DastTargetType,
+    /// URL paths to exclude from crawling / scanning.
+    #[serde(default)]
+    pub excluded_paths: Vec<String>,
+    /// Maximum crawl depth.
+    pub max_crawl_depth: u32,
+    /// Rate limit in requests per second.
+    pub rate_limit: u32,
+    /// Whether destructive methods (DELETE / PUT) are permitted.
+    #[serde(default)]
+    pub allow_destructive: bool,
+}
+
+impl Default for WebArtifactConfig {
+    fn default() -> Self {
+        Self {
+            target_kind: DastTargetType::WebApp,
+            excluded_paths: Vec::new(),
+            max_crawl_depth: 3,
+            rate_limit: 10,
+            allow_destructive: false,
+        }
+    }
+}
+
+/// The source format of a PLC project artifact.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlcFormat {
+    /// PLCopen XML project export.
+    PlcopenXml,
+    /// IEC 61131-3 Structured Text source.
+    StructuredText,
+    /// A CODESYS project archive (`.projectarchive` — a zip bundling the project
+    /// plus its referenced libraries and runtime; the source of the control-app SBOM).
+    ProjectArchive,
+}
+
+/// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PlcArtifactConfig {
+    /// The project source format.
+    pub format: PlcFormat,
+}
+
+/// A single fact discovered about a target by ingest or classification
+/// (e.g. `language=rust`, `build_system=cmake`, `mcu=stm32f429`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DetectedFact {
+    /// The fact name.
+    pub key: String,
+    /// The fact value.
+    pub value: String,
+    /// What produced the fact (e.g. `tramiton`, `language-fingerprint`).
+    pub source: String,
+}
+
+impl DetectedFact {
+    /// Build a fact from its parts.
+    pub fn new(
+        key: impl Into<String>,
+        value: impl Into<String>,
+        source: impl Into<String>,
+    ) -> Self {
+        Self {
+            key: key.into(),
+            value: value.into(),
+            source: source.into(),
+        }
+    }
+}
+
+/// One concrete thing provided for a target: code, a binary, a URL, etc.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Artifact {
+    /// Stable per-artifact id (UUID v4) — scan steps reference this.
+    pub id: String,
+    /// What kind of artifact this is.
+    pub kind: ArtifactKind,
+    /// The source reference: git URL, blob id, live URL, or image ref.
+    pub source_ref: String,
+    /// Optional human-friendly label.
+    pub display_name: Option<String>,
+    /// Content-addressed storage path once ingested (blobs only).
+    pub stored_path: Option<String>,
+    /// SHA-256 of the ingested content (git artifacts store the head SHA).
+    pub content_hash: Option<String>,
+    /// Size of the stored blob in bytes.
+    pub size_bytes: Option<u64>,
+    /// Credentials for fetching or probing this artifact.
+    pub auth: Option<ArtifactAuth>,
+    /// Git configuration (present for [`ArtifactKind::GitRepo`]).
+    pub git: Option<GitArtifactConfig>,
+    /// Dynamic-analysis configuration (present for [`ArtifactKind::LiveUrl`]).
+    pub web: Option<WebArtifactConfig>,
+    /// PLC configuration (present for [`ArtifactKind::PlcProject`]).
+    pub plc: Option<PlcArtifactConfig>,
+    /// Facts discovered about this artifact by ingest / classification.
+    #[serde(default)]
+    pub detected: Vec<DetectedFact>,
+    /// When this artifact was last ingested.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub ingested_at: Option<DateTime<Utc>>,
+}
+
+impl Artifact {
+    /// A bare artifact of the given kind and source reference.
+    fn bare(kind: ArtifactKind, source_ref: impl Into<String>) -> Self {
+        Self {
+            id: uuid::Uuid::new_v4().to_string(),
+            kind,
+            source_ref: source_ref.into(),
+            display_name: None,
+            stored_path: None,
+            content_hash: None,
+            size_bytes: None,
+            auth: None,
+            git: None,
+            web: None,
+            plc: None,
+            detected: Vec::new(),
+            ingested_at: None,
+        }
+    }
+
+    /// A git-repository artifact tracking the given branch.
+    pub fn git_repo(url: impl Into<String>, branch: impl Into<String>) -> Self {
+        let mut a = Self::bare(ArtifactKind::GitRepo, url);
+        a.git = Some(GitArtifactConfig::on_branch(branch));
+        a
+    }
+
+    /// A live-URL artifact with default crawl settings.
+    pub fn live_url(url: impl Into<String>) -> Self {
+        let mut a = Self::bare(ArtifactKind::LiveUrl, url);
+        a.web = Some(WebArtifactConfig::default());
+        a
+    }
+
+    /// A firmware-image artifact referenced by name (blob ingested later).
+    pub fn firmware_image(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::FirmwareImage, source_ref)
+    }
+
+    /// A source-archive artifact referenced by name (blob ingested later).
+    pub fn source_archive(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::SourceArchive, source_ref)
+    }
+
+    /// A mobile-package artifact (APK/AAB/IPA) referenced by name.
+    pub fn mobile_package(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::MobilePackage, source_ref)
+    }
+
+    /// A container-image artifact referenced by OCI ref.
+    pub fn container_image(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::ContainerImage, source_ref)
+    }
+
+    /// A PLC-project artifact in the given format.
+    pub fn plc_project(source_ref: impl Into<String>, format: PlcFormat) -> Self {
+        let mut a = Self::bare(ArtifactKind::PlcProject, source_ref);
+        a.plc = Some(PlcArtifactConfig { format });
+        a
+    }
+
+    /// A plaintext-description artifact (classification input only).
+    pub fn plaintext(text: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::PlaintextDescription, text)
+    }
+}
+
+/// One ranked candidate produced by the classifier.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TargetTypeCandidate {
+    /// The candidate target type.
+    pub target_type: TargetType,
+    /// Confidence in `[0.0, 1.0]`.
+    pub confidence: f32,
+    /// Why this candidate was proposed.
+    pub rationale: String,
+}
+
+/// The classifier's verdict for a target: a suggested type plus ranked
+/// alternatives and the facts the decision rested on.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Classification {
+    /// The top-ranked target type.
+    pub suggested: TargetType,
+    /// All candidates, sorted by descending confidence.
+    #[serde(default)]
+    pub candidates: Vec<TargetTypeCandidate>,
+    /// Facts gathered during classification.
+    #[serde(default)]
+    pub facts: Vec<DetectedFact>,
+    /// Which classifiers contributed (e.g. `["tramiton", "language-fingerprint"]`).
+    #[serde(default)]
+    pub detected_by: Vec<String>,
+    /// When classification ran.
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub detected_at: DateTime<Utc>,
+    /// Whether a human confirmed the suggestion.
+    #[serde(default)]
+    pub confirmed: bool,
+}
+
+/// Issue-tracker linkage, migrated from `TrackedRepository`'s `tracker_*` fields.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct IssueTrackerConfig {
+    /// The tracker platform.
+    pub tracker_type: Option<TrackerType>,
+    /// Tracker owner / organization.
+    pub owner: Option<String>,
+    /// Tracker repository / project.
+    pub repo: Option<String>,
+    /// Per-target tracker access token.
+    pub token: Option<String>,
+}
+
+/// How a target should be scanned.
+///
+/// `enabled_scans` / `disabled_scans` override the scan-applicability matrix
+/// defaults; the pentest and tracker blocks reuse the existing wizard config.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct TargetScanConfig {
+    /// Scans explicitly turned on (empty means "use matrix defaults").
+    #[serde(default)]
+    pub enabled_scans: Vec<ScanType>,
+    /// Scans explicitly turned off.
+    #[serde(default)]
+    pub disabled_scans: Vec<ScanType>,
+    /// Target environment (gates destructive / active testing).
+    #[serde(default)]
+    pub environment: Environment,
+    /// Whether destructive tests are permitted for this target.
+    #[serde(default)]
+    pub allow_destructive: bool,
+    /// Pentest strategy selector.
+    pub strategy: Option<PentestStrategy>,
+    /// Full pentest wizard configuration.
+    pub pentest: Option<PentestConfig>,
+    /// Issue-tracker linkage.
+    pub issue_tracker: Option<IssueTrackerConfig>,
+}
+
+/// A sibling product in the company suite that may already hold authoritative
+/// data for a target. compliance-scanner reconciles with these rather than
+/// recomputing what they already know.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ExternalSystem {
+    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
+    /// attestation).
+    Tramiton,
+    /// Code assistant (downstream remediation consumer).
+    Werkpilot,
+    /// Compliance-controls RAG (atomic controls derived from laws).
+    BreakpilotCompliance,
+}
+
+impl std::fmt::Display for ExternalSystem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Tramiton => write!(f, "tramiton"),
+            Self::Werkpilot => write!(f, "werkpilot"),
+            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
+        }
+    }
+}
+
+/// A link from this target to a record in a sibling product, used to reconcile
+/// existing evidence instead of recomputing it.
+///
+/// For tramiton, `project_id` is the shared cross-product key and
+/// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
+/// (which equals tramiton's `Artifact.sha256`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExternalRef {
+    /// Which sibling product this reference points at.
+    pub system: ExternalSystem,
+    /// The sibling product's project identifier, if known.
+    pub project_id: Option<String>,
+    /// Content digest of the subject artifact (firmware sha256), if known.
+    pub subject_sha256: Option<String>,
+    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
+    #[serde(default)]
+    pub status: String,
+    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
+    /// `LicenseGrant`), if the tenant provided one.
+    pub license_grant: Option<String>,
+    /// When evidence was last reconciled from this system.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_reconciled_at: Option<DateTime<Utc>>,
+}
+
+impl ExternalRef {
+    /// A freshly linked (not yet reconciled) reference to a sibling system.
+    pub fn linked(system: ExternalSystem) -> Self {
+        Self {
+            system,
+            project_id: None,
+            subject_sha256: None,
+            status: "linked".to_string(),
+            license_grant: None,
+            last_reconciled_at: None,
+        }
+    }
+}
+
+/// A regulatory / standards framework a target must comply with. Drives which
+/// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ComplianceFramework {
+    /// EU Cyber Resilience Act.
+    Cra,
+    /// IEC 62443 (industrial automation & control systems security).
+    Iec62443,
+    /// EU General Data Protection Regulation.
+    Gdpr,
+    /// SOC 2.
+    Soc2,
+    /// ISO/IEC 27001.
+    Iso27001,
+    /// EU Radio Equipment Directive (RED) cybersecurity articles.
+    RedDirective,
+}
+
+impl std::fmt::Display for ComplianceFramework {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Cra => write!(f, "cra"),
+            Self::Iec62443 => write!(f, "iec_62443"),
+            Self::Gdpr => write!(f, "gdpr"),
+            Self::Soc2 => write!(f, "soc2"),
+            Self::Iso27001 => write!(f, "iso_27001"),
+            Self::RedDirective => write!(f, "red_directive"),
+        }
+    }
+}
+
+/// The compliance scope of a target: which frameworks apply and, optionally, the
+/// jurisdiction. Captured at onboarding (with per-target-type defaults from
+/// [`default_compliance_profile`]).
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ComplianceProfile {
+    /// Applicable frameworks.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
+    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
+    pub jurisdiction: Option<String>,
+}
+
+/// The sensible default compliance scope for a target type. Firmware / PLC /
+/// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
+pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
+    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
+    let frameworks = match target_type {
+        TargetType::PlcSps
+        | TargetType::FirmwareBareMetal
+        | TargetType::FirmwareRtos
+        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
+        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
+        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
+            vec![Gdpr, Cra]
+        }
+    };
+    ComplianceProfile {
+        frameworks,
+        jurisdiction: None,
+    }
+}
+
+/// A target onboarded for scanning: the unified replacement for the legacy
+/// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OnboardedTarget {
+    /// Mongo id. Preserved from the legacy record during migration so every
+    /// downstream collection keyed by `repo_id` / `target_id` keeps resolving.
+    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
+    pub id: Option<bson::oid::ObjectId>,
+    /// Human-friendly name.
+    #[serde(default)]
+    pub name: String,
+    /// The software family this target belongs to.
+    pub target_type: TargetType,
+    /// Optional free-form description (also a classification input).
+    pub description: Option<String>,
+    /// The artifacts provided for this target.
+    #[serde(default)]
+    pub artifacts: Vec<Artifact>,
+    /// The classifier's verdict, once run.
+    pub classification: Option<Classification>,
+    /// How this target should be scanned.
+    #[serde(default)]
+    pub scan_config: TargetScanConfig,
+    /// The compliance scope (applicable frameworks / jurisdiction).
+    #[serde(default)]
+    pub compliance_profile: ComplianceProfile,
+    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
+    #[serde(default)]
+    pub external_refs: Vec<ExternalRef>,
+    /// Cron schedule for recurring scans, if any.
+    pub scan_schedule: Option<String>,
+    /// Whether inbound webhooks are enabled for this target.
+    #[serde(default)]
+    pub webhook_enabled: bool,
+    /// HMAC secret for verifying inbound webhooks.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webhook_secret: Option<String>,
+    /// Cached count of findings across this target's scans.
+    #[serde(default)]
+    pub findings_count: u32,
+    /// Creation timestamp.
+    #[serde(
+        default = "chrono::Utc::now",
+        with = "super::serde_helpers::bson_datetime"
+    )]
+    pub created_at: DateTime<Utc>,
+    /// Last-update timestamp.
+    #[serde(
+        default = "chrono::Utc::now",
+        with = "super::serde_helpers::bson_datetime"
+    )]
+    pub updated_at: DateTime<Utc>,
+}
+
+impl OnboardedTarget {
+    /// A new target of the given type with a freshly generated webhook secret.
+    pub fn new(name: String, target_type: TargetType) -> Self {
+        let now = Utc::now();
+        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
+        Self {
+            id: None,
+            name,
+            target_type,
+            description: None,
+            artifacts: Vec::new(),
+            classification: None,
+            scan_config: TargetScanConfig::default(),
+            compliance_profile: default_compliance_profile(target_type),
+            external_refs: Vec::new(),
+            scan_schedule: None,
+            webhook_enabled: false,
+            webhook_secret: Some(webhook_secret),
+            findings_count: 0,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+
+    /// The first artifact of the given kind, if present.
+    pub fn first_of(&self, kind: ArtifactKind) -> Option<&Artifact> {
+        self.artifacts.iter().find(|a| a.kind == kind)
+    }
+
+    /// Whether the target has at least one artifact of the given kind.
+    pub fn has(&self, kind: ArtifactKind) -> bool {
+        self.artifacts.iter().any(|a| a.kind == kind)
+    }
+
+    /// The primary code artifact (git repo or source archive), if any.
+    pub fn code_artifact(&self) -> Option<&Artifact> {
+        self.artifacts
+            .iter()
+            .find(|a| matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive))
+    }
+
+    /// The live-URL artifact, if any.
+    pub fn live_url(&self) -> Option<&Artifact> {
+        self.first_of(ArtifactKind::LiveUrl)
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn sample_target() -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("acme-web".to_string(), TargetType::WebApp);
+        t.artifacts.push(Artifact::git_repo(
+            "https://git.example.com/acme.git",
+            "main",
+        ));
+        t.artifacts
+            .push(Artifact::live_url("https://acme.example.com"));
+        t
+    }
+
+    #[test]
+    fn onboarded_target_bson_round_trip() {
+        let t = sample_target();
+        let b = bson::to_bson(&t).expect("serialize");
+        let back: OnboardedTarget = bson::from_bson(b.clone()).expect("deserialize");
+        let b2 = bson::to_bson(&back).expect("re-serialize");
+        assert_eq!(b, b2);
+    }
+
+    #[test]
+    fn enum_display_is_snake_case() {
+        assert_eq!(
+            TargetType::FirmwareBareMetal.to_string(),
+            "firmware_bare_metal"
+        );
+        assert_eq!(TargetType::PlcSps.to_string(), "plc_sps");
+        assert_eq!(ArtifactKind::PlcProject.to_string(), "plc_project");
+        assert_eq!(ArtifactKind::MobilePackage.to_string(), "mobile_package");
+    }
+
+    #[test]
+    fn helpers_locate_artifacts() {
+        let t = sample_target();
+        assert!(t.has(ArtifactKind::GitRepo));
+        assert!(t.live_url().is_some());
+        assert!(t.code_artifact().is_some());
+        assert!(!t.has(ArtifactKind::FirmwareImage));
+        assert_eq!(
+            t.first_of(ArtifactKind::GitRepo).map(|a| a.kind),
+            Some(ArtifactKind::GitRepo)
+        );
+    }
+
+    #[test]
+    fn new_target_generates_webhook_secret() {
+        let t = OnboardedTarget::new("t".to_string(), TargetType::BackendService);
+        let secret = t.webhook_secret.expect("secret present");
+        assert_eq!(secret.len(), 32);
+        assert!(!secret.contains('-'));
+    }
+
+    #[test]
+    fn dast_auth_folds_into_artifact_auth() {
+        let dast = DastAuthConfig {
+            method: "bearer".to_string(),
+            login_url: Some("https://x/login".to_string()),
+            username: Some("user".to_string()),
+            password: Some("pw".to_string()),
+            token: Some("tok".to_string()),
+            headers: None,
+        };
+        let auth = ArtifactAuth::from(dast);
+        assert_eq!(auth.method, "bearer");
+        // Bearer token wins over password.
+        assert_eq!(auth.secret.as_deref(), Some("tok"));
+        assert_eq!(auth.login_url.as_deref(), Some("https://x/login"));
+    }
+
+    #[test]
+    fn each_artifact_gets_a_unique_id() {
+        let a = Artifact::firmware_image("fw.bin");
+        let b = Artifact::firmware_image("fw.bin");
+        assert_ne!(a.id, b.id);
+    }
+
+    #[test]
+    fn firmware_default_profile_is_cra_and_62443() {
+        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
+        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
+        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
+    }
+
+    #[test]
+    fn webapp_default_profile_is_gdpr_and_soc2() {
+        let p = default_compliance_profile(TargetType::WebApp);
+        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
+        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
+    }
+
+    #[test]
+    fn new_target_gets_default_profile_and_no_external_refs() {
+        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
+        assert!(!t.compliance_profile.frameworks.is_empty());
+        assert!(t.external_refs.is_empty());
+    }
+
+    #[test]
+    fn external_ref_linked_defaults() {
+        let r = ExternalRef::linked(ExternalSystem::Tramiton);
+        assert_eq!(r.system, ExternalSystem::Tramiton);
+        assert_eq!(r.status, "linked");
+        assert!(r.project_id.is_none());
+        assert!(r.last_reconciled_at.is_none());
+    }
+}
@@ -1,8 +1,6 @@
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Deserializer, Serialize};
-
-use super::issue::TrackerType;
+use serde::{Deserialize, Serialize};

+/// What initiated a scan.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum ScanTrigger {
@@ -10,92 +8,3 @@ pub enum ScanTrigger {
    Webhook,
    Manual,
 }
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TrackedRepository {
-    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
-    pub id: Option<bson::oid::ObjectId>,
-    #[serde(default)]
-    pub name: String,
-    #[serde(default)]
-    pub git_url: String,
-    #[serde(default = "default_branch")]
-    pub default_branch: String,
-    pub local_path: Option<String>,
-    pub scan_schedule: Option<String>,
-    #[serde(default)]
-    pub webhook_enabled: bool,
-    /// Auto-generated HMAC secret for verifying incoming webhooks
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub webhook_secret: Option<String>,
-    pub tracker_type: Option<TrackerType>,
-    pub tracker_owner: Option<String>,
-    pub tracker_repo: Option<String>,
-    /// Optional per-repo PAT for the issue tracker (GitHub/GitLab/Jira)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tracker_token: Option<String>,
-    /// Optional auth token for HTTPS private repos (PAT or password)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_token: Option<String>,
-    /// Optional username for HTTPS auth (defaults to "x-access-token" for PATs)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_username: Option<String>,
-    pub last_scanned_commit: Option<String>,
-    #[serde(default, deserialize_with = "deserialize_findings_count")]
-    pub findings_count: u32,
-    #[serde(
-        default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
-    )]
-    pub created_at: DateTime<Utc>,
-    #[serde(
-        default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
-    )]
-    pub updated_at: DateTime<Utc>,
-}
-
-fn default_branch() -> String {
-    "main".to_string()
-}
-
-fn deserialize_findings_count<'de, D>(deserializer: D) -> Result<u32, D::Error>
-where
-    D: Deserializer<'de>,
-{
-    let bson = bson::Bson::deserialize(deserializer)?;
-    match &bson {
-        bson::Bson::Int32(n) => Ok(*n as u32),
-        bson::Bson::Int64(n) => Ok(*n as u32),
-        bson::Bson::Double(n) => Ok(*n as u32),
-        _ => Ok(0),
-    }
-}
-
-impl TrackedRepository {
-    pub fn new(name: String, git_url: String) -> Self {
-        let now = Utc::now();
-        // Generate a random webhook secret (hex-encoded UUID v4, no dashes)
-        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
-        Self {
-            id: None,
-            name,
-            git_url,
-            default_branch: "main".to_string(),
-            local_path: None,
-            scan_schedule: None,
-            auth_token: None,
-            auth_username: None,
-            webhook_enabled: false,
-            webhook_secret: Some(webhook_secret),
-            tracker_type: None,
-            tracker_owner: None,
-            tracker_repo: None,
-            tracker_token: None,
-            last_scanned_commit: None,
-            findings_count: 0,
-            created_at: now,
-            updated_at: now,
-        }
-    }
-}
@@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize};

 use super::repository::ScanTrigger;

-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
 pub enum ScanType {
    Sast,
@@ -16,6 +16,17 @@ pub enum ScanType {
    SecretDetection,
    Lint,
    CodeReview,
+    /// Static analysis of a firmware image (unpack + component CVE).
+    FirmwareStatic,
+    /// Control-logic security analysis of PLC / SPS programs.
+    PlcControlLogic,
+    /// Static analysis of a mobile package (APK / AAB / IPA).
+    MobileStatic,
+    /// Static analysis of a container image.
+    ContainerScan,
+    /// Dynamic probing of a running PLC/SPS device over industrial protocols
+    /// (Modbus/TCP, OPC UA, …) for exposed/unauthenticated control access.
+    IcsProbe,
 }

 impl std::fmt::Display for ScanType {
@@ -31,6 +42,11 @@ impl std::fmt::Display for ScanType {
            Self::SecretDetection => write!(f, "secret_detection"),
            Self::Lint => write!(f, "lint"),
            Self::CodeReview => write!(f, "code_review"),
+            Self::FirmwareStatic => write!(f, "firmware_static"),
+            Self::PlcControlLogic => write!(f, "plc_control_logic"),
+            Self::MobileStatic => write!(f, "mobile_static"),
+            Self::ContainerScan => write!(f, "container_scan"),
+            Self::IcsProbe => write!(f, "ics_probe"),
        }
    }
 }
@@ -47,6 +63,8 @@ pub enum ScanRunStatus {
 #[serde(rename_all = "snake_case")]
 pub enum ScanPhase {
    ChangeDetection,
+    ArtifactIngest,
+    Classification,
    Sast,
    SbomGeneration,
    CveScanning,
@@ -55,9 +73,14 @@ pub enum ScanPhase {
    LintScanning,
    CodeReview,
    GraphBuilding,
+    FirmwareStatic,
+    PlcAnalysis,
+    MobileStatic,
+    ContainerScan,
    LlmTriage,
    IssueCreation,
    DastScanning,
+    IcsProbe,
    Completed,
 }

@@ -0,0 +1,378 @@
+//! The Werkbank job/result contract (WB-01).
+//!
+//! The shared, dependency-free vocabulary the control plane and the Werkbank
+//! execution runner agree on: what a [`Job`] is, which [`Executor`] runs it, how
+//! it moves through the queue ([`JobStatus`]), and what a [`JobResult`] carries
+//! back. Jobs are declarative — TOML on disk, JSON on the wire — and results
+//! reuse the existing scanner result types ([`Finding`], [`DastFinding`],
+//! [`SbomEntry`]) so the runner produces exactly what the control plane persists.
+//!
+//! This module is intentionally free of the `mongodb`/`axum` features so the
+//! runner can depend on `compliance-core` without pulling the server stack.
+
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::dast::DastFinding;
+use super::finding::Finding;
+use super::sbom::SbomEntry;
+
+/// The kind of dynamic-execution job.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum JobType {
+    /// Instantiate control logic on an ephemeral soft-PLC and probe it.
+    PlcProvision,
+    /// Boot a firmware image under QEMU and run dynamic checks.
+    QemuBoot,
+    /// Crawl and dynamically test a running web endpoint.
+    Dast,
+    /// Run an active penetration test against a running target.
+    Pentest,
+}
+
+/// How a runner executes a job — the CI-runner-style classification. A runner
+/// advertises exactly one; a job requires one.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Executor {
+    /// A subprocess on the runner host (dev / trusted single-node).
+    Shell,
+    /// One or more containers on the runner's Docker (default; QEMU runs here).
+    Docker,
+    /// A Pod/Job in a Kubernetes cluster (scale-out / multi-tenant).
+    K8s,
+}
+
+/// Lifecycle state of a job in the queue.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum JobStatus {
+    /// Waiting to be leased.
+    Queued,
+    /// Leased by a runner but not yet started.
+    Leased,
+    /// Executing on a runner.
+    Running,
+    /// Completed successfully.
+    Succeeded,
+    /// Completed with an error.
+    Failed,
+    /// The lease/lifetime deadline elapsed before completion.
+    Expired,
+    /// Cancelled by the control plane.
+    Cancelled,
+}
+
+impl JobStatus {
+    /// Whether the job has reached a terminal state (no further transitions).
+    pub fn is_terminal(self) -> bool {
+        matches!(
+            self,
+            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Expired | JobStatus::Cancelled
+        )
+    }
+}
+
+/// A reference to an input artifact. Resolved by the runner from a source it can
+/// reach; the blob itself never flows through the control plane (so an on-prem
+/// runner keeps customer data local). Exactly one of `blob`/`url` should be set.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InputRef {
+    /// Content-addressed blob (e.g. `sha256:…`) the runner fetches from its store.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub blob: Option<String>,
+    /// A URL the runner can reach (git repo, internal artifact store, …).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
+}
+
+impl InputRef {
+    /// A content-addressed blob reference.
+    pub fn blob(id: impl Into<String>) -> Self {
+        Self {
+            blob: Some(id.into()),
+            url: None,
+        }
+    }
+}
+
+/// Sandbox runtime knobs. Fields are executor/job-type specific and all optional;
+/// `extra` carries anything not modelled explicitly.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct JobRuntime {
+    /// Container image (Docker executor).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub image: Option<String>,
+    /// Memory cap (e.g. `512m`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memory: Option<String>,
+    /// CPU cap (e.g. `0.5`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cpus: Option<String>,
+    /// Network to join (e.g. `isolated`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub network: Option<String>,
+    /// QEMU machine type (qemu-boot).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub machine: Option<String>,
+    /// QEMU target architecture (qemu-boot).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub arch: Option<String>,
+    /// Executor-specific extras not modelled above.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub extra: BTreeMap<String, String>,
+}
+
+/// DAST collection settings for jobs that scan a web endpoint.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DastCollect {
+    /// Maximum crawl depth (kept shallow for ephemeral instances).
+    pub max_crawl_depth: u32,
+}
+
+/// What to collect from a run.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct JobCollect {
+    /// Run the industrial-protocol probe (Modbus/OPC-UA/EtherNet-IP).
+    #[serde(default)]
+    pub ics_probe: bool,
+    /// Run DAST against the provisioned/booted web endpoint.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub dast: Option<DastCollect>,
+    /// Run an active pentest.
+    #[serde(default)]
+    pub pentest: bool,
+    /// Collect an SBOM.
+    #[serde(default)]
+    pub sbom: bool,
+}
+
+/// A declarative dynamic-execution job the control plane enqueues and a Werkbank
+/// runner leases and executes.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Job {
+    /// Unique job id (assigned by the control plane on enqueue).
+    pub id: String,
+    /// What kind of job this is.
+    #[serde(rename = "type")]
+    pub job_type: JobType,
+    /// Owning tenant.
+    pub tenant: String,
+    /// The onboarded target this job tests.
+    pub target_id: String,
+    /// The executor a runner must provide to run this job.
+    pub executor: Executor,
+    /// Runner capabilities this job requires (e.g. `arch=amd64`, `kvm=true`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub labels: Vec<String>,
+    /// Hard lifetime deadline for the whole job.
+    pub timeout_secs: u64,
+    /// Named input artifacts (e.g. `program`, `firmware`), by reference.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub inputs: BTreeMap<String, InputRef>,
+    /// Sandbox runtime knobs.
+    #[serde(default)]
+    pub runtime: JobRuntime,
+    /// What to collect from the run.
+    #[serde(default)]
+    pub collect: JobCollect,
+}
+
+impl Job {
+    /// A `plc-provision` job: instantiate the control logic named `program` on an
+    /// ephemeral soft-PLC (Docker executor) and collect the ICS probe + DAST.
+    pub fn plc_provision(
+        id: impl Into<String>,
+        tenant: impl Into<String>,
+        target_id: impl Into<String>,
+        program: InputRef,
+        timeout_secs: u64,
+    ) -> Self {
+        let mut inputs = BTreeMap::new();
+        inputs.insert("program".to_string(), program);
+        Self {
+            id: id.into(),
+            job_type: JobType::PlcProvision,
+            tenant: tenant.into(),
+            target_id: target_id.into(),
+            executor: Executor::Docker,
+            labels: Vec::new(),
+            timeout_secs,
+            inputs,
+            runtime: JobRuntime::default(),
+            collect: JobCollect {
+                ics_probe: true,
+                dast: Some(DastCollect { max_crawl_depth: 2 }),
+                pentest: false,
+                sbom: false,
+            },
+        }
+    }
+}
+
+/// The outcome of running a job, posted back to the control plane. Findings and
+/// SBOM reuse the shared scanner types, so the control plane persists them
+/// unchanged. Submission is idempotent — keyed by [`JobResult::job_id`].
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct JobResult {
+    /// The job this result is for.
+    pub job_id: String,
+    /// Terminal status of the job.
+    pub status: Option<JobStatus>,
+    /// General scanner findings (e.g. ICS-probe findings).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub findings: Vec<Finding>,
+    /// DAST findings from a web-endpoint scan.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub dast_findings: Vec<DastFinding>,
+    /// SBOM components collected from the run.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub sbom: Vec<SbomEntry>,
+    /// Error message when the job failed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Captured execution log (truncated by the runner).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub logs: Option<String>,
+    /// When execution started on the runner.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at: Option<DateTime<Utc>>,
+    /// When execution finished.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at: Option<DateTime<Utc>>,
+}
+
+impl JobResult {
+    /// A successful result for a job.
+    pub fn succeeded(job_id: impl Into<String>) -> Self {
+        Self {
+            job_id: job_id.into(),
+            status: Some(JobStatus::Succeeded),
+            ..Default::default()
+        }
+    }
+
+    /// A failed result carrying an error message.
+    pub fn failed(job_id: impl Into<String>, error: impl Into<String>) -> Self {
+        Self {
+            job_id: job_id.into(),
+            status: Some(JobStatus::Failed),
+            error: Some(error.into()),
+            ..Default::default()
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn job_round_trips_through_json() {
+        let job = Job::plc_provision("job_1", "acme", "64f0aa", InputRef::blob("sha256:abc"), 180);
+        let json = serde_json::to_string(&job).expect("serialize");
+        let back: Job = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(job, back);
+        // Enum wire forms are the kebab/lowercase the contract documents.
+        assert!(json.contains("\"type\":\"plc-provision\""));
+        assert!(json.contains("\"executor\":\"docker\""));
+    }
+
+    #[test]
+    fn parses_the_design_doc_plc_provision_toml() {
+        // The exact shape from docs/DESIGN.md §5 (wrapped in a [job] table).
+        #[derive(Deserialize)]
+        struct JobFile {
+            job: Job,
+        }
+        let src = r#"
+            [job]
+            id = "job_01H"
+            type = "plc-provision"
+            tenant = "acme"
+            target_id = "64f0"
+            executor = "docker"
+            labels = ["arch=amd64"]
+            timeout_secs = 180
+
+            [job.inputs]
+            program = { blob = "sha256:deadbeef" }
+
+            [job.runtime]
+            image = "openplc:latest"
+            memory = "512m"
+            cpus = "0.5"
+            network = "isolated"
+
+            [job.collect]
+            ics_probe = true
+            dast = { max_crawl_depth = 2 }
+        "#;
+        let file: JobFile = toml::from_str(src).expect("parse job toml");
+        let job = file.job;
+        assert_eq!(job.job_type, JobType::PlcProvision);
+        assert_eq!(job.executor, Executor::Docker);
+        assert_eq!(job.labels, vec!["arch=amd64".to_string()]);
+        assert_eq!(
+            job.inputs.get("program").and_then(|i| i.blob.as_deref()),
+            Some("sha256:deadbeef")
+        );
+        assert_eq!(job.runtime.image.as_deref(), Some("openplc:latest"));
+        assert!(job.collect.ics_probe);
+        assert_eq!(job.collect.dast.map(|d| d.max_crawl_depth), Some(2));
+    }
+
+    #[test]
+    fn qemu_boot_runtime_fields_parse() {
+        #[derive(Deserialize)]
+        struct JobFile {
+            job: Job,
+        }
+        let src = r#"
+            [job]
+            id = "j2"
+            type = "qemu-boot"
+            tenant = "acme"
+            target_id = "t"
+            executor = "docker"
+            labels = ["kvm=true"]
+            timeout_secs = 600
+            [job.inputs]
+            firmware = { blob = "sha256:cafe" }
+            [job.runtime]
+            machine = "virt"
+            arch = "arm"
+            memory = "1g"
+        "#;
+        let file: JobFile = toml::from_str(src).expect("parse");
+        assert_eq!(file.job.job_type, JobType::QemuBoot);
+        assert_eq!(file.job.runtime.arch.as_deref(), Some("arm"));
+        assert_eq!(
+            file.job
+                .inputs
+                .get("firmware")
+                .and_then(|i| i.blob.as_deref()),
+            Some("sha256:cafe")
+        );
+    }
+
+    #[test]
+    fn status_terminality() {
+        assert!(JobStatus::Succeeded.is_terminal());
+        assert!(JobStatus::Expired.is_terminal());
+        assert!(!JobStatus::Queued.is_terminal());
+        assert!(!JobStatus::Running.is_terminal());
+    }
+
+    #[test]
+    fn result_constructors() {
+        assert_eq!(JobResult::succeeded("j").status, Some(JobStatus::Succeeded));
+        let f = JobResult::failed("j", "boom");
+        assert_eq!(f.status, Some(JobStatus::Failed));
+        assert_eq!(f.error.as_deref(), Some("boom"));
+    }
+}
@@ -0,0 +1,556 @@
+//! The scan-applicability matrix.
+//!
+//! Which scans are possible for a target is a function of its [`TargetType`] and
+//! which [`ArtifactKind`]s are actually present: SAST needs code, DAST needs a
+//! running URL, firmware-static analysis needs a firmware image, and so on. This
+//! module encodes that as a table — one rule set per target type — and resolves
+//! it against a concrete [`OnboardedTarget`] into a list of [`ScanOption`]s the
+//! onboarding wizard and the scan pipeline both consume.
+
+use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
+
+/// What an artifact a scan needs in order to run.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ArtifactRequirement {
+    /// Source code — a git repo or a source archive.
+    Code,
+    /// A reachable running instance (any live URL / endpoint, scheme-agnostic —
+    /// e.g. the ICS probe works off the host:port of a modbus:// or http:// ref).
+    RunningUrl,
+    /// A reachable **web** endpoint — a live URL with an http(s) scheme. DAST is
+    /// an HTTP crawler, so a modbus:// / opc.tcp:// endpoint does not satisfy it.
+    HttpUrl,
+    /// A firmware image / binary blob.
+    Firmware,
+    /// A PLC project (PLCopen XML or Structured Text).
+    Plc,
+    /// A mobile package (APK / AAB / IPA).
+    Mobile,
+    /// A container image.
+    Container,
+    /// No specific artifact required.
+    Any,
+}
+
+/// A static rule: this scan applies to a target type, needs this artifact, and
+/// defaults on/off. The rationale explains the entry to the user.
+#[derive(Debug, Clone, Copy)]
+pub struct ScanRule {
+    /// The scan this rule governs.
+    pub scan: ScanType,
+    /// Whether the scan is on by default (only when its artifact is present).
+    pub default_on: bool,
+    /// Human-readable explanation of what the scan does here.
+    pub rationale: &'static str,
+    /// The artifact the scan consumes.
+    pub requires: ArtifactRequirement,
+}
+
+impl ScanRule {
+    const fn new(
+        scan: ScanType,
+        default_on: bool,
+        rationale: &'static str,
+        requires: ArtifactRequirement,
+    ) -> Self {
+        Self {
+            scan,
+            default_on,
+            rationale,
+            requires,
+        }
+    }
+}
+
+/// A resolved scan choice for a specific target: a rule intersected with the
+/// artifacts actually present. `blocked_reason` is `Some` when the required
+/// artifact is missing.
+#[derive(Debug, Clone)]
+pub struct ScanOption {
+    /// The scan.
+    pub scan: ScanType,
+    /// Whether to pre-select the scan (false when blocked).
+    pub default_on: bool,
+    /// Why the scan is offered.
+    pub rationale: String,
+    /// The artifact kind the scan needs, if any specific one.
+    pub required_artifact: Option<ArtifactKind>,
+    /// Set when the required artifact is absent, explaining the block.
+    pub blocked_reason: Option<String>,
+}
+
+/// The SAST umbrella: every static-analysis sub-scan that runs over source code.
+fn sast_umbrella() -> Vec<ScanRule> {
+    use ArtifactRequirement::Code;
+    vec![
+        ScanRule::new(
+            ScanType::Sast,
+            true,
+            "Static analysis (Semgrep) over source",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::Sbom,
+            true,
+            "Software bill of materials from source",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::Cve,
+            true,
+            "Match dependencies against known CVEs",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::SecretDetection,
+            true,
+            "Scan source for committed secrets",
+            Code,
+        ),
+        ScanRule::new(ScanType::Lint, true, "Language linters over source", Code),
+        ScanRule::new(
+            ScanType::Gdpr,
+            true,
+            "GDPR data-handling pattern checks",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::OAuth,
+            true,
+            "OAuth misconfiguration patterns",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::Graph,
+            true,
+            "Build the code graph for impact analysis",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::CodeReview,
+            false,
+            "LLM code review over changed source",
+            Code,
+        ),
+    ]
+}
+
+/// The rule set for a target type. Scans that are never applicable to a type are
+/// simply absent (e.g. DAST is not listed for a PLC target).
+pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
+    use ArtifactRequirement::{Firmware, HttpUrl, Mobile, Plc, RunningUrl};
+    match target_type {
+        TargetType::WebApp | TargetType::BackendService => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::Dast,
+                true,
+                "Dynamic scan of the running endpoint",
+                HttpUrl,
+            ));
+            r
+        }
+        TargetType::DesktopApp => sast_umbrella(),
+        TargetType::AndroidApp | TargetType::IosApp => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::MobileStatic,
+                true,
+                "Static analysis of the mobile package (manifest, permissions, libs)",
+                Mobile,
+            ));
+            r
+        }
+        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::FirmwareStatic,
+                true,
+                "Unpack and statically analyze the firmware image",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Sbom,
+                true,
+                "SBOM from the firmware image (binwalk / tramiton)",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Cve,
+                true,
+                "Match firmware components against known CVEs",
+                Firmware,
+            ));
+            r
+        }
+        TargetType::EmbeddedLinuxYocto => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::FirmwareStatic,
+                true,
+                "EMBA / binwalk static analysis of the image",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Sbom,
+                true,
+                "SBOM from image layers / recipes",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Cve,
+                true,
+                "Match image components against known CVEs",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Dast,
+                false,
+                "Dynamic scan of exposed network services (if any)",
+                HttpUrl,
+            ));
+            r
+        }
+        TargetType::PlcSps => {
+            // A PLC/SPS device is a composite: the control application *and* the
+            // device it runs on (firmware/OS + reachable runtime services). The
+            // control-logic scan runs on the PLC project; the firmware and DAST
+            // scans light up only when a firmware image / running endpoint is
+            // attached (e.g. a CODESYS runtime on a Yocto image with WebVisu).
+            // Firmware-image SBOM/CVE *execution* is shared with the firmware
+            // families and tracked in #151/#128; DAST over a WebVisu/OPC-UA
+            // endpoint uses the existing DAST path.
+            vec![
+                ScanRule::new(
+                    ScanType::PlcControlLogic,
+                    true,
+                    "Control-logic security rules over the PLC program",
+                    Plc,
+                ),
+                // Device-level scans are offered but opt-in (default-off): they
+                // apply only when a firmware image is attached, and firmware-image
+                // SBOM/CVE *execution* is shared with the firmware families and
+                // still landing (#151/#128), so they must not silently auto-run.
+                ScanRule::new(
+                    ScanType::FirmwareStatic,
+                    false,
+                    "Static analysis of the device firmware image (OS + runtime)",
+                    Firmware,
+                ),
+                ScanRule::new(
+                    ScanType::Sbom,
+                    false,
+                    "SBOM from the device firmware image (OS packages + CODESYS runtime)",
+                    Firmware,
+                ),
+                ScanRule::new(
+                    ScanType::Cve,
+                    false,
+                    "Match device firmware components against known CVEs",
+                    Firmware,
+                ),
+                ScanRule::new(
+                    ScanType::Dast,
+                    false,
+                    "Dynamic scan of the running device (WebVisu / exposed services)",
+                    HttpUrl,
+                ),
+                ScanRule::new(
+                    ScanType::IcsProbe,
+                    false,
+                    "Probe the running device over industrial protocols (Modbus/TCP, …)",
+                    RunningUrl,
+                ),
+            ]
+        }
+    }
+}
+
+/// Whether an active penetration test is applicable to this target type.
+///
+/// Pentest runs as its own session (not a [`ScanType`] scan) and needs a
+/// reachable running target, so it is offered only for the network-reachable
+/// families.
+pub fn supports_pentest(target_type: TargetType) -> bool {
+    matches!(
+        target_type,
+        TargetType::WebApp
+            | TargetType::BackendService
+            | TargetType::AndroidApp
+            | TargetType::IosApp
+            | TargetType::EmbeddedLinuxYocto
+            // A PLC/SPS device exposes reachable runtime services (WebVisu, OPC UA,
+            // the CODESYS programming protocol), so an active pentest applies.
+            | TargetType::PlcSps
+    )
+}
+
+/// The representative artifact kind a requirement is satisfied by.
+fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
+    match req {
+        ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
+        ArtifactRequirement::RunningUrl | ArtifactRequirement::HttpUrl => {
+            Some(ArtifactKind::LiveUrl)
+        }
+        ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
+        ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
+        ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
+        ArtifactRequirement::Container => Some(ArtifactKind::ContainerImage),
+        ArtifactRequirement::Any => None,
+    }
+}
+
+/// Whether a live-URL reference is an http(s) web endpoint (vs. an industrial
+/// endpoint like `modbus://` / `opc.tcp://`, which DAST cannot crawl).
+fn is_http_url(source_ref: &str) -> bool {
+    let s = source_ref.trim();
+    s.starts_with("http://") || s.starts_with("https://")
+}
+
+/// Whether the target carries an artifact that satisfies the requirement.
+fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
+    match req {
+        ArtifactRequirement::Code => target.code_artifact().is_some(),
+        ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
+        ArtifactRequirement::HttpUrl => target
+            .artifacts
+            .iter()
+            .any(|a| a.kind == ArtifactKind::LiveUrl && is_http_url(&a.source_ref)),
+        ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
+        // A PLC project artifact, or a code artifact (git repo / source archive)
+        // holding the control logic as PLCopen XML / ST exports — the common way
+        // CODESYS projects are version-controlled.
+        ArtifactRequirement::Plc => {
+            target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
+        }
+        ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
+        ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
+        ArtifactRequirement::Any => true,
+    }
+}
+
+/// Resolve the matrix for a concrete target into the scans it can run, marking
+/// any whose required artifact is missing as blocked.
+pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
+    rules_for(target.target_type)
+        .into_iter()
+        .map(|rule| {
+            let satisfied = requirement_satisfied(rule.requires, target);
+            let required_artifact = representative_kind(rule.requires);
+            let blocked_reason = if satisfied {
+                None
+            } else if rule.requires == ArtifactRequirement::HttpUrl {
+                // A live URL may be present but non-HTTP (e.g. modbus://): be
+                // specific so the user knows DAST needs a web endpoint.
+                Some("no http(s) live URL — DAST needs a web endpoint".to_string())
+            } else {
+                Some(match required_artifact {
+                    Some(kind) => format!("no {kind} artifact provided"),
+                    None => "required artifact missing".to_string(),
+                })
+            };
+            ScanOption {
+                scan: rule.scan,
+                default_on: rule.default_on && satisfied,
+                rationale: rule.rationale.to_string(),
+                required_artifact,
+                blocked_reason,
+            }
+        })
+        .collect()
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use crate::models::{Artifact, PlcFormat};
+
+    fn target_with(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("t".to_string(), target_type);
+        t.artifacts = artifacts;
+        t
+    }
+
+    fn option<'a>(opts: &'a [ScanOption], scan: ScanType) -> Option<&'a ScanOption> {
+        opts.iter().find(|o| o.scan == scan)
+    }
+
+    #[test]
+    fn webapp_with_code_and_url_offers_sast_and_dast() {
+        let t = target_with(
+            TargetType::WebApp,
+            vec![
+                Artifact::git_repo("u", "main"),
+                Artifact::live_url("http://x"),
+            ],
+        );
+        let opts = applicable_scans(&t);
+        let sast = option(&opts, ScanType::Sast).expect("sast offered");
+        assert!(sast.default_on && sast.blocked_reason.is_none());
+        let dast = option(&opts, ScanType::Dast).expect("dast offered");
+        assert!(dast.default_on && dast.blocked_reason.is_none());
+    }
+
+    #[test]
+    fn webapp_without_url_blocks_dast() {
+        let t = target_with(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        let opts = applicable_scans(&t);
+        let dast = option(&opts, ScanType::Dast).expect("dast listed");
+        assert!(!dast.default_on);
+        assert!(dast.blocked_reason.is_some());
+        assert_eq!(dast.required_artifact, Some(ArtifactKind::LiveUrl));
+    }
+
+    #[test]
+    fn firmware_offers_firmware_static_and_not_dast() {
+        let t = target_with(
+            TargetType::FirmwareBareMetal,
+            vec![Artifact::firmware_image("fw.bin")],
+        );
+        let opts = applicable_scans(&t);
+        let fw = option(&opts, ScanType::FirmwareStatic).expect("firmware static offered");
+        assert!(fw.default_on && fw.blocked_reason.is_none());
+        assert!(option(&opts, ScanType::Dast).is_none());
+    }
+
+    #[test]
+    fn plc_control_logic_is_default_on_and_device_scans_block_without_artifacts() {
+        // A PLC project alone: control-logic runs; the device-level scans are
+        // offered but blocked until a firmware image / running endpoint is added.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
+        );
+        let opts = applicable_scans(&t);
+        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert!(plc.default_on && plc.blocked_reason.is_none());
+        for scan in [ScanType::FirmwareStatic, ScanType::Sbom, ScanType::Cve] {
+            let o = option(&opts, scan).expect("device scan offered");
+            assert!(
+                !o.default_on,
+                "{scan} must not pre-select without a firmware image"
+            );
+            assert!(o.blocked_reason.is_some());
+        }
+        let dast = option(&opts, ScanType::Dast).expect("dast offered");
+        assert!(!dast.default_on);
+        assert!(dast.blocked_reason.is_some());
+    }
+
+    #[test]
+    fn plc_control_logic_is_satisfied_by_a_git_repo() {
+        // A CODESYS project version-controlled in git (PLCopen XML / ST exports),
+        // no uploaded PlcProject artifact.
+        let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
+        let opts = applicable_scans(&t);
+        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert!(
+            plc.default_on && plc.blocked_reason.is_none(),
+            "a git repo should satisfy PLC control-logic"
+        );
+    }
+
+    #[test]
+    fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
+        // A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![
+                Artifact::plc_project("p.xml", PlcFormat::PlcopenXml),
+                Artifact::firmware_image("device.img"),
+                Artifact::live_url("http://plc.local/webvisu"),
+            ],
+        );
+        let opts = applicable_scans(&t);
+        for scan in [
+            ScanType::PlcControlLogic,
+            ScanType::FirmwareStatic,
+            ScanType::Sbom,
+            ScanType::Cve,
+        ] {
+            let o = option(&opts, scan).expect("scan offered");
+            assert!(o.blocked_reason.is_none(), "{scan} should be unblocked");
+        }
+        // Control-logic auto-runs; the device-level scans are unblocked but opt-in
+        // (default-off) until firmware-image execution lands (#151/#128).
+        assert!(option(&opts, ScanType::PlcControlLogic).unwrap().default_on);
+        assert!(!option(&opts, ScanType::Sbom).unwrap().default_on);
+        assert!(!option(&opts, ScanType::Dast).unwrap().default_on);
+        assert!(option(&opts, ScanType::Dast)
+            .unwrap()
+            .blocked_reason
+            .is_none());
+    }
+
+    #[test]
+    fn plc_with_modbus_url_offers_ics_probe_but_blocks_dast() {
+        // A soft-PLC reachable only over Modbus/TCP (no WebVisu). The ICS probe
+        // is applicable (it works off host:port), but DAST — an HTTP crawler —
+        // must be blocked so it isn't offered/run against a non-web endpoint.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![Artifact::live_url("modbus://plc-sim:502")],
+        );
+        let opts = applicable_scans(&t);
+        let ics = option(&opts, ScanType::IcsProbe).expect("ics probe offered");
+        assert!(
+            ics.blocked_reason.is_none(),
+            "ICS probe should be unblocked for a modbus:// endpoint"
+        );
+        assert!(!ics.default_on, "ICS probe stays opt-in (default-off)");
+        let dast = option(&opts, ScanType::Dast).expect("dast listed");
+        assert!(
+            dast.blocked_reason.is_some(),
+            "DAST must be blocked without an http(s) endpoint"
+        );
+        assert!(!dast.default_on);
+    }
+
+    #[test]
+    fn plc_with_http_webvisu_offers_both_dast_and_ics_probe() {
+        // A PLC exposing a WebVisu over HTTP: both DAST (web) and the ICS probe
+        // (OT ports on the same host) are applicable.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![Artifact::live_url("http://plc.local/webvisu")],
+        );
+        let opts = applicable_scans(&t);
+        assert!(option(&opts, ScanType::Dast)
+            .expect("dast offered")
+            .blocked_reason
+            .is_none());
+        assert!(option(&opts, ScanType::IcsProbe)
+            .expect("ics probe offered")
+            .blocked_reason
+            .is_none());
+    }
+
+    #[test]
+    fn pentest_support_matches_reachable_families() {
+        assert!(supports_pentest(TargetType::WebApp));
+        assert!(supports_pentest(TargetType::BackendService));
+        assert!(supports_pentest(TargetType::EmbeddedLinuxYocto));
+        // A PLC/SPS device is network-reachable (WebVisu / OPC UA / 11740).
+        assert!(supports_pentest(TargetType::PlcSps));
+        assert!(!supports_pentest(TargetType::FirmwareBareMetal));
+        assert!(!supports_pentest(TargetType::DesktopApp));
+    }
+
+    #[test]
+    fn every_target_type_has_at_least_one_rule() {
+        for tt in [
+            TargetType::WebApp,
+            TargetType::BackendService,
+            TargetType::DesktopApp,
+            TargetType::AndroidApp,
+            TargetType::IosApp,
+            TargetType::FirmwareBareMetal,
+            TargetType::FirmwareRtos,
+            TargetType::EmbeddedLinuxYocto,
+            TargetType::PlcSps,
+        ] {
+            assert!(!rules_for(tt).is_empty(), "{tt} has no rules");
+        }
+    }
+}
@@ -0,0 +1,51 @@
+//! The target-classification port.
+//!
+//! A [`TargetClassifier`] inspects a target's artifacts (and optionally their
+//! ingested working directories) and proposes one or more [`ClassifierVerdict`]s
+//! — a target type, a confidence, and the facts the decision rested on. Concrete
+//! classifiers live in the agent (language/build-system fingerprinting, a
+//! firmware detector backed by tramiton, etc.); a registry merges and ranks
+//! their verdicts. This mirrors the [`crate::traits::Scanner`] port so the two
+//! read the same way.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use crate::error::CoreError;
+use crate::models::{Artifact, DetectedFact, TargetType};
+
+/// Everything a classifier needs to reason about a target.
+pub struct ClassificationInput<'a> {
+    /// The artifacts declared for the target.
+    pub artifacts: &'a [Artifact],
+    /// Ingested working paths, keyed by [`Artifact::id`]. Absent for artifacts
+    /// with no on-disk form (e.g. a live URL).
+    pub working_paths: &'a HashMap<String, PathBuf>,
+    /// Free-form description of the target, if provided.
+    pub description: Option<&'a str>,
+}
+
+/// A single classifier's proposal for a target.
+pub struct ClassifierVerdict {
+    /// The proposed target type.
+    pub target_type: TargetType,
+    /// Confidence in `[0.0, 1.0]`.
+    pub confidence: f32,
+    /// Facts that informed the proposal.
+    pub facts: Vec<DetectedFact>,
+    /// Human-readable explanation.
+    pub rationale: String,
+}
+
+/// A source of target-type classification.
+#[allow(async_fn_in_trait)]
+pub trait TargetClassifier: Send + Sync {
+    /// Stable identifier for this classifier (recorded in `detected_by`).
+    fn name(&self) -> &str;
+
+    /// Propose zero or more ranked verdicts for the given input.
+    async fn classify(
+        &self,
+        input: &ClassificationInput<'_>,
+    ) -> Result<Vec<ClassifierVerdict>, CoreError>;
+}
@@ -0,0 +1,45 @@
+//! The compliance-controls provider port.
+//!
+//! The mapping engine turns findings into compliance status against a corpus of
+//! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
+//! a tenant-owned RAG of atomic controls derived from laws
+//! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
+//! source so the mapping engine does not hardcode a catalog.
+
+use crate::error::CoreError;
+use crate::models::ComplianceFramework;
+
+/// A control retrieved from a controls corpus.
+#[derive(Debug, Clone)]
+pub struct Control {
+    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
+    pub id: String,
+    /// The framework this control belongs to.
+    pub framework: ComplianceFramework,
+    /// Short human-readable title.
+    pub title: String,
+    /// The control text / requirement.
+    pub text: String,
+    /// Free-form source reference (catalog name, law citation, ...).
+    pub source: Option<String>,
+}
+
+/// A query for relevant controls.
+pub struct ControlQuery<'a> {
+    /// Frameworks in scope for the target.
+    pub frameworks: &'a [ComplianceFramework],
+    /// Free-text describing what to map (a finding summary, a component, ...).
+    pub context: &'a str,
+    /// Maximum number of controls to return.
+    pub limit: usize,
+}
+
+/// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
+#[allow(async_fn_in_trait)]
+pub trait ControlsProvider: Send + Sync {
+    /// Stable identifier for this provider.
+    fn name(&self) -> &str;
+
+    /// Retrieve the controls most relevant to the query.
+    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
+}
@@ -0,0 +1,58 @@
+//! The external-evidence provider port.
+//!
+//! A sibling product (tramiton, for firmware) may already hold authoritative
+//! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
+//! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
+//! reproducible-build lock, an attestation — instead of recomputing it. The key
+//! used to match is the artifact content digest (a firmware sha256, which equals
+//! [`crate::models::Artifact::content_hash`]).
+//!
+//! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
+//! client later) plus a deterministic mock for tests, so nothing here depends on
+//! an external binary.
+
+use std::path::Path;
+
+use crate::error::CoreError;
+use crate::models::{Artifact, ExternalSystem};
+
+/// A single reconcilable evidence document fetched from a sibling product.
+#[derive(Debug, Clone)]
+pub struct EvidenceDocument {
+    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
+    pub kind: String,
+    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
+    pub format: String,
+    /// The raw document payload.
+    pub content: String,
+}
+
+/// The evidence a provider could return for a target's artifact.
+#[derive(Debug, Clone, Default)]
+pub struct ReconciledEvidence {
+    /// The sibling's project identifier, if resolved.
+    pub project_id: Option<String>,
+    /// The subject content digest the evidence pertains to.
+    pub subject_sha256: Option<String>,
+    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
+    pub documents: Vec<EvidenceDocument>,
+}
+
+/// A source of externally-held, reconcilable evidence for an artifact.
+#[allow(async_fn_in_trait)]
+pub trait EvidenceProvider: Send + Sync {
+    /// Which sibling product this provider integrates.
+    fn system(&self) -> ExternalSystem;
+
+    /// Whether this provider can handle the given artifact + working path
+    /// (e.g. tramiton handles firmware images / embedded source trees).
+    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
+
+    /// Reconcile existing evidence for the artifact, keyed by its content digest.
+    /// Returns `Ok(None)` when the provider has nothing for this artifact.
+    async fn reconcile(
+        &self,
+        artifact: &Artifact,
+        working_path: Option<&Path>,
+    ) -> Result<Option<ReconciledEvidence>, CoreError>;
+}
@@ -1,10 +1,16 @@
+pub mod classifier;
+pub mod controls;
 pub mod dast_agent;
+pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;

+pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
+pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};
@@ -10,8 +10,10 @@ pub enum Route {
    #[layout(AppShell)]
        #[route("/")]
        OverviewPage {},
-        #[route("/repositories")]
-        RepositoriesPage {},
+        #[route("/targets")]
+        TargetsPage {},
+        #[route("/onboard")]
+        OnboardingPage {},
        #[route("/findings")]
        FindingsPage {},
        #[route("/findings/:id")]
@@ -44,6 +46,8 @@ pub enum Route {
        PentestSessionPage { session_id: String },
        #[route("/mcp-servers")]
        McpServersPage {},
+        #[route("/mcp-tokens")]
+        McpTokensPage {},
 }

 const FAVICON: Asset = asset!("/assets/favicon.svg");
@@ -4,8 +4,9 @@ use dioxus_free_icons::Icon;

 use crate::app::Route;
 use crate::infrastructure::dast::fetch_dast_targets;
+use crate::infrastructure::onboarding::fetch_targets;
 use crate::infrastructure::pentest::{create_pentest_session_wizard, lookup_repo_by_url};
-use crate::infrastructure::repositories::{fetch_repositories, fetch_ssh_public_key};
+use crate::infrastructure::repositories::fetch_ssh_public_key;

 const DISCLAIMER_TEXT: &str = "I confirm that I have authorization to perform security testing \
 against the specified target. I understand that penetration testing may cause disruption to the \
@@ -39,7 +40,7 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
    let mut show_target_dropdown = use_signal(|| false);
    let mut show_repo_dropdown = use_signal(|| false);
    let existing_targets = use_resource(|| async { fetch_dast_targets().await.ok() });
-    let existing_repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let existing_repos = use_resource(|| async { fetch_targets().await.ok() });

    // SSH key state for private repos
    let mut ssh_public_key = use_signal(String::new);
@@ -211,7 +212,25 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
            Some(Some(data)) => data
                .data
                .iter()
-                .map(|r| (r.git_url.clone(), r.name.clone()))
+                .filter_map(|t| {
+                    let name = t
+                        .get("name")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or_default()
+                        .to_string();
+                    let git_url = t
+                        .get("artifacts")
+                        .and_then(|a| a.as_array())
+                        .and_then(|arr| {
+                            arr.iter().find(|a| {
+                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
+                            })
+                        })
+                        .and_then(|a| a.get("source_ref"))
+                        .and_then(|s| s.as_str())?
+                        .to_string();
+                    Some((git_url, name))
+                })
                .collect(),
            _ => Vec::new(),
        }
@@ -24,10 +24,15 @@ pub fn Sidebar() -> Element {
            icon: rsx! { Icon { icon: BsSpeedometer2, width: 18, height: 18 } },
        },
        NavItem {
-            label: "Repositories",
-            route: Route::RepositoriesPage {},
+            label: "Targets",
+            route: Route::TargetsPage {},
            icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
        },
+        NavItem {
+            label: "Onboard",
+            route: Route::OnboardingPage {},
+            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
+        },
        NavItem {
            label: "Findings",
            route: Route::FindingsPage {},
@@ -19,10 +19,6 @@ impl Database {
        Ok(Self { inner: db })
    }

-    pub fn repositories(&self) -> Collection<TrackedRepository> {
-        self.inner.collection("repositories")
-    }
-
    pub fn findings(&self) -> Collection<Finding> {
        self.inner.collection("findings")
    }
@@ -0,0 +1,90 @@
+//! Server-functions for the MCP-tokens management UI.
+//!
+//! These wrap the agent's `/api/v1/mcp-tokens` CRUD endpoints. The raw
+//! token returned by `create_mcp_token` is only visible at creation
+//! time — the agent's storage never holds the plaintext.
+
+use dioxus::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct McpTokenView {
+    pub id: String,
+    pub name: String,
+    pub token_prefix: String,
+    pub created_by: String,
+    pub created_at: serde_json::Value,
+    #[serde(default)]
+    pub last_used_at: Option<serde_json::Value>,
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct McpTokensListResponse {
+    pub data: Vec<McpTokenView>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct CreateMcpTokenResponse {
+    /// Raw token. Shown ONCE — the user must copy it now.
+    pub token: String,
+    pub view: McpTokenView,
+}
+
+#[server]
+pub async fn fetch_mcp_tokens() -> Result<McpTokensListResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get("/api/v1/mcp-tokens")
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: McpTokensListResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+#[server]
+pub async fn create_mcp_token(name: String) -> Result<CreateMcpTokenResponse, ServerFnError> {
+    if name.trim().is_empty() {
+        return Err(ServerFnError::new("Name is required"));
+    }
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/mcp-tokens")
+        .await?
+        .json(&serde_json::json!({ "name": name.trim() }))
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to create token: {body}"
+        )));
+    }
+    let body: CreateMcpTokenResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+#[server]
+pub async fn revoke_mcp_token(id: String) -> Result<(), ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::DELETE,
+        &format!("/api/v1/mcp-tokens/{id}"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to revoke token: {body}"
+        )));
+    }
+    Ok(())
+}
@@ -8,7 +8,9 @@ pub mod graph;
 pub mod help_chat;
 pub mod issues;
 pub mod mcp;
+pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;
@@ -0,0 +1,288 @@
+//! Server functions for the onboarding wizard — proxy to the agent's
+//! `/api/v1/targets` endpoints.
+
+use dioxus::prelude::*;
+use serde::{Deserialize, Serialize};
+
+/// One artifact the wizard collects for a target.
+#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
+pub struct ArtifactInputDto {
+    pub kind: String,
+    pub source_ref: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plc_format: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TargetsResponse {
+    pub data: Vec<serde_json::Value>,
+    pub total: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TargetResponse {
+    pub data: serde_json::Value,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ApplicableScansData {
+    #[serde(default)]
+    pub scans: Vec<serde_json::Value>,
+    #[serde(default)]
+    pub pentest_supported: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ApplicableScansResponse {
+    pub data: ApplicableScansData,
+}
+
+/// Validate a target name. The name is used as the clone directory downstream,
+/// so it must be a single safe segment (no slashes) and free of stray spaces.
+pub fn validate_target_name(name: &str) -> Option<String> {
+    let n = name.trim();
+    if n.is_empty() {
+        return Some("Enter a name".to_string());
+    }
+    if name != n {
+        return Some("Remove the leading/trailing spaces".to_string());
+    }
+    if n.contains('/') || n.contains('\\') {
+        return Some("No slashes — the name becomes a folder (e.g. stm32f411-blinky)".to_string());
+    }
+    None
+}
+
+/// Client-side validation of an artifact reference for its kind. Returns an
+/// error message when the value is obviously wrong for its category, so the
+/// wizard / editor can flag it up front instead of the scan discovering it.
+pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
+    let s = source_ref;
+    if s.trim().is_empty() {
+        return Some("Cannot be empty".to_string());
+    }
+    if s != s.trim() {
+        return Some("Remove the leading/trailing spaces".to_string());
+    }
+    let no_space = !s.contains(char::is_whitespace);
+    match kind {
+        "git_repo" => {
+            let looks_git = s.starts_with("https://")
+                || s.starts_with("http://")
+                || s.starts_with("ssh://")
+                || s.starts_with("git://")
+                || (s.contains('@') && s.contains(':'));
+            (!(looks_git && no_space))
+                .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
+        }
+        "live_url" => {
+            // http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
+            // devices probed by the ICS probe (e.g. modbus://plc:502).
+            let ok = (s.starts_with("https://")
+                || s.starts_with("http://")
+                || s.starts_with("modbus://")
+                || s.starts_with("opc.tcp://"))
+                && no_space;
+            (!ok).then(|| {
+                "Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
+            })
+        }
+        "container_image" => {
+            (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
+        }
+        "source_archive" | "firmware_image" | "mobile_package" | "plc_project" => {
+            (!no_space).then(|| "Enter a path or URL (no spaces)".to_string())
+        }
+        // plaintext_description (and anything unknown): accept free-form text.
+        _ => None,
+    }
+}
+
+/// List onboarded targets.
+#[server]
+pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get("/api/v1/targets")
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Create a target with the collected artifacts.
+#[server]
+pub async fn create_target(
+    name: String,
+    target_type: String,
+    description: Option<String>,
+    artifacts: Vec<ArtifactInputDto>,
+) -> Result<TargetResponse, ServerFnError> {
+    let body = serde_json::json!({
+        "name": name,
+        "target_type": target_type,
+        "description": description,
+        "artifacts": artifacts,
+    });
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
+        .await?
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Upload a file artifact (PLC project, firmware image, source archive, mobile
+/// package) to a target — proxied to the agent as multipart.
+#[server]
+pub async fn upload_target_artifact(
+    id: String,
+    kind: String,
+    plc_format: Option<String>,
+    filename: String,
+    bytes: Vec<u8>,
+) -> Result<TargetResponse, ServerFnError> {
+    let mut form = reqwest::multipart::Form::new().text("kind", kind).part(
+        "file",
+        reqwest::multipart::Part::bytes(bytes).file_name(filename),
+    );
+    if let Some(pf) = plc_format {
+        form = form.text("plc_format", pf);
+    }
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/artifacts/upload"),
+    )
+    .await?
+    .multipart(form)
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Update a target's name / type / artifacts (dashboard editor).
+#[server]
+pub async fn update_target(
+    id: String,
+    name: Option<String>,
+    target_type: Option<String>,
+    artifacts: Option<Vec<ArtifactInputDto>>,
+) -> Result<TargetResponse, ServerFnError> {
+    let mut body = serde_json::Map::new();
+    if let Some(n) = name {
+        body.insert("name".to_string(), serde_json::json!(n));
+    }
+    if let Some(t) = target_type {
+        body.insert("target_type".to_string(), serde_json::json!(t));
+    }
+    if let Some(a) = artifacts {
+        body.insert(
+            "artifacts".to_string(),
+            serde_json::to_value(a).map_err(|e| ServerFnError::new(e.to_string()))?,
+        );
+    }
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::PATCH,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .json(&serde_json::Value::Object(body))
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Enable specific opt-in scans on a target by setting `scan_config.enabled_scans`.
+/// `scans` are serde scan-type names (lowercase, no underscores — e.g. `icsprobe`).
+#[server]
+pub async fn enable_target_scans(
+    id: String,
+    scans: Vec<String>,
+) -> Result<TargetResponse, ServerFnError> {
+    let body = serde_json::json!({ "scan_config": { "enabled_scans": scans } });
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::PATCH,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .json(&body)
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Run kind-based classification on a target.
+#[server]
+pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/detect"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Fetch the scan-applicability matrix for a target.
+#[server]
+pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Delete a target (and cascade its findings / SBOM / scan runs / CVE alerts).
+#[server]
+pub async fn delete_target(id: String) -> Result<serde_json::Value, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::DELETE,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Trigger a scan for a target.
+#[server]
+pub async fn trigger_target_scan(id: String) -> Result<serde_json::Value, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/scan"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
@@ -1,145 +1,10 @@
+//! The agent's SSH deploy public key — shown so a read-only deploy key can be
+//! added to private git targets. (The legacy repositories CRUD moved to the
+//! unified onboarding/targets API.)
+
 use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::TrackedRepository;
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct RepositoryListResponse {
-    pub data: Vec<TrackedRepository>,
-    pub total: Option<u64>,
-    pub page: Option<u64>,
-}
-
-#[server]
-pub async fn fetch_repositories(page: u64) -> Result<RepositoryListResponse, ServerFnError> {
-    let path = format!("/api/v1/repositories?page={page}&limit=20");
-    let resp = super::agent_client::agent_get(&path)
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: RepositoryListResponse = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    Ok(body)
-}
-
-#[server]
-pub async fn add_repository(
-    name: String,
-    git_url: String,
-    default_branch: String,
-    auth_token: Option<String>,
-    auth_username: Option<String>,
-    tracker_type: Option<String>,
-    tracker_owner: Option<String>,
-    tracker_repo: Option<String>,
-    tracker_token: Option<String>,
-) -> Result<(), ServerFnError> {
-    let mut body = serde_json::json!({
-        "name": name,
-        "git_url": git_url,
-        "default_branch": default_branch,
-    });
-    if let Some(token) = auth_token.filter(|t| !t.is_empty()) {
-        body["auth_token"] = serde_json::Value::String(token);
-    }
-    if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
-        body["auth_username"] = serde_json::Value::String(username);
-    }
-    if let Some(tt) = tracker_type.filter(|t| !t.is_empty()) {
-        body["tracker_type"] = serde_json::Value::String(tt);
-    }
-    if let Some(to) = tracker_owner.filter(|t| !t.is_empty()) {
-        body["tracker_owner"] = serde_json::Value::String(to);
-    }
-    if let Some(tr) = tracker_repo.filter(|t| !t.is_empty()) {
-        body["tracker_repo"] = serde_json::Value::String(tr);
-    }
-    if let Some(tk) = tracker_token.filter(|t| !t.is_empty()) {
-        body["tracker_token"] = serde_json::Value::String(tk);
-    }
-
-    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/repositories")
-        .await?
-        .json(&body)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to add repository: {body}"
-        )));
-    }
-
-    Ok(())
-}
-
-#[server]
-pub async fn update_repository(
-    repo_id: String,
-    name: Option<String>,
-    default_branch: Option<String>,
-    auth_token: Option<String>,
-    auth_username: Option<String>,
-    tracker_type: Option<String>,
-    tracker_owner: Option<String>,
-    tracker_repo: Option<String>,
-    tracker_token: Option<String>,
-    scan_schedule: Option<String>,
-) -> Result<(), ServerFnError> {
-    let mut body = serde_json::Map::new();
-    if let Some(v) = name.filter(|s| !s.is_empty()) {
-        body.insert("name".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = default_branch.filter(|s| !s.is_empty()) {
-        body.insert("default_branch".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = auth_token {
-        body.insert("auth_token".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = auth_username {
-        body.insert("auth_username".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_type {
-        body.insert("tracker_type".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_owner {
-        body.insert("tracker_owner".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_repo {
-        body.insert("tracker_repo".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_token {
-        body.insert("tracker_token".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = scan_schedule {
-        body.insert("scan_schedule".into(), serde_json::Value::String(v));
-    }
-
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::PATCH,
-        &format!("/api/v1/repositories/{repo_id}"),
-    )
-    .await?
-    .json(&body)
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        let text = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to update repository: {text}"
-        )));
-    }
-
-    Ok(())
-}

+/// Fetch the agent's SSH deploy public key.
 #[server]
 pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
    let resp = super::agent_client::agent_get("/api/v1/settings/ssh-public-key")
@@ -163,86 +28,3 @@ pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
        .unwrap_or("")
        .to_string())
 }
-
-#[server]
-pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::DELETE,
-        &format!("/api/v1/repositories/{repo_id}"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to delete repository: {body}"
-        )));
-    }
-
-    Ok(())
-}
-
-#[server]
-pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
-    super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/repositories/{repo_id}/scan"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(())
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct WebhookConfigResponse {
-    pub webhook_secret: Option<String>,
-    pub tracker_type: String,
-}
-
-#[server]
-pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
-    let resp =
-        super::agent_client::agent_get(&format!("/api/v1/repositories/{repo_id}/webhook-config"))
-            .await?
-            .send()
-            .await
-            .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: WebhookConfigResponse = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    Ok(body)
-}
-
-/// Check if a repository has any running scans
-#[server]
-pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {
-    let resp = super::agent_client::agent_get("/api/v1/scan-runs?page=1&limit=1")
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: serde_json::Value = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    // Check if the most recent scan for this repo is still running
-    if let Some(scans) = body.get("data").and_then(|d| d.as_array()) {
-        for scan in scans {
-            let scan_repo = scan.get("repo_id").and_then(|v| v.as_str()).unwrap_or("");
-            let status = scan.get("status").and_then(|v| v.as_str()).unwrap_or("");
-            if scan_repo == repo_id && status == "running" {
-                return Ok(true);
-            }
-        }
-    }
-
-    Ok(false)
-}
@@ -1,3 +1,4 @@
+use axum::extract::DefaultBodyLimit;
 use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
@@ -66,6 +67,9 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                // Webhook proxy: forward to agent (no auth required)
                .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                .serve_dioxus_application(ServeConfig::new(), app)
+                // Allow large artifact uploads through the upload server function
+                // (PLC .projectarchive, firmware, mobile) — default is 2 MiB.
+                .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
                .layer(Extension(PendingOAuthStore::default()))
                .layer(middleware::from_fn(require_auth))
                .layer(Extension(server_state))
@@ -2,11 +2,11 @@ use dioxus::prelude::*;

 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::repositories::fetch_repositories;
+use crate::infrastructure::onboarding::fetch_targets;

 #[component]
 pub fn ChatIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let repos = use_resource(|| async { fetch_targets().await.ok() });

    rsx! {
        PageHeader {
@@ -28,10 +28,32 @@ pub fn ChatIndexPage() -> Element {
                        div { class: "graph-index-grid",
                            for repo in repo_list {
                                {
-                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
-                                    let url = repo.git_url.clone();
-                                    let branch = repo.default_branch.clone();
+                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let url = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find(|a| {
+                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
+                                            })
+                                        })
+                                        .and_then(|a| a.get("source_ref"))
+                                        .and_then(|s| s.as_str())
+                                        .unwrap_or_default()
+                                        .to_string();
+                                    let branch = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find_map(|a| {
+                                                a.get("git")
+                                                    .and_then(|g| g.get("default_branch"))
+                                                    .and_then(|b| b.as_str())
+                                            })
+                                        })
+                                        .unwrap_or("main")
+                                        .to_string();
                                    rsx! {
                                        Link {
                                            to: Route::ChatPage { repo_id },
@@ -20,7 +20,7 @@ pub fn FindingsPage() -> Element {
    let mut selected_ids = use_signal(Vec::<String>::new);

    let repos = use_resource(|| async {
-        crate::infrastructure::repositories::fetch_repositories(1)
+        crate::infrastructure::onboarding::fetch_targets()
            .await
            .ok()
    });
@@ -86,14 +86,14 @@ pub fn FindingsPage() -> Element {
            }
            select {
                onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                option { value: "", "All Repositories" }
+                option { value: "", "All Targets" }
                {
                    match &*repos.read() {
                        Some(Some(resp)) => rsx! {
-                            for repo in &resp.data {
+                            for t in &resp.data {
                                {
-                                    let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
+                                    let id = t.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = t.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                    rsx! {
                                        option { value: "{id}", "{name}" }
                                    }
@@ -2,11 +2,11 @@ use dioxus::prelude::*;

 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::repositories::fetch_repositories;
+use crate::infrastructure::onboarding::fetch_targets;

 #[component]
 pub fn GraphIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let repos = use_resource(|| async { fetch_targets().await.ok() });

    rsx! {
        PageHeader {
@@ -28,27 +28,34 @@ pub fn GraphIndexPage() -> Element {
                        div { class: "graph-index-grid",
                            for repo in repo_list {
                                {
-                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
-                                    let url = repo.git_url.clone();
-                                    let branch = repo.default_branch.clone();
-                                    let findings = repo.findings_count;
+                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let url = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find(|a| {
+                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
+                                            })
+                                        })
+                                        .and_then(|a| a.get("source_ref"))
+                                        .and_then(|s| s.as_str())
+                                        .unwrap_or_default()
+                                        .to_string();
+                                    let branch = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find_map(|a| {
+                                                a.get("git")
+                                                    .and_then(|g| g.get("default_branch"))
+                                                    .and_then(|b| b.as_str())
+                                            })
+                                        })
+                                        .unwrap_or("main")
+                                        .to_string();
+                                    let findings = repo.get("findings_count").and_then(|n| n.as_u64()).unwrap_or(0);
                                    let findings_label = if findings != 1 { format!("{findings} findings") } else { "1 finding".to_string() };
-                                    let updated = {
-                                        let now = chrono::Utc::now();
-                                        let diff = now.signed_duration_since(repo.updated_at);
-                                        if diff.num_minutes() < 1 {
-                                            "just now".to_string()
-                                        } else if diff.num_hours() < 1 {
-                                            format!("{}m ago", diff.num_minutes())
-                                        } else if diff.num_days() < 1 {
-                                            format!("{}h ago", diff.num_hours())
-                                        } else if diff.num_days() < 30 {
-                                            format!("{}d ago", diff.num_days())
-                                        } else {
-                                            repo.updated_at.format("%Y-%m-%d").to_string()
-                                        }
-                                    };
                                    rsx! {
                                        Link {
                                            to: Route::GraphExplorerPage { repo_id },
@@ -67,9 +74,6 @@ pub fn GraphIndexPage() -> Element {
                                                span { class: "graph-repo-card-tag graph-repo-card-tag-findings",
                                                    "{findings_label}"
                                                }
-                                                span { class: "graph-repo-card-tag",
-                                                    "Updated {updated}"
-                                                }
                                            }
                                        }
                                    }
@@ -0,0 +1,271 @@
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+use dioxus_free_icons::Icon;
+
+use crate::components::page_header::PageHeader;
+use crate::components::toast::{ToastType, Toasts};
+use crate::infrastructure::mcp_tokens::{
+    create_mcp_token, fetch_mcp_tokens, revoke_mcp_token, CreateMcpTokenResponse,
+};
+
+#[component]
+pub fn McpTokensPage() -> Element {
+    let mut tokens = use_resource(|| async { fetch_mcp_tokens().await.ok() });
+    let mut toasts = use_context::<Toasts>();
+
+    // Create-form state
+    let mut show_form = use_signal(|| false);
+    let mut new_name = use_signal(String::new);
+    let mut submitting = use_signal(|| false);
+
+    // After creation, the raw token shows once in a banner
+    let mut just_created: Signal<Option<CreateMcpTokenResponse>> = use_signal(|| None);
+
+    // Revoke confirmation: (id, name)
+    let mut confirm_revoke: Signal<Option<(String, String)>> = use_signal(|| None);
+
+    rsx! {
+        PageHeader {
+            title: "MCP Tokens",
+            description: "Static bearer tokens for the MCP server. Use in your LLM client (Claude Desktop, Cursor, etc.) — one token per tool/device.",
+        }
+
+        // ── Just-created banner ────────────────────────────────────
+        if let Some(resp) = just_created() {
+            div { class: "card mb-4", style: "border: 1px solid var(--accent-warning); background: var(--bg-warning-subtle);",
+                div { class: "card-header", style: "color: var(--accent-warning);",
+                    Icon { icon: BsExclamationTriangle, width: 14, height: 14 }
+                    " Copy this token now — it won't be shown again"
+                }
+                div { style: "padding: 1rem;",
+                    p { style: "margin-bottom: 0.5rem; color: var(--text-secondary);",
+                        "Token for "
+                        strong { "{resp.view.name}" }
+                    }
+                    div { class: "copyable", style: "background: var(--bg-secondary); padding: 0.75rem; border-radius: 4px;",
+                        code { style: "font-family: var(--font-mono); word-break: break-all; flex: 1;", "{resp.token}" }
+                        crate::components::copy_button::CopyButton { value: resp.token.clone(), small: false }
+                    }
+                    div { style: "margin-top: 0.75rem;",
+                        button {
+                            class: "btn btn-sm btn-ghost",
+                            onclick: move |_| just_created.set(None),
+                            "Dismiss"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Create form ────────────────────────────────────────────
+        div { class: "mb-4",
+            button {
+                class: "btn btn-primary",
+                onclick: move |_| {
+                    show_form.set(!show_form());
+                    new_name.set(String::new());
+                },
+                if show_form() { "Cancel" } else {
+                    Icon { icon: BsPlusLg, width: 14, height: 14 }
+                    " Create Token"
+                }
+            }
+        }
+
+        if show_form() {
+            div { class: "card mb-4",
+                div { class: "card-header", "New MCP Token" }
+                div { style: "padding: 1rem;",
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            placeholder: "Claude Desktop on my laptop",
+                            value: "{new_name}",
+                            oninput: move |e| new_name.set(e.value()),
+                        }
+                        small { style: "color: var(--text-secondary);", "A label so you can identify this token in the list. Not visible to LLM clients." }
+                    }
+                    div { style: "margin-top: 1rem;",
+                        button {
+                            class: "btn btn-primary",
+                            disabled: submitting() || new_name().trim().is_empty(),
+                            onclick: move |_| {
+                                let name = new_name().trim().to_string();
+                                if name.is_empty() {
+                                    return;
+                                }
+                                spawn(async move {
+                                    submitting.set(true);
+                                    match create_mcp_token(name).await {
+                                        Ok(resp) => {
+                                            toasts.push(ToastType::Success, "Token created. Copy it now — it won't be shown again.");
+                                            just_created.set(Some(resp));
+                                            show_form.set(false);
+                                            new_name.set(String::new());
+                                            tokens.restart();
+                                        }
+                                        Err(e) => {
+                                            toasts.push(ToastType::Error, format!("Failed to create token: {e}"));
+                                        }
+                                    }
+                                    submitting.set(false);
+                                });
+                            },
+                            if submitting() { "Creating..." } else { "Create" }
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Tokens list ────────────────────────────────────────────
+        match &*tokens.read() {
+            Some(Some(resp)) => {
+                if resp.data.is_empty() {
+                    rsx! {
+                        div { class: "card",
+                            p { style: "padding: 1rem; color: var(--text-secondary);", "No MCP tokens yet. Create one to start using the MCP server from an LLM client." }
+                        }
+                    }
+                } else {
+                    rsx! {
+                        div { class: "mcp-cards-grid",
+                            for token in resp.data.iter() {
+                                {
+                                    let id = token.id.clone();
+                                    let name = token.name.clone();
+                                    let prefix = token.token_prefix.clone();
+                                    let created_str = format_timestamp(&token.created_at);
+                                    let last_used_str = token
+                                        .last_used_at
+                                        .as_ref()
+                                        .map(format_timestamp)
+                                        .unwrap_or_else(|| "never".to_string());
+                                    let revoked = token.revoked;
+                                    rsx! {
+                                        div { class: "mcp-card", style: if revoked { "opacity: 0.55;" } else { "" },
+                                            div { class: "mcp-card-header",
+                                                div { class: "mcp-card-title",
+                                                    Icon { icon: BsKey, width: 14, height: 14 }
+                                                    h3 { "{name}" }
+                                                    if revoked {
+                                                        span { class: "mcp-card-status stopped", "revoked" }
+                                                    }
+                                                }
+                                                if !revoked {
+                                                    button {
+                                                        class: "btn btn-sm btn-ghost btn-ghost-danger",
+                                                        title: "Revoke token",
+                                                        onclick: {
+                                                            let id = id.clone();
+                                                            let name = name.clone();
+                                                            move |_| {
+                                                                confirm_revoke.set(Some((id.clone(), name.clone())));
+                                                            }
+                                                        },
+                                                        Icon { icon: BsTrash, width: 14, height: 14 }
+                                                    }
+                                                }
+                                            }
+                                            div { class: "mcp-card-details",
+                                                div { class: "mcp-detail-row",
+                                                    Icon { icon: BsKey, width: 13, height: 13 }
+                                                    span { class: "mcp-detail-label", "Prefix" }
+                                                    code { class: "mcp-detail-value", "{prefix}…" }
+                                                }
+                                                div { class: "mcp-detail-row",
+                                                    Icon { icon: BsCalendar, width: 13, height: 13 }
+                                                    span { class: "mcp-detail-label", "Created" }
+                                                    span { class: "mcp-detail-value", "{created_str}" }
+                                                }
+                                                div { class: "mcp-detail-row",
+                                                    Icon { icon: BsClockHistory, width: 13, height: 13 }
+                                                    span { class: "mcp-detail-label", "Last used" }
+                                                    span { class: "mcp-detail-value", "{last_used_str}" }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Some(None) => rsx! {
+                div { class: "card",
+                    p { style: "padding: 1rem; color: var(--accent-danger);", "Failed to load MCP tokens." }
+                }
+            },
+            None => rsx! {
+                div { class: "card",
+                    p { style: "padding: 1rem; color: var(--text-secondary);", "Loading..." }
+                }
+            },
+        }
+
+        // ── Revoke confirmation modal ──────────────────────────────
+        if let Some((id, name)) = confirm_revoke() {
+            div { class: "modal-overlay",
+                div { class: "modal",
+                    h3 { "Revoke token?" }
+                    p {
+                        "The token "
+                        strong { "{name}" }
+                        " will stop working immediately. This cannot be undone. Any LLM client using it will start getting 401."
+                    }
+                    div { style: "display: flex; gap: 0.5rem; margin-top: 1rem; justify-content: flex-end;",
+                        button {
+                            class: "btn btn-ghost",
+                            onclick: move |_| confirm_revoke.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-danger",
+                            onclick: {
+                                let id = id.clone();
+                                move |_| {
+                                    let id = id.clone();
+                                    spawn(async move {
+                                        match revoke_mcp_token(id).await {
+                                            Ok(()) => {
+                                                toasts.push(ToastType::Success, "Token revoked");
+                                                tokens.restart();
+                                            }
+                                            Err(e) => {
+                                                toasts.push(ToastType::Error, format!("Failed to revoke: {e}"));
+                                            }
+                                        }
+                                        confirm_revoke.set(None);
+                                    });
+                                }
+                            },
+                            "Revoke"
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Best-effort timestamp formatter. The agent serializes BSON DateTime
+/// as `{"$date":{"$numberLong":"..."}}` in extended JSON. We accept
+/// that shape, plain ISO strings, or anything else (best-effort).
+fn format_timestamp(v: &serde_json::Value) -> String {
+    if let Some(s) = v.as_str() {
+        return s.to_string();
+    }
+    if let Some(ms) = v
+        .get("$date")
+        .and_then(|d| d.get("$numberLong"))
+        .and_then(|s| s.as_str())
+        .and_then(|s| s.parse::<i64>().ok())
+    {
+        return chrono::DateTime::<chrono::Utc>::from_timestamp_millis(ms)
+            .map(|d| d.format("%Y-%m-%d %H:%M").to_string())
+            .unwrap_or_else(|| ms.to_string());
+    }
+    "—".to_string()
+}
@@ -11,11 +11,13 @@ pub mod graph_index;
 pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
+pub mod mcp_tokens;
+pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
-pub mod repositories;
 pub mod sbom;
+pub mod targets;

 pub use chat::ChatPage;
 pub use chat_index::ChatIndexPage;
@@ -30,8 +32,10 @@ pub use graph_index::GraphIndexPage;
 pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
+pub use mcp_tokens::McpTokensPage;
+pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
-pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
+pub use targets::TargetsPage;
@@ -0,0 +1,656 @@
+use dioxus::prelude::*;
+
+use crate::components::page_header::PageHeader;
+use crate::infrastructure::onboarding::{
+    create_target, detect_target, enable_target_scans, fetch_applicable_scans, trigger_target_scan,
+    upload_target_artifact, validate_artifact_ref, validate_target_name, ArtifactInputDto,
+};
+
+/// (value, label, one-line description) for the 9 target families.
+const TARGET_TYPES: &[(&str, &str, &str)] = &[
+    ("web_app", "Web Application", "Front end + server"),
+    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
+    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
+    ("android_app", "Android App", "APK / AAB"),
+    ("ios_app", "iOS App", "IPA"),
+    (
+        "firmware_bare_metal",
+        "Firmware — bare metal",
+        "No operating system",
+    ),
+    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
+    (
+        "embedded_linux_yocto",
+        "Embedded Linux / Yocto",
+        "BSP + image",
+    ),
+    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
+];
+
+/// (value, label) for the artifact kinds a user can attach.
+const ARTIFACT_KINDS: &[(&str, &str)] = &[
+    ("git_repo", "Git repository"),
+    ("source_archive", "Source archive (zip)"),
+    ("firmware_image", "Firmware image"),
+    ("mobile_package", "Mobile package (APK/IPA)"),
+    ("container_image", "Container image"),
+    ("live_url", "Live URL"),
+    ("plc_project", "PLC project"),
+    ("plaintext_description", "Description (text)"),
+];
+
+const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
+
+/// Artifact kinds provided as an uploaded file (rather than a URL/text ref).
+fn is_file_kind(kind: &str) -> bool {
+    matches!(
+        kind,
+        "plc_project" | "firmware_image" | "source_archive" | "mobile_package"
+    )
+}
+
+/// A file artifact staged in the wizard, uploaded after the target is created.
+#[derive(Clone, PartialEq)]
+struct PendingFile {
+    kind: String,
+    plc_format: Option<String>,
+    filename: String,
+    bytes: Vec<u8>,
+}
+
+/// One row in the applicable-scans list on the success step.
+#[component]
+fn ScanRow(scan: serde_json::Value) -> Element {
+    let name = scan
+        .get("scan")
+        .and_then(|v| v.as_str())
+        .unwrap_or("?")
+        .to_string();
+    let rationale = scan
+        .get("rationale")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+    let blocked = scan
+        .get("blocked_reason")
+        .and_then(|v| v.as_str())
+        .map(String::from);
+    let default_on = scan
+        .get("default_on")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let badge_class = if blocked.is_some() {
+        "badge badge-info"
+    } else if default_on {
+        "badge badge-success"
+    } else {
+        "badge"
+    };
+    rsx! {
+        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
+            span { class: "{badge_class}", "{name}" }
+            span { style: "opacity: 0.8;", "{rationale}" }
+            if let Some(b) = blocked {
+                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
+            }
+        }
+    }
+}
+
+fn kind_label(kind: &str) -> &str {
+    ARTIFACT_KINDS
+        .iter()
+        .find(|(v, _)| *v == kind)
+        .map(|(_, l)| *l)
+        .unwrap_or(kind)
+}
+
+fn type_label(value: &str) -> &str {
+    TARGET_TYPES
+        .iter()
+        .find(|(v, _, _)| *v == value)
+        .map(|(_, l, _)| *l)
+        .unwrap_or(value)
+}
+
+#[component]
+pub fn OnboardingPage() -> Element {
+    let mut step = use_signal(|| 0usize);
+    let mut name = use_signal(String::new);
+    let mut target_type = use_signal(String::new);
+    let mut description = use_signal(String::new);
+    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
+
+    // "Add artifact" mini-form.
+    let mut new_kind = use_signal(|| "git_repo".to_string());
+    let mut new_source = use_signal(String::new);
+    let mut new_branch = use_signal(|| "main".to_string());
+    // File-upload artifacts (PLC project, firmware image, ...).
+    let mut new_plc_format = use_signal(|| "plcopen_xml".to_string());
+    let mut new_file = use_signal(|| Option::<(String, Vec<u8>)>::None);
+    let mut pending_files = use_signal(Vec::<PendingFile>::new);
+
+    // Create + result state.
+    let mut creating = use_signal(|| false);
+    let mut error = use_signal(|| Option::<String>::None);
+    let mut scans = use_signal(Vec::<serde_json::Value>::new);
+    let mut suggested = use_signal(|| Option::<String>::None);
+    let mut created_id = use_signal(|| Option::<String>::None);
+    let mut scan_msg = use_signal(|| Option::<String>::None);
+    // Opt-in scans (default-off but unblocked) the user ticks to enable before
+    // running — stored as serde scan-type names (lowercase, no underscores).
+    let mut enabled_extra = use_signal(Vec::<String>::new);
+
+    let step_now = step();
+    let name_error = validate_target_name(&name());
+    let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
+    let has_artifacts = !artifacts().is_empty() || !pending_files().is_empty();
+    // Opt-in scans: applicable + unblocked, but default-off (e.g. the ICS probe).
+    // The user ticks these to enable them before the first run. Each entry is
+    // (display name for the label, serde scan-type name for the enable call —
+    // lowercase, no underscores, matching ScanType's rename_all = "lowercase").
+    let optin_scans: Vec<(String, String)> = scans()
+        .iter()
+        .filter_map(|s| {
+            let unblocked = s.get("blocked_reason").and_then(|v| v.as_str()).is_none();
+            let default_on = s
+                .get("default_on")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
+            if unblocked && !default_on {
+                let display = s.get("scan").and_then(|v| v.as_str())?.to_string();
+                let serde_name = display.replace('_', "");
+                Some((display, serde_name))
+            } else {
+                None
+            }
+        })
+        .collect();
+    // Live validation of the artifact reference being typed (empty = no error yet).
+    let new_source_error = if new_source().is_empty() {
+        None
+    } else {
+        validate_artifact_ref(&new_kind(), &new_source())
+    };
+
+    rsx! {
+        PageHeader {
+            title: "Onboard a target",
+            description: "Add a target, attach its artifacts, and see which scans apply.",
+        }
+
+        // Stepper.
+        div { class: "wizard-steps",
+            for (i, label) in STEP_LABELS.iter().enumerate() {
+                div {
+                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
+                    span { class: "wizard-step-dot", "{i + 1}" }
+                    span { class: "wizard-step-label", "{label}" }
+                }
+            }
+        }
+
+        if let Some(err) = error() {
+            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
+                div { class: "card-header", "Error" }
+                div { style: "padding: 12px;", "{err}" }
+            }
+        }
+
+        div { class: "card",
+            // ---- Step 0: target type + name ----
+            if step_now == 0 {
+                div { class: "card-header", "What kind of software is this?" }
+                div { style: "padding: 16px;",
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            placeholder: "acme-web",
+                            value: "{name}",
+                            oninput: move |e| name.set(e.value()),
+                        }
+                        if !name().is_empty() {
+                            if let Some(err) = name_error.clone() {
+                                div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 4px;", "{err}" }
+                            }
+                        }
+                    }
+                    div {
+                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
+                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
+                            div {
+                                class: "card",
+                                style: if target_type() == value {
+                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
+                                } else {
+                                    "padding: 12px; cursor: pointer;"
+                                },
+                                onclick: move |_| target_type.set(value.to_string()),
+                                div { style: "font-weight: 600;", "{tlabel}" }
+                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
+                            }
+                        }
+                    }
+                }
+            }
+
+            // ---- Step 1: artifacts ----
+            if step_now == 1 {
+                div { class: "card-header", "Attach artifacts" }
+                if target_type() == "plc_sps" {
+                    div {
+                        style: "margin: 12px 16px 0; padding: 12px 14px; border-left: 3px solid var(--accent, #3b82f6); background: var(--surface-2, rgba(59,130,246,0.08)); font-size: 0.88em; line-height: 1.55;",
+                        div { style: "font-weight: 600; margin-bottom: 4px;", "CODESYS / PLC projects" }
+                        "Attach a "
+                        b { "PLC project" }
+                        " (PLCopen XML / ST, or a .projectarchive), or a "
+                        b { "Git repository" }
+                        " of exported source — every scan is then just a pull."
+                        ul { style: "margin: 6px 0 0; padding-left: 18px;",
+                            li {
+                                b { "Control-logic SAST" }
+                                " — commit "
+                                b { "PLCopen XML exports" }
+                                " (Project → Export PLCopenXML) or raw .st; ST and graphical FBD/LD are both analyzed."
+                            }
+                            li {
+                                b { "Library + runtime SBOM" }
+                                " — include the "
+                                b { ".projectarchive" }
+                                "; PLCopen XML alone carries no libraries."
+                            }
+                            li {
+                                "Avoid committing only the binary "
+                                code { ".project" }
+                                " — it can't be parsed and doesn't diff."
+                            }
+                        }
+                    }
+                }
+                div { style: "padding: 16px;",
+                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
+                        div { class: "form-group", style: "margin: 0;",
+                            label { "Kind" }
+                            select {
+                                value: "{new_kind}",
+                                oninput: move |e| new_kind.set(e.value()),
+                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
+                                    option { value: "{value}", "{klabel}" }
+                                }
+                            }
+                        }
+                        if is_file_kind(&new_kind()) {
+                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                                label { "File" }
+                                input {
+                                    r#type: "file",
+                                    onchange: move |evt| {
+                                        let Some(file) = evt.files().into_iter().next() else { return; };
+                                        let name = file.name();
+                                        // Auto-detect the PLC format from the file extension.
+                                        let lname = name.to_ascii_lowercase();
+                                        if lname.ends_with(".projectarchive") || lname.ends_with(".project") {
+                                            new_plc_format.set("project_archive".to_string());
+                                        } else if lname.ends_with(".xml") || lname.ends_with(".plcopen") {
+                                            new_plc_format.set("plcopen_xml".to_string());
+                                        } else if lname.ends_with(".st") || lname.ends_with(".exp") || lname.ends_with(".scl") {
+                                            new_plc_format.set("structured_text".to_string());
+                                        }
+                                        spawn(async move {
+                                            if let Ok(bytes) = file.read_bytes().await {
+                                                new_file.set(Some((name, bytes.to_vec())));
+                                            }
+                                        });
+                                    },
+                                }
+                            }
+                            if new_kind() == "plc_project" {
+                                div { class: "form-group", style: "margin: 0;",
+                                    label { "Format" }
+                                    select {
+                                        value: "{new_plc_format}",
+                                        oninput: move |e| new_plc_format.set(e.value()),
+                                        option {
+                                            value: "plcopen_xml",
+                                            selected: new_plc_format() == "plcopen_xml",
+                                            "PLCopen XML",
+                                        }
+                                        option {
+                                            value: "structured_text",
+                                            selected: new_plc_format() == "structured_text",
+                                            "Structured Text",
+                                        }
+                                        option {
+                                            value: "project_archive",
+                                            selected: new_plc_format() == "project_archive",
+                                            "Project archive (.projectarchive)",
+                                        }
+                                    }
+                                }
+                            }
+                            button {
+                                class: "btn btn-secondary",
+                                disabled: new_file().is_none(),
+                                onclick: move |_| {
+                                    if let Some((fname, data)) = new_file() {
+                                        let kind = new_kind();
+                                        let plc_format = if kind == "plc_project" {
+                                            Some(new_plc_format())
+                                        } else {
+                                            None
+                                        };
+                                        pending_files.write().push(PendingFile {
+                                            kind,
+                                            plc_format,
+                                            filename: fname,
+                                            bytes: data,
+                                        });
+                                        new_file.set(None);
+                                    }
+                                },
+                                "+ Add file"
+                            }
+                        } else {
+                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                                label { "Reference (URL / path / text)" }
+                                input {
+                                    r#type: "text",
+                                    placeholder: "https://git.example.com/acme.git",
+                                    value: "{new_source}",
+                                    oninput: move |e| new_source.set(e.value()),
+                                }
+                            }
+                            if new_kind() == "git_repo" {
+                                div { class: "form-group", style: "margin: 0;",
+                                    label { "Branch" }
+                                    input {
+                                        r#type: "text",
+                                        value: "{new_branch}",
+                                        oninput: move |e| new_branch.set(e.value()),
+                                    }
+                                }
+                            }
+                            button {
+                                class: "btn btn-secondary",
+                                disabled: new_source().trim().is_empty() || new_source_error.is_some(),
+                                onclick: move |_| {
+                                    let kind = new_kind();
+                                    if !new_source().trim().is_empty()
+                                        && validate_artifact_ref(&kind, &new_source()).is_none()
+                                    {
+                                        let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
+                                        artifacts.write().push(ArtifactInputDto {
+                                            kind,
+                                            source_ref: new_source(),
+                                            branch,
+                                            plc_format: None,
+                                        });
+                                        new_source.set(String::new());
+                                    }
+                                },
+                                "+ Add"
+                            }
+                        }
+                    }
+                    if is_file_kind(&new_kind()) {
+                        if let Some((fname, data)) = new_file() {
+                            div { style: "font-size: 0.85em; opacity: 0.7; margin-top: 6px;",
+                                "Selected: {fname} ({data.len()} bytes)"
+                            }
+                        }
+                    } else if let Some(err) = new_source_error.clone() {
+                        div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
+                    }
+                    // Staged file artifacts (uploaded after the target is created).
+                    for (i, pf) in pending_files().iter().enumerate() {
+                        div {
+                            style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-top: 6px;",
+                            span {
+                                span { style: "opacity: 0.7;", "{kind_label(&pf.kind)} (file): " }
+                                "{pf.filename} ({pf.bytes.len()} bytes)"
+                            }
+                            button {
+                                class: "btn btn-ghost-danger btn-sm",
+                                onclick: move |_| { pending_files.write().remove(i); },
+                                "Remove"
+                            }
+                        }
+                    }
+
+                    div { style: "margin-top: 16px;",
+                        if has_artifacts {
+                            for (i, a) in artifacts().iter().enumerate() {
+                                div {
+                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
+                                    span {
+                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
+                                        "{a.source_ref}"
+                                    }
+                                    button {
+                                        class: "btn btn-ghost-danger btn-sm",
+                                        onclick: move |_| { artifacts.write().remove(i); },
+                                        "Remove"
+                                    }
+                                }
+                            }
+                        } else {
+                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
+                        }
+                    }
+                }
+            }
+
+            // ---- Step 2: review + create ----
+            if step_now == 2 {
+                div { class: "card-header", "Review" }
+                div { style: "padding: 16px;",
+                    div { class: "wizard-summary",
+                        div { strong { "Name: " } "{name()}" }
+                        div { strong { "Type: " } "{type_label(&target_type())}" }
+                        div { strong { "Artifacts:" } }
+                        ul {
+                            for a in artifacts() {
+                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
+                            }
+                        }
+                    }
+                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
+                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
+                    }
+                }
+            }
+
+            // ---- Step 3: created ----
+            if step_now == 3 {
+                div { class: "card-header", "Target onboarded" }
+                div { style: "padding: 16px;",
+                    p {
+                        strong { "{name()}" }
+                        " was created."
+                        if let Some(s) = suggested() {
+                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
+                        }
+                    }
+                    h4 { style: "margin-top: 16px;", "Applicable scans" }
+                    if scans().is_empty() {
+                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
+                    } else {
+                        for s in scans() {
+                            ScanRow { scan: s }
+                        }
+                    }
+                    if !optin_scans.is_empty() {
+                        div { style: "margin-top: 12px; padding: 10px; border: 1px dashed var(--border, #ccc); border-radius: 6px;",
+                            div { style: "font-weight: 600; margin-bottom: 6px;", "Enable opt-in scans" }
+                            div { style: "opacity: 0.7; font-size: 0.85em; margin-bottom: 8px;",
+                                "These are applicable but off by default (they touch a live device). Tick to enable before running."
+                            }
+                            for pair in optin_scans.clone() {
+                                {
+                                    let (display, serde_name) = pair;
+                                    let cb_name = serde_name.clone();
+                                    rsx! {
+                                        label {
+                                            style: "display: flex; gap: 6px; align-items: center; margin-top: 4px;",
+                                            input {
+                                                r#type: "checkbox",
+                                                checked: enabled_extra().contains(&serde_name),
+                                                onchange: move |_| {
+                                                    let mut v = enabled_extra();
+                                                    if let Some(p) = v.iter().position(|x| x == &cb_name) {
+                                                        v.remove(p);
+                                                    } else {
+                                                        v.push(cb_name.clone());
+                                                    }
+                                                    enabled_extra.set(v);
+                                                },
+                                            }
+                                            "Enable {display}"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if let Some(msg) = scan_msg() {
+                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
+                    }
+                    div { style: "margin-top: 16px; display: flex; gap: 8px;",
+                        button {
+                            class: "btn btn-primary",
+                            onclick: move |_| {
+                                if let Some(id) = created_id() {
+                                    let extra = enabled_extra();
+                                    scan_msg.set(Some("Scan triggered...".to_string()));
+                                    spawn(async move {
+                                        // Persist any ticked opt-in scans first, so the
+                                        // agent's build_scan_plan includes them this run.
+                                        if !extra.is_empty() {
+                                            if let Err(e) =
+                                                enable_target_scans(id.clone(), extra).await
+                                            {
+                                                scan_msg.set(Some(format!(
+                                                    "Failed to enable opt-in scans: {e}"
+                                                )));
+                                                return;
+                                            }
+                                        }
+                                        match trigger_target_scan(id).await {
+                                            Ok(_) => scan_msg.set(Some(
+                                                "Scan started — findings will appear as it runs.".to_string(),
+                                            )),
+                                            Err(e) => scan_msg.set(Some(format!("Failed to start scan: {e}"))),
+                                        }
+                                    });
+                                }
+                            },
+                            "Run scan"
+                        }
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| {
+                                step.set(0);
+                                name.set(String::new());
+                                target_type.set(String::new());
+                                description.set(String::new());
+                                artifacts.write().clear();
+                                pending_files.write().clear();
+                                new_file.set(None);
+                                scans.write().clear();
+                                suggested.set(None);
+                                created_id.set(None);
+                                scan_msg.set(None);
+                                error.set(None);
+                            },
+                            "Onboard another"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ---- Footer navigation ----
+        if step_now < 3 {
+            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
+                button {
+                    class: "btn btn-back",
+                    disabled: step_now == 0,
+                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
+                    "Back"
+                }
+                if step_now < 2 {
+                    button {
+                        class: "btn btn-primary",
+                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
+                        onclick: move |_| step.set(step() + 1),
+                        "Next"
+                    }
+                } else {
+                    button {
+                        class: "btn btn-primary",
+                        disabled: creating(),
+                        onclick: move |_| {
+                            let n = name();
+                            let tt = target_type();
+                            let desc = description();
+                            let arts = artifacts();
+                            let files = pending_files();
+                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
+                            creating.set(true);
+                            error.set(None);
+                            spawn(async move {
+                                match create_target(n, tt, d, arts).await {
+                                    Ok(resp) => {
+                                        let id = resp
+                                            .data
+                                            .get("_id")
+                                            .and_then(|o| o.get("$oid"))
+                                            .and_then(|s| s.as_str())
+                                            .map(String::from);
+                                        if let Some(id) = id {
+                                            created_id.set(Some(id.clone()));
+                                            // Upload staged file artifacts now that the target exists.
+                                            for pf in files {
+                                                let fname = pf.filename.clone();
+                                                if let Err(e) = upload_target_artifact(
+                                                    id.clone(),
+                                                    pf.kind,
+                                                    pf.plc_format,
+                                                    pf.filename,
+                                                    pf.bytes,
+                                                )
+                                                .await
+                                                {
+                                                    error.set(Some(format!(
+                                                        "Upload failed for {fname}: {e}"
+                                                    )));
+                                                }
+                                            }
+                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
+                                                scans.set(sc.data.scans);
+                                            }
+                                            if let Ok(det) = detect_target(id).await {
+                                                suggested.set(
+                                                    det.data
+                                                        .get("classification")
+                                                        .and_then(|c| c.get("suggested"))
+                                                        .and_then(|s| s.as_str())
+                                                        .map(String::from),
+                                                );
+                                            }
+                                        }
+                                        step.set(3);
+                                    }
+                                    Err(e) => error.set(Some(e.to_string())),
+                                }
+                                creating.set(false);
+                            });
+                        },
+                        if creating() { "Creating..." } else { "Create target" }
+                    }
+                }
+            }
+        }
+    }
+}
@@ -6,7 +6,7 @@ use crate::app::Route;
 use crate::components::page_header::PageHeader;
 use crate::components::stat_card::StatCard;
 use crate::infrastructure::mcp::fetch_mcp_servers;
-use crate::infrastructure::repositories::fetch_repositories;
+use crate::infrastructure::onboarding::fetch_targets;

 #[cfg(feature = "server")]
 use crate::infrastructure::stats::fetch_overview_stats;
@@ -26,7 +26,7 @@ pub fn OverviewPage() -> Element {
        }
    });

-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let repos = use_resource(|| async { fetch_targets().await.ok() });
    let mcp_servers = use_resource(|| async { fetch_mcp_servers().await.ok() });

    rsx! {
@@ -94,8 +94,8 @@ pub fn OverviewPage() -> Element {
                                        style: "display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; padding: 1rem;",
                                        for repo in repo_list {
                                            {
-                                                let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                rsx! {
                                                    Link {
                                                        to: Route::ChatPage { repo_id },
@@ -1,657 +0,0 @@
-use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-#[allow(unused_imports)]
-use dioxus_free_icons::icons::bs_icons::{BsGear, BsPencil};
-use dioxus_free_icons::Icon;
-
-use crate::components::page_header::PageHeader;
-use crate::components::pagination::Pagination;
-use crate::components::toast::{ToastType, Toasts};
-use crate::pages::graph_explorer::GraphExplorerInline;
-
-async fn async_sleep_5s() {
-    #[cfg(feature = "web")]
-    {
-        gloo_timers::future::TimeoutFuture::new(5_000).await;
-    }
-    #[cfg(not(feature = "web"))]
-    {
-        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-    }
-}
-
-#[component]
-pub fn RepositoriesPage() -> Element {
-    let mut page = use_signal(|| 1u64);
-    let mut show_add_form = use_signal(|| false);
-    let mut name = use_signal(String::new);
-    let mut git_url = use_signal(String::new);
-    let mut branch = use_signal(|| "main".to_string());
-    let mut auth_token = use_signal(String::new);
-    let mut auth_username = use_signal(String::new);
-    let mut show_auth = use_signal(|| false);
-    let mut ssh_public_key = use_signal(String::new);
-    let mut show_tracker = use_signal(|| false);
-    let mut tracker_type_val = use_signal(String::new);
-    let mut tracker_owner_val = use_signal(String::new);
-    let mut tracker_repo_val = use_signal(String::new);
-    let mut tracker_token_val = use_signal(String::new);
-    let mut adding = use_signal(|| false);
-    let mut toasts = use_context::<Toasts>();
-    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
-    let mut edit_repo_id = use_signal(|| Option::<String>::None);
-    let mut edit_name = use_signal(String::new);
-    let mut edit_branch = use_signal(String::new);
-    let mut edit_tracker_type = use_signal(String::new);
-    let mut edit_tracker_owner = use_signal(String::new);
-    let mut edit_tracker_repo = use_signal(String::new);
-    let mut edit_tracker_token = use_signal(String::new);
-    let mut edit_saving = use_signal(|| false);
-    let mut edit_webhook_secret = use_signal(|| Option::<String>::None);
-    let mut edit_webhook_tracker = use_signal(String::new);
-    let mut scanning_ids = use_signal(Vec::<String>::new);
-    let mut graph_repo_id = use_signal(|| Option::<String>::None);
-
-    let mut repos = use_resource(move || {
-        let p = page();
-        async move {
-            crate::infrastructure::repositories::fetch_repositories(p)
-                .await
-                .ok()
-        }
-    });
-
-    rsx! {
-        PageHeader {
-            title: "Repositories",
-            description: "Tracked git repositories",
-        }
-
-        div { style: "margin-bottom: 16px;",
-            button {
-                class: "btn btn-primary",
-                onclick: move |_| show_add_form.toggle(),
-                if show_add_form() { "Cancel" } else { "+ Add Repository" }
-            }
-        }
-
-        if show_add_form() {
-            div { class: "card",
-                div { class: "card-header", "Add Repository" }
-                div { class: "form-group",
-                    label { "Name" }
-                    input {
-                        r#type: "text",
-                        placeholder: "my-project",
-                        value: "{name}",
-                        oninput: move |e| name.set(e.value()),
-                    }
-                }
-                div { class: "form-group",
-                    label { "Git URL" }
-                    input {
-                        r#type: "text",
-                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
-                        value: "{git_url}",
-                        oninput: move |e| git_url.set(e.value()),
-                    }
-                }
-                div { class: "form-group",
-                    label { "Default Branch" }
-                    input {
-                        r#type: "text",
-                        placeholder: "main",
-                        value: "{branch}",
-                        oninput: move |e| branch.set(e.value()),
-                    }
-                }
-
-                // Private repo auth section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| {
-                            let opening = !show_auth();
-                            show_auth.toggle();
-                            if opening {
-                                // Fetch SSH key every time the section opens
-                                ssh_public_key.set(String::new());
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
-                                        Ok(key) => ssh_public_key.set(key),
-                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
-                                    }
-                                });
-                            }
-                        },
-                        if show_auth() { "Hide auth options" } else { "Private repository?" }
-                    }
-                }
-
-                if show_auth() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        // SSH deploy key display
-                        div { style: "margin-bottom: 12px;",
-                            label { style: "font-size: 12px; color: var(--text-secondary);",
-                                "For SSH URLs: add this deploy key (read-only) to your repository"
-                            }
-                            div {
-                                class: "copyable",
-                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px;",
-                                code {
-                                    style: "font-size: 11px; word-break: break-all; user-select: all;",
-                                    if ssh_public_key().is_empty() {
-                                        "Loading..."
-                                    } else {
-                                        "{ssh_public_key}"
-                                    }
-                                }
-                                if !ssh_public_key().is_empty() {
-                                    crate::components::copy_button::CopyButton { value: ssh_public_key(), small: true }
-                                }
-                            }
-                        }
-
-                        // HTTPS auth fields
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "For HTTPS URLs: provide an access token (PAT) or username/password"
-                        }
-                        div { class: "form-group",
-                            label { "Auth Token / Password" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx or personal access token",
-                                value: "{auth_token}",
-                                oninput: move |e| auth_token.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Username (optional, defaults to x-access-token)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "x-access-token",
-                                value: "{auth_username}",
-                                oninput: move |e| auth_username.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
-                // Issue tracker config section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| show_tracker.toggle(),
-                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
-                    }
-                }
-
-                if show_tracker() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "Configure an issue tracker to auto-create issues from findings"
-                        }
-                        div { class: "form-group",
-                            label { "Tracker Type" }
-                            select {
-                                value: "{tracker_type_val}",
-                                onchange: move |e| tracker_type_val.set(e.value()),
-                                option { value: "", "None" }
-                                option { value: "github", "GitHub" }
-                                option { value: "gitlab", "GitLab" }
-                                option { value: "gitea", "Gitea" }
-                                option { value: "jira", "Jira" }
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Owner / Namespace" }
-                            input {
-                                r#type: "text",
-                                placeholder: "org-name",
-                                value: "{tracker_owner_val}",
-                                oninput: move |e| tracker_owner_val.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Repository / Project" }
-                            input {
-                                r#type: "text",
-                                placeholder: "repo-name",
-                                value: "{tracker_repo_val}",
-                                oninput: move |e| tracker_repo_val.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Tracker Token (PAT)" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx / glpat-xxxx",
-                                value: "{tracker_token_val}",
-                                oninput: move |e| tracker_token_val.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
-                button {
-                    class: "btn btn-primary",
-                    disabled: adding(),
-                    onclick: move |_| {
-                        let n = name();
-                        let u = git_url();
-                        let b = branch();
-                        let tok = {
-                            let v = auth_token();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let usr = {
-                            let v = auth_username();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
-                        adding.set(true);
-                        spawn(async move {
-                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
-                                Ok(_) => {
-                                    toasts.push(ToastType::Success, "Repository added");
-                                    repos.restart();
-                                }
-                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                            }
-                            adding.set(false);
-                        });
-                        show_add_form.set(false);
-                        show_auth.set(false);
-                        show_tracker.set(false);
-                        name.set(String::new());
-                        git_url.set(String::new());
-                        auth_token.set(String::new());
-                        auth_username.set(String::new());
-                        tracker_type_val.set(String::new());
-                        tracker_owner_val.set(String::new());
-                        tracker_repo_val.set(String::new());
-                        tracker_token_val.set(String::new());
-                    },
-                    if adding() { "Validating..." } else { "Add" }
-                }
-            }
-        }
-
-        // ── Delete confirmation dialog ──
-        if let Some((del_id, del_name)) = confirm_delete() {
-            div { class: "modal-overlay",
-                div { class: "modal-dialog",
-                    h3 { "Delete Repository" }
-                    p {
-                        "Are you sure you want to delete "
-                        strong { "{del_name}" }
-                        "?"
-                    }
-                    p { class: "modal-warning",
-                        "This will permanently remove all associated findings, SBOM entries, scan runs, graph data, embeddings, and CVE alerts."
-                    }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| confirm_delete.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-danger",
-                            onclick: move |_| {
-                                let id = del_id.clone();
-                                let name = del_name.clone();
-                                confirm_delete.set(None);
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::delete_repository(id).await {
-                                        Ok(_) => {
-                                            toasts.push(ToastType::Success, format!("{name} deleted"));
-                                            repos.restart();
-                                        }
-                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                    }
-                                });
-                            },
-                            "Delete"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ── Edit repository dialog ──
-        if let Some(eid) = edit_repo_id() {
-            div { class: "modal-overlay",
-                div { class: "modal-dialog",
-                    h3 { "Edit Repository" }
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            value: "{edit_name}",
-                            oninput: move |e| edit_name.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Default Branch" }
-                        input {
-                            r#type: "text",
-                            value: "{edit_branch}",
-                            oninput: move |e| edit_branch.set(e.value()),
-                        }
-                    }
-                    h4 { style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);", "Issue Tracker" }
-                    div { class: "form-group",
-                        label { "Tracker Type" }
-                        select {
-                            value: "{edit_tracker_type}",
-                            onchange: move |e| edit_tracker_type.set(e.value()),
-                            option { value: "", "None" }
-                            option { value: "github", "GitHub" }
-                            option { value: "gitlab", "GitLab" }
-                            option { value: "gitea", "Gitea" }
-                            option { value: "jira", "Jira" }
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Owner / Namespace" }
-                        input {
-                            r#type: "text",
-                            placeholder: "org-name",
-                            value: "{edit_tracker_owner}",
-                            oninput: move |e| edit_tracker_owner.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Repository / Project" }
-                        input {
-                            r#type: "text",
-                            placeholder: "repo-name",
-                            value: "{edit_tracker_repo}",
-                            oninput: move |e| edit_tracker_repo.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Tracker Token (leave empty to keep existing)" }
-                        input {
-                            r#type: "password",
-                            placeholder: "Enter new token to change",
-                            value: "{edit_tracker_token}",
-                            oninput: move |e| edit_tracker_token.set(e.value()),
-                        }
-                    }
-                    // Webhook configuration section
-                    if let Some(secret) = edit_webhook_secret() {
-                        h4 {
-                            style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);",
-                            "Webhook Configuration"
-                        }
-                        p {
-                            style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "Add this webhook in your repository settings to enable push-triggered scans and PR reviews."
-                        }
-                        div { class: "form-group",
-                            label { "Webhook URL" }
-                            {
-                                #[cfg(feature = "web")]
-                                let origin = web_sys::window()
-                                    .and_then(|w: web_sys::Window| w.location().origin().ok())
-                                    .unwrap_or_default();
-                                #[cfg(not(feature = "web"))]
-                                let origin = String::new();
-                                let webhook_url = format!("{origin}/webhook/{}/{eid}", edit_webhook_tracker());
-                                rsx! {
-                                    div { class: "copyable",
-                                        input {
-                                            r#type: "text",
-                                            readonly: true,
-                                            style: "font-family: monospace; font-size: 12px; flex: 1;",
-                                            value: "{webhook_url}",
-                                        }
-                                        crate::components::copy_button::CopyButton { value: webhook_url.clone() }
-                                    }
-                                }
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Webhook Secret" }
-                            div { class: "copyable",
-                                input {
-                                    r#type: "text",
-                                    readonly: true,
-                                    style: "font-family: monospace; font-size: 12px; flex: 1;",
-                                    value: "{secret}",
-                                }
-                                crate::components::copy_button::CopyButton { value: secret.clone() }
-                            }
-                        }
-                    }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| edit_repo_id.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-primary",
-                            disabled: edit_saving(),
-                            onclick: move |_| {
-                                let id = eid.clone();
-                                let nm = { let v = edit_name(); if v.is_empty() { None } else { Some(v) } };
-                                let br = { let v = edit_branch(); if v.is_empty() { None } else { Some(v) } };
-                                let tt = { let v = edit_tracker_type(); if v.is_empty() { None } else { Some(v) } };
-                                let t_owner = { let v = edit_tracker_owner(); if v.is_empty() { None } else { Some(v) } };
-                                let t_repo = { let v = edit_tracker_repo(); if v.is_empty() { None } else { Some(v) } };
-                                let t_tok = { let v = edit_tracker_token(); if v.is_empty() { None } else { Some(v) } };
-                                edit_saving.set(true);
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::update_repository(
-                                        id, nm, br, None, None, tt, t_owner, t_repo, t_tok, None,
-                                    ).await {
-                                        Ok(_) => {
-                                            toasts.push(ToastType::Success, "Repository updated");
-                                            repos.restart();
-                                        }
-                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                    }
-                                    edit_saving.set(false);
-                                    edit_repo_id.set(None);
-                                });
-                            },
-                            if edit_saving() { "Saving..." } else { "Save" }
-                        }
-                    }
-                }
-            }
-        }
-
-        match &*repos.read() {
-            Some(Some(resp)) => {
-                let total_pages = resp.total.unwrap_or(0).div_ceil(20).max(1);
-                rsx! {
-                    div { class: "card",
-                        div { class: "table-wrapper",
-                            table {
-                                thead {
-                                    tr {
-                                        th { "Name" }
-                                        th { "Git URL" }
-                                        th { "Branch" }
-                                        th { "Findings" }
-                                        th { "Last Scanned" }
-                                        th { "Actions" }
-                                    }
-                                }
-                                tbody {
-                                    for repo in &resp.data {
-                                        {
-                                            let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                            let repo_id_scan = repo_id.clone();
-                                            let repo_id_del = repo_id.clone();
-                                            let repo_id_edit = repo_id.clone();
-                                            let repo_name_del = repo.name.clone();
-                                            let edit_repo_data = repo.clone();
-                                            let is_scanning = scanning_ids().contains(&repo_id);
-                                            rsx! {
-                                                tr {
-                                                    td { "{repo.name}" }
-                                                    td {
-                                                        style: "font-size: 12px; font-family: monospace;",
-                                                        "{repo.git_url}"
-                                                    }
-                                                    td { "{repo.default_branch}" }
-                                                    td { "{repo.findings_count}" }
-                                                    td {
-                                                        {
-                                                            let now = chrono::Utc::now();
-                                                            let diff = now.signed_duration_since(repo.updated_at);
-                                                            let label = if diff.num_minutes() < 1 {
-                                                                "just now".to_string()
-                                                            } else if diff.num_hours() < 1 {
-                                                                format!("{}m ago", diff.num_minutes())
-                                                            } else if diff.num_days() < 1 {
-                                                                format!("{}h ago", diff.num_hours())
-                                                            } else if diff.num_days() < 30 {
-                                                                format!("{}d ago", diff.num_days())
-                                                            } else {
-                                                                repo.updated_at.format("%Y-%m-%d").to_string()
-                                                            };
-                                                            rsx! { span { style: "font-size: 12px;", "{label}" } }
-                                                        }
-                                                    }
-                                                    td { style: "display: flex; gap: 4px;",
-                                                        button {
-                                                            class: if graph_repo_id().as_deref() == Some(repo_id.as_str()) { "btn btn-ghost btn-active" } else { "btn btn-ghost" },
-                                                            title: "View graph",
-                                                            onclick: {
-                                                                let rid = repo_id.clone();
-                                                                move |_| {
-                                                                    if graph_repo_id().as_deref() == Some(rid.as_str()) {
-                                                                        graph_repo_id.set(None);
-                                                                    } else {
-                                                                        graph_repo_id.set(Some(rid.clone()));
-                                                                    }
-                                                                }
-                                                            },
-                                                            Icon { icon: BsDiagram3, width: 16, height: 16 }
-                                                        }
-                                                        button {
-                                                            class: "btn btn-ghost",
-                                                            title: "Edit repository",
-                                                            onclick: move |_| {
-                                                                edit_name.set(edit_repo_data.name.clone());
-                                                                edit_branch.set(edit_repo_data.default_branch.clone());
-                                                                edit_tracker_type.set(
-                                                                    edit_repo_data.tracker_type.as_ref().map(|t| t.to_string()).unwrap_or_default()
-                                                                );
-                                                                edit_tracker_owner.set(edit_repo_data.tracker_owner.clone().unwrap_or_default());
-                                                                edit_tracker_repo.set(edit_repo_data.tracker_repo.clone().unwrap_or_default());
-                                                                edit_tracker_token.set(String::new());
-                                                                edit_webhook_secret.set(None);
-                                                                edit_webhook_tracker.set(String::new());
-                                                                edit_repo_id.set(Some(repo_id_edit.clone()));
-                                                                // Fetch webhook config in background
-                                                                let rid = repo_id_edit.clone();
-                                                                spawn(async move {
-                                                                    if let Ok(cfg) = crate::infrastructure::repositories::fetch_webhook_config(rid).await {
-                                                                        edit_webhook_secret.set(cfg.webhook_secret);
-                                                                        edit_webhook_tracker.set(cfg.tracker_type);
-                                                                    }
-                                                                });
-                                                            },
-                                                            Icon { icon: BsPencil, width: 16, height: 16 }
-                                                        }
-                                                        button {
-                                                            class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
-                                                            title: "Trigger scan",
-                                                            disabled: is_scanning,
-                                                            onclick: move |_| {
-                                                                let id = repo_id_scan.clone();
-                                                                // Add to scanning set
-                                                                let mut ids = scanning_ids();
-                                                                ids.push(id.clone());
-                                                                scanning_ids.set(ids);
-                                                                spawn(async move {
-                                                                    match crate::infrastructure::repositories::trigger_repo_scan(id.clone()).await {
-                                                                        Ok(_) => {
-                                                                            toasts.push(ToastType::Success, "Scan triggered");
-                                                                            // Poll until scan completes
-                                                                            loop {
-                                                                                async_sleep_5s().await;
-                                                                                match crate::infrastructure::repositories::check_repo_scanning(id.clone()).await {
-                                                                                    Ok(false) => break,
-                                                                                    Ok(true) => continue,
-                                                                                    Err(_) => break,
-                                                                                }
-                                                                            }
-                                                                            toasts.push(ToastType::Success, "Scan complete");
-                                                                            repos.restart();
-                                                                        }
-                                                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                                                    }
-                                                                    // Remove from scanning set
-                                                                    let mut ids = scanning_ids();
-                                                                    ids.retain(|i| i != &id);
-                                                                    scanning_ids.set(ids);
-                                                                });
-                                                            },
-                                                            if is_scanning {
-                                                                span { class: "spinner" }
-                                                            } else {
-                                                                Icon { icon: BsPlayCircle, width: 16, height: 16 }
-                                                            }
-                                                        }
-                                                        button {
-                                                            class: "btn btn-ghost btn-ghost-danger",
-                                                            title: "Delete repository",
-                                                            onclick: move |_| {
-                                                                confirm_delete.set(Some((repo_id_del.clone(), repo_name_del.clone())));
-                                                            },
-                                                            Icon { icon: BsTrash, width: 16, height: 16 }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                        Pagination {
-                            current_page: page(),
-                            total_pages: total_pages,
-                            on_page_change: move |p| page.set(p),
-                        }
-                    }
-
-                    // Inline graph explorer
-                    if let Some(rid) = graph_repo_id() {
-                        div { class: "card", style: "margin-top: 16px;",
-                            div { class: "card-header", style: "display: flex; justify-content: space-between; align-items: center;",
-                                span { "Code Graph" }
-                                button {
-                                    class: "btn btn-sm btn-ghost",
-                                    title: "Close graph",
-                                    onclick: move |_| { graph_repo_id.set(None); },
-                                    Icon { icon: BsX, width: 18, height: 18 }
-                                }
-                            }
-                            GraphExplorerInline { repo_id: rid }
-                        }
-                    }
-                }
-            },
-            Some(None) => rsx! {
-                div { class: "card", p { "Failed to load repositories." } }
-            },
-            None => rsx! {
-                div { class: "loading", "Loading repositories..." }
-            },
-        }
-    }
-}
@@ -28,9 +28,9 @@ pub fn SbomPage() -> Element {
    let mut diff_repo_a = use_signal(String::new);
    let mut diff_repo_b = use_signal(String::new);

-    // ── Repos for dropdowns ──
+    // ── Targets for dropdowns ──
    let repos = use_resource(|| async {
-        crate::infrastructure::repositories::fetch_repositories(1)
+        crate::infrastructure::onboarding::fetch_targets()
            .await
            .ok()
    });
@@ -114,14 +114,14 @@ pub fn SbomPage() -> Element {
                select {
                    class: "sbom-filter-select",
                    onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                    option { value: "", "All Repositories" }
+                    option { value: "", "All Targets" }
                    {
                        match &*repos.read() {
                            Some(Some(resp)) => rsx! {
                                for repo in &resp.data {
                                    {
-                                        let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                        let name = repo.name.clone();
+                                        let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                        let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                        rsx! { option { value: "{id}", "{name}" } }
                                    }
                                }
@@ -476,8 +476,8 @@ pub fn SbomPage() -> Element {
                                    Some(Some(resp)) => rsx! {
                                        for repo in &resp.data {
                                            {
-                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                rsx! { option { value: "{id}", "{name}" } }
                                            }
                                        }
@@ -498,8 +498,8 @@ pub fn SbomPage() -> Element {
                                    Some(Some(resp)) => rsx! {
                                        for repo in &resp.data {
                                            {
-                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                rsx! { option { value: "{id}", "{name}" } }
                                            }
                                        }
@@ -0,0 +1,544 @@
+//! Targets page — lists onboarded targets (the unified `OnboardedTarget`
+//! records the wizard creates) and lets the user run a scan, inspect the
+//! classification / applicable scans, or delete a target.
+//!
+//! Creation lives in the Onboard wizard (`/onboard`); this page is the
+//! "where is my target, and what did the scan find" surface.
+
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+use dioxus_free_icons::Icon;
+
+use crate::components::page_header::PageHeader;
+use crate::components::toast::{ToastType, Toasts};
+use crate::infrastructure::onboarding::{
+    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan, update_target,
+    validate_artifact_ref, validate_target_name, ArtifactInputDto,
+};
+
+/// The nine target families (value, label) for the edit form's type selector.
+const TARGET_TYPES: &[(&str, &str)] = &[
+    ("web_app", "Web Application"),
+    ("backend_service", "Backend / API"),
+    ("desktop_app", "Desktop App"),
+    ("android_app", "Android App"),
+    ("ios_app", "iOS App"),
+    ("firmware_bare_metal", "Firmware — bare metal"),
+    ("firmware_rtos", "Firmware — RTOS"),
+    ("embedded_linux_yocto", "Embedded Linux / Yocto"),
+    ("plc_sps", "PLC / SPS"),
+];
+
+/// The artifact kinds (value, label) for the edit form.
+const ARTIFACT_KINDS: &[(&str, &str)] = &[
+    ("git_repo", "Git repository"),
+    ("source_archive", "Source archive (zip)"),
+    ("firmware_image", "Firmware image"),
+    ("mobile_package", "Mobile package (APK/IPA)"),
+    ("container_image", "Container image"),
+    ("live_url", "Live URL"),
+    ("plc_project", "PLC project"),
+    ("plaintext_description", "Description (text)"),
+];
+
+/// Prettify a snake_case target-type value into a human label.
+fn pretty_type(v: &str) -> String {
+    match v {
+        "web_app" => "Web Application".into(),
+        "backend_service" => "Backend / API".into(),
+        "desktop_app" => "Desktop App".into(),
+        "android_app" => "Android App".into(),
+        "ios_app" => "iOS App".into(),
+        "firmware_bare_metal" => "Firmware — bare metal".into(),
+        "firmware_rtos" => "Firmware — RTOS".into(),
+        "embedded_linux_yocto" => "Embedded Linux / Yocto".into(),
+        "plc_sps" => "PLC / SPS".into(),
+        other => other.replace('_', " "),
+    }
+}
+
+fn str_at<'a>(v: &'a serde_json::Value, key: &str) -> &'a str {
+    v.get(key).and_then(|x| x.as_str()).unwrap_or("")
+}
+
+fn target_id(t: &serde_json::Value) -> String {
+    t.get("_id")
+        .and_then(|o| o.get("$oid"))
+        .and_then(|s| s.as_str())
+        .unwrap_or_default()
+        .to_string()
+}
+
+/// The applicable-scans matrix for one target, fetched on expand.
+#[component]
+fn TargetScans(id: String) -> Element {
+    let scan_id = id.clone();
+    let scans = use_resource(move || {
+        let id = scan_id.clone();
+        async move { fetch_applicable_scans(id).await.ok() }
+    });
+
+    let snapshot = scans.read().clone();
+    match &snapshot {
+        Some(Some(resp)) => {
+            let rows = resp.data.scans.clone();
+            let pentest = resp.data.pentest_supported;
+            rsx! {
+                div { style: "margin-top: 8px;",
+                    if rows.is_empty() {
+                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
+                    }
+                    for s in rows {
+                        {
+                            let name = str_at(&s, "scan").to_string();
+                            let rationale = str_at(&s, "rationale").to_string();
+                            let blocked = s.get("blocked_reason").and_then(|b| b.as_str()).map(String::from);
+                            let default_on = s.get("default_on").and_then(|b| b.as_bool()).unwrap_or(false);
+                            let badge = if blocked.is_some() {
+                                "badge badge-info"
+                            } else if default_on {
+                                "badge badge-success"
+                            } else {
+                                "badge"
+                            };
+                            rsx! {
+                                div { style: "display: flex; gap: 8px; align-items: center; padding: 4px 0;",
+                                    span { class: "{badge}", "{name}" }
+                                    span { style: "opacity: 0.8; font-size: 0.9em;", "{rationale}" }
+                                    if let Some(b) = blocked {
+                                        span { style: "opacity: 0.6; font-style: italic; font-size: 0.9em;", "— {b}" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if pentest {
+                        div { style: "margin-top: 6px; opacity: 0.75; font-size: 0.85em;",
+                            "Active pentest is supported for this target type."
+                        }
+                    }
+                }
+            }
+        }
+        Some(None) => rsx! { div { style: "opacity: 0.6;", "Failed to load applicable scans." } },
+        None => rsx! { div { style: "opacity: 0.6;", "Loading scans..." } },
+    }
+}
+
+#[component]
+pub fn TargetsPage() -> Element {
+    let mut toasts = use_context::<Toasts>();
+    let mut scanning_ids = use_signal(Vec::<String>::new);
+    let mut expanded_ids = use_signal(Vec::<String>::new);
+    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
+
+    // Edit-target modal state.
+    let mut edit_id = use_signal(|| Option::<String>::None);
+    let mut edit_name = use_signal(String::new);
+    let mut edit_type = use_signal(String::new);
+    let mut edit_arts = use_signal(Vec::<ArtifactInputDto>::new);
+    let mut edit_saving = use_signal(|| false);
+    // In-modal "add artifact" mini-form.
+    let mut e_kind = use_signal(|| "git_repo".to_string());
+    let mut e_source = use_signal(String::new);
+    let mut e_branch = use_signal(|| "main".to_string());
+
+    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
+
+    rsx! {
+        PageHeader {
+            title: "Targets",
+            description: "Onboarded targets and what their scans found. Add new targets from Onboard.",
+        }
+
+        div { style: "margin-bottom: 16px; display: flex; gap: 8px;",
+            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
+                "+ Onboard a target"
+            }
+            button {
+                class: "btn btn-secondary",
+                onclick: move |_| targets.restart(),
+                "Refresh"
+            }
+        }
+
+        // ── Delete confirmation ──
+        if let Some((del_id, del_name)) = confirm_delete() {
+            div { class: "modal-overlay",
+                div { class: "modal-dialog",
+                    h3 { "Delete Target" }
+                    p { "Delete " strong { "{del_name}" } "?" }
+                    p { class: "modal-warning",
+                        "This permanently removes the target and its findings, SBOM entries, scan runs, and CVE alerts."
+                    }
+                    div { class: "modal-actions",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| confirm_delete.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-danger",
+                            onclick: move |_| {
+                                let id = del_id.clone();
+                                let name = del_name.clone();
+                                confirm_delete.set(None);
+                                spawn(async move {
+                                    match delete_target(id).await {
+                                        Ok(_) => {
+                                            toasts.push(ToastType::Success, format!("{name} deleted"));
+                                            targets.restart();
+                                        }
+                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                    }
+                                });
+                            },
+                            "Delete"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Edit target ──
+        if let Some(eid) = edit_id() {
+            {
+            let name_err = validate_target_name(&edit_name());
+            let e_source_err = if e_source().is_empty() {
+                None
+            } else {
+                validate_artifact_ref(&e_kind(), &e_source())
+            };
+            rsx! {
+                div { class: "modal-overlay",
+                    div { class: "modal-dialog",
+                        h3 { "Edit target" }
+                        div { class: "form-group",
+                            label { "Name" }
+                            input {
+                                r#type: "text",
+                                value: "{edit_name}",
+                                oninput: move |e| edit_name.set(e.value()),
+                            }
+                            if !edit_name().is_empty() {
+                                if let Some(err) = name_err.clone() {
+                                    div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
+                                }
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Type" }
+                            select {
+                                value: "{edit_type}",
+                                oninput: move |e| edit_type.set(e.value()),
+                                for (v, l) in TARGET_TYPES.iter().copied() {
+                                    option { value: "{v}", selected: edit_type() == v, "{l}" }
+                                }
+                            }
+                        }
+                        label { style: "font-weight: 600;", "Artifacts" }
+                        for (i, a) in edit_arts().iter().enumerate() {
+                            div { style: "display: flex; justify-content: space-between; align-items: center; padding: 4px 0;",
+                                span { style: "font-size: 0.9em;",
+                                    span { style: "opacity: 0.7;", "{a.kind}: " }
+                                    span { style: "font-family: monospace;", "{a.source_ref}" }
+                                }
+                                button {
+                                    class: "btn btn-ghost btn-ghost-danger btn-sm",
+                                    onclick: move |_| { edit_arts.write().remove(i); },
+                                    "Remove"
+                                }
+                            }
+                        }
+                        div { style: "display: flex; gap: 8px; align-items: flex-end; margin-top: 8px;",
+                            div { class: "form-group", style: "margin: 0;",
+                                label { "Kind" }
+                                select {
+                                    value: "{e_kind}",
+                                    oninput: move |e| e_kind.set(e.value()),
+                                    for (v, l) in ARTIFACT_KINDS.iter().copied() {
+                                        option { value: "{v}", selected: e_kind() == v, "{l}" }
+                                    }
+                                }
+                            }
+                            div { class: "form-group", style: "margin: 0; flex: 1;",
+                                label { "Reference" }
+                                input {
+                                    r#type: "text",
+                                    value: "{e_source}",
+                                    oninput: move |e| e_source.set(e.value()),
+                                }
+                            }
+                            if e_kind() == "git_repo" {
+                                div { class: "form-group", style: "margin: 0;",
+                                    label { "Branch" }
+                                    input {
+                                        r#type: "text",
+                                        value: "{e_branch}",
+                                        oninput: move |e| e_branch.set(e.value()),
+                                    }
+                                }
+                            }
+                            button {
+                                class: "btn btn-secondary",
+                                disabled: e_source().trim().is_empty() || e_source_err.is_some(),
+                                onclick: move |_| {
+                                    let kind = e_kind();
+                                    if !e_source().trim().is_empty()
+                                        && validate_artifact_ref(&kind, &e_source()).is_none()
+                                    {
+                                        let branch = if kind == "git_repo" { Some(e_branch()) } else { None };
+                                        edit_arts.write().push(ArtifactInputDto {
+                                            kind,
+                                            source_ref: e_source(),
+                                            branch,
+                                            plc_format: None,
+                                        });
+                                        e_source.set(String::new());
+                                    }
+                                },
+                                "+ Add"
+                            }
+                        }
+                        if let Some(err) = e_source_err.clone() {
+                            div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
+                        }
+                        div { class: "modal-actions",
+                            button {
+                                class: "btn btn-secondary",
+                                onclick: move |_| edit_id.set(None),
+                                "Cancel"
+                            }
+                            button {
+                                class: "btn btn-primary",
+                                disabled: edit_saving() || name_err.is_some(),
+                                onclick: move |_| {
+                                    let id = eid.clone();
+                                    let nm = edit_name();
+                                    let tt = edit_type();
+                                    let arts = edit_arts();
+                                    edit_saving.set(true);
+                                    spawn(async move {
+                                        match update_target(id, Some(nm), Some(tt), Some(arts)).await {
+                                            Ok(_) => {
+                                                toasts.push(ToastType::Success, "Target updated");
+                                                targets.restart();
+                                                edit_id.set(None);
+                                            }
+                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                        }
+                                        edit_saving.set(false);
+                                    });
+                                },
+                                if edit_saving() { "Saving..." } else { "Save" }
+                            }
+                        }
+                    }
+                }
+            }
+            }
+        }
+
+        {
+        let targets_snapshot = targets.read().clone();
+        match &targets_snapshot {
+            Some(Some(resp)) => {
+                let rows = resp.data.clone();
+                if rows.is_empty() {
+                    rsx! {
+                        div { class: "card", style: "padding: 24px; text-align: center;",
+                            p { style: "opacity: 0.7;", "No targets yet." }
+                            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
+                                "Onboard your first target"
+                            }
+                        }
+                    }
+                } else {
+                    rsx! {
+                        div { class: "card",
+                            div { class: "table-wrapper",
+                                table {
+                                    thead {
+                                        tr {
+                                            th { "Name" }
+                                            th { "Type" }
+                                            th { "Detected" }
+                                            th { "Artifacts" }
+                                            th { "Findings" }
+                                            th { "Actions" }
+                                        }
+                                    }
+                                    tbody {
+                                        for t in rows {
+                                            {
+                                                let id = target_id(&t);
+                                                let name = str_at(&t, "name").to_string();
+                                                let ttype = pretty_type(str_at(&t, "target_type"));
+                                                let suggested = t
+                                                    .get("classification")
+                                                    .and_then(|c| c.get("suggested"))
+                                                    .and_then(|s| s.as_str())
+                                                    .map(pretty_type);
+                                                let artifacts = t
+                                                    .get("artifacts")
+                                                    .and_then(|a| a.as_array())
+                                                    .cloned()
+                                                    .unwrap_or_default();
+                                                let findings = t
+                                                    .get("findings_count")
+                                                    .and_then(|n| n.as_u64())
+                                                    .unwrap_or(0);
+                                                let facts = t
+                                                    .get("classification")
+                                                    .and_then(|c| c.get("facts"))
+                                                    .and_then(|f| f.as_array())
+                                                    .cloned()
+                                                    .unwrap_or_default();
+                                                let is_scanning = scanning_ids().contains(&id);
+                                                let is_expanded = expanded_ids().contains(&id);
+                                                let id_scan = id.clone();
+                                                let id_exp = id.clone();
+                                                let id_del = id.clone();
+                                                let id_edit = id.clone();
+                                                let name_del = name.clone();
+                                                let name_edit = name.clone();
+                                                let ttype_raw = str_at(&t, "target_type").to_string();
+                                                let artifacts_detail = artifacts.clone();
+                                                let artifacts_edit = artifacts.clone();
+                                                rsx! {
+                                                    tr {
+                                                        td { strong { "{name}" } }
+                                                        td { "{ttype}" }
+                                                        td {
+                                                            if let Some(sug) = suggested.clone() {
+                                                                span { class: "badge badge-success", "{sug}" }
+                                                            } else {
+                                                                span { style: "opacity: 0.5;", "—" }
+                                                            }
+                                                        }
+                                                        td { "{artifacts.len()}" }
+                                                        td { "{findings}" }
+                                                        td { style: "display: flex; gap: 4px;",
+                                                            button {
+                                                                class: "btn btn-ghost",
+                                                                title: "Details",
+                                                                onclick: move |_| {
+                                                                    let mut ids = expanded_ids();
+                                                                    if ids.contains(&id_exp) {
+                                                                        ids.retain(|i| i != &id_exp);
+                                                                    } else {
+                                                                        ids.push(id_exp.clone());
+                                                                    }
+                                                                    expanded_ids.set(ids);
+                                                                },
+                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
+                                                            }
+                                                            button {
+                                                                class: "btn btn-ghost",
+                                                                title: "Edit target",
+                                                                onclick: move |_| {
+                                                                    edit_name.set(name_edit.clone());
+                                                                    edit_type.set(ttype_raw.clone());
+                                                                    let arts: Vec<ArtifactInputDto> = artifacts_edit
+                                                                        .iter()
+                                                                        .map(|a| ArtifactInputDto {
+                                                                            kind: str_at(a, "kind").to_string(),
+                                                                            source_ref: str_at(a, "source_ref").to_string(),
+                                                                            branch: a
+                                                                                .get("git")
+                                                                                .and_then(|g| g.get("default_branch"))
+                                                                                .and_then(|b| b.as_str())
+                                                                                .map(String::from),
+                                                                            plc_format: None,
+                                                                        })
+                                                                        .collect();
+                                                                    edit_arts.set(arts);
+                                                                    e_source.set(String::new());
+                                                                    edit_id.set(Some(id_edit.clone()));
+                                                                },
+                                                                Icon { icon: BsPencil, width: 16, height: 16 }
+                                                            }
+                                                            button {
+                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
+                                                                title: "Run scan",
+                                                                disabled: is_scanning,
+                                                                onclick: move |_| {
+                                                                    let id = id_scan.clone();
+                                                                    let mut ids = scanning_ids();
+                                                                    ids.push(id.clone());
+                                                                    scanning_ids.set(ids);
+                                                                    spawn(async move {
+                                                                        match trigger_target_scan(id.clone()).await {
+                                                                            Ok(_) => toasts.push(ToastType::Success, "Scan triggered — findings appear as it runs. Use Refresh."),
+                                                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                                                        }
+                                                                        let mut ids = scanning_ids();
+                                                                        ids.retain(|i| i != &id);
+                                                                        scanning_ids.set(ids);
+                                                                    });
+                                                                },
+                                                                if is_scanning {
+                                                                    span { class: "spinner" }
+                                                                } else {
+                                                                    Icon { icon: BsPlayCircle, width: 16, height: 16 }
+                                                                }
+                                                            }
+                                                            button {
+                                                                class: "btn btn-ghost btn-ghost-danger",
+                                                                title: "Delete target",
+                                                                onclick: move |_| {
+                                                                    confirm_delete.set(Some((id_del.clone(), name_del.clone())));
+                                                                },
+                                                                Icon { icon: BsTrash, width: 16, height: 16 }
+                                                            }
+                                                        }
+                                                    }
+                                                    if is_expanded {
+                                                        tr {
+                                                            td { colspan: "6",
+                                                                div { style: "padding: 12px 8px;",
+                                                                    h4 { style: "margin: 0 0 6px;", "Artifacts" }
+                                                                    if artifacts_detail.is_empty() {
+                                                                        div { style: "opacity: 0.6;", "No artifacts." }
+                                                                    }
+                                                                    for a in artifacts_detail {
+                                                                        div { style: "font-size: 0.9em; padding: 2px 0;",
+                                                                            span { style: "opacity: 0.7;", "{str_at(&a, \"kind\")}: " }
+                                                                            span { style: "font-family: monospace;", "{str_at(&a, \"source_ref\")}" }
+                                                                        }
+                                                                    }
+                                                                    if !facts.is_empty() {
+                                                                        h4 { style: "margin: 12px 0 6px;", "Detected facts" }
+                                                                        for f in facts {
+                                                                            div { style: "font-size: 0.9em; padding: 2px 0;",
+                                                                                span { style: "font-family: monospace;", "{str_at(&f, \"key\")}={str_at(&f, \"value\")}" }
+                                                                                span { style: "opacity: 0.5;", " ({str_at(&f, \"source\")})" }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                    h4 { style: "margin: 12px 0 6px;", "Applicable scans" }
+                                                                    TargetScans { id: id.clone() }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Some(None) => rsx! {
+                div { class: "card", p { "Failed to load targets." } }
+            },
+            None => rsx! {
+                div { class: "loading", "Loading targets..." }
+            },
+        }
+        }
+    }
+}
@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2021"

 [dependencies]
-compliance-core = { workspace = true, features = ["mongodb"] }
+compliance-core = { workspace = true, features = ["mongodb", "axum"] }
 rmcp = { version = "0.16", features = ["server", "macros", "transport-io", "transport-streamable-http-server"] }
 tokio = { workspace = true }
 serde = { workspace = true }
@@ -19,3 +19,6 @@ bson = { version = "2", features = ["chrono-0_4"] }
 schemars = "1.0"
 axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }
+sha2 = { workspace = true }
+hex = { workspace = true }
+dashmap = { workspace = true }
--- a/Show More
+++ b/Show More