ci: Kellnr crates.io mirror + persistent S3-backed sccache

Adopt werkpilot's CI compile-acceleration setup so builds are crates.io-
independent and cached across runs:

- Resolve crates.io deps through the self-hosted Kellnr mirror
  (crates.meghsakha.com) via a .cargo/config.toml source replacement. Git deps
  (tramiton-core) are unaffected.
- Back sccache with Hetzner S3 (breakpilot-sccache bucket, key prefix
  compliance-scanner) instead of an ephemeral /tmp dir — persistent across CI
  runs. Bump sccache to v0.10.0.
- Throttle cargo (CARGO_NET_RETRY, HTTP/1.1) so the ~670-crate download burst
  doesn't 429 the mirror.

Requires repo secrets HETZNER_S3_ACCESS_KEY and HETZNER_S3_SECRET_KEY (same
bucket/creds as werkpilot). Closes #139.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -191,18 +191,13 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
-        env:
-          # PAT for fetching the private tramiton-core git dependency during the
-          # image build (injected as a BuildKit secret, never baked into a layer).
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-agent
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -217,16 +212,13 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
-        env:
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-dashboard
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -262,16 +254,13 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
-        env:
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-mcp
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')

Dockerfile.agent

@@ -2,16 +2,7 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-# compliance-agent depends on the private tramiton-core git repo. Authenticate
+RUN cargo build --release -p compliance-agent
-# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
-# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*

Dockerfile.dashboard

@@ -7,16 +7,7 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-# compliance-agent (a workspace member) depends on the private tramiton-core git
+RUN dx build --release --package compliance-dashboard
-# repo, so the workspace resolve needs it even to build the dashboard.
-# Authenticate the fetch with a PAT passed as a BuildKit secret.
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

Dockerfile.mcp

@@ -2,16 +2,7 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-# compliance-agent (a workspace member) depends on the private tramiton-core git
+RUN cargo build --release -p compliance-mcp
-# repo, so the workspace resolve needs it even to build the mcp binary.
-# Authenticate the fetch with a PAT passed as a BuildKit secret.
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

compliance-agent/src/agent.rs

@@ -63,32 +63,8 @@ impl ComplianceAgent {
         let db = self.db_pool.for_tenant_id(tenant_id).await?;
         let orchestrator =
             PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        if self.config.unified_pipeline {
-            orchestrator.run_target(repo_id, trigger).await
-        } else {
         orchestrator.run(repo_id, trigger).await
     }
-    }
-
-    /// Run a scan for an onboarded target through the unified pipeline,
-    /// unconditionally.
-    ///
-    /// Unlike [`Self::run_scan`], this does *not* consult the
-    /// `unified_pipeline` transition flag: the caller (the `/targets/{id}/scan`
-    /// endpoint) operates on `onboarded_targets` by construction, so it must
-    /// always dispatch to `run_target` regardless of how the legacy paths
-    /// (scheduler, webhooks, `/repositories/{id}/scan`) are configured.
-    pub async fn run_target_scan(
-        &self,
-        tenant_id: &str,
-        target_id: &str,
-        trigger: compliance_core::models::ScanTrigger,
-    ) -> Result<(), crate::error::AgentError> {
-        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-        let orchestrator =
-            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run_target(target_id, trigger).await
-    }
 
     /// Run a PR review: scan the diff and post review comments.
     pub async fn run_pr_review(

compliance-agent/src/api/handlers/mod.rs

@@ -9,7 +9,6 @@ pub mod help_chat;
 pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
-pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod repos;

compliance-agent/src/api/handlers/onboarding.rs

@@ -1,393 +0,0 @@
-//! Onboarding API — CRUD for unified targets, artifact add, classification, and
-//! the scan-applicability matrix. The wizard (and future integrations) drive
-//! onboarding through these endpoints.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::{doc, oid::ObjectId, to_bson};
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
-    TargetType,
-};
-use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-use crate::classify::{classify_target, MockFirmwareDetector};
-
-use super::dto::tenant_db;
-use super::{collect_cursor_async, ApiResponse, PaginationParams};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
-/// id) from it, so clients never set internal fields.
-#[derive(Deserialize)]
-pub struct ArtifactInput {
-    pub kind: ArtifactKind,
-    pub source_ref: String,
-    #[serde(default)]
-    pub branch: Option<String>,
-    #[serde(default)]
-    pub plc_format: Option<PlcFormat>,
-}
-
-impl ArtifactInput {
-    fn build(&self) -> Artifact {
-        let s = self.source_ref.clone();
-        match self.kind {
-            ArtifactKind::GitRepo => {
-                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
-            }
-            ArtifactKind::LiveUrl => Artifact::live_url(s),
-            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
-            ArtifactKind::SourceArchive => Artifact::source_archive(s),
-            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
-            ArtifactKind::ContainerImage => Artifact::container_image(s),
-            ArtifactKind::PlcProject => {
-                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
-            }
-            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
-        }
-    }
-}
-
-#[derive(Deserialize)]
-pub struct CreateTargetRequest {
-    pub name: String,
-    pub target_type: TargetType,
-    #[serde(default)]
-    pub description: Option<String>,
-    #[serde(default)]
-    pub artifacts: Vec<ArtifactInput>,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateTargetRequest {
-    pub name: Option<String>,
-    pub target_type: Option<TargetType>,
-    pub scan_config: Option<TargetScanConfig>,
-    pub compliance_profile: Option<ComplianceProfile>,
-    pub scan_schedule: Option<String>,
-}
-
-/// One applicable-scan option, serialized for the wizard.
-#[derive(Serialize)]
-pub struct ScanOptionDto {
-    pub scan: String,
-    pub default_on: bool,
-    pub rationale: String,
-    pub required_artifact: Option<String>,
-    pub blocked_reason: Option<String>,
-}
-
-#[derive(Serialize)]
-pub struct ApplicableScansResponse {
-    pub scans: Vec<ScanOptionDto>,
-    pub pentest_supported: bool,
-}
-
-fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
-    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
-}
-
-/// GET /api/v1/targets — list onboarded targets (paginated).
-#[tracing::instrument(skip_all)]
-pub async fn list_targets(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .onboarded_targets()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-    let targets = match db
-        .onboarded_targets()
-        .find(doc! {})
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch onboarded targets: {e}");
-            Vec::new()
-        }
-    };
-    Ok(Json(ApiResponse {
-        data: targets,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-/// POST /api/v1/targets — create an onboarded target.
-#[tracing::instrument(skip_all)]
-pub async fn create_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<CreateTargetRequest>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let mut target = OnboardedTarget::new(req.name, req.target_type);
-    target.description = req.description;
-    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
-
-    let db = tenant_db(&agent, &tenant).await?;
-    let res = db
-        .onboarded_targets()
-        .insert_one(&target)
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    target.id = res.inserted_id.as_object_id();
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// GET /api/v1/targets/{id} — fetch one target.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn get_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// PATCH /api/v1/targets/{id} — update mutable fields.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn update_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateTargetRequest>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
-    if let Some(name) = req.name {
-        set.insert("name", name);
-    }
-    if let Some(tt) = req.target_type {
-        set.insert(
-            "target_type",
-            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(sc) = req.scan_config {
-        set.insert(
-            "scan_config",
-            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(cp) = req.compliance_profile {
-        set.insert(
-            "compliance_profile",
-            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(ss) = req.scan_schedule {
-        set.insert("scan_schedule", ss);
-    }
-
-    db.onboarded_targets()
-        .update_one(doc! { "_id": oid }, doc! { "$set": set })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn delete_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    db.onboarded_targets()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    // Cascade the collections keyed by repo_id == target id (best-effort).
-    let by_repo = doc! { "repo_id": &id };
-    let _ = db.findings().delete_many(by_repo.clone()).await;
-    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
-    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
-    let _ = db.cve_alerts().delete_many(by_repo).await;
-    Ok(Json(serde_json::json!({ "status": "deleted" })))
-}
-
-/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn add_artifact(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(input): Json<ArtifactInput>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn applicable_scans_for_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    let scans = applicable_scans(&target)
-        .into_iter()
-        .map(|o| ScanOptionDto {
-            scan: o.scan.to_string(),
-            default_on: o.default_on,
-            rationale: o.rationale,
-            required_artifact: o.required_artifact.map(|k| k.to_string()),
-            blocked_reason: o.blocked_reason,
-        })
-        .collect();
-
-    Ok(Json(ApiResponse {
-        data: ApplicableScansResponse {
-            scans,
-            pentest_supported: supports_pentest(target.target_type),
-        },
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
-///
-/// This is the lightweight pass: it classifies from artifact kinds without
-/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
-/// ingest, with tramiton firmware analysis) is a follow-up background step.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn detect_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let mut target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // No ingested working paths here → kind-based classification only; the mock
-    // firmware detector is never invoked (no firmware working path present).
-    let empty = HashMap::new();
-    let detector = MockFirmwareDetector { detection: None };
-    let classification = classify_target(&target, &empty, &detector)
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    let classification_bson =
-        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    target.classification = Some(classification);
-
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
-///
-/// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
-/// legacy path). Runs in the background and returns immediately.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn trigger_target_scan(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    // 404 if the target doesn't exist for this tenant.
-    if db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .is_none()
-    {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    let agent_clone = (*agent).clone();
-    let tenant_id = tenant.0.tenant_id.clone();
-    tokio::spawn(async move {
-        // Always the unified target pipeline — this endpoint is about an
-        // onboarded target by construction, independent of the global
-        // `unified_pipeline` transition flag used by the legacy paths.
-        if let Err(e) = agent_clone
-            .run_target_scan(
-                &tenant_id,
-                &id,
-                compliance_core::models::ScanTrigger::Manual,
-            )
-            .await
-        {
-            tracing::error!("Manual target scan failed for {id}: {e}");
-        }
-    });
-    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
-}

compliance-agent/src/api/routes.rs

@@ -25,33 +25,6 @@ pub fn build_router() -> Router {
             "/api/v1/repositories/{id}/webhook-config",
             get(handlers::get_webhook_config),
         )
-        // Unified onboarding targets (#131).
-        .route(
-            "/api/v1/targets",
-            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
-        )
-        .route(
-            "/api/v1/targets/{id}",
-            get(handlers::onboarding::get_target)
-                .patch(handlers::onboarding::update_target)
-                .delete(handlers::onboarding::delete_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/artifacts",
-            post(handlers::onboarding::add_artifact),
-        )
-        .route(
-            "/api/v1/targets/{id}/applicable-scans",
-            get(handlers::onboarding::applicable_scans_for_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/detect",
-            post(handlers::onboarding::detect_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/scan",
-            post(handlers::onboarding::trigger_target_scan),
-        )
         .route("/api/v1/findings", get(handlers::list_findings))
         .route("/api/v1/findings/{id}", get(handlers::get_finding))
         .route(

compliance-agent/src/config.rs

@@ -47,12 +47,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
         artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
-        // Defaults ON: the unified onboarded-target pipeline is now the primary
-        // path (no legacy `repositories` data in production). Set
-        // `UNIFIED_PIPELINE=0` to fall back to the legacy repository pipeline.
-        unified_pipeline: env_var_opt("UNIFIED_PIPELINE")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(true),
         ssh_key_path: env_var_opt("SSH_KEY_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),

compliance-agent/src/database.rs

@@ -179,23 +179,6 @@ impl DatabasePool {
             .collect())
     }
 
-    /// Tenant ids for every provisioned tenant database, derived by stripping
-    /// the `<prefix>_` from the database names. Skips the admin database
-    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
-    /// at the cluster level and cannot be recovered here — in practice tenant
-    /// ids are UUIDs and never hit that path. Used by the migration CLI's
-    /// `--all` mode.
-    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
-        let prefix = format!("{}_", self.db_prefix);
-        Ok(self
-            .list_tenant_db_names()
-            .await?
-            .into_iter()
-            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
-            .filter(|id| !id.starts_with('_'))
-            .collect())
-    }
-
     /// Drop the database for a specific tenant. Used by GDPR delete
     /// and tenant offboarding. Idempotent — dropping a non-existent
     /// database is a no-op at the driver level.
@@ -538,13 +521,6 @@ impl Database {
         self.inner.collection("onboarded_targets")
     }
 
-    /// A typed handle to an arbitrary collection by name. For bookkeeping
-    /// collections without a dedicated model (e.g. `schema_migrations`,
-    /// `onboarding_migration_log`).
-    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
-        self.inner.collection(name)
-    }
-
     pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
         self.inner.collection("dast_scan_runs")
     }

compliance-agent/src/lib.rs

@@ -8,7 +8,6 @@ pub mod database;
 pub mod error;
 pub mod ingest;
 pub mod llm;
-pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;

compliance-agent/src/main.rs

@@ -1,50 +1,4 @@
-use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
+use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
-
-/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
-/// unified `onboarded_targets` collection per tenant.
-///
-/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
-async fn run_migration(
-    args: &[String],
-    pool: &database::DatabasePool,
-) -> Result<(), compliance_agent::error::AgentError> {
-    if args.get(2).map(String::as_str) != Some("onboarding") {
-        eprintln!(
-            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
-        );
-        std::process::exit(2);
-    }
-    let has = |flag: &str| args.iter().any(|a| a == flag);
-    let dry_run = has("--dry-run");
-    let revert = has("--revert");
-    let tenant = args
-        .iter()
-        .position(|a| a == "--tenant")
-        .and_then(|i| args.get(i + 1))
-        .cloned();
-
-    let tenants: Vec<String> = if has("--all") {
-        pool.list_tenant_ids().await?
-    } else if let Some(t) = tenant {
-        vec![t]
-    } else {
-        eprintln!("specify --all or --tenant <id>");
-        std::process::exit(2);
-    };
-
-    for tenant_id in tenants {
-        let db = pool.for_tenant_id(&tenant_id).await?;
-        if revert {
-            migrate::onboarding::revert(&db).await?;
-            println!("[{tenant_id}] reverted onboarding backfill");
-        } else {
-            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
-            let prefix = if dry_run { "(dry-run) " } else { "" };
-            println!("[{tenant_id}] {prefix}{report:?}");
-        }
-    }
-    Ok(())
-}
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -77,13 +31,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let db_pool =
         database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
-    // One-shot subcommands run and exit without starting the servers.
-    let args: Vec<String> = std::env::args().collect();
-    if args.get(1).map(String::as_str) == Some("migrate") {
-        run_migration(&args, &db_pool).await?;
-        return Ok(());
-    }
-
     let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
 
     tracing::info!("Starting scheduler...");

compliance-agent/src/migrate/mod.rs

@@ -1,8 +0,0 @@
-//! One-time data migrations.
-//!
-//! Currently just the onboarding backfill ([`onboarding`]), which folds the
-//! legacy `repositories` and `dast_targets` collections into the unified
-//! `onboarded_targets` collection, preserving `_id` so every downstream record
-//! keyed by `repo_id` / `target_id` keeps resolving.
-
-pub mod onboarding;

compliance-agent/src/migrate/onboarding.rs

@@ -1,406 +0,0 @@
-//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
-//!
-//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
-//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
-//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
-//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
-//! existing webhook URLs keep working. The mapping functions are pure and unit
-//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
-//! thin driver over them.
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
-    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
-};
-use futures_util::TryStreamExt;
-use mongodb::bson::{doc, Document};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// Marker id in `schema_migrations` recording that the backfill has run.
-const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
-
-/// Summary of a backfill run.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct MigrationReport {
-    /// Repositories turned into onboarded targets.
-    pub repos_migrated: u64,
-    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
-    pub dast_targets_folded: u64,
-    /// DAST targets with no repo link, migrated as standalone targets.
-    pub dast_targets_standalone: u64,
-    /// Records skipped because a target with that `_id` already existed.
-    pub skipped_existing: u64,
-}
-
-/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
-/// are backend services; a browser app is a web app.
-fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
-    match kind {
-        DastTargetType::WebApp => TargetType::WebApp,
-        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
-    }
-}
-
-/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
-/// auth). Shared by fold-in and standalone migration.
-pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
-    let mut artifact = Artifact::live_url(dast.base_url.clone());
-    artifact.web = Some(WebArtifactConfig {
-        target_kind: dast.target_type.clone(),
-        excluded_paths: dast.excluded_paths.clone(),
-        max_crawl_depth: dast.max_crawl_depth,
-        rate_limit: dast.rate_limit,
-        allow_destructive: dast.allow_destructive,
-    });
-    artifact.auth = dast.auth_config.clone().map(Into::into);
-    artifact
-}
-
-/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
-/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
-/// and auth; tracker config folds into `scan_config`.
-///
-/// `target_type` is a safe default (`BackendService`) — the classifier can
-/// refine it later; `classification` is left `None` (unconfirmed).
-pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
-    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
-    target.id = repo.id;
-
-    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
-    artifact.git = Some(GitArtifactConfig {
-        default_branch: repo.default_branch.clone(),
-        last_scanned_commit: repo.last_scanned_commit.clone(),
-        local_path: repo.local_path.clone(),
-    });
-    if repo.auth_token.is_some() || repo.auth_username.is_some() {
-        artifact.auth = Some(compliance_core::models::ArtifactAuth {
-            method: "token".to_string(),
-            username: repo.auth_username.clone(),
-            secret: repo.auth_token.clone(),
-            ..Default::default()
-        });
-    }
-    target.artifacts.push(artifact);
-
-    if repo.tracker_type.is_some() {
-        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
-            tracker_type: repo.tracker_type.clone(),
-            owner: repo.tracker_owner.clone(),
-            repo: repo.tracker_repo.clone(),
-            token: repo.tracker_token.clone(),
-        });
-    }
-
-    target.scan_schedule = repo.scan_schedule.clone();
-    target.webhook_enabled = repo.webhook_enabled;
-    target.webhook_secret = repo.webhook_secret.clone();
-    target.findings_count = repo.findings_count;
-    target.created_at = repo.created_at;
-    target.updated_at = repo.updated_at;
-    target
-}
-
-/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
-/// target. If the repo default was `BackendService` but the DAST target is a
-/// browser web app, promote the type to `WebApp`.
-pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
-    if matches!(dast.target_type, DastTargetType::WebApp)
-        && target.target_type == TargetType::BackendService
-    {
-        target.target_type = TargetType::WebApp;
-    }
-    if !target.has(ArtifactKind::LiveUrl) {
-        target.artifacts.push(dast_to_artifact(dast));
-    }
-}
-
-/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
-pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
-    let mut target =
-        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
-    target.id = dast.id;
-    target.artifacts.push(dast_to_artifact(dast));
-    target.created_at = dast.created_at;
-    target.updated_at = dast.updated_at;
-    target
-}
-
-/// Whether the onboarding backfill has already been applied to this database.
-pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
-    let found = db
-        .collection_named::<Document>("schema_migrations")
-        .find_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(found.is_some())
-}
-
-/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
-/// tenant database.
-///
-/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
-/// skipped, so re-running is safe. With `dry_run`, computes the report without
-/// writing. The legacy collections are never deleted; the only mutation outside
-/// `onboarded_targets` is the history relink of folded DAST targets, which is
-/// logged so [`revert`] can undo it.
-pub async fn backfill_onboarded_targets(
-    db: &Database,
-    dry_run: bool,
-) -> Result<MigrationReport, AgentError> {
-    let mut report = MigrationReport::default();
-
-    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
-    let mut repos = db.repositories().find(doc! {}).await?;
-    while let Some(repo) = repos.try_next().await? {
-        let Some(id) = repo.id else { continue };
-        if db
-            .onboarded_targets()
-            .find_one(doc! { "_id": id })
-            .await?
-            .is_some()
-        {
-            report.skipped_existing += 1;
-            continue;
-        }
-        if !dry_run {
-            db.onboarded_targets()
-                .insert_one(repo_to_target(&repo))
-                .await?;
-        }
-        report.repos_migrated += 1;
-    }
-
-    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
-    let mut dasts = db.dast_targets().find(doc! {}).await?;
-    while let Some(dast) = dasts.try_next().await? {
-        let Some(dast_id) = dast.id else { continue };
-        let repo_oid = dast
-            .repo_id
-            .as_deref()
-            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
-        let linked = match repo_oid {
-            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
-            None => None,
-        };
-
-        match (linked, repo_oid) {
-            // Fold into an existing repo-derived target.
-            (Some(mut target), Some(oid)) => {
-                if target.has(ArtifactKind::LiveUrl) {
-                    report.skipped_existing += 1; // already folded on a prior run
-                    continue;
-                }
-                fold_dast_into_target(&mut target, &dast);
-                if !dry_run {
-                    db.onboarded_targets()
-                        .replace_one(doc! { "_id": oid }, &target)
-                        .await?;
-                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
-                }
-                report.dast_targets_folded += 1;
-            }
-            // No linked repo target: migrate as a standalone target (keeps _id).
-            _ => {
-                if db
-                    .onboarded_targets()
-                    .find_one(doc! { "_id": dast_id })
-                    .await?
-                    .is_some()
-                {
-                    report.skipped_existing += 1;
-                    continue;
-                }
-                if !dry_run {
-                    db.onboarded_targets()
-                        .insert_one(dast_to_standalone_target(&dast))
-                        .await?;
-                }
-                report.dast_targets_standalone += 1;
-            }
-        }
-    }
-
-    if !dry_run {
-        db.collection_named::<Document>("schema_migrations")
-            .update_one(
-                doc! { "_id": MIGRATION_MARKER },
-                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
-            )
-            .upsert(true)
-            .await?;
-    }
-    Ok(report)
-}
-
-/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
-/// unified target id, logging each move so [`revert`] can undo it.
-///
-/// Note: if multiple DAST targets fold into the same repo target, revert
-/// restores only the last-logged mapping — a rare edge. The source collections
-/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
-async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
-    db.dast_scan_runs()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.pentest_sessions()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.collection_named::<Document>("onboarding_migration_log")
-        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
-        .await?;
-    Ok(())
-}
-
-/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
-/// and the log, and clear the marker. The legacy collections are untouched, so
-/// this restores the pre-migration state.
-pub async fn revert(db: &Database) -> Result<(), AgentError> {
-    let log = db.collection_named::<Document>("onboarding_migration_log");
-    let mut cursor = log.find(doc! {}).await?;
-    while let Some(entry) = cursor.try_next().await? {
-        if let (Ok(old), Ok(new)) = (
-            entry.get_str("old_target_id"),
-            entry.get_str("new_target_id"),
-        ) {
-            db.dast_scan_runs()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-            db.pentest_sessions()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-        }
-    }
-    db.onboarded_targets().drop().await?;
-    log.drop().await?;
-    db.collection_named::<Document>("schema_migrations")
-        .delete_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{DastAuthConfig, TrackerType};
-
-    fn repo() -> TrackedRepository {
-        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
-        r.id = Some(mongodb::bson::oid::ObjectId::new());
-        r.default_branch = "develop".to_string();
-        r.last_scanned_commit = Some("abc123".to_string());
-        r.auth_token = Some("pat".to_string());
-        r.auth_username = Some("bob".to_string());
-        r.tracker_type = Some(TrackerType::Gitea);
-        r.tracker_owner = Some("acme".to_string());
-        r.findings_count = 7;
-        r
-    }
-
-    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
-        let mut d = DastTarget::new(
-            "acme-web".to_string(),
-            "https://acme.example.com".to_string(),
-            kind,
-        );
-        d.id = Some(mongodb::bson::oid::ObjectId::new());
-        d.repo_id = repo_id;
-        d.max_crawl_depth = 5;
-        d.auth_config = Some(DastAuthConfig {
-            method: "bearer".to_string(),
-            login_url: None,
-            username: None,
-            password: None,
-            token: Some("tok".to_string()),
-            headers: None,
-        });
-        d
-    }
-
-    #[test]
-    fn repo_maps_preserving_id_and_git_artifact() {
-        let r = repo();
-        let t = repo_to_target(&r);
-        assert_eq!(t.id, r.id); // id preserved
-        assert_eq!(t.findings_count, 7);
-        assert_eq!(t.scan_schedule, r.scan_schedule);
-        let git = t.code_artifact().expect("git artifact");
-        assert_eq!(git.kind, ArtifactKind::GitRepo);
-        assert_eq!(git.source_ref, "https://git/acme.git");
-        let gc = git.git.as_ref().expect("git config");
-        assert_eq!(gc.default_branch, "develop");
-        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
-        let auth = git.auth.as_ref().expect("auth");
-        assert_eq!(auth.secret.as_deref(), Some("pat"));
-        assert_eq!(auth.username.as_deref(), Some("bob"));
-        assert_eq!(
-            t.scan_config
-                .issue_tracker
-                .as_ref()
-                .and_then(|it| it.tracker_type.clone()),
-            Some(TrackerType::Gitea)
-        );
-    }
-
-    #[test]
-    fn standalone_dast_maps_preserving_id_and_live_url() {
-        let d = dast(None, DastTargetType::WebApp);
-        let t = dast_to_standalone_target(&d);
-        assert_eq!(t.id, d.id);
-        assert_eq!(t.target_type, TargetType::WebApp);
-        let url = t.live_url().expect("live url");
-        assert_eq!(url.source_ref, "https://acme.example.com");
-        let web = url.web.as_ref().expect("web config");
-        assert_eq!(web.max_crawl_depth, 5);
-        assert_eq!(
-            url.auth.as_ref().and_then(|a| a.secret.clone()),
-            Some("tok".to_string())
-        );
-    }
-
-    #[test]
-    fn rest_api_dast_maps_to_backend_service() {
-        let d = dast(None, DastTargetType::RestApi);
-        assert_eq!(
-            dast_to_standalone_target(&d).target_type,
-            TargetType::BackendService
-        );
-    }
-
-    #[test]
-    fn fold_adds_live_url_and_promotes_webapp() {
-        let mut t = repo_to_target(&repo());
-        assert_eq!(t.target_type, TargetType::BackendService);
-        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
-        assert_eq!(t.target_type, TargetType::WebApp); // promoted
-        assert!(t.has(ArtifactKind::LiveUrl));
-        assert!(t.has(ArtifactKind::GitRepo));
-    }
-
-    #[test]
-    fn fold_is_idempotent_on_live_url() {
-        let mut t = repo_to_target(&repo());
-        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
-        fold_dast_into_target(&mut t, &d);
-        fold_dast_into_target(&mut t, &d);
-        let live_urls = t
-            .artifacts
-            .iter()
-            .filter(|a| a.kind == ArtifactKind::LiveUrl)
-            .count();
-        assert_eq!(live_urls, 1);
-    }
-}

compliance-agent/src/pentest/cleanup.rs

@@ -342,7 +342,6 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
-            unified_pipeline: false,
         }
     }
 

compliance-agent/src/pipeline/mod.rs

@@ -8,7 +8,6 @@ mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
-pub mod plan;
 mod pr_review;
 pub mod sbom;
 pub mod semgrep;

compliance-agent/src/pipeline/orchestrator.rs

@@ -15,7 +15,6 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
-use crate::pipeline::plan::build_scan_plan;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
 
@@ -420,260 +419,6 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
-    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
-    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
-    /// `onboarded_targets` and dispatches by the scan plan.
-    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
-    pub async fn run_target(
-        &self,
-        target_id: &str,
-        trigger: ScanTrigger,
-    ) -> Result<(), AgentError> {
-        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
-            .map_err(|e| AgentError::Other(e.to_string()))?;
-        let target = self
-            .db
-            .onboarded_targets()
-            .find_one(doc! { "_id": oid })
-            .await?
-            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
-
-        let scan_run = ScanRun::new(target_id.to_string(), trigger);
-        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
-        let scan_run_id = insert
-            .inserted_id
-            .as_object_id()
-            .map(|id| id.to_hex())
-            .unwrap_or_default();
-
-        let result = self.run_target_pipeline(&target, &scan_run_id).await;
-        match &result {
-            Ok(count) => {
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! { "$set": {
-                            "status": "completed",
-                            "current_phase": "completed",
-                            "new_findings_count": *count as i64,
-                            "completed_at": mongodb::bson::DateTime::now(),
-                        } },
-                    )
-                    .await?;
-            }
-            Err(e) => {
-                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! { "$set": {
-                            "status": "failed",
-                            "error_message": e.to_string(),
-                            "completed_at": mongodb::bson::DateTime::now(),
-                        } },
-                    )
-                    .await?;
-            }
-        }
-        result.map(|_| ())
-    }
-
-    /// Run the applicable scans for a target. For a code target this reuses the
-    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
-    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
-    /// follow-ups (#128/#129/#130). Returns the number of new findings.
-    async fn run_target_pipeline(
-        &self,
-        target: &OnboardedTarget,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
-        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
-        let plan = build_scan_plan(target);
-        tracing::info!(
-            target_id = %target_id,
-            target_type = %target.target_type,
-            planned_steps = plan.steps.len(),
-            "Unified pipeline: scan plan built"
-        );
-
-        // Ingest + classify (tramiton for firmware) and store the detected type.
-        self.classify_and_store(target, &target_id, scan_run_id)
-            .await;
-        // Provision a DAST target from a LiveUrl artifact so DAST fires for
-        // wizard-created targets, not just migrated ones.
-        self.ensure_dast_target(target, &plan).await;
-
-        match target.code_artifact() {
-            Some(code) if code.kind == ArtifactKind::GitRepo => {
-                let repo = repo_view_from_target(target, code);
-                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
-                self.finalize_target(target, &repo, new_count).await?;
-                Ok(new_count)
-            }
-            Some(_) => {
-                tracing::warn!(
-                    target_id = %target_id,
-                    "Unified pipeline: source-archive scanning not yet wired; skipping"
-                );
-                Ok(0)
-            }
-            None => {
-                // No code to scan. Firmware/PLC/mobile static scanners land in
-                // #128/#129/#130; DAST for a running URL still works when a
-                // DastTarget row exists (migrated targets).
-                tracing::info!(
-                    target_id = %target_id,
-                    "Unified pipeline: no code artifact; attempting DAST only"
-                );
-                self.update_phase(scan_run_id, "dast_scanning").await;
-                self.maybe_trigger_dast(&target_id, scan_run_id).await;
-                Ok(0)
-            }
-        }
-    }
-
-    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
-    /// heuristics otherwise), and store the detected classification on the target.
-    /// Best-effort — never fails the scan.
-    async fn classify_and_store(
-        &self,
-        target: &OnboardedTarget,
-        target_id: &str,
-        scan_run_id: &str,
-    ) {
-        self.update_phase(scan_run_id, "classification").await;
-        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
-        let ingest_set = match crate::ingest::ingest_all(target, &ctx) {
-            Ok(set) => set,
-            Err(e) => {
-                tracing::warn!(target_id, error = %e, "Unified pipeline: ingest for classification failed");
-                return;
-            }
-        };
-        let working_paths = ingest_set.working_paths();
-        match crate::classify::classify_target(
-            target,
-            &working_paths,
-            &crate::classify::TramitonNative,
-        )
-        .await
-        {
-            Ok(classification) => {
-                tracing::info!(
-                    target_id,
-                    suggested = %classification.suggested,
-                    "Unified pipeline: classified target"
-                );
-                if let (Some(oid), Ok(bson)) = (target.id, mongodb::bson::to_bson(&classification))
-                {
-                    let _ = self
-                        .db
-                        .onboarded_targets()
-                        .update_one(
-                            doc! { "_id": oid },
-                            doc! { "$set": { "classification": bson } },
-                        )
-                        .await;
-                }
-            }
-            Err(e) => {
-                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
-            }
-        }
-    }
-
-    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
-    /// `DastTarget` (keyed by `repo_id` = target id) so the existing DAST trigger
-    /// fires for wizard-created targets. Idempotent.
-    async fn ensure_dast_target(
-        &self,
-        target: &OnboardedTarget,
-        plan: &crate::pipeline::plan::ScanPlan,
-    ) {
-        if !plan.has(ScanType::Dast) {
-            return;
-        }
-        let (Some(url), Some(oid)) = (target.live_url(), target.id) else {
-            return;
-        };
-        let target_id = oid.to_hex();
-        if self
-            .db
-            .dast_targets()
-            .find_one(doc! { "repo_id": &target_id })
-            .await
-            .ok()
-            .flatten()
-            .is_some()
-        {
-            return; // already provisioned
-        }
-        let kind = url
-            .web
-            .as_ref()
-            .map(|w| w.target_kind.clone())
-            .unwrap_or(DastTargetType::WebApp);
-        let mut dast = DastTarget::new(target.name.clone(), url.source_ref.clone(), kind);
-        dast.repo_id = Some(target_id);
-        if let Some(web) = &url.web {
-            dast.excluded_paths = web.excluded_paths.clone();
-            dast.max_crawl_depth = web.max_crawl_depth;
-            dast.rate_limit = web.rate_limit;
-            dast.allow_destructive = web.allow_destructive;
-        }
-        if let Some(auth) = &url.auth {
-            dast.auth_config = Some(DastAuthConfig {
-                method: auth.method.clone(),
-                login_url: auth.login_url.clone(),
-                username: auth.username.clone(),
-                password: None,
-                token: auth.secret.clone(),
-                headers: auth.headers.clone(),
-            });
-        }
-        if let Err(e) = self.db.dast_targets().insert_one(&dast).await {
-            tracing::warn!(error = %e, "Unified pipeline: failed to provision DAST target");
-        }
-    }
-
-    /// Sync the onboarded-target document after a scan: bump `findings_count`
-    /// and advance the git artifact's `last_scanned_commit` watermark.
-    async fn finalize_target(
-        &self,
-        target: &OnboardedTarget,
-        repo: &TrackedRepository,
-        new_count: u32,
-    ) -> Result<(), AgentError> {
-        let oid = match target.id {
-            Some(id) => id,
-            None => return Ok(()),
-        };
-        self.db
-            .onboarded_targets()
-            .update_one(
-                doc! { "_id": oid },
-                doc! {
-                    "$inc": { "findings_count": new_count as i64 },
-                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
-                },
-            )
-            .await?;
-
-        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
-        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
-            self.db
-                .onboarded_targets()
-                .update_one(
-                    doc! { "_id": oid, "artifacts.id": &code.id },
-                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
-                )
-                .await?;
-        }
-        Ok(())
-    }
-
     pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
             let _ = self
@@ -691,37 +436,6 @@ impl PipelineOrchestrator {
     }
 }
 
-/// Build a legacy `TrackedRepository` view from an onboarded target's code
-/// artifact, so the unified pipeline can reuse the existing repo pipeline. The
-/// inverse of the migration's `repo_to_target`. `_id` is preserved so findings
-/// and DAST lookups resolve against the same key.
-fn repo_view_from_target(target: &OnboardedTarget, code: &Artifact) -> TrackedRepository {
-    let mut repo = TrackedRepository::new(target.name.clone(), code.source_ref.clone());
-    repo.id = target.id;
-    if let Some(git) = &code.git {
-        repo.default_branch = git.default_branch.clone();
-        repo.last_scanned_commit = git.last_scanned_commit.clone();
-        repo.local_path = git.local_path.clone();
-    }
-    if let Some(auth) = &code.auth {
-        repo.auth_token = auth.secret.clone();
-        repo.auth_username = auth.username.clone();
-    }
-    if let Some(it) = &target.scan_config.issue_tracker {
-        repo.tracker_type = it.tracker_type.clone();
-        repo.tracker_owner = it.owner.clone();
-        repo.tracker_repo = it.repo.clone();
-        repo.tracker_token = it.token.clone();
-    }
-    repo.scan_schedule = target.scan_schedule.clone();
-    repo.webhook_enabled = target.webhook_enabled;
-    repo.webhook_secret = target.webhook_secret.clone();
-    repo.findings_count = target.findings_count;
-    repo.created_at = target.created_at;
-    repo.updated_at = target.updated_at;
-    repo
-}
-
 /// Extract the scheme + host from a git URL.
 /// e.g. "https://gitea.example.com/owner/repo.git" -> "https://gitea.example.com"
 /// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" -> "https://gitea.example.com"
@@ -746,50 +460,3 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
         None
     }
 }
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{
-        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
-    };
-
-    #[test]
-    fn repo_view_preserves_id_git_auth_and_tracker() {
-        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
-        target.id = Some(mongodb::bson::oid::ObjectId::new());
-        target.findings_count = 3;
-        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
-            tracker_type: Some(TrackerType::Gitea),
-            owner: Some("acme".to_string()),
-            repo: Some("web".to_string()),
-            token: Some("tt".to_string()),
-        });
-
-        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
-        if let Some(git) = artifact.git.as_mut() {
-            git.last_scanned_commit = Some("abc123".to_string());
-        }
-        artifact.auth = Some(ArtifactAuth {
-            method: "token".to_string(),
-            username: Some("bob".to_string()),
-            secret: Some("pat".to_string()),
-            ..Default::default()
-        });
-        target.artifacts.push(artifact);
-
-        let code = target.code_artifact().expect("code artifact");
-        let repo = repo_view_from_target(&target, code);
-
-        assert_eq!(repo.id, target.id); // preserved
-        assert_eq!(repo.git_url, "https://git/acme.git");
-        assert_eq!(repo.default_branch, "develop");
-        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
-        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
-        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
-        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
-        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
-        assert_eq!(repo.findings_count, 3);
-    }
-}

compliance-agent/src/pipeline/plan.rs

@@ -1,195 +0,0 @@
-//! The scan plan.
-//!
-//! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
-//! list of scans to run, each bound to the artifact it consumes. It intersects
-//! the scan-applicability matrix ([`applicable_scans`]) with the target's
-//! `scan_config` overrides: a scan runs when its required artifact is present and
-//! it is either on by default or explicitly enabled, and is not explicitly
-//! disabled. This is the decision engine the unified pipeline (`run_target`)
-//! executes.
-
-use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
-use compliance_core::scan_matrix::applicable_scans;
-
-/// One scan to run, bound to the artifact it operates on.
-#[derive(Debug, Clone, PartialEq)]
-pub struct ScanStep {
-    /// The scan to run.
-    pub scan_type: ScanType,
-    /// The pipeline phase to report while it runs.
-    pub phase: ScanPhase,
-    /// The id of the artifact this scan consumes ([`Artifact::id`]).
-    pub artifact_id: String,
-}
-
-/// The ordered set of scans to run for a target.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct ScanPlan {
-    /// The scans, in matrix order.
-    pub steps: Vec<ScanStep>,
-}
-
-impl ScanPlan {
-    /// Whether the plan contains a step for the given scan type.
-    pub fn has(&self, scan: ScanType) -> bool {
-        self.steps.iter().any(|s| s.scan_type == scan)
-    }
-
-    /// Whether the plan is empty (nothing to run).
-    pub fn is_empty(&self) -> bool {
-        self.steps.is_empty()
-    }
-}
-
-/// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
-/// bound to the artifact it consumes. Scans whose required artifact is absent, or
-/// that are disabled, or off-by-default and not explicitly enabled, are dropped.
-pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
-    let enabled = &target.scan_config.enabled_scans;
-    let disabled = &target.scan_config.disabled_scans;
-
-    let mut steps = Vec::new();
-    for option in applicable_scans(target) {
-        // Required artifact missing → not runnable.
-        if option.blocked_reason.is_some() {
-            continue;
-        }
-        // Explicit opt-out wins.
-        if disabled.contains(&option.scan) {
-            continue;
-        }
-        // Run if on by default, or explicitly enabled.
-        if !option.default_on && !enabled.contains(&option.scan) {
-            continue;
-        }
-        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
-            continue;
-        };
-        steps.push(ScanStep {
-            scan_type: option.scan,
-            phase: phase_for(option.scan),
-            artifact_id: artifact.id.clone(),
-        });
-    }
-    ScanPlan { steps }
-}
-
-/// Resolve the artifact a scan consumes. A "code" requirement (represented by
-/// `GitRepo`) is satisfied by a git repo *or* a source archive.
-fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
-    match required {
-        Some(ArtifactKind::GitRepo) => target.code_artifact(),
-        Some(kind) => target.first_of(kind),
-        None => target.code_artifact().or_else(|| target.artifacts.first()),
-    }
-}
-
-/// The pipeline phase reported while a given scan runs.
-fn phase_for(scan: ScanType) -> ScanPhase {
-    match scan {
-        ScanType::Sast => ScanPhase::Sast,
-        ScanType::Sbom => ScanPhase::SbomGeneration,
-        ScanType::Cve => ScanPhase::CveScanning,
-        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
-        ScanType::SecretDetection => ScanPhase::SecretDetection,
-        ScanType::Lint => ScanPhase::LintScanning,
-        ScanType::CodeReview => ScanPhase::CodeReview,
-        ScanType::Graph => ScanPhase::GraphBuilding,
-        ScanType::Dast => ScanPhase::DastScanning,
-        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
-        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
-        ScanType::MobileStatic => ScanPhase::MobileStatic,
-        ScanType::ContainerScan => ScanPhase::ContainerScan,
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{PlcFormat, TargetType};
-
-    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
-        let mut t = OnboardedTarget::new("t".to_string(), target_type);
-        t.artifacts = artifacts;
-        t
-    }
-
-    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
-        plan.steps.iter().find(|s| s.scan_type == scan)
-    }
-
-    #[test]
-    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
-        let code = Artifact::git_repo("https://git/x", "main");
-        let url = Artifact::live_url("https://x");
-        let (code_id, url_id) = (code.id.clone(), url.id.clone());
-        let t = target(TargetType::WebApp, vec![code, url]);
-
-        let plan = build_scan_plan(&t);
-        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
-        assert_eq!(sast.artifact_id, code_id);
-        assert_eq!(sast.phase, ScanPhase::Sast);
-        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
-        assert_eq!(dast.artifact_id, url_id);
-    }
-
-    #[test]
-    fn webapp_without_url_omits_dast() {
-        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
-        let plan = build_scan_plan(&t);
-        assert!(plan.has(ScanType::Sast));
-        assert!(!plan.has(ScanType::Dast));
-    }
-
-    #[test]
-    fn code_scan_binds_to_source_archive_when_no_git_repo() {
-        let arc = Artifact::source_archive("src.zip");
-        let arc_id = arc.id.clone();
-        let t = target(TargetType::BackendService, vec![arc]);
-        let plan = build_scan_plan(&t);
-        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
-        assert_eq!(sast.artifact_id, arc_id);
-    }
-
-    #[test]
-    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
-        let fw = Artifact::firmware_image("fw.bin");
-        let fw_id = fw.id.clone();
-        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
-        let plan = build_scan_plan(&t);
-        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
-        assert_eq!(sbom.artifact_id, fw_id);
-        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
-        assert!(!plan.has(ScanType::Dast));
-    }
-
-    #[test]
-    fn plc_plans_only_control_logic() {
-        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
-        let t = target(TargetType::PlcSps, vec![plc]);
-        let plan = build_scan_plan(&t);
-        assert_eq!(plan.steps.len(), 1);
-        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
-        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
-    }
-
-    #[test]
-    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
-        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
-        t.scan_config.disabled_scans = vec![ScanType::Lint];
-        // CodeReview is off by default for web; enable it explicitly.
-        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
-        let plan = build_scan_plan(&t);
-        assert!(!plan.has(ScanType::Lint));
-        assert!(plan.has(ScanType::CodeReview));
-        assert!(plan.has(ScanType::Sast));
-    }
-
-    #[test]
-    fn no_code_artifact_yields_empty_plan_for_web() {
-        let t = target(TargetType::WebApp, vec![]);
-        let plan = build_scan_plan(&t);
-        assert!(plan.is_empty());
-    }
-}

compliance-agent/src/scheduler.rs

@@ -288,25 +288,25 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
         None => return,
     };
 
-    let cursor = match db.onboarded_targets().find(doc! {}).await {
+    let cursor = match db.repositories().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("Failed to list targets for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
             return;
         }
     };
 
-    let targets: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+    let repos: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
 
-    for target in targets {
+    for repo in repos {
-        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
+        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
         if let Err(e) = agent
-            .run_target_scan(tenant_id, &target_id, ScanTrigger::Scheduled)
+            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
             .await
         {
             tracing::error!(
                 "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                target.name
+                repo.name
             );
         }
     }

compliance-agent/tests/common/mod.rs

@@ -25,9 +25,8 @@ impl TestServer {
         let mongodb_uri = std::env::var("TEST_MONGODB_URI")
             .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
 
-        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // Unique database name per test run to avoid collisions
-        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
-        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
 
         let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await
@@ -70,7 +69,6 @@ impl TestServer {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
-            unified_pipeline: false,
         };
 
         let agent = ComplianceAgent::new(config, db_pool);

compliance-agent/tests/integration/api/mod.rs

@@ -2,6 +2,5 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
-mod onboarding;
 mod repositories;
 mod stats;

compliance-agent/tests/integration/api/onboarding.rs

@@ -1,115 +0,0 @@
-use crate::common::TestServer;
-use serde_json::json;
-
-#[tokio::test]
-async fn create_list_and_applicable_scans() {
-    let server = TestServer::start().await;
-
-    // Initially empty.
-    let resp = server.get("/api/v1/targets").await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    // Create a web-app target with a git repo + a live URL.
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({
-                "name": "acme-web",
-                "target_type": "web_app",
-                "artifacts": [
-                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
-                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
-                ]
-            }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-    assert!(!id.is_empty());
-    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
-
-    // List returns it.
-    let resp = server.get("/api/v1/targets").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 1);
-
-    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
-    let resp = server
-        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let scans = body["data"]["scans"].as_array().unwrap();
-    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
-    assert!(names.contains(&"sast"));
-    assert!(names.contains(&"dast"));
-    assert_eq!(body["data"]["pentest_supported"], true);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn detect_classifies_a_plc_target() {
-    let server = TestServer::start().await;
-
-    // A PLC project artifact is a strong kind-based signal.
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({
-                "name": "line-controller",
-                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
-                "artifacts": [
-                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
-                ]
-            }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-
-    let resp = server
-        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn add_artifact_and_delete_target() {
-    let server = TestServer::start().await;
-
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({ "name": "svc", "target_type": "backend_service" }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-
-    // Attach a git repo.
-    let resp = server
-        .post(
-            &format!("/api/v1/targets/{id}/artifacts"),
-            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
-
-    // Delete it.
-    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
-    assert_eq!(resp.status(), 200);
-    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
-    assert_eq!(resp.status(), 404);
-
-    server.cleanup().await;
-}

compliance-agent/tests/integration/migration.rs

@@ -1,156 +0,0 @@
-// Integration tests for the onboarding backfill migration.
-//
-// Requires MongoDB (set TEST_MONGODB_URI if not at the default).
-// Not run in CI (which is `--lib` only) — run locally:
-//   cargo test -p compliance-agent --test e2e migration
-
-use compliance_agent::database::{Database, DatabasePool};
-use compliance_agent::migrate::onboarding;
-use compliance_core::models::{
-    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
-};
-use mongodb::bson::{doc, Document};
-
-async fn fresh_db() -> (DatabasePool, String, Database) {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
-    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
-    let pool = DatabasePool::connect(&uri, &prefix)
-        .await
-        .expect("connect mongo");
-    let db = pool.for_tenant_id("t1").await.expect("tenant db");
-    (pool, prefix, db)
-}
-
-async fn cleanup(pool: &DatabasePool, prefix: &str) {
-    if let Ok(names) = pool.client().list_database_names().await {
-        for n in names {
-            if n.starts_with(prefix) {
-                pool.client().database(&n).drop().await.ok();
-            }
-        }
-    }
-}
-
-#[tokio::test]
-async fn backfill_folds_relinks_is_idempotent_and_reversible() {
-    let (pool, prefix, db) = fresh_db().await;
-
-    // Seed a repo.
-    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
-    let repo_id = db
-        .repositories()
-        .insert_one(repo)
-        .await
-        .expect("insert repo")
-        .inserted_id
-        .as_object_id()
-        .expect("repo oid");
-
-    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
-    let mut linked = DastTarget::new(
-        "acme-web".into(),
-        "https://acme.example.com".into(),
-        DastTargetType::WebApp,
-    );
-    linked.repo_id = Some(repo_id.to_hex());
-    let linked_id = db
-        .dast_targets()
-        .insert_one(linked)
-        .await
-        .expect("insert linked dast")
-        .inserted_id
-        .as_object_id()
-        .expect("linked oid");
-
-    // A repo-less DAST target (standalone).
-    let standalone = DastTarget::new(
-        "acme-api".into(),
-        "https://api.acme.com".into(),
-        DastTargetType::RestApi,
-    );
-    let standalone_id = db
-        .dast_targets()
-        .insert_one(standalone)
-        .await
-        .expect("insert standalone dast")
-        .inserted_id
-        .as_object_id()
-        .expect("standalone oid");
-
-    // A DAST scan run pointing at the linked target — should be relinked to the repo.
-    db.collection_named::<Document>("dast_scan_runs")
-        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
-        .await
-        .expect("insert dast run");
-
-    // --- Backfill ---
-    assert!(!onboarding::already_applied(&db).await.unwrap());
-    let report = onboarding::backfill_onboarded_targets(&db, false)
-        .await
-        .expect("backfill");
-    assert_eq!(report.repos_migrated, 1);
-    assert_eq!(report.dast_targets_folded, 1);
-    assert_eq!(report.dast_targets_standalone, 1);
-    assert!(onboarding::already_applied(&db).await.unwrap());
-
-    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
-    let repo_target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": repo_id })
-        .await
-        .unwrap()
-        .expect("repo target");
-    assert!(repo_target.has(ArtifactKind::GitRepo));
-    assert!(repo_target.has(ArtifactKind::LiveUrl));
-    assert_eq!(repo_target.target_type, TargetType::WebApp);
-
-    // Standalone target: preserved _id, live-url, backend service.
-    let standalone_target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": standalone_id })
-        .await
-        .unwrap()
-        .expect("standalone target");
-    assert!(standalone_target.has(ArtifactKind::LiveUrl));
-    assert_eq!(standalone_target.target_type, TargetType::BackendService);
-
-    // The DAST run was relinked from the old dast id to the repo (unified) id.
-    let run = db
-        .collection_named::<Document>("dast_scan_runs")
-        .find_one(doc! {})
-        .await
-        .unwrap()
-        .expect("run");
-    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
-
-    // --- Idempotent: re-run migrates nothing new ---
-    let again = onboarding::backfill_onboarded_targets(&db, false)
-        .await
-        .expect("backfill again");
-    assert_eq!(again.repos_migrated, 0);
-    assert_eq!(again.dast_targets_folded, 0);
-    assert_eq!(again.dast_targets_standalone, 0);
-    assert!(again.skipped_existing >= 2);
-
-    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
-    onboarding::revert(&db).await.expect("revert");
-    assert_eq!(
-        db.onboarded_targets()
-            .count_documents(doc! {})
-            .await
-            .unwrap(),
-        0
-    );
-    let run_after = db
-        .collection_named::<Document>("dast_scan_runs")
-        .find_one(doc! {})
-        .await
-        .unwrap()
-        .expect("run");
-    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
-    assert!(!onboarding::already_applied(&db).await.unwrap());
-
-    cleanup(&pool, &prefix).await;
-}

compliance-agent/tests/integration/mod.rs

@@ -7,4 +7,3 @@
 // Or nightly: (via CI with MongoDB service container)
 
 mod api;
-mod migration;

compliance-core/src/config.rs

@@ -49,11 +49,6 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
-    /// When true, `run_scan` dispatches to the unified `run_target` pipeline
-    /// (reads `onboarded_targets`) instead of the legacy repository pipeline.
-    /// Env `UNIFIED_PIPELINE`. Defaults on; set `UNIFIED_PIPELINE=0` to use the
-    /// legacy repository pipeline.
-    pub unified_pipeline: bool,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-dashboard/src/app.rs

@@ -12,10 +12,6 @@ pub enum Route {
         OverviewPage {},
         #[route("/repositories")]
         RepositoriesPage {},
-        #[route("/targets")]
-        TargetsPage {},
-        #[route("/onboard")]
-        OnboardingPage {},
         #[route("/findings")]
         FindingsPage {},
         #[route("/findings/:id")]

compliance-dashboard/src/components/sidebar.rs

@@ -24,15 +24,10 @@ pub fn Sidebar() -> Element {
             icon: rsx! { Icon { icon: BsSpeedometer2, width: 18, height: 18 } },
         },
         NavItem {
-            label: "Targets",
+            label: "Repositories",
-            route: Route::TargetsPage {},
+            route: Route::RepositoriesPage {},
             icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
         },
-        NavItem {
-            label: "Onboard",
-            route: Route::OnboardingPage {},
-            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
-        },
         NavItem {
             label: "Findings",
             route: Route::FindingsPage {},

compliance-dashboard/src/infrastructure/mod.rs

@@ -10,7 +10,6 @@ pub mod issues;
 pub mod mcp;
 pub mod mcp_tokens;
 pub mod notifications;
-pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -1,139 +0,0 @@
-//! Server functions for the onboarding wizard — proxy to the agent's
-//! `/api/v1/targets` endpoints.
-
-use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-/// One artifact the wizard collects for a target.
-#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
-pub struct ArtifactInputDto {
-    pub kind: String,
-    pub source_ref: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plc_format: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct TargetsResponse {
-    pub data: Vec<serde_json::Value>,
-    pub total: Option<u64>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct TargetResponse {
-    pub data: serde_json::Value,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ApplicableScansData {
-    #[serde(default)]
-    pub scans: Vec<serde_json::Value>,
-    #[serde(default)]
-    pub pentest_supported: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ApplicableScansResponse {
-    pub data: ApplicableScansData,
-}
-
-/// List onboarded targets.
-#[server]
-pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get("/api/v1/targets")
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Create a target with the collected artifacts.
-#[server]
-pub async fn create_target(
-    name: String,
-    target_type: String,
-    description: Option<String>,
-    artifacts: Vec<ArtifactInputDto>,
-) -> Result<TargetResponse, ServerFnError> {
-    let body = serde_json::json!({
-        "name": name,
-        "target_type": target_type,
-        "description": description,
-        "artifacts": artifacts,
-    });
-    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
-        .await?
-        .json(&body)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Run kind-based classification on a target.
-#[server]
-pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/detect"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Fetch the scan-applicability matrix for a target.
-#[server]
-pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Delete a target (and cascade its findings / SBOM / scan runs / CVE alerts).
-#[server]
-pub async fn delete_target(id: String) -> Result<serde_json::Value, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::DELETE,
-        &format!("/api/v1/targets/{id}"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Trigger a scan for a target.
-#[server]
-pub async fn trigger_target_scan(id: String) -> Result<serde_json::Value, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/scan"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}

compliance-dashboard/src/pages/mod.rs

@@ -12,13 +12,11 @@ pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
 pub mod mcp_tokens;
-pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
 pub mod repositories;
 pub mod sbom;
-pub mod targets;
 
 pub use chat::ChatPage;
 pub use chat_index::ChatIndexPage;
@@ -34,10 +32,8 @@ pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
 pub use mcp_tokens::McpTokensPage;
-pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
 pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
-pub use targets::TargetsPage;

compliance-dashboard/src/pages/onboarding.rs

@@ -1,402 +0,0 @@
-use dioxus::prelude::*;
-
-use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::{
-    create_target, detect_target, fetch_applicable_scans, trigger_target_scan, ArtifactInputDto,
-};
-
-/// (value, label, one-line description) for the 9 target families.
-const TARGET_TYPES: &[(&str, &str, &str)] = &[
-    ("web_app", "Web Application", "Front end + server"),
-    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
-    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
-    ("android_app", "Android App", "APK / AAB"),
-    ("ios_app", "iOS App", "IPA"),
-    (
-        "firmware_bare_metal",
-        "Firmware — bare metal",
-        "No operating system",
-    ),
-    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
-    (
-        "embedded_linux_yocto",
-        "Embedded Linux / Yocto",
-        "BSP + image",
-    ),
-    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
-];
-
-/// (value, label) for the artifact kinds a user can attach.
-const ARTIFACT_KINDS: &[(&str, &str)] = &[
-    ("git_repo", "Git repository"),
-    ("source_archive", "Source archive (zip)"),
-    ("firmware_image", "Firmware image"),
-    ("mobile_package", "Mobile package (APK/IPA)"),
-    ("container_image", "Container image"),
-    ("live_url", "Live URL"),
-    ("plc_project", "PLC project"),
-    ("plaintext_description", "Description (text)"),
-];
-
-const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
-
-/// One row in the applicable-scans list on the success step.
-#[component]
-fn ScanRow(scan: serde_json::Value) -> Element {
-    let name = scan
-        .get("scan")
-        .and_then(|v| v.as_str())
-        .unwrap_or("?")
-        .to_string();
-    let rationale = scan
-        .get("rationale")
-        .and_then(|v| v.as_str())
-        .unwrap_or("")
-        .to_string();
-    let blocked = scan
-        .get("blocked_reason")
-        .and_then(|v| v.as_str())
-        .map(String::from);
-    let default_on = scan
-        .get("default_on")
-        .and_then(|v| v.as_bool())
-        .unwrap_or(false);
-    let badge_class = if blocked.is_some() {
-        "badge badge-info"
-    } else if default_on {
-        "badge badge-success"
-    } else {
-        "badge"
-    };
-    rsx! {
-        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
-            span { class: "{badge_class}", "{name}" }
-            span { style: "opacity: 0.8;", "{rationale}" }
-            if let Some(b) = blocked {
-                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
-            }
-        }
-    }
-}
-
-fn kind_label(kind: &str) -> &str {
-    ARTIFACT_KINDS
-        .iter()
-        .find(|(v, _)| *v == kind)
-        .map(|(_, l)| *l)
-        .unwrap_or(kind)
-}
-
-fn type_label(value: &str) -> &str {
-    TARGET_TYPES
-        .iter()
-        .find(|(v, _, _)| *v == value)
-        .map(|(_, l, _)| *l)
-        .unwrap_or(value)
-}
-
-#[component]
-pub fn OnboardingPage() -> Element {
-    let mut step = use_signal(|| 0usize);
-    let mut name = use_signal(String::new);
-    let mut target_type = use_signal(String::new);
-    let mut description = use_signal(String::new);
-    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
-
-    // "Add artifact" mini-form.
-    let mut new_kind = use_signal(|| "git_repo".to_string());
-    let mut new_source = use_signal(String::new);
-    let mut new_branch = use_signal(|| "main".to_string());
-
-    // Create + result state.
-    let mut creating = use_signal(|| false);
-    let mut error = use_signal(|| Option::<String>::None);
-    let mut scans = use_signal(Vec::<serde_json::Value>::new);
-    let mut suggested = use_signal(|| Option::<String>::None);
-    let mut created_id = use_signal(|| Option::<String>::None);
-    let mut scan_msg = use_signal(|| Option::<String>::None);
-
-    let step_now = step();
-    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
-    let has_artifacts = !artifacts().is_empty();
-
-    rsx! {
-        PageHeader {
-            title: "Onboard a target",
-            description: "Add a target, attach its artifacts, and see which scans apply.",
-        }
-
-        // Stepper.
-        div { class: "wizard-steps",
-            for (i, label) in STEP_LABELS.iter().enumerate() {
-                div {
-                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
-                    span { class: "wizard-step-dot", "{i + 1}" }
-                    span { class: "wizard-step-label", "{label}" }
-                }
-            }
-        }
-
-        if let Some(err) = error() {
-            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
-                div { class: "card-header", "Error" }
-                div { style: "padding: 12px;", "{err}" }
-            }
-        }
-
-        div { class: "card",
-            // ---- Step 0: target type + name ----
-            if step_now == 0 {
-                div { class: "card-header", "What kind of software is this?" }
-                div { style: "padding: 16px;",
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            placeholder: "acme-web",
-                            value: "{name}",
-                            oninput: move |e| name.set(e.value()),
-                        }
-                    }
-                    div {
-                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
-                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
-                            div {
-                                class: "card",
-                                style: if target_type() == value {
-                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
-                                } else {
-                                    "padding: 12px; cursor: pointer;"
-                                },
-                                onclick: move |_| target_type.set(value.to_string()),
-                                div { style: "font-weight: 600;", "{tlabel}" }
-                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
-                            }
-                        }
-                    }
-                }
-            }
-
-            // ---- Step 1: artifacts ----
-            if step_now == 1 {
-                div { class: "card-header", "Attach artifacts" }
-                div { style: "padding: 16px;",
-                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
-                        div { class: "form-group", style: "margin: 0;",
-                            label { "Kind" }
-                            select {
-                                value: "{new_kind}",
-                                oninput: move |e| new_kind.set(e.value()),
-                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
-                                    option { value: "{value}", "{klabel}" }
-                                }
-                            }
-                        }
-                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                            label { "Reference (URL / path / text)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "https://git.example.com/acme.git",
-                                value: "{new_source}",
-                                oninput: move |e| new_source.set(e.value()),
-                            }
-                        }
-                        if new_kind() == "git_repo" {
-                            div { class: "form-group", style: "margin: 0;",
-                                label { "Branch" }
-                                input {
-                                    r#type: "text",
-                                    value: "{new_branch}",
-                                    oninput: move |e| new_branch.set(e.value()),
-                                }
-                            }
-                        }
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| {
-                                let kind = new_kind();
-                                if !new_source().trim().is_empty() {
-                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
-                                    artifacts.write().push(ArtifactInputDto {
-                                        kind,
-                                        source_ref: new_source(),
-                                        branch,
-                                        plc_format: None,
-                                    });
-                                    new_source.set(String::new());
-                                }
-                            },
-                            "+ Add"
-                        }
-                    }
-
-                    div { style: "margin-top: 16px;",
-                        if has_artifacts {
-                            for (i, a) in artifacts().iter().enumerate() {
-                                div {
-                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
-                                    span {
-                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
-                                        "{a.source_ref}"
-                                    }
-                                    button {
-                                        class: "btn btn-ghost-danger btn-sm",
-                                        onclick: move |_| { artifacts.write().remove(i); },
-                                        "Remove"
-                                    }
-                                }
-                            }
-                        } else {
-                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
-                        }
-                    }
-                }
-            }
-
-            // ---- Step 2: review + create ----
-            if step_now == 2 {
-                div { class: "card-header", "Review" }
-                div { style: "padding: 16px;",
-                    div { class: "wizard-summary",
-                        div { strong { "Name: " } "{name()}" }
-                        div { strong { "Type: " } "{type_label(&target_type())}" }
-                        div { strong { "Artifacts:" } }
-                        ul {
-                            for a in artifacts() {
-                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
-                            }
-                        }
-                    }
-                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
-                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
-                    }
-                }
-            }
-
-            // ---- Step 3: created ----
-            if step_now == 3 {
-                div { class: "card-header", "Target onboarded" }
-                div { style: "padding: 16px;",
-                    p {
-                        strong { "{name()}" }
-                        " was created."
-                        if let Some(s) = suggested() {
-                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
-                        }
-                    }
-                    h4 { style: "margin-top: 16px;", "Applicable scans" }
-                    if scans().is_empty() {
-                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
-                    } else {
-                        for s in scans() {
-                            ScanRow { scan: s }
-                        }
-                    }
-                    if let Some(msg) = scan_msg() {
-                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
-                    }
-                    div { style: "margin-top: 16px; display: flex; gap: 8px;",
-                        button {
-                            class: "btn btn-primary",
-                            onclick: move |_| {
-                                if let Some(id) = created_id() {
-                                    scan_msg.set(Some("Scan triggered...".to_string()));
-                                    spawn(async move {
-                                        match trigger_target_scan(id).await {
-                                            Ok(_) => scan_msg.set(Some(
-                                                "Scan started — findings will appear as it runs.".to_string(),
-                                            )),
-                                            Err(e) => scan_msg.set(Some(format!("Failed to start scan: {e}"))),
-                                        }
-                                    });
-                                }
-                            },
-                            "Run scan"
-                        }
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| {
-                                step.set(0);
-                                name.set(String::new());
-                                target_type.set(String::new());
-                                description.set(String::new());
-                                artifacts.write().clear();
-                                scans.write().clear();
-                                suggested.set(None);
-                                created_id.set(None);
-                                scan_msg.set(None);
-                                error.set(None);
-                            },
-                            "Onboard another"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ---- Footer navigation ----
-        if step_now < 3 {
-            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
-                button {
-                    class: "btn btn-back",
-                    disabled: step_now == 0,
-                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
-                    "Back"
-                }
-                if step_now < 2 {
-                    button {
-                        class: "btn btn-primary",
-                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
-                        onclick: move |_| step.set(step() + 1),
-                        "Next"
-                    }
-                } else {
-                    button {
-                        class: "btn btn-primary",
-                        disabled: creating(),
-                        onclick: move |_| {
-                            let n = name();
-                            let tt = target_type();
-                            let desc = description();
-                            let arts = artifacts();
-                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
-                            creating.set(true);
-                            error.set(None);
-                            spawn(async move {
-                                match create_target(n, tt, d, arts).await {
-                                    Ok(resp) => {
-                                        let id = resp
-                                            .data
-                                            .get("_id")
-                                            .and_then(|o| o.get("$oid"))
-                                            .and_then(|s| s.as_str())
-                                            .map(String::from);
-                                        if let Some(id) = id {
-                                            created_id.set(Some(id.clone()));
-                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
-                                                scans.set(sc.data.scans);
-                                            }
-                                            if let Ok(det) = detect_target(id).await {
-                                                suggested.set(
-                                                    det.data
-                                                        .get("classification")
-                                                        .and_then(|c| c.get("suggested"))
-                                                        .and_then(|s| s.as_str())
-                                                        .map(String::from),
-                                                );
-                                            }
-                                        }
-                                        step.set(3);
-                                    }
-                                    Err(e) => error.set(Some(e.to_string())),
-                                }
-                                creating.set(false);
-                            });
-                        },
-                        if creating() { "Creating..." } else { "Create target" }
-                    }
-                }
-            }
-        }
-    }
-}

compliance-dashboard/src/pages/repositories.rs

@@ -23,6 +23,20 @@ async fn async_sleep_5s() {
 #[component]
 pub fn RepositoriesPage() -> Element {
     let mut page = use_signal(|| 1u64);
+    let mut show_add_form = use_signal(|| false);
+    let mut name = use_signal(String::new);
+    let mut git_url = use_signal(String::new);
+    let mut branch = use_signal(|| "main".to_string());
+    let mut auth_token = use_signal(String::new);
+    let mut auth_username = use_signal(String::new);
+    let mut show_auth = use_signal(|| false);
+    let mut ssh_public_key = use_signal(String::new);
+    let mut show_tracker = use_signal(|| false);
+    let mut tracker_type_val = use_signal(String::new);
+    let mut tracker_owner_val = use_signal(String::new);
+    let mut tracker_repo_val = use_signal(String::new);
+    let mut tracker_token_val = use_signal(String::new);
+    let mut adding = use_signal(|| false);
     let mut toasts = use_context::<Toasts>();
     let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
     let mut edit_repo_id = use_signal(|| Option::<String>::None);
@@ -50,7 +64,222 @@ pub fn RepositoriesPage() -> Element {
     rsx! {
         PageHeader {
             title: "Repositories",
-            description: "Legacy git repositories. Onboard new targets from Targets / Onboard.",
+            description: "Tracked git repositories",
+        }
+
+        div { style: "margin-bottom: 16px;",
+            button {
+                class: "btn btn-primary",
+                onclick: move |_| show_add_form.toggle(),
+                if show_add_form() { "Cancel" } else { "+ Add Repository" }
+            }
+        }
+
+        if show_add_form() {
+            div { class: "card",
+                div { class: "card-header", "Add Repository" }
+                div { class: "form-group",
+                    label { "Name" }
+                    input {
+                        r#type: "text",
+                        placeholder: "my-project",
+                        value: "{name}",
+                        oninput: move |e| name.set(e.value()),
+                    }
+                }
+                div { class: "form-group",
+                    label { "Git URL" }
+                    input {
+                        r#type: "text",
+                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
+                        value: "{git_url}",
+                        oninput: move |e| git_url.set(e.value()),
+                    }
+                }
+                div { class: "form-group",
+                    label { "Default Branch" }
+                    input {
+                        r#type: "text",
+                        placeholder: "main",
+                        value: "{branch}",
+                        oninput: move |e| branch.set(e.value()),
+                    }
+                }
+
+                // Private repo auth section
+                div { style: "margin-top: 8px;",
+                    button {
+                        class: "btn btn-ghost",
+                        style: "font-size: 12px; padding: 4px 8px;",
+                        onclick: move |_| {
+                            let opening = !show_auth();
+                            show_auth.toggle();
+                            if opening {
+                                // Fetch SSH key every time the section opens
+                                ssh_public_key.set(String::new());
+                                spawn(async move {
+                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
+                                        Ok(key) => ssh_public_key.set(key),
+                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
+                                    }
+                                });
+                            }
+                        },
+                        if show_auth() { "Hide auth options" } else { "Private repository?" }
+                    }
+                }
+
+                if show_auth() {
+                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
+                        // SSH deploy key display
+                        div { style: "margin-bottom: 12px;",
+                            label { style: "font-size: 12px; color: var(--text-secondary);",
+                                "For SSH URLs: add this deploy key (read-only) to your repository"
+                            }
+                            div {
+                                class: "copyable",
+                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px;",
+                                code {
+                                    style: "font-size: 11px; word-break: break-all; user-select: all;",
+                                    if ssh_public_key().is_empty() {
+                                        "Loading..."
+                                    } else {
+                                        "{ssh_public_key}"
+                                    }
+                                }
+                                if !ssh_public_key().is_empty() {
+                                    crate::components::copy_button::CopyButton { value: ssh_public_key(), small: true }
+                                }
+                            }
+                        }
+
+                        // HTTPS auth fields
+                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "For HTTPS URLs: provide an access token (PAT) or username/password"
+                        }
+                        div { class: "form-group",
+                            label { "Auth Token / Password" }
+                            input {
+                                r#type: "password",
+                                placeholder: "ghp_xxxx or personal access token",
+                                value: "{auth_token}",
+                                oninput: move |e| auth_token.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Username (optional, defaults to x-access-token)" }
+                            input {
+                                r#type: "text",
+                                placeholder: "x-access-token",
+                                value: "{auth_username}",
+                                oninput: move |e| auth_username.set(e.value()),
+                            }
+                        }
+                    }
+                }
+
+                // Issue tracker config section
+                div { style: "margin-top: 8px;",
+                    button {
+                        class: "btn btn-ghost",
+                        style: "font-size: 12px; padding: 4px 8px;",
+                        onclick: move |_| show_tracker.toggle(),
+                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
+                    }
+                }
+
+                if show_tracker() {
+                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
+                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "Configure an issue tracker to auto-create issues from findings"
+                        }
+                        div { class: "form-group",
+                            label { "Tracker Type" }
+                            select {
+                                value: "{tracker_type_val}",
+                                onchange: move |e| tracker_type_val.set(e.value()),
+                                option { value: "", "None" }
+                                option { value: "github", "GitHub" }
+                                option { value: "gitlab", "GitLab" }
+                                option { value: "gitea", "Gitea" }
+                                option { value: "jira", "Jira" }
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Owner / Namespace" }
+                            input {
+                                r#type: "text",
+                                placeholder: "org-name",
+                                value: "{tracker_owner_val}",
+                                oninput: move |e| tracker_owner_val.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Repository / Project" }
+                            input {
+                                r#type: "text",
+                                placeholder: "repo-name",
+                                value: "{tracker_repo_val}",
+                                oninput: move |e| tracker_repo_val.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Tracker Token (PAT)" }
+                            input {
+                                r#type: "password",
+                                placeholder: "ghp_xxxx / glpat-xxxx",
+                                value: "{tracker_token_val}",
+                                oninput: move |e| tracker_token_val.set(e.value()),
+                            }
+                        }
+                    }
+                }
+
+                button {
+                    class: "btn btn-primary",
+                    disabled: adding(),
+                    onclick: move |_| {
+                        let n = name();
+                        let u = git_url();
+                        let b = branch();
+                        let tok = {
+                            let v = auth_token();
+                            if v.is_empty() { None } else { Some(v) }
+                        };
+                        let usr = {
+                            let v = auth_username();
+                            if v.is_empty() { None } else { Some(v) }
+                        };
+                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
+                        adding.set(true);
+                        spawn(async move {
+                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
+                                Ok(_) => {
+                                    toasts.push(ToastType::Success, "Repository added");
+                                    repos.restart();
+                                }
+                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                            }
+                            adding.set(false);
+                        });
+                        show_add_form.set(false);
+                        show_auth.set(false);
+                        show_tracker.set(false);
+                        name.set(String::new());
+                        git_url.set(String::new());
+                        auth_token.set(String::new());
+                        auth_username.set(String::new());
+                        tracker_type_val.set(String::new());
+                        tracker_owner_val.set(String::new());
+                        tracker_repo_val.set(String::new());
+                        tracker_token_val.set(String::new());
+                    },
+                    if adding() { "Validating..." } else { "Add" }
+                }
+            }
         }
 
         // ── Delete confirmation dialog ──

compliance-dashboard/src/pages/targets.rs

@@ -1,339 +0,0 @@
-//! Targets page — lists onboarded targets (the unified `OnboardedTarget`
-//! records the wizard creates) and lets the user run a scan, inspect the
-//! classification / applicable scans, or delete a target.
-//!
-//! Creation lives in the Onboard wizard (`/onboard`); this page is the
-//! "where is my target, and what did the scan find" surface.
-
-use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
-
-use crate::components::page_header::PageHeader;
-use crate::components::toast::{ToastType, Toasts};
-use crate::infrastructure::onboarding::{
-    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan,
-};
-
-/// Prettify a snake_case target-type value into a human label.
-fn pretty_type(v: &str) -> String {
-    match v {
-        "web_app" => "Web Application".into(),
-        "backend_service" => "Backend / API".into(),
-        "desktop_app" => "Desktop App".into(),
-        "android_app" => "Android App".into(),
-        "ios_app" => "iOS App".into(),
-        "firmware_bare_metal" => "Firmware — bare metal".into(),
-        "firmware_rtos" => "Firmware — RTOS".into(),
-        "embedded_linux_yocto" => "Embedded Linux / Yocto".into(),
-        "plc_sps" => "PLC / SPS".into(),
-        other => other.replace('_', " "),
-    }
-}
-
-fn str_at<'a>(v: &'a serde_json::Value, key: &str) -> &'a str {
-    v.get(key).and_then(|x| x.as_str()).unwrap_or("")
-}
-
-fn target_id(t: &serde_json::Value) -> String {
-    t.get("_id")
-        .and_then(|o| o.get("$oid"))
-        .and_then(|s| s.as_str())
-        .unwrap_or_default()
-        .to_string()
-}
-
-/// The applicable-scans matrix for one target, fetched on expand.
-#[component]
-fn TargetScans(id: String) -> Element {
-    let scan_id = id.clone();
-    let scans = use_resource(move || {
-        let id = scan_id.clone();
-        async move { fetch_applicable_scans(id).await.ok() }
-    });
-
-    let snapshot = scans.read().clone();
-    match &snapshot {
-        Some(Some(resp)) => {
-            let rows = resp.data.scans.clone();
-            let pentest = resp.data.pentest_supported;
-            rsx! {
-                div { style: "margin-top: 8px;",
-                    if rows.is_empty() {
-                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
-                    }
-                    for s in rows {
-                        {
-                            let name = str_at(&s, "scan").to_string();
-                            let rationale = str_at(&s, "rationale").to_string();
-                            let blocked = s.get("blocked_reason").and_then(|b| b.as_str()).map(String::from);
-                            let default_on = s.get("default_on").and_then(|b| b.as_bool()).unwrap_or(false);
-                            let badge = if blocked.is_some() {
-                                "badge badge-info"
-                            } else if default_on {
-                                "badge badge-success"
-                            } else {
-                                "badge"
-                            };
-                            rsx! {
-                                div { style: "display: flex; gap: 8px; align-items: center; padding: 4px 0;",
-                                    span { class: "{badge}", "{name}" }
-                                    span { style: "opacity: 0.8; font-size: 0.9em;", "{rationale}" }
-                                    if let Some(b) = blocked {
-                                        span { style: "opacity: 0.6; font-style: italic; font-size: 0.9em;", "— {b}" }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                    if pentest {
-                        div { style: "margin-top: 6px; opacity: 0.75; font-size: 0.85em;",
-                            "Active pentest is supported for this target type."
-                        }
-                    }
-                }
-            }
-        }
-        Some(None) => rsx! { div { style: "opacity: 0.6;", "Failed to load applicable scans." } },
-        None => rsx! { div { style: "opacity: 0.6;", "Loading scans..." } },
-    }
-}
-
-#[component]
-pub fn TargetsPage() -> Element {
-    let mut toasts = use_context::<Toasts>();
-    let mut scanning_ids = use_signal(Vec::<String>::new);
-    let mut expanded_ids = use_signal(Vec::<String>::new);
-    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
-
-    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
-
-    rsx! {
-        PageHeader {
-            title: "Targets",
-            description: "Onboarded targets and what their scans found. Add new targets from Onboard.",
-        }
-
-        div { style: "margin-bottom: 16px; display: flex; gap: 8px;",
-            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
-                "+ Onboard a target"
-            }
-            button {
-                class: "btn btn-secondary",
-                onclick: move |_| targets.restart(),
-                "Refresh"
-            }
-        }
-
-        // ── Delete confirmation ──
-        if let Some((del_id, del_name)) = confirm_delete() {
-            div { class: "modal-overlay",
-                div { class: "modal-dialog",
-                    h3 { "Delete Target" }
-                    p { "Delete " strong { "{del_name}" } "?" }
-                    p { class: "modal-warning",
-                        "This permanently removes the target and its findings, SBOM entries, scan runs, and CVE alerts."
-                    }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| confirm_delete.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-danger",
-                            onclick: move |_| {
-                                let id = del_id.clone();
-                                let name = del_name.clone();
-                                confirm_delete.set(None);
-                                spawn(async move {
-                                    match delete_target(id).await {
-                                        Ok(_) => {
-                                            toasts.push(ToastType::Success, format!("{name} deleted"));
-                                            targets.restart();
-                                        }
-                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                    }
-                                });
-                            },
-                            "Delete"
-                        }
-                    }
-                }
-            }
-        }
-
-        {
-        let targets_snapshot = targets.read().clone();
-        match &targets_snapshot {
-            Some(Some(resp)) => {
-                let rows = resp.data.clone();
-                if rows.is_empty() {
-                    rsx! {
-                        div { class: "card", style: "padding: 24px; text-align: center;",
-                            p { style: "opacity: 0.7;", "No targets yet." }
-                            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
-                                "Onboard your first target"
-                            }
-                        }
-                    }
-                } else {
-                    rsx! {
-                        div { class: "card",
-                            div { class: "table-wrapper",
-                                table {
-                                    thead {
-                                        tr {
-                                            th { "Name" }
-                                            th { "Type" }
-                                            th { "Detected" }
-                                            th { "Artifacts" }
-                                            th { "Findings" }
-                                            th { "Actions" }
-                                        }
-                                    }
-                                    tbody {
-                                        for t in rows {
-                                            {
-                                                let id = target_id(&t);
-                                                let name = str_at(&t, "name").to_string();
-                                                let ttype = pretty_type(str_at(&t, "target_type"));
-                                                let suggested = t
-                                                    .get("classification")
-                                                    .and_then(|c| c.get("suggested"))
-                                                    .and_then(|s| s.as_str())
-                                                    .map(pretty_type);
-                                                let artifacts = t
-                                                    .get("artifacts")
-                                                    .and_then(|a| a.as_array())
-                                                    .cloned()
-                                                    .unwrap_or_default();
-                                                let findings = t
-                                                    .get("findings_count")
-                                                    .and_then(|n| n.as_u64())
-                                                    .unwrap_or(0);
-                                                let facts = t
-                                                    .get("classification")
-                                                    .and_then(|c| c.get("facts"))
-                                                    .and_then(|f| f.as_array())
-                                                    .cloned()
-                                                    .unwrap_or_default();
-                                                let is_scanning = scanning_ids().contains(&id);
-                                                let is_expanded = expanded_ids().contains(&id);
-                                                let id_scan = id.clone();
-                                                let id_exp = id.clone();
-                                                let id_del = id.clone();
-                                                let name_del = name.clone();
-                                                let artifacts_detail = artifacts.clone();
-                                                rsx! {
-                                                    tr {
-                                                        td { strong { "{name}" } }
-                                                        td { "{ttype}" }
-                                                        td {
-                                                            if let Some(sug) = suggested.clone() {
-                                                                span { class: "badge badge-success", "{sug}" }
-                                                            } else {
-                                                                span { style: "opacity: 0.5;", "—" }
-                                                            }
-                                                        }
-                                                        td { "{artifacts.len()}" }
-                                                        td { "{findings}" }
-                                                        td { style: "display: flex; gap: 4px;",
-                                                            button {
-                                                                class: "btn btn-ghost",
-                                                                title: "Details",
-                                                                onclick: move |_| {
-                                                                    let mut ids = expanded_ids();
-                                                                    if ids.contains(&id_exp) {
-                                                                        ids.retain(|i| i != &id_exp);
-                                                                    } else {
-                                                                        ids.push(id_exp.clone());
-                                                                    }
-                                                                    expanded_ids.set(ids);
-                                                                },
-                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
-                                                            }
-                                                            button {
-                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
-                                                                title: "Run scan",
-                                                                disabled: is_scanning,
-                                                                onclick: move |_| {
-                                                                    let id = id_scan.clone();
-                                                                    let mut ids = scanning_ids();
-                                                                    ids.push(id.clone());
-                                                                    scanning_ids.set(ids);
-                                                                    spawn(async move {
-                                                                        match trigger_target_scan(id.clone()).await {
-                                                                            Ok(_) => toasts.push(ToastType::Success, "Scan triggered — findings appear as it runs. Use Refresh."),
-                                                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                                                        }
-                                                                        let mut ids = scanning_ids();
-                                                                        ids.retain(|i| i != &id);
-                                                                        scanning_ids.set(ids);
-                                                                    });
-                                                                },
-                                                                if is_scanning {
-                                                                    span { class: "spinner" }
-                                                                } else {
-                                                                    Icon { icon: BsPlayCircle, width: 16, height: 16 }
-                                                                }
-                                                            }
-                                                            button {
-                                                                class: "btn btn-ghost btn-ghost-danger",
-                                                                title: "Delete target",
-                                                                onclick: move |_| {
-                                                                    confirm_delete.set(Some((id_del.clone(), name_del.clone())));
-                                                                },
-                                                                Icon { icon: BsTrash, width: 16, height: 16 }
-                                                            }
-                                                        }
-                                                    }
-                                                    if is_expanded {
-                                                        tr {
-                                                            td { colspan: "6",
-                                                                div { style: "padding: 12px 8px;",
-                                                                    h4 { style: "margin: 0 0 6px;", "Artifacts" }
-                                                                    if artifacts_detail.is_empty() {
-                                                                        div { style: "opacity: 0.6;", "No artifacts." }
-                                                                    }
-                                                                    for a in artifacts_detail {
-                                                                        div { style: "font-size: 0.9em; padding: 2px 0;",
-                                                                            span { style: "opacity: 0.7;", "{str_at(&a, \"kind\")}: " }
-                                                                            span { style: "font-family: monospace;", "{str_at(&a, \"source_ref\")}" }
-                                                                        }
-                                                                    }
-                                                                    if !facts.is_empty() {
-                                                                        h4 { style: "margin: 12px 0 6px;", "Detected facts" }
-                                                                        for f in facts {
-                                                                            div { style: "font-size: 0.9em; padding: 2px 0;",
-                                                                                span { style: "font-family: monospace;", "{str_at(&f, \"key\")}={str_at(&f, \"value\")}" }
-                                                                                span { style: "opacity: 0.5;", " ({str_at(&f, \"source\")})" }
-                                                                            }
-                                                                        }
-                                                                    }
-                                                                    h4 { style: "margin: 12px 0 6px;", "Applicable scans" }
-                                                                    TargetScans { id: id.clone() }
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            Some(None) => rsx! {
-                div { class: "card", p { "Failed to load targets." } }
-            },
-            None => rsx! {
-                div { class: "loading", "Loading targets..." }
-            },
-        }
-        }
-    }
-}