fix(orchestrator): refresh control_refs on PLC re-scans (#230)

.env.example

@@ -34,6 +34,24 @@ SCAN_SCHEDULE=0 0 */6 * * *
 CVE_MONITOR_SCHEDULE=0 0 0 * * *
 GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
 
+# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
+# enabled; requires the agent container to have Docker access (socket mount).
+# When on, a PLC/SPS target with control logic but no reachable device gets its
+# logic instantiated on a throwaway OpenPLC, probed, then torn down.
+PLC_RUNTIME_ENABLED=0
+PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
+PLC_RUNTIME_NETWORK=certifai
+PLC_RUNTIME_MEMORY=512m
+PLC_RUNTIME_CPUS=0.5
+PLC_RUNTIME_MAX_LIFETIME_SECS=180
+PLC_RUNTIME_OPENPLC_USER=openplc
+PLC_RUNTIME_OPENPLC_PASSWORD=openplc
+
+# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
+# When set, mounts the runner-facing queue + artifact endpoints behind this
+# bearer token; runners present the same token. Unset = endpoints not mounted.
+WERKBANK_RUNNER_TOKEN=
+
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001

.gitea/workflows/ci.yml

@@ -7,6 +7,13 @@ on:
   pull_request:
 
 env:
+  # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
+  # username contains '$', which sh expands when interpolated into the
+  # script (robot$ci-push -> robot-push) => docker login unauthorized.
+  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
@@ -107,6 +114,10 @@ jobs:
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
+      - name: Clippy (werkbank-exec)
+        run: cargo clippy -p werkbank-exec -- -D warnings
+      - name: Clippy (control-map)
+        run: cargo clippy -p control-map -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -115,8 +126,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent)
-        run: cargo test -p compliance-core -p compliance-agent --lib
+      - name: Tests (core + agent + werkbank-exec + control-map)
+        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)
@@ -202,11 +213,14 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-agent
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-agent
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -226,11 +240,14 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-dashboard
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-dashboard
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -248,10 +265,13 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-docs
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-docs
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -271,11 +291,14 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=registry.meghsakha.com/compliance-mcp
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-mcp
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"

Cargo.lock

@@ -666,6 +666,7 @@ dependencies = [
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
+ "control-map",
  "dashmap",
  "dotenvy",
  "futures-core",
@@ -699,6 +700,7 @@ dependencies = [
  "urlencoding",
  "uuid",
  "walkdir",
+ "werkbank-exec",
  "zip",
 ]
 
@@ -723,6 +725,7 @@ dependencies = [
  "sha2",
  "thiserror 2.0.18",
  "tokio",
+ "toml",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
@@ -966,6 +969,15 @@ dependencies = [
  "charset",
 ]
 
+[[package]]
+name = "control-map"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.8.0"
@@ -5087,6 +5099,12 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -6470,6 +6488,7 @@ dependencies = [
  "getrandom 0.4.1",
  "js-sys",
  "serde_core",
+ "sha1_smol",
  "wasm-bindgen",
 ]
 
@@ -6713,6 +6732,25 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "werkbank-exec"
+version = "0.1.0"
+dependencies = [
+ "compliance-core",
+ "compliance-dast",
+ "futures-util",
+ "hex",
+ "regex",
+ "reqwest",
+ "secrecy",
+ "sha2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "uuid",
+ "walkdir",
+]
+
 [[package]]
 name = "which"
 version = "6.0.3"

Cargo.toml

@@ -7,6 +7,8 @@ members = [
     "compliance-dast",
     "compliance-mcp",
     "compliance-smoke",
+    "werkbank-exec",
+    "control-map",
 ]
 resolver = "2"
 
@@ -16,6 +18,7 @@ expect_used = "deny"
 
 [workspace.dependencies]
 compliance-core = { path = "compliance-core", default-features = false }
+control-map = { path = "control-map" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
@@ -23,11 +26,11 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
-uuid = { version = "1", features = ["v4", "serde"] }
+uuid = { version = "1", features = ["v4", "v5", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }

compliance-agent/Cargo.toml

@@ -8,8 +8,12 @@ workspace = true
 
 [dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
+control-map = { workspace = true }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
+# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
+# used by the Werkbank runner.
+werkbank-exec = { path = "../werkbank-exec" }
 # Native firmware build/target detection for bare-metal & RTOS artifacts.
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this

compliance-agent/rules/cra_semgrep.yaml

@@ -0,0 +1,117 @@
+# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
+# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
+# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
+# not matter). Detection here is deterministic; the grounded LLM judge downstream
+# only confirms/refutes — it never detects. Keep patterns tight: a false positive
+# that the judge refutes marks the whole finding a false positive.
+rules:
+  # --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
+  - id: cra-ai-1-flask-debug-enabled
+    languages: [python]
+    severity: WARNING
+    message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
+    metadata:
+      cwe: ["CWE-489: Active Debug Code"]
+      control: cra-ai-1
+    patterns:
+      - pattern: '$APP.run(..., debug=True, ...)'
+
+  - id: cra-ai-1-django-debug-true
+    languages: [python]
+    severity: WARNING
+    message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
+    metadata:
+      cwe: ["CWE-489: Active Debug Code"]
+      control: cra-ai-1
+    patterns:
+      - pattern: 'DEBUG = True'
+
+  - id: cra-ai-1-tls-verify-disabled
+    languages: [python]
+    severity: ERROR
+    message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
+    metadata:
+      cwe: ["CWE-295: Improper Certificate Validation"]
+      control: cra-ai-1
+    patterns:
+      - pattern: 'requests.$M(..., verify=False, ...)'
+
+  - id: cra-ai-1-cors-wildcard
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
+    metadata:
+      cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
+      control: cra-ai-1
+    patterns:
+      - pattern-either:
+          - pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
+          - pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
+
+  # --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
+  - id: cra-ai-7-weak-password-hash
+    languages: [python]
+    severity: ERROR
+    message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
+    metadata:
+      cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
+      control: cra-ai-7
+    patterns:
+      - pattern-either:
+          - pattern: 'hashlib.md5($PW)'
+          - pattern: 'hashlib.sha1($PW)'
+      - metavariable-regex:
+          metavariable: $PW
+          regex: '(?i).*(pass|pwd|secret|cred|token).*'
+
+  # --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
+  - id: cra-ai-10-session-cookie-insecure
+    languages: [python]
+    severity: ERROR
+    message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
+    metadata:
+      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
+      control: cra-ai-10
+    patterns:
+      - pattern-either:
+          - pattern: 'SESSION_COOKIE_SECURE = False'
+          - pattern: 'SESSION_COOKIE_HTTPONLY = False'
+
+  - id: cra-ai-10-express-cookie-insecure
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
+    metadata:
+      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
+      control: cra-ai-10
+    patterns:
+      - pattern-either:
+          - pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
+          - pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
+
+  # --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
+  - id: cra-ai-14-python-weak-cipher
+    languages: [python]
+    severity: ERROR
+    message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
+    metadata:
+      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
+      control: cra-ai-14
+    patterns:
+      - pattern-either:
+          - pattern: 'AES.new($K, AES.MODE_ECB, ...)'
+          - pattern: 'DES.new(...)'
+          - pattern: 'DES3.new(...)'
+
+  - id: cra-ai-14-node-weak-cipher
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
+    metadata:
+      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
+      control: cra-ai-14
+    patterns:
+      - pattern-either:
+          - pattern: 'crypto.createCipheriv("des-ecb", ...)'
+          - pattern: 'crypto.createCipheriv("des", ...)'
+          - pattern: 'crypto.createCipher(...)'

compliance-agent/src/api/handlers/mod.rs

@@ -10,10 +10,12 @@ pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
+pub mod oscal;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod sbom;
 pub mod scans;
+pub mod werkbank_jobs;
 
 // Re-export all handler functions so routes.rs can use `handlers::function_name`
 pub use dto::*;

compliance-agent/src/api/handlers/oscal.rs

@@ -0,0 +1,48 @@
+//! OSCAL assessment endpoint.
+//!
+//! Returns a standard OSCAL assessment-results document for a target's findings,
+//! driven by each finding's stamped `control_refs` (from the scan's control-triage
+//! stage): mapped findings target their controls, unmapped findings are reported
+//! as-is. See `compliance_core::models::oscal_assessment`.
+
+use axum::extract::Extension;
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use mongodb::bson::doc;
+use serde::Deserialize;
+
+use compliance_core::models::oscal_assessment::assess;
+use compliance_core::models::Finding;
+use compliance_core::tenant_ctx::TenantCtx;
+
+use super::dto::{collect_cursor_async, tenant_db, AgentExt};
+
+#[derive(Debug, Deserialize)]
+pub struct AssessRequest {
+    /// The target / repo id whose findings are assessed.
+    pub target_id: String,
+}
+
+/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
+pub async fn assess_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<AssessRequest>,
+) -> Response {
+    let db = match tenant_db(&agent, &tenant).await {
+        Ok(db) => db,
+        Err(code) => return code.into_response(),
+    };
+
+    let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
+            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+        }
+    };
+
+    Json(assess(&findings, chrono::Utc::now())).into_response()
+}

compliance-agent/src/api/handlers/werkbank_jobs.rs

@@ -0,0 +1,289 @@
+//! Werkbank runner endpoints (`/api/v1/werkbank/jobs/*`).
+//!
+//! The pull API a Werkbank runner talks to: lease a job, heartbeat while it runs,
+//! and post the result back. Machine auth is a **static bearer token**
+//! (`WERKBANK_RUNNER_TOKEN`) — not a Keycloak JWT, because a runner acts across
+//! tenants (each request names its `tenant`). Routes are only mounted when the
+//! token is configured; with none set they don't exist (404).
+//!
+//! On completion the runner's findings are persisted against the job's target,
+//! so a job run by a remote runner lands the same findings an in-process run
+//! would (WB-05, the control-plane cut-over).
+
+use axum::extract::{Extension, Path, Request};
+use axum::http::{header, StatusCode};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use mongodb::bson::{doc, oid::ObjectId};
+use secrecy::ExposeSecret;
+use serde::{Deserialize, Serialize};
+use std::time::Duration;
+
+use compliance_core::models::werkbank::{
+    CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
+};
+use compliance_core::models::ArtifactKind;
+
+use super::dto::AgentExt;
+use crate::database::Database;
+use crate::werkbank::JobQueue;
+
+/// Gate the runner endpoints behind the static runner bearer token.
+pub async fn require_runner_token(
+    Extension(agent): AgentExt,
+    request: Request,
+    next: Next,
+) -> Response {
+    let Some(expected) = agent.config.werkbank_runner_token.as_ref() else {
+        return (StatusCode::NOT_FOUND, "werkbank runner API disabled").into_response();
+    };
+    let presented = request
+        .headers()
+        .get(header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.strip_prefix("Bearer "))
+        .map(str::trim)
+        .filter(|s| !s.is_empty());
+    let Some(presented) = presented else {
+        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
+    };
+    if !constant_time_eq(presented, expected.expose_secret()) {
+        return (StatusCode::UNAUTHORIZED, "Invalid runner token").into_response();
+    }
+    next.run(request).await
+}
+
+/// `POST /api/v1/werkbank/jobs/lease` — lease the oldest runnable job, or `204`.
+#[tracing::instrument(skip_all, fields(tenant = %req.tenant, runner = %req.runner_id))]
+pub async fn lease(
+    Extension(agent): AgentExt,
+    Json(req): Json<LeaseRequest>,
+) -> Result<Response, StatusCode> {
+    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
+    let leased = queue
+        .lease(
+            &req.runner_id,
+            req.executor,
+            &req.labels,
+            Duration::from_secs(req.lease_ttl_secs),
+            chrono::Utc::now(),
+        )
+        .await
+        .map_err(internal)?;
+    Ok(match leased {
+        Some(job) => Json(job).into_response(),
+        None => StatusCode::NO_CONTENT.into_response(),
+    })
+}
+
+/// `POST /api/v1/werkbank/jobs/heartbeat` — extend the lease; `409` if it's lost.
+#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
+pub async fn heartbeat(
+    Extension(agent): AgentExt,
+    Json(req): Json<HeartbeatRequest>,
+) -> Result<Response, StatusCode> {
+    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
+    let ack = queue
+        .heartbeat(
+            &req.job_id,
+            &req.lease_token,
+            Duration::from_secs(req.lease_ttl_secs),
+            chrono::Utc::now(),
+        )
+        .await
+        .map_err(internal)?;
+    Ok(match ack {
+        Some(ack) => Json(ack).into_response(),
+        // Lease lost — the runner should abandon the job.
+        None => StatusCode::CONFLICT.into_response(),
+    })
+}
+
+/// `POST /api/v1/werkbank/jobs/complete` — record the result and persist findings.
+#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
+pub async fn complete(
+    Extension(agent): AgentExt,
+    Json(req): Json<CompleteRequest>,
+) -> Result<Json<CompleteResponse>, StatusCode> {
+    let db = tenant_db(&agent, &req.tenant).await?;
+    let queue = JobQueue::new(&db);
+    let now = chrono::Utc::now();
+    let recorded = queue
+        .complete(&req.job_id, &req.lease_token, &req.result, now)
+        .await
+        .map_err(internal)?;
+
+    // Only persist findings for the run that actually recorded the result, so a
+    // duplicate/late completion can't double-insert.
+    if recorded {
+        if let Some(record) = queue.get(&req.job_id).await.map_err(internal)? {
+            persist_findings(&db, &record.job.target_id, &req.result).await;
+        }
+    }
+    Ok(Json(CompleteResponse { recorded }))
+}
+
+/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
+/// program a runner needs to load). The hash is validated against traversal by
+/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
+/// input.
+#[tracing::instrument(skip_all, fields(hash = %hash))]
+pub async fn serve_artifact(
+    Extension(agent): AgentExt,
+    Path(hash): Path<String>,
+) -> Result<Response, StatusCode> {
+    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
+    match crate::ingest::blob::read_blob(base, &hash) {
+        Ok(bytes) => {
+            Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
+        }
+        Err(_) => Err(StatusCode::NOT_FOUND),
+    }
+}
+
+/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
+/// stash it as a content-addressed blob (which the runner fetches via
+/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
+/// half of the loop — a runner then leases it, provisions, and posts results.
+#[derive(Debug, Deserialize)]
+pub struct EnqueueRequest {
+    /// The tenant whose queue to enqueue into.
+    pub tenant: String,
+    /// The onboarded target to test.
+    pub target_id: String,
+}
+
+/// The enqueued job's id.
+#[derive(Debug, Serialize)]
+pub struct EnqueueResponse {
+    /// The new job id.
+    pub job_id: String,
+    /// Whether this call inserted it (false = already queued).
+    pub enqueued: bool,
+}
+
+#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
+pub async fn enqueue(
+    Extension(agent): AgentExt,
+    Json(req): Json<EnqueueRequest>,
+) -> Result<Json<EnqueueResponse>, StatusCode> {
+    let db = tenant_db(&agent, &req.tenant).await?;
+    let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(internal)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // Extract the control-logic program from the target's PLC-source artifacts
+    // (same selection as the in-process PLC scan).
+    let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
+    let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
+    let program = target
+        .artifacts
+        .iter()
+        .filter(|a| {
+            matches!(
+                a.kind,
+                ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+            )
+        })
+        .find_map(|a| {
+            let path = ingest_set
+                .get(&a.id)
+                .and_then(|ia| ia.working_path.clone())?;
+            werkbank_exec::plc::extract_program(&path)
+        })
+        .ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
+
+    // Stash the program source so the runner can fetch it by hash.
+    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
+    let hash =
+        crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
+
+    let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
+    let job = Job::plc_provision(
+        &job_id,
+        &req.tenant,
+        &req.target_id,
+        InputRef::blob(hash),
+        agent.config.plc_runtime.max_lifetime_secs,
+    );
+    let enqueued = JobQueue::new(&db)
+        .enqueue(job, chrono::Utc::now())
+        .await
+        .map_err(internal)?;
+    Ok(Json(EnqueueResponse { job_id, enqueued }))
+}
+
+/// Persist a job result's findings against its target: general findings
+/// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
+/// is logged, not surfaced to the runner (its result is already recorded).
+async fn persist_findings(db: &Database, target_id: &str, result: &JobResult) {
+    for finding in &result.findings {
+        let exists = db
+            .findings()
+            .find_one(doc! { "fingerprint": &finding.fingerprint })
+            .await
+            .ok()
+            .flatten()
+            .is_some();
+        if !exists {
+            if let Err(e) = db.findings().insert_one(finding).await {
+                tracing::warn!(target_id, error = %e, "werkbank: persist finding failed");
+            }
+        }
+    }
+    for finding in &result.dast_findings {
+        if let Err(e) = db.dast_findings().insert_one(finding).await {
+            tracing::warn!(target_id, error = %e, "werkbank: persist DAST finding failed");
+        }
+    }
+    tracing::info!(
+        target_id,
+        findings = result.findings.len(),
+        dast = result.dast_findings.len(),
+        "werkbank: persisted runner results"
+    );
+}
+
+/// Resolve the tenant-scoped database for a request.
+async fn tenant_db(
+    agent: &crate::agent::ComplianceAgent,
+    tenant: &str,
+) -> Result<Database, StatusCode> {
+    agent.db_pool.for_tenant_id(tenant).await.map_err(internal)
+}
+
+/// Map any internal error to a 500.
+fn internal<E: std::fmt::Display>(e: E) -> StatusCode {
+    tracing::error!("werkbank endpoint error: {e}");
+    StatusCode::INTERNAL_SERVER_ERROR
+}
+
+/// Length-checked, constant-time-ish token comparison.
+fn constant_time_eq(a: &str, b: &str) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.bytes().zip(b.bytes()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::constant_time_eq;
+
+    #[test]
+    fn token_compare() {
+        assert!(constant_time_eq("secret", "secret"));
+        assert!(!constant_time_eq("secret", "secrex"));
+        assert!(!constant_time_eq("secret", "secretx"));
+        assert!(!constant_time_eq("", "x"));
+    }
+}

compliance-agent/src/api/routes.rs

@@ -6,6 +6,7 @@ use crate::api::handlers;
 pub fn build_router() -> Router {
     Router::new()
         .route("/api/v1/health", get(handlers::health))
+        .route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
         .route("/api/v1/stats/overview", get(handlers::stats_overview))
         .route(
             "/api/v1/settings/ssh-public-key",

compliance-agent/src/api/server.rs

@@ -4,7 +4,7 @@ use axum::extract::{DefaultBodyLimit, Request};
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
-use axum::routing::{delete, get};
+use axum::routing::{delete, get, post};
 use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
@@ -72,8 +72,43 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
         Router::new()
     };
 
+    // Werkbank runner API. Like admin, only mounted when its bearer token is
+    // configured; runners authenticate with WERKBANK_RUNNER_TOKEN (not a JWT).
+    let werkbank_router: Router = if agent.config.werkbank_runner_token.is_some() {
+        tracing::info!(
+            "Werkbank runner API enabled — /api/v1/werkbank/jobs/* behind WERKBANK_RUNNER_TOKEN"
+        );
+        Router::new()
+            .route(
+                "/api/v1/werkbank/jobs/lease",
+                post(handlers::werkbank_jobs::lease),
+            )
+            .route(
+                "/api/v1/werkbank/jobs/heartbeat",
+                post(handlers::werkbank_jobs::heartbeat),
+            )
+            .route(
+                "/api/v1/werkbank/jobs/complete",
+                post(handlers::werkbank_jobs::complete),
+            )
+            .route(
+                "/api/v1/werkbank/jobs/enqueue",
+                post(handlers::werkbank_jobs::enqueue),
+            )
+            .route(
+                "/api/v1/werkbank/artifacts/{hash}",
+                get(handlers::werkbank_jobs::serve_artifact),
+            )
+            .layer(middleware::from_fn(
+                handlers::werkbank_jobs::require_runner_token,
+            ))
+    } else {
+        Router::new()
+    };
+
     let mut app = routes::build_router()
         .merge(admin_router)
+        .merge(werkbank_router)
         // Allow large artifact uploads (PLC .projectarchive, firmware images,
         // mobile packages) — axum's default request-body limit is only 2 MiB.
         .layer(DefaultBodyLimit::max(512 * 1024 * 1024))

compliance-agent/src/config.rs

@@ -1,3 +1,4 @@
+use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -63,5 +64,47 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
         pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
         admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
         tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
+        plc_runtime: load_plc_runtime_config(),
+        werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
+        breakpilot: load_breakpilot_config(),
     })
 }
+
+/// Build the ephemeral soft-PLC provisioning config from the environment,
+/// falling back to [`PlcRuntimeConfig::default`] for any unset knob. Disabled
+/// unless `PLC_RUNTIME_ENABLED` is truthy — it requires Docker access.
+fn load_plc_runtime_config() -> PlcRuntimeConfig {
+    let d = PlcRuntimeConfig::default();
+    PlcRuntimeConfig {
+        enabled: env_var_opt("PLC_RUNTIME_ENABLED")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.enabled),
+        image: env_var_opt("PLC_RUNTIME_IMAGE").unwrap_or(d.image),
+        network: env_var_opt("PLC_RUNTIME_NETWORK").unwrap_or(d.network),
+        memory: env_var_opt("PLC_RUNTIME_MEMORY").unwrap_or(d.memory),
+        cpus: env_var_opt("PLC_RUNTIME_CPUS").unwrap_or(d.cpus),
+        max_lifetime_secs: env_var_opt("PLC_RUNTIME_MAX_LIFETIME_SECS")
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(d.max_lifetime_secs),
+        openplc_user: env_var_opt("PLC_RUNTIME_OPENPLC_USER").unwrap_or(d.openplc_user),
+        openplc_password: env_secret_opt("PLC_RUNTIME_OPENPLC_PASSWORD")
+            .unwrap_or(d.openplc_password),
+    }
+}
+
+/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
+/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
+fn load_breakpilot_config() -> BreakpilotConfig {
+    let d = BreakpilotConfig::default();
+    BreakpilotConfig {
+        base_url: env_var_opt("BREAKPILOT_BASE_URL"),
+        token: env_secret_opt("BREAKPILOT_TOKEN"),
+        snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
+        semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.semantic_mapping),
+        grounded_control_checks: env_var_opt("BREAKPILOT_GROUNDED_CHECKS")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.grounded_control_checks),
+    }
+}

compliance-agent/src/controls/checker.rs

@@ -0,0 +1,114 @@
+//! The grounded control checker: judge each candidate region for a control, then
+//! keep only the verdicts that survive the grounding gate.
+//!
+//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
+//! the whole recognize → ground path is then exercised without an LLM. With the
+//! real judge, determinism comes from temperature 0 plus the gate.
+
+use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
+use compliance_core::models::Finding;
+
+use super::judge::ControlJudge;
+
+/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
+pub struct GroundedControlChecker<J> {
+    judge: J,
+}
+
+impl<J: ControlJudge> GroundedControlChecker<J> {
+    pub fn new(judge: J) -> Self {
+        Self { judge }
+    }
+
+    /// Judge every candidate region for `spec` and return the grounded findings.
+    /// A verdict that doesn't quote real code in its region is dropped by
+    /// [`ground`], so nothing fabricated reaches the caller.
+    pub async fn check(
+        &self,
+        spec: &ControlCheckSpec,
+        regions: &[CandidateRegion],
+        repo_id: &str,
+    ) -> Vec<Finding> {
+        let mut findings = Vec::new();
+        for region in regions {
+            let verdict = self.judge.judge(spec, region).await;
+            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
+                findings.push(finding);
+            }
+        }
+        findings
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::control_check::LlmVerdict;
+    use compliance_core::models::finding::Severity;
+
+    /// Deterministic stub: returns a fixed verdict for every region, so the
+    /// recognize → ground composition is tested without an LLM.
+    struct StubJudge {
+        verdict: LlmVerdict,
+    }
+
+    impl ControlJudge for StubJudge {
+        async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
+            self.verdict.clone()
+        }
+    }
+
+    fn spec() -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: "cra-ai-8".into(),
+            title: "No default passwords".into(),
+            requirement: "No default credentials".into(),
+            default_cwe: Some("CWE-798".into()),
+            severity: Severity::High,
+        }
+    }
+
+    fn region(content: &str) -> CandidateRegion {
+        CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 1,
+            content: content.into(),
+        }
+    }
+
+    #[tokio::test]
+    async fn keeps_grounded_and_drops_ungrounded() {
+        let checker = GroundedControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: true,
+                snippet: "PASSWORD = \"admin\"".into(),
+                cwe: None,
+                confidence: 0.9,
+            },
+        });
+        let regions = vec![
+            region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
+            region("totally unrelated code\n"),      // snippet absent → dropped
+        ];
+        let findings = checker.check(&spec(), &regions, "repo").await;
+        assert_eq!(findings.len(), 1);
+        assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
+        assert_eq!(findings[0].line_number, Some(2));
+    }
+
+    #[tokio::test]
+    async fn non_violation_yields_nothing() {
+        let checker = GroundedControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: false,
+                snippet: String::new(),
+                cwe: None,
+                confidence: 0.0,
+            },
+        });
+        let findings = checker
+            .check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
+            .await;
+        assert!(findings.is_empty());
+    }
+}

compliance-agent/src/controls/index.rs

@@ -0,0 +1,245 @@
+//! In-memory embedding index over the control corpus, for region → control
+//! retrieval.
+//!
+//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
+//! controls carry none), so we map by *similarity*: embed each control's
+//! requirement text once, then for a code region pull the top-K nearest controls
+//! to hand to the grounded judge. This is the retrieval half of the semantic path.
+
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use compliance_core::control_check::ControlCheckSpec;
+use compliance_core::error::CoreError;
+
+use crate::llm::LlmClient;
+
+/// A control spec paired with its requirement-text embedding.
+pub struct ControlIndex {
+    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
+}
+
+/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
+/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
+#[derive(Serialize, Deserialize)]
+struct PersistedIndex {
+    corpus_hash: String,
+    entries: Vec<PersistedEntry>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct PersistedEntry {
+    spec: ControlCheckSpec,
+    embedding: Vec<f64>,
+}
+
+/// Stable hash of the corpus identity (each control's id + requirement text, in
+/// order). Same catalog → same hash → the cached embeddings are reused instead of
+/// re-embedding the whole corpus.
+fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
+    let mut hasher = Sha256::new();
+    for s in specs {
+        hasher.update(s.control_id.as_bytes());
+        hasher.update([0u8]);
+        hasher.update(s.requirement.as_bytes());
+        hasher.update([0u8]);
+    }
+    format!("{:x}", hasher.finalize())
+}
+
+impl ControlIndex {
+    /// Build directly from precomputed embeddings (used by tests + callers that
+    /// already embedded the corpus).
+    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
+        Self { entries }
+    }
+
+    /// Load the index from `cache_path` if it still matches the current corpus,
+    /// otherwise embed the corpus and persist it there. This turns the per-scan
+    /// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
+    /// that survives across scans; the cache self-invalidates when the catalog
+    /// changes (its [`corpus_hash`] no longer matches).
+    pub async fn load_or_build(
+        llm: &LlmClient,
+        specs: Vec<ControlCheckSpec>,
+        cache_path: &Path,
+    ) -> Result<Self, CoreError> {
+        let hash = corpus_hash(&specs);
+        if let Some(index) = Self::load_cache(cache_path, &hash).await {
+            tracing::debug!(
+                controls = index.len(),
+                "reusing cached control embedding index"
+            );
+            return Ok(index);
+        }
+        let index = Self::build(llm, specs).await?;
+        if let Err(e) = index.write_cache(cache_path, &hash).await {
+            tracing::warn!(error = %e, "failed to persist control embedding index");
+        }
+        Ok(index)
+    }
+
+    /// Read a persisted index, returning it only if its corpus hash matches.
+    async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
+        let raw = tokio::fs::read(path).await.ok()?;
+        let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
+        if persisted.corpus_hash != hash {
+            return None;
+        }
+        Some(Self {
+            entries: persisted
+                .entries
+                .into_iter()
+                .map(|e| (e.spec, e.embedding))
+                .collect(),
+        })
+    }
+
+    /// Persist the index atomically (temp file + rename) keyed by corpus hash.
+    async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
+        if let Some(parent) = path.parent() {
+            tokio::fs::create_dir_all(parent).await?;
+        }
+        let persisted = PersistedIndex {
+            corpus_hash: hash.to_string(),
+            entries: self
+                .entries
+                .iter()
+                .map(|(spec, emb)| PersistedEntry {
+                    spec: spec.clone(),
+                    embedding: emb.clone(),
+                })
+                .collect(),
+        };
+        let raw = serde_json::to_vec(&persisted)?;
+        let tmp = path.with_extension("json.tmp");
+        tokio::fs::write(&tmp, &raw).await?;
+        tokio::fs::rename(&tmp, path).await?;
+        Ok(())
+    }
+
+    /// Build by embedding each control's requirement text.
+    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
+        if specs.is_empty() {
+            return Ok(Self {
+                entries: Vec::new(),
+            });
+        }
+        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
+        let embeddings = llm
+            .embed(texts)
+            .await
+            .map_err(|e| CoreError::Llm(e.to_string()))?;
+        Ok(Self {
+            entries: specs.into_iter().zip(embeddings).collect(),
+        })
+    }
+
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
+    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
+        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
+            .entries
+            .iter()
+            .map(|(spec, emb)| (cosine(query, emb), spec))
+            .collect();
+        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
+        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
+    }
+}
+
+/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
+fn cosine(a: &[f64], b: &[f64]) -> f64 {
+    if a.len() != b.len() || a.is_empty() {
+        return 0.0;
+    }
+    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
+    let na: f64 = a.iter().map(|x| x * x).sum();
+    let nb: f64 = b.iter().map(|x| x * x).sum();
+    if na == 0.0 || nb == 0.0 {
+        return 0.0;
+    }
+    dot / (na.sqrt() * nb.sqrt())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::finding::Severity;
+
+    fn spec(id: &str) -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: id.into(),
+            title: id.into(),
+            requirement: id.into(),
+            default_cwe: None,
+            severity: Severity::Medium,
+        }
+    }
+
+    #[test]
+    fn nearest_ranks_by_cosine() {
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("a"), vec![1.0, 0.0]),
+            (spec("b"), vec![0.0, 1.0]),
+            (spec("c"), vec![0.7, 0.7]),
+        ]);
+        let hits = index.nearest(&[0.9, 0.1], 2);
+        assert_eq!(hits.len(), 2);
+        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
+    }
+
+    #[test]
+    fn cosine_edges_are_zero() {
+        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
+        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
+        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
+    }
+
+    #[test]
+    fn corpus_hash_is_stable_and_identity_sensitive() {
+        let a = corpus_hash(&[spec("x"), spec("y")]);
+        assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
+        assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
+        assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
+    }
+
+    #[tokio::test]
+    #[allow(clippy::unwrap_used)]
+    async fn cache_round_trips_and_misses_on_corpus_change() {
+        let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
+        let path = dir.join("control-index.json");
+        let specs = [spec("a"), spec("b")];
+        let hash = corpus_hash(&specs);
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("a"), vec![1.0, 0.0]),
+            (spec("b"), vec![0.0, 1.0]),
+        ]);
+        index.write_cache(&path, &hash).await.unwrap();
+
+        // matching corpus hash → hit
+        let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
+        assert_eq!(loaded.len(), 2);
+        assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
+        // corpus changed → miss (forces a rebuild)
+        assert!(ControlIndex::load_cache(&path, "differenthash")
+            .await
+            .is_none());
+        // absent file → miss, not an error
+        assert!(
+            ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
+                .await
+                .is_none()
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

compliance-agent/src/controls/judge.rs

@@ -0,0 +1,167 @@
+//! The "recognize" stage: judge whether a code region violates a control.
+//!
+//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
+//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
+//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
+//! and everything it returns is then re-checked by the grounding gate
+//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
+//! smart; it is never trusted.
+
+use std::sync::Arc;
+
+use serde::Deserialize;
+
+use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
+
+use crate::llm::LlmClient;
+
+/// Prompt/logic version — part of the verdict cache key, bump on any change here.
+pub const PROMPT_VERSION: &str = "control-judge-v1";
+
+const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
+You are given ONE compliance control (a requirement) and ONE code region. Decide \
+ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
+shown — never assume code that is not present. (2) If and only if it violates, copy \
+the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
+region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
+violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
+Respond with STRICT JSON only, no prose: \
+{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
+
+/// Judges one (control, region). Async-in-trait so a stub can drive tests.
+#[allow(async_fn_in_trait)]
+pub trait ControlJudge: Send + Sync {
+    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
+}
+
+/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
+pub struct LlmControlJudge {
+    llm: Arc<LlmClient>,
+}
+
+impl LlmControlJudge {
+    pub fn new(llm: Arc<LlmClient>) -> Self {
+        Self { llm }
+    }
+}
+
+impl ControlJudge for LlmControlJudge {
+    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
+        let user = build_user_prompt(spec, region);
+        match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
+            Ok(response) => parse_verdict(&response),
+            Err(e) => {
+                // Fail closed: a transient model error yields no finding, never a
+                // fabricated one.
+                tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
+                no_violation()
+            }
+        }
+    }
+}
+
+fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
+    format!(
+        "CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
+        id = spec.control_id,
+        title = spec.title,
+        req = spec.requirement,
+        file = region.file,
+        line = region.start_line,
+        code = region.content,
+    )
+}
+
+#[derive(Debug, Default, Deserialize)]
+struct RawVerdict {
+    #[serde(default)]
+    violates: bool,
+    #[serde(default)]
+    snippet: String,
+    #[serde(default)]
+    cwe: Option<String>,
+    #[serde(default)]
+    confidence: f64,
+}
+
+/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
+/// degrades to a non-violation (never a fabricated finding).
+fn parse_verdict(response: &str) -> LlmVerdict {
+    let cleaned = response
+        .trim()
+        .trim_start_matches("```json")
+        .trim_start_matches("```")
+        .trim_end_matches("```")
+        .trim();
+    match serde_json::from_str::<RawVerdict>(cleaned) {
+        Ok(raw) => LlmVerdict {
+            violates: raw.violates,
+            snippet: raw.snippet,
+            cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
+            confidence: raw.confidence,
+        },
+        Err(e) => {
+            tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
+            no_violation()
+        }
+    }
+}
+
+fn no_violation() -> LlmVerdict {
+    LlmVerdict {
+        violates: false,
+        snippet: String::new(),
+        cwe: None,
+        confidence: 0.0,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::finding::Severity;
+
+    fn spec() -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: "cra-ai-8".into(),
+            title: "No default passwords".into(),
+            requirement: "Products must not ship default credentials".into(),
+            default_cwe: Some("CWE-798".into()),
+            severity: Severity::High,
+        }
+    }
+
+    #[test]
+    fn parses_plain_and_fenced_json() {
+        let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
+        let v = parse_verdict(plain);
+        assert!(v.violates);
+        assert_eq!(v.snippet, "PASSWORD = \"x\"");
+        assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
+
+        let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
+        assert!(!parse_verdict(fenced).violates);
+    }
+
+    #[test]
+    fn garbage_and_empty_cwe_are_safe() {
+        assert!(!parse_verdict("not json at all").violates); // fail closed
+        let no_cwe =
+            parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": "  ", "confidence": 0.5}"#);
+        assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
+    }
+
+    #[test]
+    fn user_prompt_carries_control_and_code() {
+        let region = CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 10,
+            content: "PASSWORD = \"admin\"".into(),
+        };
+        let p = build_user_prompt(&spec(), &region);
+        assert!(p.contains("cra-ai-8"));
+        assert!(p.contains("Products must not ship default credentials"));
+        assert!(p.contains("PASSWORD = \"admin\""));
+        assert!(p.contains("src/auth.py"));
+    }
+}

compliance-agent/src/controls/mod.rs

@@ -0,0 +1,23 @@
+//! Controls corpus providers.
+//!
+//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
+//! the control corpus the mapping engine assesses findings against. Currently:
+//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
+//! and snapshots it locally.
+
+mod checker;
+mod index;
+mod judge;
+mod oscal_provider;
+mod scan_triage;
+mod semantic;
+mod surface;
+mod triage;
+
+pub use checker::GroundedControlChecker;
+pub use index::ControlIndex;
+pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
+pub use oscal_provider::OscalControlsProvider;
+pub use scan_triage::{grounded_surface_findings, semantic_stamp_findings, triage_repo_findings};
+pub use semantic::SemanticControlChecker;
+pub use triage::{ControlTriage, TriageOutcome};

compliance-agent/src/controls/oscal_provider.rs

@@ -0,0 +1,229 @@
+//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
+//! catalog export.
+//!
+//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
+//! the exact bytes to disk (so scans are deterministic and keep working offline /
+//! on-prem), and maps the catalog into the corpus controls the mapping engine
+//! consumes. The producer owns the catalog; we own the assessment — this is the
+//! ingest half of the loop.
+
+use std::path::PathBuf;
+
+use secrecy::{ExposeSecret, SecretString};
+
+use compliance_core::error::CoreError;
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::models::oscal::OscalDocument;
+use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
+
+/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
+/// and snapshots it locally for deterministic / offline reuse.
+pub struct OscalControlsProvider {
+    http: reqwest::Client,
+    base_url: String,
+    token: Option<SecretString>,
+    snapshot_dir: PathBuf,
+}
+
+impl OscalControlsProvider {
+    /// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
+    /// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
+    /// snapshots are written so a later scan can reuse them without the network.
+    pub fn new(
+        http: reqwest::Client,
+        base_url: impl Into<String>,
+        token: Option<SecretString>,
+        snapshot_dir: impl Into<PathBuf>,
+    ) -> Self {
+        Self {
+            http,
+            base_url: base_url.into(),
+            token,
+            snapshot_dir: snapshot_dir.into(),
+        }
+    }
+
+    fn catalog_url(&self, framework: &str) -> String {
+        format!(
+            "{}/api/compliance/v1/oscal/catalog?framework={framework}",
+            self.base_url.trim_end_matches('/')
+        )
+    }
+
+    fn snapshot_path(&self, framework: &str) -> PathBuf {
+        self.snapshot_dir
+            .join(format!("oscal-catalog-{framework}.json"))
+    }
+
+    /// Fetch the raw catalog bytes for a framework token over HTTP.
+    async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
+        let mut req = self.http.get(self.catalog_url(framework));
+        if let Some(token) = &self.token {
+            req = req.bearer_auth(token.expose_secret());
+        }
+        let resp = req
+            .send()
+            .await
+            .map_err(|e| CoreError::Http(e.to_string()))?;
+        if !resp.status().is_success() {
+            return Err(CoreError::Http(format!(
+                "catalog fetch for {framework} returned HTTP {}",
+                resp.status()
+            )));
+        }
+        resp.bytes()
+            .await
+            .map(|b| b.to_vec())
+            .map_err(|e| CoreError::Http(e.to_string()))
+    }
+
+    /// Write a catalog snapshot atomically (temp file + rename).
+    async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
+        tokio::fs::create_dir_all(&self.snapshot_dir).await?;
+        let path = self.snapshot_path(framework);
+        let tmp = path.with_extension("json.tmp");
+        tokio::fs::write(&tmp, raw).await?;
+        tokio::fs::rename(&tmp, &path).await?;
+        Ok(())
+    }
+
+    /// Read a previously written snapshot, if one exists.
+    async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
+        match tokio::fs::read(self.snapshot_path(framework)).await {
+            Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    /// Load the catalog for a framework token: fetch fresh + snapshot the exact
+    /// bytes; on network failure, fall back to the last snapshot so scans run.
+    async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
+        match self.fetch_raw(framework).await {
+            Ok(raw) => {
+                let doc: OscalDocument = serde_json::from_slice(&raw)?;
+                if let Err(e) = self.write_snapshot(framework, &raw).await {
+                    tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
+                }
+                Ok(doc)
+            }
+            Err(fetch_err) => match self.read_snapshot(framework).await? {
+                Some(doc) => {
+                    tracing::warn!(
+                        framework, error = %fetch_err,
+                        "OSCAL catalog fetch failed; falling back to snapshot"
+                    );
+                    Ok(doc)
+                }
+                None => Err(fetch_err),
+            },
+        }
+    }
+
+    /// Load the OSCAL catalog for a compliance framework.
+    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
+        self.load_token(&framework.to_string()).await
+    }
+
+    /// Load the code-checkable master-controls catalog
+    /// (`?framework=master-controls`).
+    pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
+        self.load_token("master-controls").await
+    }
+}
+
+/// Order controls whose title/text mention the query context first (stable), then
+/// truncate to the requested limit. Naive relevance — refined when the assessment
+/// layer lands.
+fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
+    if !context.is_empty() {
+        let needle = context.to_lowercase();
+        controls.sort_by_key(|c| {
+            let hit =
+                c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
+            u8::from(!hit)
+        });
+    }
+    controls.truncate(limit);
+    controls
+}
+
+impl ControlsProvider for OscalControlsProvider {
+    fn name(&self) -> &str {
+        "breakpilot-oscal"
+    }
+
+    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
+        let mut out: Vec<Control> = Vec::new();
+        for &framework in query.frameworks {
+            match self.load(framework).await {
+                Ok(doc) => out.extend(doc.to_controls()),
+                Err(e) => {
+                    tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
+                }
+            }
+        }
+        Ok(rank_and_truncate(out, query.context, query.limit))
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
+      "version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
+      "groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
+      "props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
+
+    fn provider(dir: &std::path::Path) -> OscalControlsProvider {
+        OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
+    }
+
+    #[test]
+    fn builds_catalog_url_and_snapshot_path() {
+        let p = provider(std::path::Path::new("/snap"));
+        assert_eq!(
+            p.catalog_url("cra"),
+            "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
+        );
+        assert_eq!(
+            p.snapshot_path("cra"),
+            std::path::Path::new("/snap/oscal-catalog-cra.json")
+        );
+    }
+
+    #[test]
+    fn ranks_context_hits_first_then_truncates() {
+        let mk = |id: &str, title: &str| Control {
+            id: id.into(),
+            framework: ComplianceFramework::Cra,
+            title: title.into(),
+            text: String::new(),
+            source: None,
+        };
+        let controls = vec![
+            mk("a", "logging policy"),
+            mk("b", "multi-factor auth"),
+            mk("c", "backup"),
+        ];
+        let ranked = rank_and_truncate(controls, "auth", 2);
+        assert_eq!(ranked.len(), 2);
+        assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
+    }
+
+    #[tokio::test]
+    async fn snapshot_round_trip_and_offline_fallback() {
+        let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
+        let p = provider(&dir);
+        assert!(p.read_snapshot("cra").await.unwrap().is_none());
+        p.write_snapshot("cra", MINI_CATALOG.as_bytes())
+            .await
+            .unwrap();
+        let doc = p.read_snapshot("cra").await.unwrap().unwrap();
+        assert_eq!(doc.to_controls().len(), 1);
+        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

compliance-agent/src/controls/scan_triage.rs

@@ -0,0 +1,299 @@
+//! Scan-pipeline integration for control triage.
+//!
+//! After the deterministic tools have produced findings, this stamps each finding
+//! with the compliance control(s) it's evidence for and marks control-level false
+//! positives — using the ingested OSCAL catalog for control text, the
+//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
+//! confirm. Skipped entirely unless breakpilot is configured.
+
+use std::collections::HashMap;
+use std::path::Path;
+use std::sync::Arc;
+
+use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
+use compliance_core::models::finding::{Finding, FindingStatus, Severity};
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::AgentConfig;
+use control_map::ControlMap;
+
+use super::surface;
+use super::{
+    ControlIndex, ControlTriage, GroundedControlChecker, LlmControlJudge, OscalControlsProvider,
+    SemanticControlChecker, TriageOutcome,
+};
+use crate::llm::LlmClient;
+
+/// Nearest master controls judged per code region in the semantic pass.
+const SEMANTIC_TOP_K: usize = 5;
+
+/// Lines of context to read on each side of a finding's line.
+const REGION_WINDOW: usize = 6;
+
+/// Triage every finding in `findings` against the CRA control map: stamp
+/// `control_refs` on confirmed findings and flag control false positives. Returns
+/// the number of findings tagged with at least one control.
+pub async fn triage_repo_findings(
+    config: &AgentConfig,
+    llm: Arc<LlmClient>,
+    repo_path: &Path,
+    findings: &mut [Finding],
+) -> usize {
+    let Some(base_url) = config.breakpilot.base_url.clone() else {
+        return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
+    };
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        base_url,
+        config.breakpilot.token.clone(),
+        &config.breakpilot.snapshot_dir,
+    );
+    let specs = build_specs(&provider).await;
+    if specs.is_empty() {
+        return 0;
+    }
+    let map = match ControlMap::cra() {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(error = %e, "control map failed to load; skipping control triage");
+            return 0;
+        }
+    };
+    let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
+
+    let mut tagged = 0;
+    for finding in findings.iter_mut() {
+        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
+            continue;
+        };
+        let Some(region) = fetch_region(repo_path, &file, line) else {
+            continue;
+        };
+        match triage.triage(finding, &region).await {
+            TriageOutcome::Confirmed(controls) => {
+                finding.control_refs = controls;
+                tagged += 1;
+            }
+            TriageOutcome::FalsePositive => {
+                finding.status = FindingStatus::FalsePositive;
+                finding.triage_action = Some("control_false_positive".to_string());
+            }
+            TriageOutcome::Unmapped => {}
+        }
+    }
+    tagged
+}
+
+/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
+async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
+    let mut specs = HashMap::new();
+    match provider.load(ComplianceFramework::Cra).await {
+        Ok(doc) => {
+            for control in doc.to_controls() {
+                specs.insert(
+                    control.id.clone(),
+                    ControlCheckSpec {
+                        control_id: control.id,
+                        title: control.title,
+                        requirement: control.text,
+                        default_cwe: None,
+                        severity: Severity::Medium,
+                    },
+                );
+            }
+        }
+        Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
+    }
+    specs
+}
+
+/// Absence-based control pass (the grounded half of the hybrid coverage): for each
+/// control with a [`surface`] definition, deterministically retrieve the code
+/// surfaces it governs (login routes, logging setup, update/download code) and have
+/// the grounded judge decide whether the control holds there. Returns net-new
+/// findings, each already tagged with its control and grounded to a real snippet.
+///
+/// The orchestrator runs this when `breakpilot.grounded_control_checks` is set
+/// (on by default). Validated live; it covers the 8 absence-based CRA controls
+/// (the judge decides presence/absence, grounded to a real snippet).
+pub async fn grounded_surface_findings(
+    config: &AgentConfig,
+    llm: Arc<LlmClient>,
+    repo_path: &Path,
+    repo_id: &str,
+) -> Vec<Finding> {
+    let Some(base_url) = config.breakpilot.base_url.clone() else {
+        return Vec::new();
+    };
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        base_url,
+        config.breakpilot.token.clone(),
+        &config.breakpilot.snapshot_dir,
+    );
+    let specs = build_specs(&provider).await;
+    if specs.is_empty() {
+        return Vec::new();
+    }
+    let checker = GroundedControlChecker::new(LlmControlJudge::new(llm));
+
+    let mut out = Vec::new();
+    for surf in surface::SURFACES {
+        let Some(spec) = specs.get(surf.control_id) else {
+            continue; // catalog doesn't carry this control
+        };
+        let regions = surface::retrieve(repo_path, surf.terms);
+        if regions.is_empty() {
+            continue;
+        }
+        out.extend(checker.check(spec, &regions, repo_id).await);
+    }
+    out
+}
+
+/// Read a window of lines around `line` (1-based) from `repo_path/file`.
+fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
+    let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
+    let lines: Vec<&str> = content.lines().collect();
+    if lines.is_empty() {
+        return None;
+    }
+    let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
+    let start = center.saturating_sub(REGION_WINDOW);
+    let end = (center + REGION_WINDOW + 1).min(lines.len());
+    Some(CandidateRegion {
+        file: file.to_string(),
+        start_line: (start as u32) + 1,
+        content: lines[start..end].join("\n"),
+    })
+}
+
+/// Master-controls **semantic** pass: for each finding's code region, retrieve the
+/// top-K nearest master controls by embedding, have the grounded judge confirm,
+/// and stamp the confirmed control ids onto the finding — the scale path for the
+/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
+/// of findings that gained a master-control ref.
+///
+/// The orchestrator runs this when `breakpilot.semantic_mapping` is set (on by
+/// default). The control embedding index is built once and cached to
+/// `snapshot_dir` keyed by corpus hash ([`ControlIndex::load_or_build`]), so only
+/// the first scan after a catalog change pays the embedding cost.
+pub async fn semantic_stamp_findings(
+    config: &AgentConfig,
+    llm: Arc<LlmClient>,
+    repo_path: &Path,
+    findings: &mut [Finding],
+) -> usize {
+    let Some(base_url) = config.breakpilot.base_url.clone() else {
+        return 0;
+    };
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        base_url,
+        config.breakpilot.token.clone(),
+        &config.breakpilot.snapshot_dir,
+    );
+    let doc = match provider.load_master_controls().await {
+        Ok(d) => d,
+        Err(e) => {
+            tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
+            return 0;
+        }
+    };
+    let specs: Vec<ControlCheckSpec> = doc
+        .to_controls()
+        .into_iter()
+        .map(|c| ControlCheckSpec {
+            control_id: c.id,
+            title: c.title,
+            requirement: c.text,
+            default_cwe: None,
+            severity: Severity::Medium,
+        })
+        .collect();
+    let cache_path =
+        Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
+    let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
+        Ok(i) if !i.is_empty() => i,
+        Ok(_) => return 0,
+        Err(e) => {
+            tracing::warn!(error = %e, "failed to embed master-controls corpus");
+            return 0;
+        }
+    };
+    let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
+
+    let mut tagged = 0;
+    for finding in findings.iter_mut() {
+        if finding.status == FindingStatus::FalsePositive {
+            continue;
+        }
+        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
+            continue;
+        };
+        let Some(region) = fetch_region(repo_path, &file, line) else {
+            continue;
+        };
+        // Retrieve on the finding's intent + the code, not the region alone: two
+        // findings in one file share overlapping windows and otherwise embed alike,
+        // collapsing onto the same controls. The finding's title/description carry
+        // the discriminating signal (e.g. "brute-force protection" vs "weak hash").
+        // The raw `region` still goes to the judge for snippet grounding.
+        let query = format!(
+            "{}\n{}\n\n{}",
+            finding.title, finding.description, region.content
+        );
+        let query_emb = match llm.embed(vec![query]).await {
+            Ok(mut embs) => match embs.pop() {
+                Some(v) => v,
+                None => continue,
+            },
+            Err(e) => {
+                tracing::warn!(error = %e, "query embed failed; skipping finding");
+                continue;
+            }
+        };
+        let confirmed = checker
+            .check(
+                &index,
+                &region,
+                &query_emb,
+                SEMANTIC_TOP_K,
+                &finding.repo_id,
+            )
+            .await;
+        let before = finding.control_refs.len();
+        for f in confirmed {
+            for cref in f.control_refs {
+                if !finding.control_refs.contains(&cref) {
+                    finding.control_refs.push(cref);
+                }
+            }
+        }
+        if finding.control_refs.len() > before {
+            tagged += 1;
+        }
+    }
+    tagged
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fetch_region_windows_around_the_line() {
+        let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = "a.py";
+        std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
+        let r = fetch_region(&dir, file, 4).unwrap();
+        assert!(r.content.contains("SECRET=1"));
+        assert_eq!(r.start_line, 1); // window clamps to file start
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn fetch_region_missing_file_is_none() {
+        assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
+    }
+}

compliance-agent/src/controls/semantic.rs

@@ -0,0 +1,121 @@
+//! Semantic control mapping: retrieve the top-K controls nearest a code region,
+//! then confirm each with the grounded judge.
+//!
+//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
+//! what scales to the full master-control corpus: the LLM only ever judges a
+//! handful of retrieved candidates, and every surviving verdict is still anchored
+//! to real code by the grounding gate.
+
+use compliance_core::control_check::{ground, CandidateRegion};
+use compliance_core::models::Finding;
+
+use super::index::ControlIndex;
+use super::judge::ControlJudge;
+
+/// Retrieve → judge → ground, generic over the judge so tests use a stub.
+pub struct SemanticControlChecker<J> {
+    judge: J,
+}
+
+impl<J: ControlJudge> SemanticControlChecker<J> {
+    pub fn new(judge: J) -> Self {
+        Self { judge }
+    }
+
+    /// Map a code region to the controls it violates. `query_embedding` is the
+    /// caller-supplied retrieval embedding — typically the finding's intent
+    /// (title/description) plus the region, so retrieval keys on what the finding
+    /// is *about*, not just the ambient code. The top-`k` nearest controls in
+    /// `index` are then judged against the raw `region` and grounded.
+    pub async fn check(
+        &self,
+        index: &ControlIndex,
+        region: &CandidateRegion,
+        query_embedding: &[f64],
+        k: usize,
+        repo_id: &str,
+    ) -> Vec<Finding> {
+        let candidates = index.nearest(query_embedding, k);
+        let mut findings = Vec::new();
+        for spec in &candidates {
+            let verdict = self.judge.judge(spec, region).await;
+            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
+                findings.push(finding);
+            }
+        }
+        findings
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
+    use compliance_core::models::finding::Severity;
+
+    struct StubJudge {
+        verdict: LlmVerdict,
+    }
+    impl ControlJudge for StubJudge {
+        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
+            self.verdict.clone()
+        }
+    }
+
+    fn spec(id: &str) -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: id.into(),
+            title: id.into(),
+            requirement: id.into(),
+            default_cwe: None,
+            severity: Severity::Medium,
+        }
+    }
+
+    #[tokio::test]
+    async fn retrieves_then_grounds_the_nearest_control() {
+        let index = ControlIndex::from_embeddings(vec![
+            (spec("mc-near"), vec![1.0, 0.0]),
+            (spec("mc-far"), vec![0.0, 1.0]),
+        ]);
+        let checker = SemanticControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: true,
+                snippet: "PASSWORD = \"admin\"".into(),
+                cwe: None,
+                confidence: 0.9,
+            },
+        });
+        let region = CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 1,
+            content: "PASSWORD = \"admin\"\n".into(),
+        };
+        // Query embedding nearest to mc-near; k=1 → only mc-near is judged.
+        let findings = checker
+            .check(&index, &region, &[0.95, 0.05], 1, "repo")
+            .await;
+        assert_eq!(findings.len(), 1);
+        assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
+    }
+
+    #[tokio::test]
+    async fn ungrounded_verdict_is_dropped() {
+        let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
+        let checker = SemanticControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: true,
+                snippet: "not in the region".into(),
+                cwe: None,
+                confidence: 0.9,
+            },
+        });
+        let region = CandidateRegion {
+            file: "f".into(),
+            start_line: 1,
+            content: "real code\n".into(),
+        };
+        let findings = checker.check(&index, &region, &[1.0, 0.0], 1, "repo").await;
+        assert!(findings.is_empty());
+    }
+}

compliance-agent/src/controls/surface.rs

@@ -0,0 +1,258 @@
+//! Surface retrieval for absence-based controls.
+//!
+//! Some CRA controls are violated by an *absence* — no rate limiting on login, no
+//! security logging, no signature check on an update — so there's no offending
+//! pattern for semgrep to match. Instead we deterministically locate the code
+//! *surface* the control governs (a login route, a logging setup, update/download
+//! code) by identifier/route terms, then hand each surface region to the grounded
+//! judge, which decides whether the control is satisfied there. The resulting
+//! finding grounds to the surface snippet, so nothing fabricated survives.
+//!
+//! Retrieval is intentionally cheap and bounded: keyword match + a fixed window,
+//! capped per control to keep the downstream LLM cost predictable.
+
+use std::path::Path;
+
+use compliance_core::control_check::CandidateRegion;
+
+/// An absence-based control and the case-insensitive terms that mark the code
+/// surface it governs.
+pub struct Surface {
+    pub control_id: &'static str,
+    pub terms: &'static [&'static str],
+}
+
+/// The absence-based CRA controls we retrieve surfaces for — the grounded half of
+/// the hybrid coverage (the pattern-expressible half is custom semgrep rules).
+pub const SURFACES: &[Surface] = &[
+    Surface {
+        control_id: "cra-ai-6", // Integritaetspruefung
+        terms: &[
+            "checksum",
+            "sha256",
+            "signature",
+            "hmac",
+            "integrity",
+            "verify",
+        ],
+    },
+    Surface {
+        control_id: "cra-ai-11", // Brute-Force-Schutz
+        terms: &[
+            "login",
+            "signin",
+            "authenticate",
+            "/auth",
+            "password",
+            "ratelimit",
+        ],
+    },
+    Surface {
+        control_id: "cra-ai-12", // Rollenbasierte Autorisierung (RBAC)
+        terms: &[
+            "authorize",
+            "permission",
+            "role",
+            "rbac",
+            "require_role",
+            "has_role",
+        ],
+    },
+    Surface {
+        control_id: "cra-ai-24", // Security-Logging
+        terms: &["login", "authorize", "permission", "role", "admin", "audit"],
+    },
+    Surface {
+        control_id: "cra-ai-27", // Log-Integritaet und -Aufbewahrung
+        terms: &["logging", "logger", "getlogger", "audit_log"],
+    },
+    Surface {
+        control_id: "cra-ai-28", // Sichere Update-Mechanismen
+        terms: &["update", "upgrade", "download", "firmware"],
+    },
+    Surface {
+        control_id: "cra-ai-29", // Update-Authentizitaet
+        terms: &["update", "signature", "verify", "pubkey", "certificate"],
+    },
+    Surface {
+        control_id: "cra-ai-30", // Update-Integritaet
+        terms: &["update", "checksum", "digest", "integrity", "verify"],
+    },
+];
+
+/// Source file extensions worth reading (skip binaries/assets/lockfiles).
+const CODE_EXTS: &[&str] = &[
+    "py", "js", "ts", "tsx", "jsx", "go", "java", "rb", "php", "rs", "cs", "kt",
+];
+/// Directories never worth walking.
+const SKIP_DIRS: &[&str] = &[
+    ".git",
+    "node_modules",
+    "target",
+    "vendor",
+    ".venv",
+    "__pycache__",
+    "dist",
+    "build",
+];
+/// Lines of context on each side of a hit.
+const WINDOW: usize = 6;
+/// Cap on regions per control, to bound downstream LLM calls.
+const MAX_REGIONS_PER_CONTROL: usize = 8;
+/// Skip files larger than this (generated/minified).
+const MAX_FILE_BYTES: u64 = 512 * 1024;
+
+/// Deterministically retrieve up to [`MAX_REGIONS_PER_CONTROL`] code regions in
+/// `repo_path` whose lines mention any of `terms`. Hits close together within a
+/// file are merged into one region; results are capped to bound LLM cost.
+pub fn retrieve(repo_path: &Path, terms: &[&str]) -> Vec<CandidateRegion> {
+    let lowered: Vec<String> = terms.iter().map(|t| t.to_lowercase()).collect();
+    let mut regions = Vec::new();
+    for entry in walk(repo_path) {
+        if regions.len() >= MAX_REGIONS_PER_CONTROL {
+            break;
+        }
+        let path = entry.path();
+        if !has_code_ext(path) {
+            continue;
+        }
+        let Ok(meta) = entry.metadata() else { continue };
+        if !meta.is_file() || meta.len() > MAX_FILE_BYTES {
+            continue;
+        }
+        let Ok(content) = std::fs::read_to_string(path) else {
+            continue;
+        };
+        let rel = path
+            .strip_prefix(repo_path)
+            .unwrap_or(path)
+            .to_string_lossy()
+            .to_string();
+        let lines: Vec<&str> = content.lines().collect();
+        let hits: Vec<usize> = lines
+            .iter()
+            .enumerate()
+            .filter(|(_, line)| {
+                let ll = line.to_lowercase();
+                lowered.iter().any(|t| ll.contains(t.as_str()))
+            })
+            .map(|(i, _)| i)
+            .collect();
+        for center in merge_centers(&hits) {
+            if regions.len() >= MAX_REGIONS_PER_CONTROL {
+                break;
+            }
+            let start = center.saturating_sub(WINDOW);
+            let end = (center + WINDOW + 1).min(lines.len());
+            regions.push(CandidateRegion {
+                file: rel.clone(),
+                start_line: (start as u32) + 1,
+                content: lines[start..end].join("\n"),
+            });
+        }
+    }
+    regions
+}
+
+/// Collapse ascending hit indices that fall within one window into a single
+/// representative center, so overlapping regions aren't judged repeatedly.
+fn merge_centers(hits: &[usize]) -> Vec<usize> {
+    let mut out: Vec<usize> = Vec::new();
+    for &h in hits {
+        match out.last() {
+            Some(&last) if h.saturating_sub(last) <= WINDOW => {}
+            _ => out.push(h),
+        }
+    }
+    out
+}
+
+fn has_code_ext(path: &Path) -> bool {
+    path.extension()
+        .and_then(|e| e.to_str())
+        .is_some_and(|e| CODE_EXTS.contains(&e))
+}
+
+fn walk(root: &Path) -> Vec<walkdir::DirEntry> {
+    walkdir::WalkDir::new(root)
+        .into_iter()
+        .filter_entry(|e| {
+            let name = e.file_name().to_string_lossy();
+            !SKIP_DIRS.contains(&name.as_ref())
+        })
+        .filter_map(|e| e.ok())
+        .collect()
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn write(dir: &Path, rel: &str, body: &str) {
+        let p = dir.join(rel);
+        if let Some(parent) = p.parent() {
+            std::fs::create_dir_all(parent).unwrap();
+        }
+        std::fs::write(p, body).unwrap();
+    }
+
+    fn terms_for(control_id: &str) -> &'static [&'static str] {
+        SURFACES
+            .iter()
+            .find(|s| s.control_id == control_id)
+            .unwrap()
+            .terms
+    }
+
+    #[test]
+    fn surfaces_cover_the_absence_based_controls() {
+        assert_eq!(SURFACES.len(), 8);
+        for id in [
+            "cra-ai-6",
+            "cra-ai-11",
+            "cra-ai-12",
+            "cra-ai-24",
+            "cra-ai-27",
+            "cra-ai-28",
+            "cra-ai-29",
+            "cra-ai-30",
+        ] {
+            assert!(SURFACES.iter().any(|s| s.control_id == id), "{id} missing");
+        }
+    }
+
+    #[test]
+    fn retrieves_matching_region_with_context() {
+        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        write(
+            &dir,
+            "app/auth.py",
+            "import x\n\n\n\n\n\n\ndef login(u, p):\n    return check(u, p)\n",
+        );
+        let regions = retrieve(&dir, terms_for("cra-ai-11"));
+        assert_eq!(regions.len(), 1);
+        assert!(regions[0].content.contains("def login"));
+        assert_eq!(regions[0].file, "app/auth.py");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn skips_non_code_and_vendored() {
+        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        write(&dir, "README.md", "login and password and audit\n"); // not code ext
+        write(&dir, "node_modules/pkg/index.js", "function login() {}\n"); // vendored
+        assert!(retrieve(&dir, terms_for("cra-ai-11")).is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn merges_adjacent_hits_into_one_region() {
+        // Two hits one line apart collapse to a single center/region.
+        assert_eq!(merge_centers(&[10, 11, 30]), vec![10, 30]);
+        assert_eq!(merge_centers(&[]), Vec::<usize>::new());
+        assert_eq!(merge_centers(&[5]), vec![5]);
+    }
+}

compliance-agent/src/controls/triage.rs

@@ -0,0 +1,234 @@
+//! Triage step: confirm/refute a deterministic tool finding against the controls
+//! it maps to (via the `control-map` LUT), grounding the judgment.
+//!
+//! This is where the LLM finally enters — as a **false-positive filter over tool
+//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
+//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
+//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
+//! judge then confirms or refutes each, and only judgments anchored to real code
+//! survive.
+
+use std::collections::HashMap;
+
+use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
+use compliance_core::models::Finding;
+use control_map::ControlMap;
+
+use super::judge::ControlJudge;
+
+/// What triage decided for one tool finding.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TriageOutcome {
+    /// The finding maps to no control in the LUT — keep it, untagged.
+    Unmapped,
+    /// Maps to controls and the grounded judge confirmed at least one — keep the
+    /// finding and tag it with these control ids.
+    Confirmed(Vec<String>),
+    /// Maps to controls but the judge grounded none — treat as a false positive.
+    FalsePositive,
+}
+
+/// Triages tool findings against the control map, confirming with a grounded judge.
+pub struct ControlTriage<J> {
+    judge: J,
+    map: ControlMap,
+    /// Control requirement specs (by control id), built from the ingested catalog.
+    specs: HashMap<String, ControlCheckSpec>,
+}
+
+impl<J: ControlJudge> ControlTriage<J> {
+    pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
+        Self { judge, map, specs }
+    }
+
+    /// Triage one tool finding. `region` is the code around the finding, used as
+    /// the grounding evidence for the judge.
+    pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
+        // Match by CWE (off-the-shelf findings) and/or rule id (our custom
+        // detectors, which carry no LUT-bound CWE). A finding with neither is
+        // simply unmapped.
+        let mapped = self.map.controls_for_finding(
+            &finding.scanner,
+            finding.cwe.as_deref(),
+            finding.rule_id.as_deref(),
+        );
+        if mapped.is_empty() {
+            return TriageOutcome::Unmapped;
+        }
+
+        let mut confirmed = Vec::new();
+        for entry in mapped {
+            let Some(spec) = self.specs.get(&entry.control) else {
+                continue;
+            };
+            let verdict = self.judge.judge(spec, region).await;
+            // The verdict only counts if it grounds to real code in the region.
+            if ground(spec, region, &verdict, &finding.repo_id).is_some() {
+                confirmed.push(entry.control.clone());
+            }
+        }
+
+        if confirmed.is_empty() {
+            TriageOutcome::FalsePositive
+        } else {
+            TriageOutcome::Confirmed(confirmed)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::control_check::LlmVerdict;
+    use compliance_core::models::finding::Severity;
+    use compliance_core::models::scan::ScanType;
+
+    struct StubJudge {
+        verdict: LlmVerdict,
+    }
+    impl ControlJudge for StubJudge {
+        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
+            self.verdict.clone()
+        }
+    }
+
+    fn specs() -> HashMap<String, ControlCheckSpec> {
+        let mut m = HashMap::new();
+        m.insert(
+            "cra-ai-8".to_string(),
+            ControlCheckSpec {
+                control_id: "cra-ai-8".into(),
+                title: "No default passwords".into(),
+                requirement: "No default credentials".into(),
+                default_cwe: Some("CWE-798".into()),
+                severity: Severity::High,
+            },
+        );
+        m
+    }
+
+    fn semgrep_finding(cwe: &str) -> Finding {
+        let mut f = Finding::new(
+            "repo".into(),
+            "fp1".into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            "hardcoded credential".into(),
+            "desc".into(),
+            Severity::High,
+        );
+        f.cwe = Some(cwe.into());
+        f
+    }
+
+    fn region() -> CandidateRegion {
+        CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 1,
+            content: "PASSWORD = \"admin123\"\n".into(),
+        }
+    }
+
+    #[tokio::test]
+    async fn confirmed_finding_is_tagged_with_control() {
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: true,
+                    snippet: "PASSWORD = \"admin123\"".into(),
+                    cwe: None,
+                    confidence: 0.9,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs(),
+        );
+        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
+        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
+    }
+
+    #[tokio::test]
+    async fn refuted_mapped_finding_is_false_positive() {
+        // Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: false,
+                    snippet: String::new(),
+                    cwe: None,
+                    confidence: 0.1,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs(),
+        );
+        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
+        assert_eq!(out, TriageOutcome::FalsePositive);
+    }
+
+    #[tokio::test]
+    async fn custom_rule_finding_without_cwe_is_confirmed() {
+        // A custom detector finding carries a rule id but no LUT-bound CWE; it must
+        // still map (by rule id) and confirm.
+        let mut specs = specs();
+        specs.insert(
+            "cra-ai-1".to_string(),
+            ControlCheckSpec {
+                control_id: "cra-ai-1".into(),
+                title: "Secure-by-Default".into(),
+                requirement: "Ship secure defaults".into(),
+                default_cwe: None,
+                severity: Severity::Medium,
+            },
+        );
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: true,
+                    snippet: "app.run(debug=True)".into(),
+                    cwe: None,
+                    confidence: 0.9,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs,
+        );
+        let mut f = Finding::new(
+            "repo".into(),
+            "fp".into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            "flask debug".into(),
+            "desc".into(),
+            Severity::Medium,
+        );
+        f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
+        let region = CandidateRegion {
+            file: "app.py".into(),
+            start_line: 1,
+            content: "app.run(debug=True)\n".into(),
+        };
+        let out = triage.triage(&f, &region).await;
+        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
+    }
+
+    #[tokio::test]
+    async fn unmapped_cwe_is_left_untagged() {
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: true,
+                    snippet: "PASSWORD = \"admin123\"".into(),
+                    cwe: None,
+                    confidence: 0.9,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs(),
+        );
+        let out = triage
+            .triage(&semgrep_finding("CWE-99999"), &region())
+            .await;
+        assert_eq!(out, TriageOutcome::Unmapped);
+    }
+}

compliance-agent/src/database.rs

@@ -465,6 +465,34 @@ impl Database {
             )
             .await?;
 
+        // werkbank_jobs: unique job id (idempotent enqueue by job id)
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "job.id": 1 })
+                    .options(IndexOptions::builder().unique(true).build())
+                    .build(),
+            )
+            .await?;
+
+        // werkbank_jobs: lease query — oldest queued job for an executor
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // werkbank_jobs: visibility-timeout sweep of expired leases
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "status": 1, "lease_expires_at": 1 })
+                    .build(),
+            )
+            .await?;
+
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -563,6 +591,12 @@ impl Database {
         self.inner.collection("pentest_messages")
     }
 
+    /// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
+    /// control plane enqueues and runners lease.
+    pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
+        self.inner.collection("werkbank_jobs")
+    }
+
     #[allow(dead_code)]
     pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
         self.inner.collection(name)

compliance-agent/src/error.rs

@@ -27,6 +27,9 @@ pub enum AgentError {
     #[error("Configuration error: {0}")]
     Config(String),
 
+    #[error("Dynamic-execution error: {0}")]
+    Exec(#[from] werkbank_exec::ExecError),
+
     #[error("{0}")]
     Other(String),
 }

compliance-agent/src/ingest/blob.rs

@@ -32,6 +32,30 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
     Ok((hex::encode(hasher.finalize()), total))
 }
 
+/// Store raw bytes in the content-addressed blob store under `base`, returning
+/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
+/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
+pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
+    let sha = hex::encode(Sha256::digest(bytes));
+    let dir = base.join("blobs").join(&sha[0..2]);
+    fs::create_dir_all(&dir)?;
+    let dest = dir.join(&sha);
+    if !dest.exists() {
+        fs::write(&dest, bytes)?;
+    }
+    Ok(sha)
+}
+
+/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
+/// so a request can't traverse outside the blob store.
+pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
+    if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
+    }
+    let path = base.join("blobs").join(&sha[0..2]).join(sha);
+    Ok(fs::read(path)?)
+}
+
 /// Copy `src` into the content-addressed blob store under `base`, returning the
 /// stored path. Idempotent: an already-present blob is not rewritten.
 pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {

compliance-agent/src/ingest/mod.rs

@@ -6,7 +6,7 @@
 //! is also the reconciliation key against sibling products (a firmware sha256
 //! matches tramiton's `Artifact.sha256`).
 
-mod blob;
+pub(crate) mod blob;
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};

compliance-agent/src/lib.rs

@@ -4,6 +4,7 @@ pub mod agent;
 pub mod api;
 pub mod classify;
 pub mod config;
+pub mod controls;
 pub mod database;
 pub mod error;
 pub mod ingest;
@@ -16,3 +17,4 @@ pub mod ssh;
 #[allow(dead_code)]
 pub mod trackers;
 pub mod webhooks;
+pub mod werkbank;

compliance-agent/src/llm/embedding.rs

@@ -22,6 +22,11 @@ struct EmbeddingData {
     index: usize,
 }
 
+/// Max inputs per embedding request. The bge/OpenAI-like backends cap the input
+/// array (bge-multilingual-gemma2 rejects >25 with "batch size overflow"), so we
+/// chunk larger corpora — a whole control catalog (~1.8k) would otherwise 500.
+const EMBED_BATCH_SIZE: usize = 16;
+
 // ── Embedding implementation ───────────────────────────────────
 
 impl LlmClient {
@@ -29,8 +34,21 @@ impl LlmClient {
         &self.embed_model
     }
 
-    /// Generate embeddings for a batch of texts
+    /// Generate embeddings for a batch of texts, chunking into backend-sized
+    /// requests and preserving input order across chunks.
     pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
+        if texts.is_empty() {
+            return Ok(Vec::new());
+        }
+        let mut out = Vec::with_capacity(texts.len());
+        for chunk in texts.chunks(EMBED_BATCH_SIZE) {
+            out.extend(self.embed_batch(chunk.to_vec()).await?);
+        }
+        Ok(out)
+    }
+
+    /// Embed one backend-sized batch (≤ [`EMBED_BATCH_SIZE`]) in a single request.
+    async fn embed_batch(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
         let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));
 
         let request_body = EmbeddingRequest {
@@ -72,3 +90,33 @@ impl LlmClient {
         Ok(data.into_iter().map(|d| d.embedding).collect())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use secrecy::SecretString;
+
+    fn client() -> LlmClient {
+        LlmClient::new(
+            "http://unused".into(),
+            SecretString::from(String::new()),
+            "m".into(),
+            "e".into(),
+        )
+    }
+
+    #[tokio::test]
+    async fn empty_input_makes_no_request() {
+        // Must short-circuit before any HTTP call (base_url is unroutable).
+        let out = client().embed(Vec::new()).await.unwrap();
+        assert!(out.is_empty());
+    }
+
+    #[test]
+    fn batch_size_is_within_backend_cap() {
+        assert!(
+            EMBED_BATCH_SIZE <= 25,
+            "must stay under the bge 25-input cap"
+        );
+    }
+}

compliance-agent/src/pentest/cleanup.rs

@@ -342,6 +342,9 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
+            werkbank_runner_token: None,
+            breakpilot: compliance_core::config::BreakpilotConfig::default(),
         }
     }
 

compliance-agent/src/pipeline/mod.rs

@@ -5,7 +5,6 @@ pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
-pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;

compliance-agent/src/pipeline/orchestrator.rs

@@ -215,8 +215,72 @@ impl PipelineOrchestrator {
         .await;
         tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
 
-        // Dedup against existing findings and insert new ones
+        // Stage 5b: control triage — stamp findings with the compliance control(s)
+        // they're evidence for and flag control false positives (grounded LLM over
+        // deterministic tool output). No-op unless breakpilot is configured.
+        self.update_phase(scan_run_id, "control_triage").await;
+        let tagged = crate::controls::triage_repo_findings(
+            &self.config,
+            self.llm.clone(),
+            &repo_path,
+            &mut all_findings,
+        )
+        .await;
+        if tagged > 0 {
+            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
+        }
+
+        // Stage 5c: semantic control mapping — scale path for the master-controls
+        // corpus (no CWE to LUT on): embed each finding's region, retrieve the
+        // nearest master controls, grounded-judge, and stamp confirmed refs. On by
+        // default (validated live); the corpus embedding is cached so only the
+        // first scan after a catalog change pays it.
+        if self.config.breakpilot.semantic_mapping {
+            self.update_phase(scan_run_id, "semantic_control_mapping")
+                .await;
+            let sem = crate::controls::semantic_stamp_findings(
+                &self.config,
+                self.llm.clone(),
+                &repo_path,
+                &mut all_findings,
+            )
+            .await;
+            if sem > 0 {
+                tracing::info!(
+                    "[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
+                );
+            }
+        }
+
+        // Stage 5d: grounded surface checks — the absence-based controls (no
+        // rate limiting, no security logging, no update-signature check) have no
+        // syntactic pattern to match, so we retrieve the code surface each governs
+        // and let the grounded judge decide whether it holds, producing net-new
+        // findings already tagged + grounded. On by default (validated live); it
+        // covers the 8 absence-based CRA controls.
+        if self.config.breakpilot.grounded_control_checks {
+            self.update_phase(scan_run_id, "grounded_control_checks")
+                .await;
+            let grounded = crate::controls::grounded_surface_findings(
+                &self.config,
+                self.llm.clone(),
+                &repo_path,
+                &repo_id,
+            )
+            .await;
+            if !grounded.is_empty() {
+                tracing::info!(
+                    "[{repo_id}] Grounded surface checks raised {} control findings",
+                    grounded.len()
+                );
+                all_findings.extend(grounded);
+            }
+        }
+
+        // Dedup against existing findings: insert first-seen ones, and refresh the
+        // control mappings on ones we've seen before.
         let mut new_count = 0u32;
+        let mut refreshed_count = 0u32;
         let mut new_findings: Vec<Finding> = Vec::new();
         for mut finding in all_findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
@@ -231,8 +295,25 @@ impl PipelineOrchestrator {
                 finding.id = result.inserted_id.as_object_id();
                 new_findings.push(finding);
                 new_count += 1;
+            } else if !finding.control_refs.is_empty() {
+                // Re-scan refresh: a mapping pass (newly enabled or tuned) computed
+                // control_refs for a finding first seen before mapping ran. Persist
+                // them onto the existing row — the insert path alone never would.
+                self.db
+                    .findings()
+                    .update_one(
+                        doc! { "fingerprint": &finding.fingerprint },
+                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
+                    )
+                    .await?;
+                refreshed_count += 1;
             }
         }
+        if refreshed_count > 0 {
+            tracing::info!(
+                "[{repo_id}] Refreshed control_refs on {refreshed_count} existing findings"
+            );
+        }
 
         // Remove stale SBOM entries for this repo before reinserting
         if !sbom_entries.is_empty() {
@@ -404,6 +485,21 @@ impl PipelineOrchestrator {
         let ics = plan.has(ScanType::IcsProbe);
         if plc {
             new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
+            // Provision-and-test (#183): with the control logic but no reachable
+            // device, instantiate it on an ephemeral soft-PLC and probe that
+            // instead of the customer's OT network. Opt-in (needs Docker) and only
+            // when there is no live URL to probe directly. Never fails the scan.
+            if self.config.plc_runtime.enabled && target.live_url().is_none() {
+                match self
+                    .run_provisioned_plc_test(target, &target_id, scan_run_id)
+                    .await
+                {
+                    Ok(n) => new_count += n,
+                    Err(e) => {
+                        tracing::warn!(target_id = %target_id, error = %e, "provision-and-test failed")
+                    }
+                }
+            }
         }
         if ics {
             new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
@@ -490,7 +586,21 @@ impl PipelineOrchestrator {
             let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
                 continue;
             };
-            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
+            let mut source_findings = crate::pipeline::plc::analyze_tree(&path, target_id);
+            // Control mapping for the PLC path (run_plc_scan is separate from
+            // run_pipeline, which does its own mapping). PLC findings carry
+            // file_path/line/cwe, so the semantic pass reads each region under this
+            // source's `path` and stamps master-control refs. The LUT + grounded
+            // surface passes are code-pattern / CRA-specific and don't apply to
+            // IEC 61131-3 control logic, so only the semantic pass runs here.
+            crate::controls::semantic_stamp_findings(
+                &self.config,
+                self.llm.clone(),
+                &path,
+                &mut source_findings,
+            )
+            .await;
+            all_findings.extend(source_findings);
             // Control-application SBOM: CODESYS libraries + runtime from a
             // `.projectarchive` (uploaded, or committed in the working tree).
             let archive = a
@@ -515,7 +625,112 @@ impl PipelineOrchestrator {
         );
 
         let mut new_count = 0u32;
+        let mut refreshed_count = 0u32;
         for mut finding in all_findings {
+            finding.scan_run_id = Some(scan_run_id.to_string());
+            if self
+                .db
+                .findings()
+                .find_one(doc! { "fingerprint": &finding.fingerprint })
+                .await?
+                .is_none()
+            {
+                self.db.findings().insert_one(&finding).await?;
+                new_count += 1;
+            } else if !finding.control_refs.is_empty() {
+                // Re-scan refresh: mirror run_pipeline — persist newly-computed
+                // control_refs onto a PLC finding first seen before the semantic
+                // pass ran. The insert path alone never would, so without this a
+                // PLC re-scan can only pick up mappings via a delete + re-add.
+                self.db
+                    .findings()
+                    .update_one(
+                        doc! { "fingerprint": &finding.fingerprint },
+                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
+                    )
+                    .await?;
+                refreshed_count += 1;
+            }
+        }
+        if refreshed_count > 0 {
+            tracing::info!(
+                target_id,
+                "Refreshed control_refs on {refreshed_count} existing PLC findings"
+            );
+        }
+
+        if !all_sbom.is_empty() {
+            if let Err(e) = self
+                .persist_control_app_sbom(target_id, &target.name, all_sbom)
+                .await
+            {
+                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Provision-and-test (#183): instantiate the target's control logic on an
+    /// ephemeral soft-PLC (OpenPLC), start it, probe the provisioned Modbus
+    /// endpoint, and tear the instance down. Used when a PLC/SPS target has the
+    /// control logic but no reachable live device to probe directly. Guarded by
+    /// `plc_runtime.enabled` (needs Docker); persists the same [`ScanType::IcsProbe`]
+    /// findings as a live probe.
+    async fn run_provisioned_plc_test(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        self.update_phase(scan_run_id, "plc_provision").await;
+
+        // Locate a loadable control-logic program among the PLC-source artifacts
+        // (same selection as the static PLC scan: dedicated PLC projects plus code
+        // artifacts holding PLCopen XML / ST exports).
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
+        let program = target
+            .artifacts
+            .iter()
+            .filter(|a| {
+                matches!(
+                    a.kind,
+                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+                )
+            })
+            .find_map(|a| {
+                let path = ingest_set
+                    .get(&a.id)
+                    .and_then(|ia| ia.working_path.clone())?;
+                werkbank_exec::plc::extract_program(&path)
+            });
+        let Some(program) = program else {
+            tracing::info!(
+                target_id,
+                "provision-and-test: no loadable control-logic program"
+            );
+            return Ok(0);
+        };
+
+        let http = werkbank_exec::plc::http_client()?;
+        let provisioner = werkbank_exec::plc::DockerSoftPlc::new(self.config.plc_runtime.clone());
+        let outcome = werkbank_exec::plc::provision_and_test(
+            &provisioner,
+            &http,
+            &self.config.plc_runtime,
+            &program,
+            target_id,
+        )
+        .await?;
+        tracing::info!(
+            target_id,
+            found = outcome.findings.len(),
+            dast = outcome.dast.is_some(),
+            "provision-and-test complete"
+        );
+
+        let mut new_count = 0u32;
+        for mut finding in outcome.findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
             if self
                 .db
@@ -529,12 +744,18 @@ impl PipelineOrchestrator {
             }
         }
 
-        if !all_sbom.is_empty() {
-            if let Err(e) = self
-                .persist_control_app_sbom(target_id, &target.name, all_sbom)
-                .await
-            {
-                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
+        // Persist the DAST scan of the provisioned web endpoint, linked to this
+        // scan run (mirrors `maybe_trigger_dast`).
+        if let Some(dast) = outcome.dast {
+            let mut scan_run = dast.scan_run;
+            scan_run.sast_scan_run_id = Some(scan_run_id.to_string());
+            if let Err(e) = self.db.dast_scan_runs().insert_one(&scan_run).await {
+                tracing::warn!(target_id, error = %e, "failed to store provisioned DAST scan run");
+            }
+            for finding in &dast.findings {
+                if let Err(e) = self.db.dast_findings().insert_one(finding).await {
+                    tracing::warn!(target_id, error = %e, "failed to store provisioned DAST finding");
+                }
             }
         }
         Ok(new_count)
@@ -556,7 +777,7 @@ impl PipelineOrchestrator {
         };
         // Short per-request budget so an unreachable device doesn't stall the scan.
         let budget = std::time::Duration::from_secs(5);
-        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
+        let findings = werkbank_exec::ics::probe_target(&endpoint, target_id, budget).await;
         tracing::info!(
             target_id,
             endpoint = %endpoint,

compliance-agent/src/pipeline/semgrep.rs

@@ -1,4 +1,4 @@
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use compliance_core::models::{Finding, ScanType, Severity};
 use compliance_core::traits::{ScanOutput, Scanner};
@@ -6,6 +6,30 @@ use compliance_core::CoreError;
 
 use crate::pipeline::dedup;
 
+/// Custom CRA-control detectors bundled into the binary and staged to a temp file
+/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
+/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
+/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
+/// keyed back to its control by the `control-map` LUT.
+const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
+
+/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
+/// rename). Returns `None` on failure — the scan then runs with auto rules only.
+async fn stage_cra_rules() -> Option<PathBuf> {
+    let dir = std::env::temp_dir();
+    let path = dir.join("compliance-cra-semgrep.yaml");
+    let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
+    if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
+        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
+        return None;
+    }
+    if let Err(e) = tokio::fs::rename(&tmp, &path).await {
+        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
+        return None;
+    }
+    Some(path)
+}
+
 pub struct SemgrepScanner;
 
 impl Scanner for SemgrepScanner {
@@ -19,30 +43,26 @@ impl Scanner for SemgrepScanner {
 
     #[tracing::instrument(skip_all)]
     async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let output = tokio::time::timeout(
-            std::time::Duration::from_secs(600),
-            tokio::process::Command::new("semgrep")
-                .args([
-                    "--config=auto",
-                    "--json",
-                    "--quiet",
-                    "--max-memory",
-                    "500",
-                    "--jobs",
-                    "1",
-                ])
-                .arg(repo_path)
-                .output(),
-        )
-        .await
-        .map_err(|_| CoreError::Scanner {
-            scanner: "semgrep".to_string(),
-            source: "timed out after 10 minutes".into(),
-        })?
-        .map_err(|e| CoreError::Scanner {
-            scanner: "semgrep".to_string(),
-            source: Box::new(e),
-        })?;
+        let cra_rules = stage_cra_rules().await;
+        let mut command = tokio::process::Command::new("semgrep");
+        command.arg("--config=auto");
+        if let Some(path) = &cra_rules {
+            command.arg(format!("--config={}", path.display()));
+        }
+        command
+            .args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
+            .arg(repo_path);
+
+        let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
+            .await
+            .map_err(|_| CoreError::Scanner {
+                scanner: "semgrep".to_string(),
+                source: "timed out after 10 minutes".into(),
+            })?
+            .map_err(|e| CoreError::Scanner {
+                scanner: "semgrep".to_string(),
+                source: Box::new(e),
+            })?;
 
         if !output.status.success() && output.stdout.is_empty() {
             let stderr = String::from_utf8_lossy(&output.stderr);
@@ -82,10 +102,7 @@ impl Scanner for SemgrepScanner {
                 finding.file_path = Some(r.path);
                 finding.line_number = Some(r.start.line);
                 finding.code_snippet = Some(r.extra.lines);
-                finding.cwe = r
-                    .extra
-                    .metadata
-                    .and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
+                finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
                 finding
             })
             .collect();
@@ -124,10 +141,34 @@ struct SemgrepExtra {
     metadata: Option<serde_json::Value>,
 }
 
+/// semgrep emits `metadata.cwe` as a list of strings like
+/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
+/// the first entry and normalise it to just the `CWE-NNN` id.
+fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
+    let raw = metadata.get("cwe")?;
+    let text = match raw {
+        serde_json::Value::Array(items) => items.first()?.as_str()?,
+        serde_json::Value::String(s) => s.as_str(),
+        _ => return None,
+    };
+    let id = text.split(':').next().unwrap_or(text).trim();
+    (!id.is_empty()).then(|| id.to_string())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn extract_cwe_handles_list_and_normalises() {
+        let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
+        assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
+        let bare = serde_json::json!({"cwe": "CWE-89"});
+        assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
+        let none = serde_json::json!({"severity": "ERROR"});
+        assert_eq!(extract_cwe(&none), None);
+    }
+
     #[test]
     fn deserialize_semgrep_output() {
         let json = r#"{

compliance-agent/src/werkbank/mod.rs

@@ -0,0 +1,10 @@
+//! Werkbank control-plane: the dynamic-execution job queue.
+//!
+//! The control plane enqueues declarative [`Job`](compliance_core::models::werkbank::Job)s
+//! and Werkbank runners lease, run, and complete them. [`queue::JobQueue`] is the
+//! Mongo-backed queue behind that flow (WB-02); the runner-facing HTTP transport
+//! and the runner itself land in later stories.
+
+pub mod queue;
+
+pub use queue::{JobQueue, SweepOutcome};

compliance-agent/src/werkbank/queue.rs

@@ -0,0 +1,309 @@
+//! The Mongo-backed Werkbank job queue (WB-02).
+//!
+//! A pull queue: the control plane [`enqueue`](JobQueue::enqueue)s jobs; a runner
+//! [`lease`](JobQueue::lease)s the oldest queued job it can run (matched by
+//! executor + labels), [`heartbeat`](JobQueue::heartbeat)s while it works, and
+//! [`complete`](JobQueue::complete)s it. Leases carry a visibility timeout: if a
+//! runner dies mid-job its heartbeats stop, the lease expires, and
+//! [`sweep_expired`](JobQueue::sweep_expired) returns the job to `queued` (or
+//! `expired` once it has been retried too many times).
+//!
+//! All state transitions are single atomic Mongo updates guarded by the lease
+//! token, so two runners can never both own a job. Every operation takes an
+//! explicit `now` so the queue's time-dependent behaviour is deterministically
+//! testable.
+
+use std::time::Duration;
+
+use chrono::{DateTime, Utc};
+use mongodb::bson::{doc, Bson, DateTime as BsonDateTime};
+use mongodb::error::{ErrorKind, WriteFailure};
+use mongodb::options::ReturnDocument;
+use mongodb::Collection;
+
+use compliance_core::models::werkbank::{
+    Executor, HeartbeatAck, Job, JobRecord, JobResult, JobStatus, LeasedJob,
+};
+
+use crate::database::Database;
+use crate::error::AgentError;
+
+/// The non-terminal states a job can be swept or cancelled from.
+const ACTIVE_STATES: [&str; 2] = ["leased", "running"];
+/// Every terminal state (no further transitions).
+const TERMINAL_STATES: [&str; 4] = ["succeeded", "failed", "expired", "cancelled"];
+
+/// What a visibility-timeout sweep did.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct SweepOutcome {
+    /// Expired-lease jobs returned to `queued` for another runner.
+    pub requeued: u64,
+    /// Jobs that had exhausted their attempts and were marked `expired`.
+    pub expired: u64,
+}
+
+/// The Mongo-backed job queue.
+pub struct JobQueue {
+    coll: Collection<JobRecord>,
+}
+
+impl JobQueue {
+    /// Build a queue over a tenant database's `werkbank_jobs` collection.
+    pub fn new(db: &Database) -> Self {
+        Self {
+            coll: db.werkbank_jobs(),
+        }
+    }
+
+    /// Enqueue a job. Idempotent by job id: a job that is already present is a
+    /// no-op. Returns `true` if this call inserted it, `false` if it existed.
+    pub async fn enqueue(&self, job: Job, now: DateTime<Utc>) -> Result<bool, AgentError> {
+        let record = JobRecord::queued(job, now);
+        match self.coll.insert_one(&record).await {
+            Ok(_) => Ok(true),
+            Err(e) if is_duplicate_key(&e) => Ok(false),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    /// Atomically lease the oldest `queued` job this runner can run — matched by
+    /// executor and by labels (every label the job requires must be one the
+    /// runner advertises). Returns the job plus a lease token, or `None` if
+    /// nothing is runnable.
+    pub async fn lease(
+        &self,
+        runner_id: &str,
+        executor: Executor,
+        runner_labels: &[String],
+        lease_ttl: Duration,
+        now: DateTime<Utc>,
+    ) -> Result<Option<LeasedJob>, AgentError> {
+        let token = uuid::Uuid::new_v4().to_string();
+        let expires = bson_dt(now + ttl(lease_ttl));
+        let executor_bson = mongodb::bson::to_bson(&executor).unwrap_or(Bson::Null);
+
+        let filter = doc! {
+            "status": "queued",
+            "cancel_requested": { "$ne": true },
+            "job.executor": executor_bson,
+            // Every label the job requires must be in the runner's set — i.e. the
+            // job has no label that is not offered by the runner. Absent/empty
+            // job labels match any runner.
+            "job.labels": { "$not": { "$elemMatch": { "$nin": runner_labels.to_vec() } } },
+        };
+        let update = doc! {
+            "$set": {
+                "status": "leased",
+                "lease_token": &token,
+                "leased_by": runner_id,
+                "lease_expires_at": expires,
+                "heartbeat_at": bson_dt(now),
+                "updated_at": bson_dt(now),
+            },
+            "$inc": { "attempts": 1 },
+        };
+
+        let record = self
+            .coll
+            .find_one_and_update(filter, update)
+            .sort(doc! { "created_at": 1 }) // FIFO
+            .return_document(ReturnDocument::After)
+            .await?;
+        Ok(record.map(|r| LeasedJob {
+            job: r.job,
+            lease_token: token,
+        }))
+    }
+
+    /// Extend a lease and report whether the job has been asked to cancel.
+    /// Transitions the job to `running` on the first heartbeat. Returns `None`
+    /// when the lease is no longer valid (token mismatch, or the job is already
+    /// terminal) — the runner should then abandon the work.
+    pub async fn heartbeat(
+        &self,
+        job_id: &str,
+        lease_token: &str,
+        lease_ttl: Duration,
+        now: DateTime<Utc>,
+    ) -> Result<Option<HeartbeatAck>, AgentError> {
+        let filter = doc! {
+            "job.id": job_id,
+            "lease_token": lease_token,
+            "status": { "$in": ACTIVE_STATES.to_vec() },
+        };
+        let update = doc! {
+            "$set": {
+                "status": "running",
+                "lease_expires_at": bson_dt(now + ttl(lease_ttl)),
+                "heartbeat_at": bson_dt(now),
+                "updated_at": bson_dt(now),
+            },
+        };
+        let record = self
+            .coll
+            .find_one_and_update(filter, update)
+            .return_document(ReturnDocument::After)
+            .await?;
+        Ok(record.map(|r| HeartbeatAck {
+            cancelled: r.cancel_requested,
+        }))
+    }
+
+    /// Record a job's terminal result. Guarded by the lease token and only from
+    /// an active (`leased`/`running`) state, so it is idempotent — a duplicate or
+    /// late submission after the job already finished matches nothing. Returns
+    /// `true` if this call recorded the result.
+    pub async fn complete(
+        &self,
+        job_id: &str,
+        lease_token: &str,
+        result: &JobResult,
+        now: DateTime<Utc>,
+    ) -> Result<bool, AgentError> {
+        let status = result.status.unwrap_or(JobStatus::Failed);
+        let status_bson = mongodb::bson::to_bson(&status).unwrap_or(Bson::String("failed".into()));
+        let result_bson =
+            mongodb::bson::to_bson(result).map_err(|e| AgentError::Other(e.to_string()))?;
+
+        let filter = doc! {
+            "job.id": job_id,
+            "lease_token": lease_token,
+            "status": { "$in": ACTIVE_STATES.to_vec() },
+        };
+        let update = doc! {
+            "$set": {
+                "status": status_bson,
+                "result": result_bson,
+                "lease_token": Bson::Null,
+                "lease_expires_at": Bson::Null,
+                "updated_at": bson_dt(now),
+            },
+        };
+        let res = self.coll.update_one(filter, update).await?;
+        Ok(res.modified_count == 1)
+    }
+
+    /// Request cancellation of a job. A still-`queued` job is cancelled outright;
+    /// an in-flight one is flagged so the runner sees it on its next heartbeat and
+    /// tears down. Returns `true` if a non-terminal job matched.
+    pub async fn cancel(&self, job_id: &str, now: DateTime<Utc>) -> Result<bool, AgentError> {
+        let filter = doc! {
+            "job.id": job_id,
+            "status": { "$nin": TERMINAL_STATES.to_vec() },
+        };
+        // Pipeline update: flag cancellation, and if still queued flip straight to
+        // cancelled (nothing is running it).
+        let pipeline = vec![doc! {
+            "$set": {
+                "cancel_requested": true,
+                "status": {
+                    "$cond": [ { "$eq": ["$status", "queued"] }, "cancelled", "$status" ]
+                },
+                "updated_at": bson_dt(now),
+            }
+        }];
+        let res = self.coll.update_one(filter, pipeline).await?;
+        Ok(res.matched_count == 1)
+    }
+
+    /// Sweep leases whose visibility timeout has elapsed: return them to `queued`
+    /// for another runner, or mark them `expired` once they have been leased
+    /// `max_attempts` times. This is what makes a crashed runner's job recover.
+    pub async fn sweep_expired(
+        &self,
+        now: DateTime<Utc>,
+        max_attempts: u32,
+        // (kept explicit rather than a const so callers can tune retry policy)
+    ) -> Result<SweepOutcome, AgentError> {
+        let now_bson = bson_dt(now);
+        let max = i64::from(max_attempts);
+
+        let requeue = self
+            .coll
+            .update_many(
+                doc! {
+                    "status": { "$in": ACTIVE_STATES.to_vec() },
+                    "lease_expires_at": { "$lt": &now_bson },
+                    "attempts": { "$lt": max },
+                },
+                doc! { "$set": {
+                    "status": "queued",
+                    "lease_token": Bson::Null,
+                    "leased_by": Bson::Null,
+                    "lease_expires_at": Bson::Null,
+                    "updated_at": &now_bson,
+                } },
+            )
+            .await?;
+
+        let expire = self
+            .coll
+            .update_many(
+                doc! {
+                    "status": { "$in": ACTIVE_STATES.to_vec() },
+                    "lease_expires_at": { "$lt": &now_bson },
+                    "attempts": { "$gte": max },
+                },
+                doc! { "$set": {
+                    "status": "expired",
+                    "lease_token": Bson::Null,
+                    "lease_expires_at": Bson::Null,
+                    "updated_at": &now_bson,
+                } },
+            )
+            .await?;
+
+        Ok(SweepOutcome {
+            requeued: requeue.modified_count,
+            expired: expire.modified_count,
+        })
+    }
+
+    /// Fetch a job record by job id (inspection / control-plane reads).
+    pub async fn get(&self, job_id: &str) -> Result<Option<JobRecord>, AgentError> {
+        Ok(self.coll.find_one(doc! { "job.id": job_id }).await?)
+    }
+}
+
+/// A `chrono::Duration` for a lease TTL, saturating rather than panicking on an
+/// absurd input (`chrono::Duration::seconds` panics past its internal bound).
+fn ttl(d: Duration) -> chrono::Duration {
+    let secs = i64::try_from(d.as_secs()).unwrap_or(i64::MAX);
+    chrono::Duration::try_seconds(secs).unwrap_or(chrono::Duration::MAX)
+}
+
+/// A chrono instant as a BSON date (so Mongo stores/compares it as a real date).
+fn bson_dt(dt: DateTime<Utc>) -> BsonDateTime {
+    BsonDateTime::from_chrono(dt)
+}
+
+/// Whether a Mongo error is a duplicate-key (E11000) violation — a job with this
+/// id is already enqueued.
+fn is_duplicate_key(e: &mongodb::error::Error) -> bool {
+    match &*e.kind {
+        ErrorKind::Write(WriteFailure::WriteError(we)) => we.code == 11000,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ttl_saturates_and_converts() {
+        assert_eq!(ttl(Duration::from_secs(30)), chrono::Duration::seconds(30));
+        // An absurd TTL saturates instead of panicking.
+        assert_eq!(ttl(Duration::from_secs(u64::MAX)), chrono::Duration::MAX);
+    }
+
+    #[test]
+    fn state_constants_are_disjoint() {
+        for s in ACTIVE_STATES {
+            assert!(
+                !TERMINAL_STATES.contains(&s),
+                "{s} cannot be both active and terminal"
+            );
+        }
+    }
+}

compliance-agent/tests/c5_example2.rs

@@ -0,0 +1,125 @@
+//! C5 example 2 — exploratory (not a committed regression test). Four topically
+//! distinct findings, to see whether tuned semantic retrieval maps each to the
+//! right master-control family. Run:
+//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
+//!   cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use compliance_core::models::finding::{Finding, Severity};
+use compliance_core::models::scan::ScanType;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
+}
+
+fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
+    let mut f = Finding::new(
+        "repo-c5b".into(),
+        format!("{file}:{line}"),
+        "semgrep".into(),
+        ScanType::Sast,
+        title.into(),
+        desc.into(),
+        Severity::High,
+    );
+    f.file_path = Some(file.into());
+    f.line_number = Some(line);
+    f
+}
+
+fn write(repo: &std::path::Path, rel: &str, body: &str) {
+    let p = repo.join(rel);
+    if let Some(parent) = p.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    std::fs::write(p, body).unwrap();
+}
+
+#[tokio::test]
+#[ignore = "live: api-dev + LiteLLM"]
+async fn c5b_varied_findings() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+    let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: std::env::temp_dir()
+            .join("c5-oscal-snap")
+            .to_string_lossy()
+            .into_owned(),
+        semantic_mapping: true,
+        grounded_control_checks: false,
+    };
+
+    let repo = std::env::temp_dir().join("c5b-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    write(
+        &repo,
+        "app/db.py",
+        "import sqlite3\n\ndef get_user(username):\n    q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n    return conn.execute(q)\n",
+    );
+    write(
+        &repo,
+        "app/config.py",
+        "# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
+    );
+    write(
+        &repo,
+        "app/net.py",
+        "import requests\n\ndef fetch(url):\n    return requests.get(url, verify=False, timeout=5)\n",
+    );
+    write(
+        &repo,
+        "app/ser.py",
+        "import pickle\n\ndef load_state(blob):\n    return pickle.loads(blob)\n",
+    );
+
+    let mut findings = vec![
+        mk(
+            "app/db.py",
+            4,
+            "SQL injection via string-concatenated query",
+            "User input is concatenated directly into a SQL statement, allowing SQL injection.",
+        ),
+        mk(
+            "app/config.py",
+            2,
+            "Hardcoded API credential in source",
+            "A live API key is hardcoded in source code instead of a secret store.",
+        ),
+        mk(
+            "app/net.py",
+            4,
+            "TLS certificate verification disabled",
+            "requests is called with verify=False, disabling TLS certificate validation.",
+        ),
+        mk(
+            "app/ser.py",
+            3,
+            "Insecure deserialization with pickle.loads",
+            "Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
+        ),
+    ];
+
+    let tagged =
+        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
+            .await;
+    println!("\n=== C5 example 2: varied findings ===");
+    for f in &findings {
+        println!("  {:52} -> {:?}", f.title, f.control_refs);
+    }
+    println!("tagged: {tagged}/4");
+    let _ = std::fs::remove_dir_all(&repo);
+    assert!(tagged >= 1);
+}

compliance-agent/tests/c5_semantic_live.rs

@@ -0,0 +1,145 @@
+//! C5 live verification — the semantic master-controls path end to end against the
+//! deployed api-dev catalog. Ignored (hits api-dev + LiteLLM). Run explicitly:
+//!
+//!   set -a; . ./.env; set +a
+//!   BREAKPILOT_BASE_URL=https://api-dev.breakpilot.ai \
+//!     cargo test -p compliance-agent --test c5_semantic_live -- --ignored --nocapture
+//!
+//! Pulls the live master-controls catalog, embeds the corpus (chunked), then for a
+//! couple of real vulnerable findings retrieves the nearest master controls and
+//! grounded-judges them, stamping master-control refs.
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use compliance_core::models::finding::{Finding, Severity};
+use compliance_core::models::scan::ScanType;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set for the live C5 test"))
+}
+
+fn mk_finding(file: &str, line: u32, title: &str) -> Finding {
+    let mut f = Finding::new(
+        "repo-c5".into(),
+        format!("{file}:{line}"),
+        "semgrep".into(),
+        ScanType::Sast,
+        title.into(),
+        title.into(),
+        Severity::High,
+    );
+    f.file_path = Some(file.into());
+    f.line_number = Some(line);
+    f
+}
+
+#[tokio::test]
+#[ignore = "live: requires deployed api-dev master-controls (fetch+parse only, no LLM)"]
+async fn c5_ingest_master_controls_catalog() {
+    use compliance_agent::controls::OscalControlsProvider;
+
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        env("BREAKPILOT_BASE_URL"),
+        None,
+        std::env::temp_dir().join("c5-ingest-snap"),
+    );
+    let doc = provider
+        .load_master_controls()
+        .await
+        .expect("pull + parse master-controls catalog");
+    let controls = doc.to_controls();
+    println!(
+        "\n=== C5 ingest: {} master controls parsed ===",
+        controls.len()
+    );
+    for c in controls.iter().take(4) {
+        let text: String = c.text.chars().take(90).collect();
+        println!("  {} | {} | {}", c.id, c.title, text);
+    }
+    assert!(
+        !controls.is_empty(),
+        "expected a non-empty master-control corpus"
+    );
+}
+
+#[tokio::test]
+#[ignore = "live: requires deployed api-dev master-controls + LiteLLM"]
+async fn c5_semantic_stamps_master_control_refs() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+
+    let mut config = common::dev_config("mongodb://unused".into(), "c5".into());
+    let snapshot = std::env::temp_dir().join("c5-oscal-snap");
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: snapshot.to_string_lossy().into_owned(),
+        semantic_mapping: true,
+        grounded_control_checks: false,
+    };
+
+    // Fixture repo with recognizable code-checkable surfaces.
+    let repo = std::env::temp_dir().join("c5-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    std::fs::create_dir_all(repo.join("app")).expect("mkdir");
+    std::fs::write(
+        repo.join("app/auth.py"),
+        concat!(
+            "import hashlib\n",
+            "\n",
+            "def store_password(user, password):\n",
+            "    # weak, unsalted password hashing\n",
+            "    digest = hashlib.md5(password.encode()).hexdigest()\n",
+            "    db.save(user, digest)\n",
+            "\n",
+            "@app.route('/login', methods=['POST'])\n",
+            "def login():\n",
+            "    u = request.form['username']\n",
+            "    p = request.form['password']\n",
+            "    return 'ok' if check(u, p) else ('bad', 401)\n",
+        ),
+    )
+    .expect("write fixture");
+
+    let mut findings = vec![
+        mk_finding("app/auth.py", 5, "Weak password hash (md5, unsalted)"),
+        mk_finding(
+            "app/auth.py",
+            9,
+            "Login endpoint without brute-force protection",
+        ),
+    ];
+
+    let tagged =
+        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
+            .await;
+
+    println!("\n=== C5 semantic master-controls stamping ===");
+    for f in &findings {
+        println!(
+            "  {:50} {}:{:?} -> {:?}",
+            f.title,
+            f.file_path.as_deref().unwrap_or(""),
+            f.line_number,
+            f.control_refs
+        );
+    }
+    println!("findings that gained >=1 master-control ref: {tagged}");
+    let _ = std::fs::remove_dir_all(&repo);
+
+    // Live corpus — assert only that the path runs and stamps at least one ref.
+    assert!(
+        tagged >= 1,
+        "expected at least one finding to gain a master-control ref"
+    );
+}

compliance-agent/tests/common/mod.rs

@@ -2,6 +2,10 @@
 //
 // Spins up the agent API server on a random port with an isolated test
 // database. Each test gets a fresh database that is dropped on cleanup.
+//
+// Included via `mod common;` in several test binaries; not every binary uses
+// every helper, so allow dead code here.
+#![allow(dead_code)]
 
 use std::sync::Arc;
 
@@ -11,6 +15,55 @@ use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
+/// The runner bearer token wired into the test config.
+pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
+
+/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
+/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
+pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
+    AgentConfig {
+        mongodb_uri,
+        mongodb_database: db_name,
+        litellm_url: std::env::var("TEST_LITELLM_URL")
+            .unwrap_or_else(|_| "http://localhost:4000".into()),
+        litellm_api_key: SecretString::from(String::new()),
+        litellm_model: "gpt-4o".into(),
+        litellm_embed_model: "text-embedding-3-small".into(),
+        agent_port: 0, // not used — we bind ourselves
+        scan_schedule: String::new(),
+        cve_monitor_schedule: String::new(),
+        git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+        artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
+        ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
+        github_token: None,
+        github_webhook_secret: None,
+        gitlab_url: None,
+        gitlab_token: None,
+        gitlab_webhook_secret: None,
+        jira_url: None,
+        jira_email: None,
+        jira_api_token: None,
+        jira_project_key: None,
+        searxng_url: None,
+        nvd_api_key: None,
+        keycloak_url: None,
+        keycloak_realm: None,
+        keycloak_admin_username: None,
+        keycloak_admin_password: None,
+        pentest_verification_email: None,
+        pentest_imap_host: None,
+        pentest_imap_port: None,
+        pentest_imap_tls: false,
+        pentest_imap_username: None,
+        pentest_imap_password: None,
+        admin_api_token: None,
+        tenant_registry_url: None,
+        plc_runtime: compliance_core::PlcRuntimeConfig::default(),
+        werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
+        breakpilot: compliance_core::config::BreakpilotConfig::default(),
+    }
+}
+
 /// A running test server with a unique database.
 pub struct TestServer {
     pub base_url: String,
@@ -33,44 +86,7 @@ impl TestServer {
             .await
             .expect("Failed to build DatabasePool");
 
-        let config = AgentConfig {
-            mongodb_uri: mongodb_uri.clone(),
-            mongodb_database: db_name.clone(),
-            litellm_url: std::env::var("TEST_LITELLM_URL")
-                .unwrap_or_else(|_| "http://localhost:4000".into()),
-            litellm_api_key: SecretString::from(String::new()),
-            litellm_model: "gpt-4o".into(),
-            litellm_embed_model: "text-embedding-3-small".into(),
-            agent_port: 0, // not used — we bind ourselves
-            scan_schedule: String::new(),
-            cve_monitor_schedule: String::new(),
-            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
-            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
-            github_token: None,
-            github_webhook_secret: None,
-            gitlab_url: None,
-            gitlab_token: None,
-            gitlab_webhook_secret: None,
-            jira_url: None,
-            jira_email: None,
-            jira_api_token: None,
-            jira_project_key: None,
-            searxng_url: None,
-            nvd_api_key: None,
-            keycloak_url: None,
-            keycloak_realm: None,
-            keycloak_admin_username: None,
-            keycloak_admin_password: None,
-            pentest_verification_email: None,
-            pentest_imap_host: None,
-            pentest_imap_port: None,
-            pentest_imap_tls: false,
-            pentest_imap_username: None,
-            pentest_imap_password: None,
-            admin_api_token: None,
-            tenant_registry_url: None,
-        };
+        let config = dev_config(mongodb_uri.clone(), db_name.clone());
 
         let agent = ComplianceAgent::new(config, db_pool);
 

compliance-agent/tests/grounded_surface_live.rs

@@ -0,0 +1,92 @@
+//! Live validation of the grounded surface path (Stage 5d) for absence-based CRA
+//! controls. Ignored (hits api-dev CRA catalog + LiteLLM). Run:
+//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
+//!   cargo test -p compliance-agent --test grounded_surface_live -- --ignored --nocapture
+//!
+//! Builds a fixture whose code surfaces trigger several absence-based controls
+//! (no rate limiting, no security logging, unverified update) and checks that the
+//! grounded checker produces control-tagged findings.
+
+mod common;
+
+use std::sync::Arc;
+
+use compliance_agent::llm::LlmClient;
+use compliance_core::config::BreakpilotConfig;
+use secrecy::SecretString;
+
+fn env(k: &str) -> String {
+    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
+}
+
+fn write(repo: &std::path::Path, rel: &str, body: &str) {
+    let p = repo.join(rel);
+    if let Some(parent) = p.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    std::fs::write(p, body).unwrap();
+}
+
+#[tokio::test]
+#[ignore = "live: api-dev CRA catalog + LiteLLM"]
+async fn grounded_surface_flags_absence_controls() {
+    let llm = Arc::new(LlmClient::new(
+        env("LITELLM_URL"),
+        SecretString::from(env("LITELLM_API_KEY")),
+        env("LITELLM_MODEL"),
+        env("LITELLM_EMBED_MODEL"),
+    ));
+    let mut config = common::dev_config("mongodb://unused".into(), "grounded".into());
+    config.breakpilot = BreakpilotConfig {
+        base_url: Some(env("BREAKPILOT_BASE_URL")),
+        token: None,
+        snapshot_dir: std::env::temp_dir()
+            .join("grounded-snap")
+            .to_string_lossy()
+            .into_owned(),
+        semantic_mapping: false,
+        grounded_control_checks: true,
+    };
+
+    let repo = std::env::temp_dir().join("grounded-fixture-repo");
+    let _ = std::fs::remove_dir_all(&repo);
+    // cra-ai-11: login endpoint with no rate limiting / lockout
+    write(
+        &repo,
+        "app/auth.py",
+        "@app.route('/login', methods=['POST'])\ndef login():\n    u = request.form['username']\n    p = request.form['password']\n    if authenticate(u, p):\n        return redirect('/')\n    return 'bad credentials', 401\n",
+    );
+    // cra-ai-24: privileged admin action with no security/audit logging
+    write(
+        &repo,
+        "app/admin.py",
+        "@app.route('/admin/delete_user', methods=['POST'])\ndef admin_delete_user():\n    uid = request.form['uid']\n    db.users.delete_one({'_id': uid})\n    return 'ok', 200\n",
+    );
+    // cra-ai-28/29/30: firmware update applied without signature / checksum verification
+    write(
+        &repo,
+        "app/updater.py",
+        "def apply_firmware_update(url):\n    blob = download(url)\n    install_firmware(blob)\n    reboot_device()\n",
+    );
+
+    let findings =
+        compliance_agent::controls::grounded_surface_findings(&config, llm, &repo, "repo-grounded")
+            .await;
+
+    println!("\n=== Grounded surface findings ({}) ===", findings.len());
+    for f in &findings {
+        println!(
+            "  {:24} {}:{:?}  {}",
+            f.control_refs.join(","),
+            f.file_path.as_deref().unwrap_or(""),
+            f.line_number,
+            f.title
+        );
+    }
+    let _ = std::fs::remove_dir_all(&repo);
+
+    assert!(
+        !findings.is_empty(),
+        "expected the grounded pass to flag at least one absence-based control"
+    );
+}

compliance-agent/tests/werkbank_api.rs

@@ -0,0 +1,291 @@
+//! Integration tests for the Werkbank runner endpoints (WB-05).
+//!
+//! Drives the real HTTP handlers (lease/heartbeat/complete) against a live Mongo:
+//! a runner leases a seeded job, completes it, and the result's findings are
+//! persisted against the job's target. Also checks the bearer-token gate. Skips
+//! cleanly when no Mongo is reachable.
+
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+mod common;
+
+use std::sync::Arc;
+
+use axum::routing::{get, post};
+use axum::{middleware, Extension, Router};
+
+use compliance_agent::agent::ComplianceAgent;
+use compliance_agent::api::handlers::werkbank_jobs;
+use compliance_agent::database::DatabasePool;
+use compliance_agent::werkbank::JobQueue;
+use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
+use compliance_core::models::{
+    Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
+};
+
+use common::{dev_config, TEST_RUNNER_TOKEN};
+
+const TENANT: &str = "dev";
+
+/// A running werkbank API on a random port, or `None` if no Mongo.
+struct Harness {
+    base_url: String,
+    client: reqwest::Client,
+    pool: DatabasePool,
+    db_name: String,
+}
+
+async fn start() -> Option<Harness> {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let db_name = format!("wba_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
+    let pool = match DatabasePool::connect(&uri, &db_name).await {
+        Ok(p) => p,
+        Err(_) => {
+            eprintln!("SKIP werkbank_api: no MongoDB reachable at {uri}");
+            return None;
+        }
+    };
+    // Touch the tenant DB so indexes are ensured before the queue is used.
+    pool.for_tenant_id(TENANT).await.expect("tenant db");
+
+    let agent = ComplianceAgent::new(dev_config(uri, db_name.clone()), pool.clone());
+    let app = Router::new()
+        .route("/api/v1/werkbank/jobs/lease", post(werkbank_jobs::lease))
+        .route(
+            "/api/v1/werkbank/jobs/heartbeat",
+            post(werkbank_jobs::heartbeat),
+        )
+        .route(
+            "/api/v1/werkbank/jobs/complete",
+            post(werkbank_jobs::complete),
+        )
+        .route(
+            "/api/v1/werkbank/jobs/enqueue",
+            post(werkbank_jobs::enqueue),
+        )
+        .route(
+            "/api/v1/werkbank/artifacts/{hash}",
+            get(werkbank_jobs::serve_artifact),
+        )
+        .layer(middleware::from_fn(werkbank_jobs::require_runner_token))
+        .layer(Extension(Arc::new(agent)));
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.ok();
+    });
+
+    Some(Harness {
+        base_url: format!("http://127.0.0.1:{port}"),
+        client: reqwest::Client::new(),
+        pool,
+        db_name,
+    })
+}
+
+impl Harness {
+    fn post(
+        &self,
+        path: &str,
+        token: Option<&str>,
+        body: serde_json::Value,
+    ) -> reqwest::RequestBuilder {
+        let mut r = self
+            .client
+            .post(format!("{}{path}", self.base_url))
+            .json(&body);
+        if let Some(t) = token {
+            r = r.bearer_auth(t);
+        }
+        r
+    }
+    async fn cleanup(&self) {
+        let _ = self
+            .pool
+            .client()
+            .database(&format!("{}_{TENANT}", self.db_name))
+            .drop()
+            .await;
+    }
+}
+
+fn finding_for(target: &str, fp: &str) -> Finding {
+    let mut f = Finding::new(
+        target.to_string(),
+        fp.to_string(),
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "Modbus exposed".to_string(),
+        "unauthenticated".to_string(),
+        Severity::Critical,
+    );
+    f.rule_id = Some("ics-modbus-exposed".to_string());
+    f
+}
+
+#[tokio::test]
+async fn lease_complete_persists_findings_against_the_target() {
+    let Some(h) = start().await else { return };
+    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
+    let queue = JobQueue::new(&db);
+
+    // Seed a queued job.
+    let job = Job::plc_provision("job-1", TENANT, "target-1", InputRef::blob("sha256:x"), 180);
+    assert!(queue.enqueue(job, chrono::Utc::now()).await.unwrap());
+
+    // Lease it over HTTP.
+    let resp = h
+        .post(
+            "/api/v1/werkbank/jobs/lease",
+            Some(TEST_RUNNER_TOKEN),
+            serde_json::json!({
+                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
+                "labels": [], "lease_ttl_secs": 60
+            }),
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "lease should return a job");
+    let leased: LeasedJob = resp.json().await.unwrap();
+    assert_eq!(leased.job.id, "job-1");
+
+    // Complete it with a finding.
+    let mut result = JobResult::succeeded("job-1");
+    result.findings = vec![finding_for("target-1", "fp-abc")];
+    let resp = h
+        .post(
+            "/api/v1/werkbank/jobs/complete",
+            Some(TEST_RUNNER_TOKEN),
+            serde_json::json!({
+                "tenant": TENANT, "job_id": "job-1",
+                "lease_token": leased.lease_token, "result": result
+            }),
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    assert!(resp.json::<serde_json::Value>().await.unwrap()["recorded"]
+        .as_bool()
+        .unwrap());
+
+    // The job is now succeeded, and the finding was persisted to the target.
+    assert_eq!(
+        queue.get("job-1").await.unwrap().unwrap().status,
+        JobStatus::Succeeded
+    );
+    let stored = db
+        .findings()
+        .find_one(mongodb::bson::doc! { "fingerprint": "fp-abc" })
+        .await
+        .unwrap();
+    assert!(stored.is_some(), "finding should be persisted");
+
+    h.cleanup().await;
+}
+
+#[tokio::test]
+async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
+    let Some(h) = start().await else { return };
+    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
+
+    // A PlcSps target with a single complete ST program uploaded.
+    let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let st = dir.join("main.st");
+    std::fs::write(
+        &st,
+        "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n  RESOURCE R\nEND_CONFIGURATION\n",
+    )
+    .unwrap();
+    let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
+    let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
+    art.stored_path = Some(st.to_string_lossy().to_string());
+    target.artifacts.push(art);
+    let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
+    let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
+
+    // Enqueue → a plc-provision job whose program is a content-addressed blob.
+    let resp = h
+        .post(
+            "/api/v1/werkbank/jobs/enqueue",
+            Some(TEST_RUNNER_TOKEN),
+            serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "enqueue should succeed");
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let job_id = body["job_id"].as_str().unwrap().to_string();
+
+    let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
+    let hash = rec
+        .job
+        .inputs
+        .get("program")
+        .and_then(|i| i.blob.clone())
+        .expect("program blob");
+
+    // Serve the blob back and confirm it's the program source (what the runner
+    // would fetch).
+    let served = h
+        .client
+        .get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
+        .bearer_auth(TEST_RUNNER_TOKEN)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(served.status(), 200);
+    assert!(served.text().await.unwrap().contains("CONFIGURATION"));
+
+    h.cleanup().await;
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[tokio::test]
+async fn empty_queue_leases_nothing() {
+    let Some(h) = start().await else { return };
+    let resp = h
+        .post(
+            "/api/v1/werkbank/jobs/lease",
+            Some(TEST_RUNNER_TOKEN),
+            serde_json::json!({
+                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
+                "labels": [], "lease_ttl_secs": 60
+            }),
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 204, "no job → 204");
+    h.cleanup().await;
+}
+
+#[tokio::test]
+async fn runner_endpoints_require_the_bearer_token() {
+    let Some(h) = start().await else { return };
+    let body = serde_json::json!({
+        "tenant": TENANT, "runner_id": "r1", "executor": "docker",
+        "labels": [], "lease_ttl_secs": 60
+    });
+
+    let no_token = h
+        .post("/api/v1/werkbank/jobs/lease", None, body.clone())
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(no_token.status(), 401, "missing token → 401");
+
+    let bad_token = h
+        .post("/api/v1/werkbank/jobs/lease", Some("wrong"), body)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(bad_token.status(), 401, "wrong token → 401");
+
+    h.cleanup().await;
+}

compliance-agent/tests/werkbank_queue.rs

@@ -0,0 +1,258 @@
+//! Integration tests for the Werkbank job queue (WB-02).
+//!
+//! Exercises the atomic lease/heartbeat/complete/sweep flow against a real
+//! MongoDB — the guarantees (idempotent enqueue, single-owner lease, visibility
+//! timeout) are Mongo-semantics-dependent and can't be unit-tested in isolation.
+//! Skips cleanly when no Mongo is reachable (set `TEST_MONGODB_URI` to point at
+//! one; defaults to the local dev cluster).
+
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+use std::time::Duration;
+
+use chrono::{DateTime, TimeZone, Utc};
+
+use compliance_agent::database::Database;
+use compliance_agent::werkbank::JobQueue;
+use compliance_core::models::werkbank::{Executor, InputRef, Job, JobResult};
+
+/// Connect + ensure indexes on a throwaway database, or `None` if no Mongo.
+async fn setup() -> Option<(JobQueue, mongodb::Database)> {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let db_name = format!("wbq_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
+    let db = match Database::connect(&uri, &db_name).await {
+        Ok(d) => d,
+        Err(_) => {
+            eprintln!("SKIP werkbank_queue: no MongoDB reachable at {uri}");
+            return None;
+        }
+    };
+    db.ensure_indexes().await.expect("ensure indexes");
+    let queue = JobQueue::new(&db);
+    Some((queue, db.inner().clone()))
+}
+
+fn base_time() -> DateTime<Utc> {
+    Utc.timestamp_opt(1_700_000_000, 0).unwrap()
+}
+
+fn job(id: &str) -> Job {
+    Job::plc_provision(id, "acme", "target-1", InputRef::blob("sha256:abc"), 180)
+}
+
+fn job_with_labels(id: &str, labels: &[&str]) -> Job {
+    let mut j = job(id);
+    j.labels = labels.iter().map(|s| s.to_string()).collect();
+    j
+}
+
+macro_rules! skip_if_no_mongo {
+    () => {
+        match setup().await {
+            Some(v) => v,
+            None => return,
+        }
+    };
+}
+
+#[tokio::test]
+async fn enqueue_is_idempotent() {
+    let (q, db) = skip_if_no_mongo!();
+    let now = base_time();
+
+    assert!(q.enqueue(job("j1"), now).await.expect("enqueue"));
+    // Same id again — no duplicate row, reports "already present".
+    assert!(!q.enqueue(job("j1"), now).await.expect("enqueue2"));
+
+    let rec = q.get("j1").await.expect("get").expect("exists");
+    assert_eq!(
+        rec.status,
+        compliance_core::models::werkbank::JobStatus::Queued
+    );
+    assert_eq!(rec.attempts, 0);
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn lease_matches_executor_and_labels_and_is_fifo() {
+    let (q, db) = skip_if_no_mongo!();
+    let t0 = base_time();
+
+    // Two docker jobs (j_old older than j_new) + one requiring a kvm label.
+    q.enqueue(job("j_old"), t0).await.unwrap();
+    q.enqueue(job("j_new"), t0 + chrono::Duration::seconds(5))
+        .await
+        .unwrap();
+    q.enqueue(job_with_labels("j_kvm", &["kvm=true"]), t0)
+        .await
+        .unwrap();
+
+    // Wrong executor: a shell runner leases nothing.
+    assert!(q
+        .lease("r-shell", Executor::Shell, &[], Duration::from_secs(30), t0)
+        .await
+        .unwrap()
+        .is_none());
+
+    // A docker runner without the kvm label gets the oldest label-free job (FIFO).
+    let leased = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
+        .await
+        .unwrap()
+        .expect("leased");
+    assert_eq!(leased.job.id, "j_old", "oldest matching job first");
+    assert!(!leased.lease_token.is_empty());
+
+    // The kvm job stays unleased for that runner (missing label)...
+    let none = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
+        .await
+        .unwrap()
+        .expect("next");
+    assert_eq!(none.job.id, "j_new", "label-free job, not the kvm one");
+
+    // ...but a runner advertising kvm can take it.
+    let kvm = q
+        .lease(
+            "r2",
+            Executor::Docker,
+            &["kvm=true".to_string(), "arch=amd64".to_string()],
+            Duration::from_secs(30),
+            t0,
+        )
+        .await
+        .unwrap()
+        .expect("kvm leased");
+    assert_eq!(kvm.job.id, "j_kvm");
+
+    // A leased job increments attempts and is no longer queued.
+    let rec = q.get("j_old").await.unwrap().unwrap();
+    assert_eq!(rec.attempts, 1);
+    assert_eq!(rec.leased_by.as_deref(), Some("r1"));
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn heartbeat_extends_lease_and_surfaces_cancel() {
+    let (q, db) = skip_if_no_mongo!();
+    let now = base_time();
+
+    q.enqueue(job("j1"), now).await.unwrap();
+    let leased = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .unwrap();
+
+    // A valid heartbeat moves it to running and reports not-cancelled.
+    let ack = q
+        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .expect("valid lease");
+    assert!(!ack.cancelled);
+    assert_eq!(
+        q.get("j1").await.unwrap().unwrap().status,
+        compliance_core::models::werkbank::JobStatus::Running
+    );
+
+    // A wrong token is a lost lease.
+    assert!(q
+        .heartbeat("j1", "wrong-token", Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .is_none());
+
+    // Cancelling an in-flight job flags it; the next heartbeat reports cancelled.
+    assert!(q.cancel("j1", now).await.unwrap());
+    let ack = q
+        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .expect("still leased");
+    assert!(ack.cancelled);
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn complete_is_idempotent_and_token_guarded() {
+    let (q, db) = skip_if_no_mongo!();
+    let now = base_time();
+
+    q.enqueue(job("j1"), now).await.unwrap();
+    let leased = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .unwrap();
+
+    // Wrong token cannot complete.
+    let mut result = JobResult::succeeded("j1");
+    result.findings = Vec::new();
+    assert!(!q.complete("j1", "nope", &result, now).await.unwrap());
+
+    // The lease holder completes it once...
+    assert!(q
+        .complete("j1", &leased.lease_token, &result, now)
+        .await
+        .unwrap());
+    let rec = q.get("j1").await.unwrap().unwrap();
+    assert_eq!(
+        rec.status,
+        compliance_core::models::werkbank::JobStatus::Succeeded
+    );
+    assert!(rec.result.is_some());
+    assert!(rec.lease_token.is_none(), "lease cleared on completion");
+
+    // ...and a second (duplicate) completion is a no-op.
+    assert!(!q
+        .complete("j1", &leased.lease_token, &result, now)
+        .await
+        .unwrap());
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn sweep_requeues_expired_then_expires_after_max_attempts() {
+    let (q, db) = skip_if_no_mongo!();
+    let t0 = base_time();
+
+    q.enqueue(job("j1"), t0).await.unwrap();
+
+    // Lease #1 with a 10s TTL; then time jumps past expiry.
+    q.lease("r1", Executor::Docker, &[], Duration::from_secs(10), t0)
+        .await
+        .unwrap()
+        .unwrap();
+    let past = t0 + chrono::Duration::seconds(60);
+
+    // attempts=1 < max=2 → requeued.
+    let swept = q.sweep_expired(past, 2).await.unwrap();
+    assert_eq!(swept.requeued, 1);
+    assert_eq!(swept.expired, 0);
+    assert_eq!(
+        q.get("j1").await.unwrap().unwrap().status,
+        compliance_core::models::werkbank::JobStatus::Queued
+    );
+
+    // Lease #2 (attempts=2), let it expire again → now expired (>= max).
+    q.lease("r2", Executor::Docker, &[], Duration::from_secs(10), past)
+        .await
+        .unwrap()
+        .unwrap();
+    let later = past + chrono::Duration::seconds(60);
+    let swept = q.sweep_expired(later, 2).await.unwrap();
+    assert_eq!(swept.requeued, 0);
+    assert_eq!(swept.expired, 1);
+    assert_eq!(
+        q.get("j1").await.unwrap().unwrap().status,
+        compliance_core::models::werkbank::JobStatus::Expired
+    );
+
+    db.drop().await.ok();
+}

compliance-core/Cargo.toml

@@ -50,3 +50,7 @@ axum = { version = "0.8", optional = true }
 jsonwebtoken = { version = "9", optional = true }
 reqwest = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
+
+[dev-dependencies]
+# Parse the declarative TOML job specs in the Werkbank contract tests.
+toml = "0.8"

compliance-core/src/auth.rs

@@ -64,11 +64,11 @@ struct Claims {
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 
 /// Path prefixes that bypass JWT validation. The admin sub-router
-/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
-/// not be routed through the customer-JWT path — a Keycloak token
-/// always carries a single tenant_id and would semantically conflict
-/// with cross-tenant admin operations.
-const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
+/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
+/// have their own static-bearer middleware and must not be routed through the
+/// customer-JWT path — a Keycloak token always carries a single tenant_id and
+/// would semantically conflict with these cross-tenant / machine operations.
+const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
 
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.

compliance-core/src/config.rs

@@ -49,6 +49,102 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
+    /// Ephemeral soft-PLC provisioning for dynamic PLC testing (#183). Off by
+    /// default: it needs Docker access in the agent's runtime, which is a
+    /// deployment opt-in.
+    pub plc_runtime: PlcRuntimeConfig,
+    /// Static bearer for the Werkbank runner endpoints
+    /// (`/api/v1/werkbank/jobs/*`). Machine auth for runners leasing/completing
+    /// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
+    /// `None`, those endpoints are not mounted at all.
+    pub werkbank_runner_token: Option<SecretString>,
+    /// Source for the OSCAL control catalog pulled from breakpilot-compliance
+    /// (drives the [`crate::traits::ControlsProvider`]). Disabled when
+    /// `base_url` is `None`.
+    pub breakpilot: BreakpilotConfig,
+}
+
+/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
+/// to snapshot it for deterministic / offline reuse.
+#[derive(Debug, Clone)]
+pub struct BreakpilotConfig {
+    /// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
+    /// the OSCAL controls provider.
+    pub base_url: Option<String>,
+    /// Optional bearer token for the catalog endpoint.
+    pub token: Option<SecretString>,
+    /// Directory for catalog snapshots.
+    pub snapshot_dir: String,
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// retrieve nearest controls, grounded-judge). On by default — validated live
+    /// against the deployed master-controls catalog. Still a no-op unless
+    /// `base_url` is set and the catalog is reachable.
+    pub semantic_mapping: bool,
+    /// Enable the **grounded surface** pass for absence-based controls (retrieve
+    /// the code surface a control governs, judge whether it holds). On by default
+    /// — validated live; it covers the 8 absence-based CRA controls that no
+    /// syntactic rule can.
+    pub grounded_control_checks: bool,
+}
+
+impl Default for BreakpilotConfig {
+    fn default() -> Self {
+        Self {
+            base_url: None,
+            token: None,
+            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
+            semantic_mapping: true,
+            grounded_control_checks: true,
+        }
+    }
+}
+
+/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
+///
+/// When a PLC/SPS target ships control logic but no reachable live device, the
+/// agent can instantiate that logic itself: spin up a throwaway soft-PLC
+/// (OpenPLC) container in-cluster, load the program, start the runtime, probe it
+/// over industrial protocols, then tear it down. This struct carries the knobs
+/// for that container's lifecycle and the OpenPLC web-UI credentials used to
+/// upload the program.
+#[derive(Clone, Debug)]
+pub struct PlcRuntimeConfig {
+    /// Master switch. Provision-and-test does nothing unless this is set — it
+    /// shells out to `docker`, which requires the agent container to have Docker
+    /// access (socket mount), an explicit deployment decision.
+    pub enabled: bool,
+    /// Container image for the ephemeral soft-PLC (OpenPLC).
+    pub image: String,
+    /// Docker network the instance joins. Must be the agent's own network so it
+    /// is reachable in-cluster by container name and never published to the host.
+    pub network: String,
+    /// Memory cap passed to `docker run --memory` (e.g. `512m`).
+    pub memory: String,
+    /// CPU cap passed to `docker run --cpus` (e.g. `0.5`).
+    pub cpus: String,
+    /// Hard ceiling on a provisioned instance's lifetime. Teardown is guaranteed
+    /// no later than this even if a load/probe step hangs.
+    pub max_lifetime_secs: u64,
+    /// OpenPLC web-UI username for the program upload (image default `openplc`).
+    pub openplc_user: String,
+    /// OpenPLC web-UI password (image default `openplc`).
+    pub openplc_password: SecretString,
+}
+
+impl Default for PlcRuntimeConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            image: "registry.meghsakha.com/openplc:latest".to_string(),
+            network: "certifai".to_string(),
+            memory: "512m".to_string(),
+            cpus: "0.5".to_string(),
+            max_lifetime_secs: 180,
+            openplc_user: "openplc".to_string(),
+            openplc_password: SecretString::from("openplc".to_string()),
+        }
+    }
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/control_check.rs

@@ -0,0 +1,205 @@
+//! Grounded control-driven checking.
+//!
+//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
+//! whose output is grounded to real code — so a hallucinated finding cannot
+//! survive. Determinism is structural, not a prompt plea:
+//!
+//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
+//!    code it never saw;
+//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
+//!    in the region, and the line is recomputed from that match — the model's own
+//!    line number is never trusted ([`ground`]);
+//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
+//!
+//! The LLM supplies cross-language / cross-stack pattern recognition; this module
+//! supplies the determinism.
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use crate::models::finding::{Finding, Severity};
+use crate::models::scan::ScanType;
+
+/// A control rendered as a check the LLM judges code against.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlCheckSpec {
+    /// Stable control id, e.g. `"cra-ai-8"`.
+    pub control_id: String,
+    /// Short control title (used in the finding title).
+    pub title: String,
+    /// The requirement text the LLM judges against (control objective/statement).
+    pub requirement: String,
+    /// CWE to fall back to when the model doesn't supply one.
+    pub default_cwe: Option<String>,
+    /// Severity for findings raised from this control.
+    pub severity: Severity,
+}
+
+/// A retrieved code region the LLM judges — never the whole repo.
+#[derive(Debug, Clone)]
+pub struct CandidateRegion {
+    /// Repo-relative path.
+    pub file: String,
+    /// 1-based line number of the region's first line in `file`.
+    pub start_line: u32,
+    /// The region's source text.
+    pub content: String,
+}
+
+/// The LLM's structured verdict for one (control, region). `snippet` is the
+/// verbatim code the model claims proves the violation — it is the anchor the
+/// grounding gate checks.
+#[derive(Debug, Clone)]
+pub struct LlmVerdict {
+    pub violates: bool,
+    pub snippet: String,
+    pub cwe: Option<String>,
+    pub confidence: f64,
+}
+
+/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
+/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
+/// finding's line is computed from the match, so a fabricated or mis-located
+/// snippet is dropped. Pure — no LLM, no I/O.
+pub fn ground(
+    spec: &ControlCheckSpec,
+    region: &CandidateRegion,
+    verdict: &LlmVerdict,
+    repo_id: &str,
+) -> Option<Finding> {
+    if !verdict.violates {
+        return None;
+    }
+    let snippet = verdict.snippet.trim();
+    if snippet.is_empty() {
+        return None;
+    }
+    // Grounding: the quoted snippet must literally exist in the retrieved region.
+    let pos = region.content.find(snippet)?;
+    // Recompute the real line from the match — never trust the model's number.
+    let newlines_before = region.content[..pos].matches('\n').count();
+    let line = region.start_line + newlines_before as u32;
+
+    let mut finding = Finding::new(
+        repo_id.to_string(),
+        control_finding_fingerprint(&spec.control_id, &region.file, snippet),
+        "control-check".to_string(),
+        ScanType::CodeReview,
+        format!("{}: {}", spec.control_id, spec.title),
+        format!(
+            "Control {} appears violated ({}) at {}:{line}",
+            spec.control_id, spec.requirement, region.file
+        ),
+        spec.severity.clone(),
+    );
+    finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
+    finding.file_path = Some(region.file.clone());
+    finding.line_number = Some(line);
+    finding.code_snippet = Some(snippet.to_string());
+    finding.confidence = Some(verdict.confidence);
+    // Carry the control reference on the finding.
+    finding.control_refs = vec![spec.control_id.clone()];
+    Some(finding)
+}
+
+/// Deterministic cache key for a (control, region, model, prompt-version) verdict
+/// so identical inputs reproduce the same verdict without another LLM call.
+pub fn cache_key(
+    control_id: &str,
+    region_content: &str,
+    model: &str,
+    prompt_version: &str,
+) -> String {
+    hash_parts(&[control_id, region_content, model, prompt_version])
+}
+
+fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
+    hash_parts(&[control_id, file, snippet])
+}
+
+fn hash_parts(parts: &[&str]) -> String {
+    let mut hasher = Sha256::new();
+    for part in parts {
+        hasher.update(part.as_bytes());
+        hasher.update([0u8]); // domain separator between parts
+    }
+    hex::encode(hasher.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spec() -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: "cra-ai-8".into(),
+            title: "No default passwords".into(),
+            requirement: "Products must not ship default credentials".into(),
+            default_cwe: Some("CWE-798".into()),
+            severity: Severity::High,
+        }
+    }
+
+    fn region() -> CandidateRegion {
+        CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 10,
+            content: "def login():\n    PASSWORD = \"admin123\"\n    return PASSWORD\n".into(),
+        }
+    }
+
+    #[test]
+    fn grounds_real_snippet_with_recomputed_line() {
+        let v = LlmVerdict {
+            violates: true,
+            snippet: "PASSWORD = \"admin123\"".into(),
+            cwe: None,
+            confidence: 0.9,
+        };
+        let f = ground(&spec(), &region(), &v, "repo").expect("should ground");
+        assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
+        assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
+        assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
+        assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
+        assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
+    }
+
+    #[test]
+    fn drops_fabricated_snippet_not_in_region() {
+        let v = LlmVerdict {
+            violates: true,
+            snippet: "SECRET = \"totally-made-up\"".into(),
+            cwe: None,
+            confidence: 0.99,
+        };
+        assert!(ground(&spec(), &region(), &v, "repo").is_none());
+    }
+
+    #[test]
+    fn drops_non_violation_and_empty_snippet() {
+        let no = LlmVerdict {
+            violates: false,
+            snippet: "PASSWORD = \"admin123\"".into(),
+            cwe: None,
+            confidence: 0.9,
+        };
+        assert!(ground(&spec(), &region(), &no, "repo").is_none());
+        let empty = LlmVerdict {
+            violates: true,
+            snippet: "   ".into(),
+            cwe: None,
+            confidence: 0.9,
+        };
+        assert!(ground(&spec(), &region(), &empty, "repo").is_none());
+    }
+
+    #[test]
+    fn cache_key_and_fingerprint_are_deterministic() {
+        assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
+        assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
+        assert_eq!(
+            control_finding_fingerprint("c", "f", "s"),
+            control_finding_fingerprint("c", "f", "s")
+        );
+    }
+}

compliance-core/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod config;
+pub mod control_check;
 pub mod db;
 pub mod error;
 pub mod models;
@@ -13,6 +14,6 @@ pub mod auth;
 #[cfg(feature = "axum")]
 pub mod tenant_ctx;
 
-pub use config::{AgentConfig, DashboardConfig};
+pub use config::{AgentConfig, DashboardConfig, PlcRuntimeConfig};
 pub use error::CoreError;
 pub use tenant::{OrgRole, TenantContext, TenantStatus};

compliance-core/src/models/finding.rs

@@ -76,6 +76,10 @@ pub struct Finding {
     pub triage_rationale: Option<String>,
     /// Developer feedback on finding quality
     pub developer_feedback: Option<String>,
+    /// Compliance control ids this finding is evidence for (stamped by control
+    /// triage against the `control-map` LUT). Empty when unmapped.
+    #[serde(default)]
+    pub control_refs: Vec<String>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
@@ -118,6 +122,7 @@ impl Finding {
             triage_action: None,
             triage_rationale: None,
             developer_feedback: None,
+            control_refs: Vec::new(),
             created_at: now,
             updated_at: now,
         }

compliance-core/src/models/mod.rs

@@ -10,11 +10,14 @@ pub mod mcp;
 pub mod mcp_token;
 pub mod notification;
 pub mod onboarding;
+pub mod oscal;
+pub mod oscal_assessment;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
 pub mod scan;
 pub(crate) mod serde_helpers;
+pub mod werkbank;
 
 pub use auth::AuthInfo;
 pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
@@ -38,6 +41,8 @@ pub use onboarding::{
     GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
     TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
+pub use oscal::OscalDocument;
+pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
     PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
@@ -47,3 +52,8 @@ pub use pentest::{
 pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
+pub use werkbank::{
+    CompleteRequest, CompleteResponse, DastCollect, Executor, HeartbeatAck, HeartbeatRequest,
+    InputRef, Job, JobCollect, JobRecord, JobResult, JobRuntime, JobStatus, JobType, LeaseRequest,
+    LeasedJob,
+};

compliance-core/src/models/oscal.rs

@@ -0,0 +1,250 @@
+//! OSCAL 1.1 catalog types + mapping into the controls corpus.
+//!
+//! Deserialises the OSCAL catalog served by breakpilot-compliance
+//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
+//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
+//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
+//! producer can add detail without breaking us.
+//!
+//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
+//! and scanner routing live in our assessment layer, not here — see
+//! [`crate::traits::ControlsProvider`].
+
+use serde::Deserialize;
+
+use crate::models::onboarding::ComplianceFramework;
+use crate::traits::Control as CorpusControl;
+
+/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
+#[derive(Debug, Clone, Deserialize)]
+pub struct OscalDocument {
+    pub catalog: Catalog,
+}
+
+/// An OSCAL catalog: metadata + a tree of control groups.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Catalog {
+    pub uuid: String,
+    pub metadata: Metadata,
+    #[serde(default)]
+    pub groups: Vec<Group>,
+    #[serde(rename = "back-matter", default)]
+    pub back_matter: Option<BackMatter>,
+}
+
+/// Catalog metadata (title/version + provenance props).
+#[derive(Debug, Clone, Deserialize)]
+pub struct Metadata {
+    pub title: String,
+    pub version: String,
+    #[serde(rename = "oscal-version")]
+    pub oscal_version: String,
+    #[serde(default)]
+    pub props: Vec<Prop>,
+}
+
+/// A name/value property, optionally namespaced.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Prop {
+    pub name: String,
+    pub value: String,
+    #[serde(default)]
+    pub ns: Option<String>,
+}
+
+/// A control group (may nest sub-groups and controls).
+#[derive(Debug, Clone, Deserialize)]
+pub struct Group {
+    #[serde(default)]
+    pub id: String,
+    #[serde(default)]
+    pub title: String,
+    #[serde(default)]
+    pub controls: Vec<Control>,
+    #[serde(default)]
+    pub groups: Vec<Group>,
+}
+
+/// An OSCAL control (may nest enhancement controls).
+#[derive(Debug, Clone, Deserialize)]
+pub struct Control {
+    pub id: String,
+    #[serde(default)]
+    pub title: String,
+    #[serde(default)]
+    pub props: Vec<Prop>,
+    #[serde(default)]
+    pub parts: Vec<Part>,
+    #[serde(default)]
+    pub links: Vec<Link>,
+    #[serde(default)]
+    pub controls: Vec<Control>,
+}
+
+/// A control part (e.g. the `statement`), may nest sub-parts.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Part {
+    #[serde(default)]
+    pub name: String,
+    #[serde(default)]
+    pub prose: Option<String>,
+    #[serde(default)]
+    pub parts: Vec<Part>,
+}
+
+/// A link, e.g. a `reference` to a back-matter resource.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Link {
+    pub href: String,
+    #[serde(default)]
+    pub rel: Option<String>,
+}
+
+/// Back-matter holding referenced resources (e.g. the CRA measures).
+#[derive(Debug, Clone, Deserialize)]
+pub struct BackMatter {
+    #[serde(default)]
+    pub resources: Vec<Resource>,
+}
+
+/// A back-matter resource referenced by control links.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Resource {
+    pub uuid: String,
+    #[serde(default)]
+    pub title: Option<String>,
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+impl Metadata {
+    /// First prop value with the given name.
+    pub fn prop(&self, name: &str) -> Option<&str> {
+        self.props
+            .iter()
+            .find(|p| p.name == name)
+            .map(|p| p.value.as_str())
+    }
+}
+
+impl Control {
+    /// First prop value with the given name.
+    pub fn prop(&self, name: &str) -> Option<&str> {
+        self.props
+            .iter()
+            .find(|p| p.name == name)
+            .map(|p| p.value.as_str())
+    }
+
+    /// The control's `statement` prose, if present.
+    pub fn statement(&self) -> Option<&str> {
+        self.parts
+            .iter()
+            .find(|p| p.name == "statement")
+            .and_then(|p| p.prose.as_deref())
+    }
+}
+
+impl OscalDocument {
+    /// The framework this catalog declares (`metadata.props[name="framework"]`).
+    pub fn framework(&self) -> Option<ComplianceFramework> {
+        framework_from_str(self.catalog.metadata.prop("framework")?)
+    }
+
+    /// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
+    pub fn content_hash(&self) -> Option<&str> {
+        self.catalog.metadata.prop("content-hash")
+    }
+
+    /// Flatten the catalog into the corpus controls the mapping engine consumes.
+    pub fn to_controls(&self) -> Vec<CorpusControl> {
+        let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
+        let source_label = self.catalog.metadata.title.as_str();
+        let mut out = Vec::new();
+        for group in &self.catalog.groups {
+            collect_group(group, framework, source_label, &mut out);
+        }
+        out
+    }
+}
+
+/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
+/// serde snake_case representation.
+fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
+    serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
+}
+
+fn collect_group(
+    group: &Group,
+    framework: ComplianceFramework,
+    source_label: &str,
+    out: &mut Vec<CorpusControl>,
+) {
+    for control in &group.controls {
+        collect_control(control, framework, source_label, out);
+    }
+    for sub in &group.groups {
+        collect_group(sub, framework, source_label, out);
+    }
+}
+
+fn collect_control(
+    control: &Control,
+    framework: ComplianceFramework,
+    source_label: &str,
+    out: &mut Vec<CorpusControl>,
+) {
+    let source = match control.prop("annex-anchor") {
+        Some(anchor) => Some(format!("{source_label} · {anchor}")),
+        None => Some(source_label.to_string()),
+    };
+    out.push(CorpusControl {
+        id: control.id.clone(),
+        framework,
+        title: control.title.clone(),
+        text: control.statement().unwrap_or_default().to_string(),
+        source,
+    });
+    for enhancement in &control.controls {
+        collect_control(enhancement, framework, source_label, out);
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
+
+    fn parse() -> OscalDocument {
+        serde_json::from_str(CATALOG).unwrap()
+    }
+
+    #[test]
+    fn parses_full_catalog() {
+        let doc = parse();
+        assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
+        assert!(!doc.catalog.groups.is_empty());
+        assert!(doc.catalog.back_matter.is_some());
+    }
+
+    #[test]
+    fn maps_all_controls_to_corpus() {
+        let doc = parse();
+        let controls = doc.to_controls();
+        assert_eq!(controls.len(), 40);
+        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
+
+        let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
+        assert_eq!(c8.framework, ComplianceFramework::Cra);
+        assert!(!c8.title.is_empty());
+        assert!(!c8.text.is_empty(), "statement prose should map into text");
+        assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
+    }
+
+    #[test]
+    fn exposes_content_hash_for_snapshotting() {
+        assert_eq!(parse().content_hash().map(str::len), Some(64));
+    }
+}

compliance-core/src/models/oscal_assessment.rs

@@ -0,0 +1,424 @@
+//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
+//!
+//! The catalog (domain content) comes from the producer; the **assessment** is
+//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
+//! standard OSCAL assessment-results document: an observation per linked finding,
+//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
+//! records the full catalog set we considered.
+//!
+//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
+//! timestamp. Pure — no DB, no network.
+
+use std::collections::HashMap;
+
+use chrono::{DateTime, Utc};
+use serde::Serialize;
+use uuid::Uuid;
+
+use crate::models::finding::{Finding, FindingStatus};
+
+const OSCAL_VERSION: &str = "1.1.2";
+/// Same namespace as the catalog exporter, so ids are stable and correlatable.
+const NAMESPACE: Uuid = Uuid::from_bytes([
+    0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
+]);
+
+fn det_uuid(name: &str) -> String {
+    Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
+}
+
+/// Links findings to the catalog control-ids they provide evidence for.
+pub struct ControlLinker {
+    cwe_to_controls: HashMap<u32, Vec<String>>,
+}
+
+impl ControlLinker {
+    /// Build a linker from an explicit CWE → control-id map.
+    pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
+        Self { cwe_to_controls }
+    }
+
+    /// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
+    /// `_CWE_TO_REQ`; extend as scanner coverage grows).
+    pub fn cra_seed() -> Self {
+        let pairs: &[(u32, &str)] = &[
+            (798, "cra-ai-8"),
+            (259, "cra-ai-8"),
+            (1392, "cra-ai-8"),
+            (327, "cra-ai-13"),
+            (326, "cra-ai-13"),
+            (319, "cra-ai-15"),
+            (311, "cra-ai-15"),
+            (89, "cra-ai-20"),
+            (79, "cra-ai-20"),
+            (78, "cra-ai-20"),
+            (22, "cra-ai-20"),
+        ];
+        let mut map: HashMap<u32, Vec<String>> = HashMap::new();
+        for (cwe, id) in pairs {
+            map.entry(*cwe).or_default().push((*id).to_string());
+        }
+        Self::new(map)
+    }
+
+    /// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
+    fn parse_cwe(raw: &str) -> Option<u32> {
+        raw.trim_start_matches(|c: char| !c.is_ascii_digit())
+            .split(|c: char| !c.is_ascii_digit())
+            .next()
+            .filter(|s| !s.is_empty())
+            .and_then(|s| s.parse().ok())
+    }
+
+    /// The control-ids a finding provides evidence for (via its CWE).
+    pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
+        finding
+            .cwe
+            .as_deref()
+            .and_then(Self::parse_cwe)
+            .and_then(|cwe| self.cwe_to_controls.get(&cwe))
+            .cloned()
+            .unwrap_or_default()
+    }
+}
+
+/// Build a standard OSCAL assessment-results document from `findings`, using each
+/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
+/// finding is emitted as an observation — mapped findings additionally produce a
+/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
+/// (an observation carrying their CWE/tool/severity, with no control target) so
+/// nothing is lost. `at` is the assessment timestamp.
+pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
+    let ts = at.to_rfc3339();
+
+    let mut observations = Vec::new();
+    let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
+    let mut mapped = 0usize;
+    let mut unmapped = 0usize;
+
+    for finding in findings {
+        if finding.status == FindingStatus::FalsePositive {
+            continue; // flagged tool false positive — excluded from the report
+        }
+        let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
+        let location = match (&finding.file_path, finding.line_number) {
+            (Some(f), Some(l)) => Some(format!("{f}:{l}")),
+            (Some(f), None) => Some(f.clone()),
+            _ => None,
+        };
+        let is_mapped = !finding.control_refs.is_empty();
+        if is_mapped {
+            mapped += 1;
+        } else {
+            unmapped += 1;
+        }
+        let mut props = vec![
+            ObsProp::new("tool", &finding.scanner),
+            ObsProp::new("severity", &finding.severity.to_string()),
+            ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
+        ];
+        if let Some(cwe) = &finding.cwe {
+            props.push(ObsProp::new("cwe", cwe));
+        }
+        observations.push(Observation {
+            uuid: obs_uuid.clone(),
+            title: finding.title.clone(),
+            description: finding.description.clone(),
+            methods: vec!["TEST".to_string()],
+            collected: ts.clone(),
+            props,
+            relevant_evidence: vec![RelevantEvidence {
+                href: location.map(|l| format!("file://{l}")),
+                description: format!("[{}] {}", finding.scanner, finding.title),
+            }],
+        });
+        for control_id in &finding.control_refs {
+            obs_by_control
+                .entry(control_id.clone())
+                .or_default()
+                .push(obs_uuid.clone());
+        }
+    }
+
+    let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
+    hit_controls.sort();
+    let ar_findings: Vec<ArFinding> = hit_controls
+        .iter()
+        .map(|control_id| ArFinding {
+            uuid: det_uuid(&format!("finding:{control_id}")),
+            title: format!("Findings affect {control_id}"),
+            target: FindingTarget {
+                target_type: "statement-id".to_string(),
+                target_id: format!("{control_id}_smt"),
+                status: TargetStatus {
+                    state: "not-satisfied".to_string(),
+                },
+            },
+            related_observations: obs_by_control[*control_id]
+                .iter()
+                .map(|u| RelatedObservation {
+                    observation_uuid: u.clone(),
+                })
+                .collect(),
+        })
+        .collect();
+
+    let include_controls: Vec<SelectControlById> = hit_controls
+        .iter()
+        .map(|c| SelectControlById {
+            control_id: (*c).clone(),
+        })
+        .collect();
+
+    let result = ArResult {
+        uuid: det_uuid("result:cra"),
+        title: "Automated code-compliance assessment".to_string(),
+        description: format!(
+            "{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
+            observations.len(),
+            include_controls.len()
+        ),
+        start: ts.clone(),
+        reviewed_controls: ReviewedControls {
+            control_selections: vec![ControlSelection { include_controls }],
+        },
+        observations,
+        findings: ar_findings,
+    };
+
+    AssessmentResultsDoc {
+        assessment_results: AssessmentResults {
+            uuid: det_uuid("assessment-results:cra"),
+            metadata: ArMetadata {
+                title: "Compliance scanner — OSCAL assessment results".to_string(),
+                last_modified: ts,
+                version: "1.0.0".to_string(),
+                oscal_version: OSCAL_VERSION.to_string(),
+            },
+            import_ap: ImportAp {
+                href: "#cra-annex-i".to_string(),
+            },
+            results: vec![result],
+        },
+    }
+}
+
+// ── OSCAL assessment-results document (serialise) ────────────────────────────
+
+/// The root OSCAL assessment-results document.
+#[derive(Debug, Clone, Serialize)]
+pub struct AssessmentResultsDoc {
+    #[serde(rename = "assessment-results")]
+    pub assessment_results: AssessmentResults,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct AssessmentResults {
+    pub uuid: String,
+    pub metadata: ArMetadata,
+    #[serde(rename = "import-ap")]
+    pub import_ap: ImportAp,
+    pub results: Vec<ArResult>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArMetadata {
+    pub title: String,
+    #[serde(rename = "last-modified")]
+    pub last_modified: String,
+    pub version: String,
+    #[serde(rename = "oscal-version")]
+    pub oscal_version: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ImportAp {
+    pub href: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArResult {
+    pub uuid: String,
+    pub title: String,
+    pub description: String,
+    pub start: String,
+    #[serde(rename = "reviewed-controls")]
+    pub reviewed_controls: ReviewedControls,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub observations: Vec<Observation>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub findings: Vec<ArFinding>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ReviewedControls {
+    #[serde(rename = "control-selections")]
+    pub control_selections: Vec<ControlSelection>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ControlSelection {
+    #[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
+    pub include_controls: Vec<SelectControlById>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SelectControlById {
+    #[serde(rename = "control-id")]
+    pub control_id: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Observation {
+    pub uuid: String,
+    pub title: String,
+    pub description: String,
+    pub methods: Vec<String>,
+    pub collected: String,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub props: Vec<ObsProp>,
+    #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
+    pub relevant_evidence: Vec<RelevantEvidence>,
+}
+
+/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
+/// unmapped finding be reported fully as-is.
+#[derive(Debug, Clone, Serialize)]
+pub struct ObsProp {
+    pub name: String,
+    pub value: String,
+}
+
+impl ObsProp {
+    fn new(name: &str, value: &str) -> Self {
+        Self {
+            name: name.to_string(),
+            value: value.to_string(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct RelevantEvidence {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub href: Option<String>,
+    pub description: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArFinding {
+    pub uuid: String,
+    pub title: String,
+    pub target: FindingTarget,
+    #[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
+    pub related_observations: Vec<RelatedObservation>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct FindingTarget {
+    #[serde(rename = "type")]
+    pub target_type: String,
+    #[serde(rename = "target-id")]
+    pub target_id: String,
+    pub status: TargetStatus,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TargetStatus {
+    pub state: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct RelatedObservation {
+    #[serde(rename = "observation-uuid")]
+    pub observation_uuid: String,
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use crate::models::finding::Severity;
+    use crate::models::scan::ScanType;
+
+    fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
+        let mut f = Finding::new(
+            "repo".into(),
+            fp.into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            "hardcoded credential".into(),
+            "desc".into(),
+            Severity::High,
+        );
+        f.cwe = cwe.map(Into::into);
+        f.file_path = Some("src/auth.rs".into());
+        f.line_number = Some(42);
+        f.control_refs = refs.iter().map(|s| s.to_string()).collect();
+        f
+    }
+
+    fn at() -> DateTime<Utc> {
+        DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc)
+    }
+
+    #[test]
+    fn mapped_finding_becomes_control_finding() {
+        let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
+        let r = &doc.assessment_results.results[0];
+        assert_eq!(r.observations.len(), 1);
+        assert_eq!(r.findings.len(), 1);
+        assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
+        assert_eq!(r.findings[0].target.status.state, "not-satisfied");
+        assert_eq!(
+            r.reviewed_controls.control_selections[0]
+                .include_controls
+                .len(),
+            1
+        );
+    }
+
+    #[test]
+    fn unmapped_finding_is_reported_as_is() {
+        let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
+        let r = &doc.assessment_results.results[0];
+        assert_eq!(r.observations.len(), 1); // still emitted...
+        assert!(r.findings.is_empty()); // ...but no control finding
+        assert!(r.reviewed_controls.control_selections[0]
+            .include_controls
+            .is_empty());
+        let props: Vec<(&str, &str)> = r.observations[0]
+            .props
+            .iter()
+            .map(|p| (p.name.as_str(), p.value.as_str()))
+            .collect();
+        assert!(props.contains(&("mapping", "unmapped")));
+        assert!(props.contains(&("cwe", "CWE-319")));
+    }
+
+    #[test]
+    fn false_positive_is_excluded() {
+        let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
+        f.status = FindingStatus::FalsePositive;
+        let doc = assess(&[f], at());
+        assert!(doc.assessment_results.results[0].observations.is_empty());
+    }
+
+    #[test]
+    fn deterministic_and_valid_oscal() {
+        let mk = || {
+            vec![
+                finding("f1", Some("CWE-798"), &["cra-ai-8"]),
+                finding("f2", Some("CWE-319"), &[]),
+            ]
+        };
+        let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
+        let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
+        assert_eq!(a, b);
+        assert!(a.contains("\"oscal-version\":\"1.1.2\""));
+        assert!(a.contains("\"not-satisfied\""));
+        assert!(a.contains("\"mapping\""));
+    }
+}

compliance-core/src/models/werkbank.rs

@@ -0,0 +1,514 @@
+//! The Werkbank job/result contract (WB-01).
+//!
+//! The shared, dependency-free vocabulary the control plane and the Werkbank
+//! execution runner agree on: what a [`Job`] is, which [`Executor`] runs it, how
+//! it moves through the queue ([`JobStatus`]), and what a [`JobResult`] carries
+//! back. Jobs are declarative — TOML on disk, JSON on the wire — and results
+//! reuse the existing scanner result types ([`Finding`], [`DastFinding`],
+//! [`SbomEntry`]) so the runner produces exactly what the control plane persists.
+//!
+//! This module is intentionally free of the `mongodb`/`axum` features so the
+//! runner can depend on `compliance-core` without pulling the server stack.
+
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::dast::DastFinding;
+use super::finding::Finding;
+use super::sbom::SbomEntry;
+
+/// The kind of dynamic-execution job.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum JobType {
+    /// Instantiate control logic on an ephemeral soft-PLC and probe it.
+    PlcProvision,
+    /// Boot a firmware image under QEMU and run dynamic checks.
+    QemuBoot,
+    /// Crawl and dynamically test a running web endpoint.
+    Dast,
+    /// Run an active penetration test against a running target.
+    Pentest,
+}
+
+/// How a runner executes a job — the CI-runner-style classification. A runner
+/// advertises exactly one; a job requires one.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Executor {
+    /// A subprocess on the runner host (dev / trusted single-node).
+    Shell,
+    /// One or more containers on the runner's Docker (default; QEMU runs here).
+    Docker,
+    /// A Pod/Job in a Kubernetes cluster (scale-out / multi-tenant).
+    K8s,
+}
+
+/// Lifecycle state of a job in the queue.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum JobStatus {
+    /// Waiting to be leased.
+    Queued,
+    /// Leased by a runner but not yet started.
+    Leased,
+    /// Executing on a runner.
+    Running,
+    /// Completed successfully.
+    Succeeded,
+    /// Completed with an error.
+    Failed,
+    /// The lease/lifetime deadline elapsed before completion.
+    Expired,
+    /// Cancelled by the control plane.
+    Cancelled,
+}
+
+impl JobStatus {
+    /// Whether the job has reached a terminal state (no further transitions).
+    pub fn is_terminal(self) -> bool {
+        matches!(
+            self,
+            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Expired | JobStatus::Cancelled
+        )
+    }
+}
+
+/// A reference to an input artifact. Resolved by the runner from a source it can
+/// reach; the blob itself never flows through the control plane (so an on-prem
+/// runner keeps customer data local). Exactly one of `blob`/`url` should be set.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InputRef {
+    /// Content-addressed blob (e.g. `sha256:…`) the runner fetches from its store.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub blob: Option<String>,
+    /// A URL the runner can reach (git repo, internal artifact store, …).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
+}
+
+impl InputRef {
+    /// A content-addressed blob reference.
+    pub fn blob(id: impl Into<String>) -> Self {
+        Self {
+            blob: Some(id.into()),
+            url: None,
+        }
+    }
+}
+
+/// Sandbox runtime knobs. Fields are executor/job-type specific and all optional;
+/// `extra` carries anything not modelled explicitly.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct JobRuntime {
+    /// Container image (Docker executor).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub image: Option<String>,
+    /// Memory cap (e.g. `512m`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memory: Option<String>,
+    /// CPU cap (e.g. `0.5`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cpus: Option<String>,
+    /// Network to join (e.g. `isolated`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub network: Option<String>,
+    /// QEMU machine type (qemu-boot).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub machine: Option<String>,
+    /// QEMU target architecture (qemu-boot).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub arch: Option<String>,
+    /// Executor-specific extras not modelled above.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub extra: BTreeMap<String, String>,
+}
+
+/// DAST collection settings for jobs that scan a web endpoint.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DastCollect {
+    /// Maximum crawl depth (kept shallow for ephemeral instances).
+    pub max_crawl_depth: u32,
+}
+
+/// What to collect from a run.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct JobCollect {
+    /// Run the industrial-protocol probe (Modbus/OPC-UA/EtherNet-IP).
+    #[serde(default)]
+    pub ics_probe: bool,
+    /// Run DAST against the provisioned/booted web endpoint.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub dast: Option<DastCollect>,
+    /// Run an active pentest.
+    #[serde(default)]
+    pub pentest: bool,
+    /// Collect an SBOM.
+    #[serde(default)]
+    pub sbom: bool,
+}
+
+/// A declarative dynamic-execution job the control plane enqueues and a Werkbank
+/// runner leases and executes.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Job {
+    /// Unique job id (assigned by the control plane on enqueue).
+    pub id: String,
+    /// What kind of job this is.
+    #[serde(rename = "type")]
+    pub job_type: JobType,
+    /// Owning tenant.
+    pub tenant: String,
+    /// The onboarded target this job tests.
+    pub target_id: String,
+    /// The executor a runner must provide to run this job.
+    pub executor: Executor,
+    /// Runner capabilities this job requires (e.g. `arch=amd64`, `kvm=true`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub labels: Vec<String>,
+    /// Hard lifetime deadline for the whole job.
+    pub timeout_secs: u64,
+    /// Named input artifacts (e.g. `program`, `firmware`), by reference.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub inputs: BTreeMap<String, InputRef>,
+    /// Sandbox runtime knobs.
+    #[serde(default)]
+    pub runtime: JobRuntime,
+    /// What to collect from the run.
+    #[serde(default)]
+    pub collect: JobCollect,
+}
+
+impl Job {
+    /// A `plc-provision` job: instantiate the control logic named `program` on an
+    /// ephemeral soft-PLC (Docker executor) and collect the ICS probe + DAST.
+    pub fn plc_provision(
+        id: impl Into<String>,
+        tenant: impl Into<String>,
+        target_id: impl Into<String>,
+        program: InputRef,
+        timeout_secs: u64,
+    ) -> Self {
+        let mut inputs = BTreeMap::new();
+        inputs.insert("program".to_string(), program);
+        Self {
+            id: id.into(),
+            job_type: JobType::PlcProvision,
+            tenant: tenant.into(),
+            target_id: target_id.into(),
+            executor: Executor::Docker,
+            labels: Vec::new(),
+            timeout_secs,
+            inputs,
+            runtime: JobRuntime::default(),
+            collect: JobCollect {
+                ics_probe: true,
+                dast: Some(DastCollect { max_crawl_depth: 2 }),
+                pentest: false,
+                sbom: false,
+            },
+        }
+    }
+}
+
+/// The outcome of running a job, posted back to the control plane. Findings and
+/// SBOM reuse the shared scanner types, so the control plane persists them
+/// unchanged. Submission is idempotent — keyed by [`JobResult::job_id`].
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct JobResult {
+    /// The job this result is for.
+    pub job_id: String,
+    /// Terminal status of the job.
+    pub status: Option<JobStatus>,
+    /// General scanner findings (e.g. ICS-probe findings).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub findings: Vec<Finding>,
+    /// DAST findings from a web-endpoint scan.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub dast_findings: Vec<DastFinding>,
+    /// SBOM components collected from the run.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub sbom: Vec<SbomEntry>,
+    /// Error message when the job failed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Captured execution log (truncated by the runner).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub logs: Option<String>,
+    /// When execution started on the runner.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at: Option<DateTime<Utc>>,
+    /// When execution finished.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at: Option<DateTime<Utc>>,
+}
+
+impl JobResult {
+    /// A successful result for a job.
+    pub fn succeeded(job_id: impl Into<String>) -> Self {
+        Self {
+            job_id: job_id.into(),
+            status: Some(JobStatus::Succeeded),
+            ..Default::default()
+        }
+    }
+
+    /// A failed result carrying an error message.
+    pub fn failed(job_id: impl Into<String>, error: impl Into<String>) -> Self {
+        Self {
+            job_id: job_id.into(),
+            status: Some(JobStatus::Failed),
+            error: Some(error.into()),
+            ..Default::default()
+        }
+    }
+}
+
+/// A queued job as persisted by the control plane (WB-02): the [`Job`] contract
+/// plus the queue bookkeeping — status, lease ownership, attempt count, and the
+/// eventual result. The runner never sees this record; on lease it receives a
+/// [`LeasedJob`] (the job plus a token it presents to heartbeat/complete).
+///
+/// Timestamps persist as native BSON dates so the queue's range queries (lease
+/// FIFO by `created_at`, visibility-timeout sweep by `lease_expires_at`) compare
+/// correctly.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct JobRecord {
+    /// The job to run.
+    pub job: Job,
+    /// Current queue state.
+    pub status: JobStatus,
+    /// The lease token held by the current runner (proves lease ownership).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lease_token: Option<String>,
+    /// Id of the runner holding the lease.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub leased_by: Option<String>,
+    /// When the current lease expires — the visibility timeout after which a
+    /// crashed runner's job is swept back to `queued`.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub lease_expires_at: Option<DateTime<Utc>>,
+    /// Last heartbeat from the runner.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub heartbeat_at: Option<DateTime<Utc>>,
+    /// How many times the job has been leased (incremented on each lease).
+    #[serde(default)]
+    pub attempts: u32,
+    /// Set when the control plane requests cancellation; the runner sees it on
+    /// its next heartbeat and aborts.
+    #[serde(default)]
+    pub cancel_requested: bool,
+    /// The result, once the job reaches a terminal state.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub result: Option<JobResult>,
+    /// When the job was enqueued.
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub created_at: DateTime<Utc>,
+    /// Last modification.
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub updated_at: DateTime<Utc>,
+}
+
+impl JobRecord {
+    /// A freshly-enqueued (`queued`) record for a job.
+    pub fn queued(job: Job, now: DateTime<Utc>) -> Self {
+        Self {
+            job,
+            status: JobStatus::Queued,
+            lease_token: None,
+            leased_by: None,
+            lease_expires_at: None,
+            heartbeat_at: None,
+            attempts: 0,
+            cancel_requested: false,
+            result: None,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+}
+
+/// A job handed to a runner on lease: what to run plus the token the runner must
+/// present to heartbeat and complete it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeasedJob {
+    /// The job to execute.
+    pub job: Job,
+    /// The lease token proving ownership (opaque to the runner).
+    pub lease_token: String,
+}
+
+/// The runner's view of a heartbeat: whether the control plane has asked the job
+/// to stop. `None` from the queue means the lease was lost (token mismatch or the
+/// job already terminal) and the runner should abandon the work.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct HeartbeatAck {
+    /// The control plane requested cancellation — the runner should tear down.
+    pub cancelled: bool,
+}
+
+// --- Runner ↔ control-plane transport (the pull API wire types) ---------------
+// Shared so the runner (client) and the control plane (server) agree on shapes.
+
+/// Runner → control plane: lease the oldest runnable job for this runner.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct LeaseRequest {
+    /// The tenant queue to lease from.
+    pub tenant: String,
+    /// The runner id (advertised for attribution).
+    pub runner_id: String,
+    /// The executor this runner provides.
+    pub executor: Executor,
+    /// The capability labels this runner advertises.
+    #[serde(default)]
+    pub labels: Vec<String>,
+    /// Requested lease lifetime (the visibility timeout), in seconds.
+    pub lease_ttl_secs: u64,
+}
+
+/// Runner → control plane: prove lease ownership and extend it.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct HeartbeatRequest {
+    /// The tenant queue.
+    pub tenant: String,
+    /// The job being worked.
+    pub job_id: String,
+    /// The lease token from the [`LeasedJob`].
+    pub lease_token: String,
+    /// Lease lifetime to extend to, in seconds.
+    pub lease_ttl_secs: u64,
+}
+
+/// Runner → control plane: record a job's terminal result.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CompleteRequest {
+    /// The tenant queue.
+    pub tenant: String,
+    /// The job being completed.
+    pub job_id: String,
+    /// The lease token proving ownership.
+    pub lease_token: String,
+    /// The result to record.
+    pub result: JobResult,
+}
+
+/// Control plane → runner: whether the completion was recorded (false if the
+/// lease was already lost — token mismatch or the job had become terminal).
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+pub struct CompleteResponse {
+    /// Whether the result was recorded.
+    pub recorded: bool,
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn job_round_trips_through_json() {
+        let job = Job::plc_provision("job_1", "acme", "64f0aa", InputRef::blob("sha256:abc"), 180);
+        let json = serde_json::to_string(&job).expect("serialize");
+        let back: Job = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(job, back);
+        // Enum wire forms are the kebab/lowercase the contract documents.
+        assert!(json.contains("\"type\":\"plc-provision\""));
+        assert!(json.contains("\"executor\":\"docker\""));
+    }
+
+    #[test]
+    fn parses_the_design_doc_plc_provision_toml() {
+        // The exact shape from docs/DESIGN.md §5 (wrapped in a [job] table).
+        #[derive(Deserialize)]
+        struct JobFile {
+            job: Job,
+        }
+        let src = r#"
+            [job]
+            id = "job_01H"
+            type = "plc-provision"
+            tenant = "acme"
+            target_id = "64f0"
+            executor = "docker"
+            labels = ["arch=amd64"]
+            timeout_secs = 180
+
+            [job.inputs]
+            program = { blob = "sha256:deadbeef" }
+
+            [job.runtime]
+            image = "openplc:latest"
+            memory = "512m"
+            cpus = "0.5"
+            network = "isolated"
+
+            [job.collect]
+            ics_probe = true
+            dast = { max_crawl_depth = 2 }
+        "#;
+        let file: JobFile = toml::from_str(src).expect("parse job toml");
+        let job = file.job;
+        assert_eq!(job.job_type, JobType::PlcProvision);
+        assert_eq!(job.executor, Executor::Docker);
+        assert_eq!(job.labels, vec!["arch=amd64".to_string()]);
+        assert_eq!(
+            job.inputs.get("program").and_then(|i| i.blob.as_deref()),
+            Some("sha256:deadbeef")
+        );
+        assert_eq!(job.runtime.image.as_deref(), Some("openplc:latest"));
+        assert!(job.collect.ics_probe);
+        assert_eq!(job.collect.dast.map(|d| d.max_crawl_depth), Some(2));
+    }
+
+    #[test]
+    fn qemu_boot_runtime_fields_parse() {
+        #[derive(Deserialize)]
+        struct JobFile {
+            job: Job,
+        }
+        let src = r#"
+            [job]
+            id = "j2"
+            type = "qemu-boot"
+            tenant = "acme"
+            target_id = "t"
+            executor = "docker"
+            labels = ["kvm=true"]
+            timeout_secs = 600
+            [job.inputs]
+            firmware = { blob = "sha256:cafe" }
+            [job.runtime]
+            machine = "virt"
+            arch = "arm"
+            memory = "1g"
+        "#;
+        let file: JobFile = toml::from_str(src).expect("parse");
+        assert_eq!(file.job.job_type, JobType::QemuBoot);
+        assert_eq!(file.job.runtime.arch.as_deref(), Some("arm"));
+        assert_eq!(
+            file.job
+                .inputs
+                .get("firmware")
+                .and_then(|i| i.blob.as_deref()),
+            Some("sha256:cafe")
+        );
+    }
+
+    #[test]
+    fn status_terminality() {
+        assert!(JobStatus::Succeeded.is_terminal());
+        assert!(JobStatus::Expired.is_terminal());
+        assert!(!JobStatus::Queued.is_terminal());
+        assert!(!JobStatus::Running.is_terminal());
+    }
+
+    #[test]
+    fn result_constructors() {
+        assert_eq!(JobResult::succeeded("j").status, Some(JobStatus::Succeeded));
+        let f = JobResult::failed("j", "boom");
+        assert_eq!(f.status, Some(JobStatus::Failed));
+        assert_eq!(f.error.as_deref(), Some("boom"));
+    }
+}

compliance-mcp/src/main.rs

@@ -42,7 +42,19 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
         let pool_for_factory = pool.clone();
         let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
+            move || {
+                // The factory runs in the request task, still inside the bearer
+                // middleware's `TENANT_ID` scope, and BEFORE rmcp spawns the
+                // session task (which would lose the task_local). So bind the
+                // tenant into the session's server instance here, once.
+                let tenant_id = auth::current_tenant_id().ok_or_else(|| {
+                    std::io::Error::other("no tenant context when creating MCP session")
+                })?;
+                Ok(ComplianceMcpServer::new(
+                    pool_for_factory.clone(),
+                    tenant_id,
+                ))
+            },
             Arc::new(LocalSessionManager::default()),
             StreamableHttpServerConfig::default(),
         );
@@ -69,16 +81,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             tenant_id = %synth_tenant,
             "stdio transport — using synthetic tenant id; DO NOT use in production"
         );
-        let server = ComplianceMcpServer::new(pool);
+        let server = ComplianceMcpServer::new(pool, synth_tenant);
         let transport = rmcp::transport::stdio();
         use rmcp::ServiceExt;
-        auth::TENANT_ID
-            .scope(synth_tenant, async {
-                let handle = server.serve(transport).await?;
-                handle.waiting().await?;
-                Ok::<_, Box<dyn std::error::Error>>(())
-            })
-            .await?;
+        let handle = server.serve(transport).await?;
+        handle.waiting().await?;
     }
 
     Ok(())

compliance-mcp/src/server.rs

@@ -2,37 +2,33 @@ use rmcp::{
     handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
 };
 
-use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
-use crate::tools::{dast, findings, pentest, sbom};
+use crate::tools::{dast, findings, oscal, pentest, sbom};
 
 pub struct ComplianceMcpServer {
     pool: DatabasePool,
+    /// Tenant this session serves. Bound once at session creation (the HTTP
+    /// factory reads the bearer-set tenant while still in the request scope;
+    /// stdio passes a synthetic id) — NOT a per-request `task_local`, which is
+    /// lost across the `tokio::spawn` that runs the Streamable-HTTP session.
+    tenant_id: String,
     #[allow(dead_code)]
     tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
 }
 
 impl ComplianceMcpServer {
-    /// Resolve the per-tenant `Database` from the bearer-set
-    /// `task_local`. Every tool handler calls this; missing context
-    /// surfaces as `internal_error` because it means the auth
-    /// middleware was misconfigured (handler ran without scope).
+    /// The per-tenant `Database` for this session.
     fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
-        let tenant_id = current_tenant_id().ok_or_else(|| {
-            rmcp::ErrorData::internal_error(
-                "no tenant context — bearer middleware not in chain".to_string(),
-                None,
-            )
-        })?;
-        Ok(self.pool.for_tenant_id(&tenant_id))
+        Ok(self.pool.for_tenant_id(&self.tenant_id))
     }
 }
 
 #[tool_router]
 impl ComplianceMcpServer {
-    pub fn new(pool: DatabasePool) -> Self {
+    pub fn new(pool: DatabasePool, tenant_id: String) -> Self {
         Self {
             pool,
+            tenant_id,
             tool_router: Self::tool_router(),
         }
     }
@@ -68,6 +64,17 @@ impl ComplianceMcpServer {
         findings::findings_summary(&db, params).await
     }
 
+    #[tool(
+        description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
+    )]
+    async fn oscal_assessment(
+        &self,
+        Parameters(params): Parameters<oscal::OscalAssessmentParams>,
+    ) -> Result<CallToolResult, rmcp::ErrorData> {
+        let db = self.tenant_db()?;
+        oscal::oscal_assessment(&db, params).await
+    }
+
     // ── SBOM ──────────────────────────────────────────────
 
     #[tool(

compliance-mcp/src/tools/mod.rs

@@ -1,4 +1,5 @@
 pub mod dast;
 pub mod findings;
+pub mod oscal;
 pub mod pentest;
 pub mod sbom;

compliance-mcp/src/tools/oscal.rs

@@ -0,0 +1,51 @@
+//! OSCAL assessment MCP tool.
+//!
+//! Emits a standard OSCAL assessment-results document for a repo's findings —
+//! what breakpilot's scanner MCP client pulls. Mapped findings target their
+//! compliance controls (via the stamped `control_refs`); unmapped findings are
+//! reported as-is, so nothing is lost.
+
+use mongodb::bson::doc;
+use rmcp::{model::*, ErrorData as McpError};
+use schemars::JsonSchema;
+use serde::Deserialize;
+
+use compliance_core::models::oscal_assessment::assess;
+use compliance_core::models::Finding;
+
+use crate::database::Database;
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub struct OscalAssessmentParams {
+    /// Repository / target id to assess.
+    pub repo_id: String,
+}
+
+pub async fn oscal_assessment(
+    db: &Database,
+    params: OscalAssessmentParams,
+) -> Result<CallToolResult, McpError> {
+    let mut cursor = db
+        .findings()
+        .find(doc! { "repo_id": &params.repo_id })
+        .await
+        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
+
+    let mut findings: Vec<Finding> = Vec::new();
+    while cursor
+        .advance()
+        .await
+        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
+    {
+        findings.push(
+            cursor
+                .deserialize_current()
+                .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
+        );
+    }
+
+    let document = assess(&findings, chrono::Utc::now());
+    let json = serde_json::to_string_pretty(&document)
+        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
+    Ok(CallToolResult::success(vec![Content::text(json)]))
+}

control-map/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "control-map"
+version = "0.1.0"
+edition = "2021"
+
+[lints]
+workspace = true
+
+[dependencies]
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }

control-map/data/cra_control_map.json

@@ -0,0 +1,496 @@
+{
+  "version": "1.0",
+  "framework": "cra",
+  "controls": [
+    {
+      "control": "cra-ai-1",
+      "title": "Secure-by-Default-Konfiguration",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-1-flask-debug-enabled",
+            "cra-ai-1-django-debug-true",
+            "cra-ai-1-tls-verify-disabled",
+            "cra-ai-1-cors-wildcard"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-2",
+      "title": "Minimale Angriffsflaeche",
+      "scans": [],
+      "note": "design property (minimal attack surface) — not derivable from local code patterns; architecture/threat-model review",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-3",
+      "title": "Sichere Systemarchitektur",
+      "scans": [],
+      "note": "design property (secure system architecture) — architecture review, not statically code-checkable",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-4",
+      "title": "Least-Privilege-Prinzip",
+      "scans": [],
+      "note": "design property (least-privilege) — deployment/IAM & architecture review, not a local code pattern",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-5",
+      "title": "Manipulationsschutz",
+      "scans": [],
+      "note": "design property (tamper protection) — hardware/runtime & operational control, not statically code-checkable",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-6",
+      "title": "Integritaetspruefung",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-7",
+      "title": "Starke Authentifizierung",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-7-weak-password-hash"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-8",
+      "title": "Keine Default-Passwoerter",
+      "scans": [
+        {
+          "tool": "gitleaks",
+          "scan_type": "secret_detection",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-798",
+            "CWE-259"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-9",
+      "title": "Sicheres Credential-Management",
+      "scans": [
+        {
+          "tool": "gitleaks",
+          "scan_type": "secret_detection",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-798",
+            "CWE-522"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-10",
+      "title": "Sitzungsmanagement",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-10-session-cookie-insecure",
+            "cra-ai-10-express-cookie-insecure"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-11",
+      "title": "Brute-Force-Schutz",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-12",
+      "title": "Rollenbasierte Autorisierung",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-13",
+      "title": "Verschluesselung sensibler Daten",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-327",
+            "CWE-326"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-14",
+      "title": "Speicher-Schutz (Data at Rest)",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [],
+          "rules": [
+            "cra-ai-14-python-weak-cipher",
+            "cra-ai-14-node-weak-cipher"
+          ]
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-15",
+      "title": "Transport-Schutz (Data in Transit)",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-319",
+            "CWE-311"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-16",
+      "title": "Sicheres Schluesselmanagement",
+      "scans": [
+        {
+          "tool": "gitleaks",
+          "scan_type": "secret_detection",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-798",
+            "CWE-321"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-17",
+      "title": "Datenminimierung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-18",
+      "title": "Strukturierter SSDLC",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-19",
+      "title": "Systematische Code Reviews",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-20",
+      "title": "Automatisierte Sicherheitstests",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-89",
+            "CWE-78",
+            "CWE-79",
+            "CWE-22"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-21",
+      "title": "Supply-Chain-Security",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-22",
+      "title": "Dependency-Monitoring",
+      "scans": [
+        {
+          "tool": "osv",
+          "scan_type": "cve",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "syft",
+          "scan_type": "sbom",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-23",
+      "title": "Software Bill of Materials (SBOM)",
+      "scans": [
+        {
+          "tool": "syft",
+          "scan_type": "sbom",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-24",
+      "title": "Security-Logging",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-25",
+      "title": "Ereignis-Monitoring",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-26",
+      "title": "Anomalie-Erkennung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-27",
+      "title": "Log-Integritaet und -Aufbewahrung",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-28",
+      "title": "Sichere Update-Mechanismen",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-29",
+      "title": "Update-Authentizitaet",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-30",
+      "title": "Update-Integritaet",
+      "scans": [
+        {
+          "tool": "grounded-control-check",
+          "scan_type": "code_review",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-31",
+      "title": "Lifecycle-Support",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-32",
+      "title": "Schwachstellen-Identifikation",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-33",
+      "title": "SBOM-Pflege und Analyse",
+      "scans": [
+        {
+          "tool": "syft",
+          "scan_type": "sbom",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "osv",
+          "scan_type": "cve",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-34",
+      "title": "Risikobasierte Priorisierung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-35",
+      "title": "Coordinated Vulnerability Disclosure",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-36",
+      "title": "Incident-Response-Prozess",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-37",
+      "title": "Fruehwarnung (24h)",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-38",
+      "title": "Detaillierter Vorfallsbericht (72h)",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-39",
+      "title": "Patch-Bereitstellung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-40",
+      "title": "Dokumentation und Nachbereitung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    }
+  ]
+}

control-map/src/lib.rs

@@ -0,0 +1,254 @@
+//! `control-map` — the deterministic control → scan lookup table (LUT).
+//!
+//! The "transcribing" layer: it maps each compliance control to the static-scan
+//! step(s) that check it, or marks it as needing custom tooling, or as not
+//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
+//! decides coverage. The LLM only enters later, downstream, to triage/ground the
+//! *tool's* findings (that lives in the agent, not here).
+//!
+//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
+//! + query helpers.
+
+use serde::{Deserialize, Serialize};
+
+/// Coverage bucket for a control under static (SAST-family) scanning.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Coverage {
+    /// An existing tool's scan surfaces findings for this control.
+    Covered,
+    /// Code-checkable, but no existing tool digs it out — we must write tooling.
+    NeedsTooling,
+    /// Process / document control — out of static-scan scope.
+    NotCodeCheckable,
+}
+
+/// One tool binding: a scan step that (at least partially) checks a control.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ScanBinding {
+    /// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
+    pub tool: String,
+    /// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
+    pub scan_type: String,
+    /// CWEs whose findings map to this control (used to attach findings back).
+    #[serde(default)]
+    pub cwe: Vec<String>,
+    /// Optional specific rule ids this control keys on.
+    #[serde(default)]
+    pub rules: Vec<String>,
+}
+
+/// One control's entry in the LUT.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlEntry {
+    /// Control id, e.g. `"cra-ai-8"`.
+    pub control: String,
+    /// Human-readable title (for the reviewable view).
+    #[serde(default)]
+    pub title: String,
+    /// Coverage bucket.
+    pub status: Coverage,
+    /// Tool bindings (empty unless `status == Covered`).
+    #[serde(default)]
+    pub scans: Vec<ScanBinding>,
+    /// Reviewer note — why it needs tooling / isn't code-checkable.
+    #[serde(default)]
+    pub note: Option<String>,
+}
+
+/// The control → scan lookup table for one framework.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlMap {
+    pub version: String,
+    pub framework: String,
+    pub controls: Vec<ControlEntry>,
+}
+
+const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
+
+/// Whether an authored rule id `bound` matches a scanner's emitted rule id
+/// `actual`. semgrep prefixes local-rule check_ids with a path
+/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
+/// id segment rather than requiring exact equality.
+fn rule_id_matches(bound: &str, actual: &str) -> bool {
+    actual == bound || actual.ends_with(&format!(".{bound}"))
+}
+
+impl ControlMap {
+    /// Load the built-in CRA control map (the embedded, authored LUT).
+    pub fn cra() -> Result<Self, MapError> {
+        Ok(serde_json::from_str(CRA_MAP_JSON)?)
+    }
+
+    /// The coverage entry for a control id, if present.
+    pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
+        self.controls.iter().find(|c| c.control == control_id)
+    }
+
+    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
+    /// raw tool finding back to the control(s) it's evidence for.
+    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
+        self.controls_for_finding(tool, Some(cwe), None)
+    }
+
+    /// Controls a tool finding is evidence for, matched by CWE and/or the specific
+    /// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
+    /// bind by rule id (precise — a broad CWE would over-attribute and then the
+    /// grounded judge could drop a genuine finding as a control false positive).
+    pub fn controls_for_finding(
+        &self,
+        tool: &str,
+        cwe: Option<&str>,
+        rule_id: Option<&str>,
+    ) -> Vec<&ControlEntry> {
+        self.controls
+            .iter()
+            .filter(|c| {
+                c.scans.iter().any(|s| {
+                    s.tool == tool
+                        && (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
+                            || rule_id
+                                .is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
+                })
+            })
+            .collect()
+    }
+
+    /// Count of controls in each coverage bucket.
+    pub fn summary(&self) -> CoverageSummary {
+        let mut s = CoverageSummary::default();
+        for c in &self.controls {
+            match c.status {
+                Coverage::Covered => s.covered += 1,
+                Coverage::NeedsTooling => s.needs_tooling += 1,
+                Coverage::NotCodeCheckable => s.not_code_checkable += 1,
+            }
+        }
+        s
+    }
+}
+
+/// Coverage bucket counts.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct CoverageSummary {
+    pub covered: usize,
+    pub needs_tooling: usize,
+    pub not_code_checkable: usize,
+}
+
+impl CoverageSummary {
+    pub fn total(&self) -> usize {
+        self.covered + self.needs_tooling + self.not_code_checkable
+    }
+}
+
+/// Errors loading a control map.
+#[derive(Debug, thiserror::Error)]
+pub enum MapError {
+    #[error("failed to parse control map: {0}")]
+    Parse(#[from] serde_json::Error),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cra_map_loads_all_40_controls() {
+        let map = ControlMap::cra().expect("CRA map should parse");
+        assert_eq!(map.framework, "cra");
+        assert_eq!(map.controls.len(), 40);
+        assert_eq!(map.summary().total(), 40);
+    }
+
+    #[test]
+    fn hardcoded_password_control_is_tool_covered() {
+        let map = ControlMap::cra().unwrap();
+        let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
+        assert_eq!(c.status, Coverage::Covered);
+        assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
+        assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
+    }
+
+    #[test]
+    fn finding_attaches_back_to_control_via_tool_and_cwe() {
+        let map = ControlMap::cra().unwrap();
+        let hits = map.controls_for("semgrep", "CWE-798");
+        assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
+    }
+
+    #[test]
+    fn covered_and_not_checkable_are_populated() {
+        let s = ControlMap::cra().unwrap().summary();
+        assert!(s.covered > 0);
+        assert!(s.not_code_checkable > 0);
+        // needs_tooling is now empty: every code-checkable control is either
+        // tool-covered or covered by the grounded surface pass.
+        assert_eq!(s.needs_tooling, 0);
+    }
+
+    #[test]
+    fn rule_id_matching_handles_semgrep_path_prefix() {
+        let bound = "cra-ai-1-flask-debug-enabled";
+        assert!(rule_id_matches(bound, bound)); // exact
+        assert!(rule_id_matches(
+            bound,
+            "tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
+        )); // semgrep path prefix
+        assert!(!rule_id_matches(
+            bound,
+            "cra-ai-1-flask-debug-enabled-extra"
+        )); // not a suffix segment
+        assert!(!rule_id_matches(
+            bound,
+            "python.lang.security.exec-detected"
+        )); // unrelated
+    }
+
+    #[test]
+    fn custom_rule_finding_attaches_to_control_by_rule_id() {
+        let map = ControlMap::cra().unwrap();
+        // cra-ai-1 is now tool-covered by custom rules.
+        assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
+        // A prefixed check_id still maps back to cra-ai-1 by rule id.
+        let hits =
+            map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
+        assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
+    }
+
+    #[test]
+    fn coverage_after_grounded_promotion() {
+        let s = ControlMap::cra().unwrap().summary();
+        // 9 off-the-shelf + 4 custom-semgrep + 8 grounded surface controls (promoted
+        // after the grounded path was validated live).
+        assert_eq!(s.covered, 21);
+        // Nothing left as needs_tooling — every code-checkable control is covered.
+        assert_eq!(s.needs_tooling, 0);
+        // The 4 pure-architectural controls remain not code-checkable.
+        assert_eq!(s.not_code_checkable, 19);
+        assert_eq!(s.total(), 40);
+    }
+
+    #[test]
+    fn architectural_controls_are_not_code_checkable() {
+        let map = ControlMap::cra().unwrap();
+        for id in ["cra-ai-2", "cra-ai-3", "cra-ai-4", "cra-ai-5"] {
+            let c = map.coverage(id).unwrap();
+            assert_eq!(c.status, Coverage::NotCodeCheckable, "{id}");
+            assert!(c.scans.is_empty(), "{id} should carry no scan bindings");
+        }
+    }
+
+    #[test]
+    fn custom_rule_controls_do_not_bind_by_broad_cwe() {
+        let map = ControlMap::cra().unwrap();
+        // cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
+        // only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
+        assert!(map.controls_for("semgrep", "CWE-489").is_empty());
+        // The CWE path for off-the-shelf findings is unchanged.
+        assert!(map
+            .controls_for("semgrep", "CWE-798")
+            .iter()
+            .any(|c| c.control == "cra-ai-8"));
+    }
+}

docs/.vitepress/config.mts

@@ -36,6 +36,7 @@ export default withMermaid(defineConfig({
           { text: 'Pentest Architecture', link: '/features/pentest-architecture' },
           { text: 'AI Chat', link: '/features/ai-chat' },
           { text: 'Code Knowledge Graph', link: '/features/graph' },
+          { text: 'Compliance Control Mapping', link: '/features/control-mapping' },
           { text: 'MCP Integration', link: '/features/mcp-server' },
         ],
       },
@@ -44,6 +45,7 @@ export default withMermaid(defineConfig({
         items: [
           { text: 'Glossary', link: '/reference/glossary' },
           { text: 'Tools & Scanners', link: '/reference/tools' },
+          { text: 'PLC Runtime Landscape', link: '/reference/plc-runtimes' },
         ],
       },
     ],

docs/features/control-mapping.md

@@ -0,0 +1,136 @@
+# Compliance Control Mapping
+
+Control mapping connects the scanner's raw output — deterministic tool findings and the code itself — to the **compliance controls** each piece of evidence supports. A hardcoded credential stops being just "CWE-798 from semgrep" and becomes evidence for *"cra-ai-8: no default passwords"* and, at scale, master control *`mc-31761` hardcoded_secrets_detection*. Findings carry those references (`control_refs`) into the dashboard and out over the MCP server as OSCAL, so the compliance report is built from real, grounded findings rather than a questionnaire.
+
+## The core principle: tools detect, the LLM judges
+
+The design has one rule, borrowed from the ZeroFalse / IRIS line of research: **deterministic tools are the detectors; the LLM is only ever a grounded false-positive filter, never the thing that finds the issue.**
+
+- A tool (semgrep, gitleaks, syft/osv, ZAP, nuclei) detects deterministically.
+- An **authored, human-reviewed lookup table** (`control-map`) maps that detection to the control(s) it's evidence for.
+- The LLM enters last, to *confirm or refute* the mapping against the actual code — and every surviving verdict is anchored to a verbatim snippet by the grounding gate.
+
+This keeps hallucination out of detection. The LLM supplies cross-language, cross-stack pattern *recognition*; the surrounding machinery supplies determinism.
+
+## Coverage model
+
+Every control lands in one of three buckets, recorded in the `control-map` LUT (`control-map/data/cra_control_map.json`) and never decided by an LLM:
+
+| Bucket | Meaning |
+| --- | --- |
+| `covered` | An existing tool's scan surfaces findings for this control |
+| `needs_tooling` | Code-checkable, but no off-the-shelf tool digs it out — we author a detector or use the grounded surface check |
+| `not_code_checkable` | A design/process property — out of static-scan scope |
+
+For the **CRA** framework (40 controls) the split is **13 covered · 8 needs_tooling · 19 not_code_checkable**. The 16 originally-uncovered controls were resolved as a hybrid:
+
+- **4 custom semgrep detectors** (`cra-ai-1`, `7`, `10`, `14`) — secure-by-default, weak password hashing, insecure session cookies, weak data-at-rest ciphers. Shipped in the binary and matched back to controls **by rule id** so a broad CWE can't over-attribute.
+- **8 grounded surface checks** (`cra-ai-6`, `11`, `12`, `24`, `27`, `28`, `29`, `30`) — the absence-based controls (no rate limiting, no security logging, no update-signature check…) that have no syntactic pattern.
+- **4 marked not_code_checkable** (`cra-ai-2`, `3`, `4`, `5`) — minimal attack surface, secure architecture, least privilege, tamper protection.
+
+At scale, the **master-controls** corpus (breakpilot's deduped clusters, exported as OSCAL) currently provides **~2,882 code-checkable controls** (2,143 `network` + 739 `source_code`), matched semantically.
+
+## The three mapping paths
+
+```mermaid
+flowchart TD
+    T[Deterministic tools\nsemgrep · gitleaks · syft/osv · ZAP] --> F[Findings]
+    F --> B["Stage 5b — LUT triage\ncontrols_for(tool, cwe / rule_id)"]
+    F --> C["Stage 5c — Semantic\nembed region+intent → top-K master controls"]
+    R[Repo source] --> D["Stage 5d — Grounded surface\nretrieve surface for absence-based controls"]
+    B --> J{{Grounded LLM judge\ntemp 0 · verbatim snippet}}
+    C --> J
+    D --> J
+    J -->|snippet grounds in region| S[Stamp control_refs]
+    J -->|refuted / ungrounded| X[Dropped]
+```
+
+All three paths converge on the same **grounded judge** and the same **grounding gate**. They differ only in how candidate (finding/region, control) pairs are produced.
+
+### Stage 5b — deterministic LUT triage
+
+The default path. A tool finding is matched to controls via `control_map.controls_for_finding(tool, cwe, rule_id)`; the judge then confirms each mapped control against the code region. Outcomes: `Confirmed([ids])` (stamp them), `FalsePositive` (drop the finding), or `Unmapped` (keep it untagged). Runs whenever `BREAKPILOT_BASE_URL` is set.
+
+### Stage 5c — semantic retrieval (master-controls scale)
+
+Master controls carry no CWE, so they can't be LUT-mapped. Instead we map by *similarity*: embed every control's requirement text once (cached), then for each finding retrieve the top-K nearest controls and hand them to the judge. Gated behind `BREAKPILOT_SEMANTIC_MAPPING` (default off). See [Semantic retrieval](#semantic-retrieval-in-detail).
+
+### Stage 5d — grounded surface checks (absence-based controls)
+
+Some controls are violated by an *absence* — no rate limiting on login, no security logging, no signature check on an update. There's no pattern for semgrep to match, so we deterministically retrieve the code **surface** the control governs (a login route, a logging setup, update/download code) by identifier/route terms, and let the judge decide whether the control holds there. Produces net-new, already-grounded findings. Gated behind `BREAKPILOT_GROUNDED_CHECKS` (default off).
+
+## The grounding gate
+
+No matter the path, a verdict becomes a finding only if it survives `compliance_core::control_check::ground`:
+
+1. The judge runs at **temperature 0** with a closed prompt and must quote the offending code **verbatim** into `snippet`.
+2. That snippet must appear **literally** in the retrieved region — otherwise the verdict is dropped.
+3. The finding's line is **recomputed from the match**; the model's own line number is never trusted.
+4. Verdicts are cached by content hash, so re-scans reproduce.
+
+The model is allowed to be smart; it is never trusted.
+
+## Semantic retrieval in detail
+
+1. **Embed the corpus once.** Each control's requirement text is embedded with `bge-multilingual-gemma2` (3584-dim — multilingual matters, the master controls are in German while code is English). The embedding backend caps input arrays at 25 per request, so `embed()` chunks at 16; the whole `ControlIndex` is persisted to `snapshot_dir` keyed by a **corpus hash**, so only the first scan after a catalog change pays the embedding cost.
+2. **Build the query from the finding's intent, not just the code.** The retrieval query is `finding.title + finding.description + region`, not the raw region. This is the single most important tuning: two findings in one file share overlapping windows and, on the code alone, embed alike and collapse onto the same controls. The finding's own words ("brute-force protection" vs "weak hash") carry the discriminating signal. The raw region still goes to the judge for grounding.
+3. **Retrieve → judge → ground.** Top-K nearest by cosine, each judged against the region, each grounded.
+
+## Worked examples
+
+Both examples are from the live end-to-end verification (`c5_semantic_live.rs`) against the real ~2,882-control corpus.
+
+### Example 1 — a small auth file (the tuning story)
+
+Two findings in one `auth.py`: a weak `hashlib.md5(password)` hash and a login endpoint with no brute-force protection.
+
+| Finding | Region-only retrieval | Intent-enriched retrieval |
+| --- | --- | --- |
+| Weak md5 hash | 19874, 20683, 23149, 29985 | **`mc-23149`** (eliminate weak unsalted hashes) at rank 1, + `mc-21634` salted hashing |
+| Login w/o brute-force protection | *identical 4, reordered* | newly surfaces **`mc-19984`** brute_force_protection + **`mc-23186`** account_lockout |
+
+Region-only retrieval gave both findings the *same* four password-hashing controls — the brute-force finding never found its real controls because its window is saturated with `password` tokens. Enriching the query with the finding's intent fixed it: the brute-force finding now pulls the correct rate-limiting / lockout controls out of the 2,882.
+
+### Example 2 — four topically distinct vulnerabilities
+
+| Finding | Top matched controls | Family |
+| --- | --- | --- |
+| SQL injection (string-concat query) | `sql_injection_prevention`, `sql_injection`, `parameterized_queries`, input_sanitization | input-validation ✓ |
+| Hardcoded API credential | `hardcoded_secrets_detection`, credential_scanning, secrets_detection | credentials ✓ |
+| TLS verification disabled (`verify=False`) | `https_enforcement`, `configuration_verification`, transport config | transport-encryption ✓ |
+| Insecure deserialization (`pickle.loads`) | `deserialization`, `deserialization_testing`, `deserialization_security` | deserialization ✓ |
+
+Every finding maps to its exact control family, with the most specific control often at the top, and the four sets are distinct.
+
+## Known limitations
+
+- **Absence findings are weak for semantic retrieval.** Similarity matches what code *is about*, not what it *lacks*; a "missing rate limiting" finding embeds like login code. This is exactly why the grounded surface path (Stage 5d) exists — it decides presence/absence at a retrieved surface rather than by embedding distance.
+- **Generic catch-all controls co-occur.** `mc-20890 secure_development_security_code_review` appears in the top-K for many code-security findings because it is semantically near almost all of them. It's harmless (the judge grounds it, and it never crowds out the specific controls — the SQLi example didn't get it) but is a candidate for future down-weighting.
+- **Corpus classification noise.** The master-controls `verification_method` classification is imperfect — e.g. a documentation control (`eu_declaration_accuracy`) is currently tagged `source_code`. That's a corpus-side data-quality issue, separate from the mapping engine.
+
+## Emitting over MCP — closing the loop
+
+Findings don't just land in the dashboard; they flow to breakpilot-compliance as OSCAL over the scanner's MCP server, so the compliance report is assembled from real, control-tagged findings.
+
+- The MCP server exposes an **`oscal_assessment`** tool: given a `repo_id`, it emits a standard OSCAL 1.1 assessment-results document for that repo's findings — mapped findings target their controls via the stamped `control_refs`, and unmapped findings are reported **as-is** (as observations), so nothing is lost.
+- breakpilot pulls it: `POST /v1/cra/oscal-from-scanner` calls `oscal_assessment` over MCP (Streamable HTTP + bearer) and consumes the pre-computed OSCAL — rather than pulling raw findings and re-assessing.
+
+**Operational note — tenant context over HTTP.** The MCP server is multi-tenant; the bearer token resolves a tenant whose per-tenant database the tools query. rmcp's Streamable HTTP transport runs each session's tool calls in a `tokio::spawn`ed task, and `task_local`s do **not** cross a spawn — so binding the tenant in a per-request middleware `task_local` leaves tool handlers with no context (every call fails `no tenant context`). The fix is to bind the tenant to the **per-session server instance** at creation (the factory runs in the request scope before the spawn), not to a per-request task_local. Until this was fixed, the loop silently failed over HTTP and consumers fell back to demo data.
+
+## Configuration
+
+| Variable | Effect |
+| --- | --- |
+| `BREAKPILOT_BASE_URL` | breakpilot-compliance root; enables control ingest + all mapping passes. **Unset disables all control mapping** — findings are produced without `control_refs`. |
+| `BREAKPILOT_SEMANTIC_MAPPING` | Stage 5c (semantic master-controls mapping). **Default on** (validated live). |
+| `BREAKPILOT_GROUNDED_CHECKS` | Stage 5d (grounded surface checks). **Default on** (validated live). |
+| `BREAKPILOT_SNAPSHOT_DIR` | Where OSCAL catalog snapshots and the cached control-embedding index live. |
+
+The semantic and grounded passes default **on** now that both are validated live; each is still a no-op if `BREAKPILOT_BASE_URL` is unset or the catalog is unreachable, so they only ever add coverage. The live verifications live in `compliance-agent/tests/c5_semantic_live.rs` and `grounded_surface_live.rs` (ignored; run with `--ignored`).
+
+## Appendix — the master-controls data pipeline
+
+The master-controls corpus is produced by breakpilot-compliance and pulled as an OSCAL catalog from `GET /api/compliance/v1/oscal/catalog?framework=master-controls`. Two operational lessons are worth recording, because they cost real time to diagnose:
+
+- **The catalog is served from `breakpilot_db`, not `postgres`.** Diagnostics run against the wrong database will look clean while the app serves something else entirely. Confirm the app's datname (`pg_stat_activity`) before trusting any count or `EXPLAIN`.
+- **A constraint-less dump triplicated the master-control tables.** Restored without their PK/unique constraints, `master_controls` / `mc_verification` / `master_control_members` accumulated identical rows 3× (the same artifact migration `158` fixed for `doc_check_controls`). That inflated the catalog to ~26k dup'd controls and, with the indexes also missing, drove the export query to a >120s / 502. The fix (breakpilot migration `160`) ctid-dedups each table by its natural key and restores the constraints + indexes so it can't recur; the export query was also rewritten set-based (a single windowed pass instead of a per-row correlated subquery). After dedup: 41,850 → 13,950 master controls, catalog **25,938 → 2,882** code-checkable, endpoint **502 → 200 in ~3s**.

docs/reference/plc-runtimes.md

@@ -0,0 +1,97 @@
+# PLC Runtime Landscape & Support
+
+A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app**
+(see [PLC / SPS Projects](/guide/plc)).
+The **runtime** is what defines the device — it provides the IEC engine, the
+Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
+runtime ecosystems Certifai may encounter.
+
+We do **not** aim to support every runtime up front. Certifai supports the
+**CODESYS family** today; everything else is a **watch-list** — when a customer
+shows up using one, we add the parser/support for it then. The dynamic OT probe
+(Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of
+the runtime.
+
+## Support status
+
+| Status | Meaning |
+| --- | --- |
+| ✅ **Supported** | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
+| 🟡 **Covered via CODESYS** | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
+| 🔭 **Watch-list** | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
+| 🧪 **Test-bench** | A free runtime we use to *reconstruct and dynamically test* a device (see epic: provision-and-test). |
+
+## 1. CODESYS and rebranded CODESYS (the largest slice)
+
+Much of the market licenses the CODESYS runtime and rebrands the IDE. If a
+customer "doesn't use CODESYS", they often do — under another name.
+
+| Product / vendor | Based on | Status |
+| --- | --- | --- |
+| **CODESYS** (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
+| Schneider **EcoStruxure Machine Expert** (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
+| **WAGO** e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
+| **ABB** AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
+| **Bosch Rexroth** ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
+| **Eaton** XSoft-CODESYS, **KEBA** KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |
+
+## 2. Other embeddable IEC 61131-3 runtime toolkits
+
+Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a
+device), but with **different project formats and libraries**.
+
+| Toolkit | Vendor | Status |
+| --- | --- | --- |
+| **ProConOS / MULTIPROG** | Phoenix Contact / KW-Software | 🔭 Watch-list |
+| **ISaGRAF** (also does IEC 61499) | Rockwell | 🔭 Watch-list |
+| **straton** | COPA-DATA | 🔭 Watch-list |
+| **logi.CAD** | logi.cals | 🔭 Watch-list |
+
+## 3. Fully proprietary ecosystems (own runtime + IDE + protocols)
+
+Static analysis here needs a **per-vendor project parser**; the **dynamic OT
+probe still works** (they speak Modbus / OPC UA / EtherNet/IP, plus vendor
+protocols like S7comm / CIP).
+
+| Ecosystem | Vendor | Notes | Status |
+| --- | --- | --- | --- |
+| **TIA Portal / STEP 7** (S7-1200/1500), S7-1500 **Software Controller**, **Virtual PLC** | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
+| **Studio 5000** (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
+| **TwinCAT 3** | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 **+ C++ + Simulink** | 🔭 Watch-list |
+| **Automation Studio** | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
+| **GX Works** (MELSEC) | Mitsubishi | | 🔭 Watch-list |
+| **Sysmac Studio** (NX / NJ) | Omron | | 🔭 Watch-list |
+| **Proficy Machine Edition** (PACSystems) | Emerson / GE | | 🔭 Watch-list |
+
+## 4. Linux-native / containerized soft-PLC (the direction of travel)
+
+| Product | Vendor | Notes | Status |
+| --- | --- | --- | --- |
+| **PLCnext** | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
+| **ctrlX** | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
+| **Virtual PLC** / **CODESYS Virtual Control** | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |
+
+## 5. Open-source runtimes (free — our test-bench substrates)
+
+Used to **reconstruct and dynamically test** a customer device without touching
+their network (provision-and-test).
+
+| Runtime | Standard | Notes | Status |
+| --- | --- | --- | --- |
+| **OpenPLC** | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
+| **Beremiz + MatIEC** | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
+| **Eclipse 4diac (FORTE)** | IEC **61499** | Distributed, event-driven — a *different paradigm* from 61131-3's scan cycle | 🔭 Watch-list |
+| **ProView** | — | Open-source process control + SCADA | 🔭 Watch-list |
+
+## How we add support for a new runtime
+
+- **Static (SAST / SBOM):** needs a parser for that runtime's **project format**
+  (and its library/package convention). This is the per-vendor work.
+- **Dynamic (ICS probe / DAST):** already **vendor-agnostic** — it targets the
+  device's OT ports and WebVisu, not the runtime's file format. So a brand-new
+  ecosystem still gets dynamic coverage on day one.
+
+::: tip Rule of thumb
+Confirm whether a "non-CODESYS" controller is actually a **rebranded CODESYS**
+runtime (Section 1) before assuming new work — most of the long tail is.
+:::

werkbank-exec/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "werkbank-exec"
+version = "0.1.0"
+edition = "2021"
+description = "Shared dynamic-execution logic: soft-PLC provisioning + industrial-protocol probing, used by the compliance agent and the Werkbank runner."
+
+[lints]
+workspace = true
+
+[dependencies]
+compliance-core = { workspace = true }
+compliance-dast = { path = "../compliance-dast" }
+tokio = { workspace = true }
+reqwest = { workspace = true }
+uuid = { workspace = true }
+regex = { workspace = true }
+secrecy = { workspace = true }
+sha2 = { workspace = true }
+hex = { workspace = true }
+tracing = { workspace = true }
+thiserror = { workspace = true }
+walkdir = "2"
+futures-util = "0.3"

werkbank-exec/src/error.rs

@@ -0,0 +1,16 @@
+//! Error type for the dynamic-execution logic.
+
+/// Anything that can go wrong provisioning and testing a soft-PLC. The compliance
+/// agent maps this into its own `AgentError` at the call boundary.
+#[derive(thiserror::Error, Debug)]
+pub enum ExecError {
+    /// An HTTP request (to OpenPLC) failed.
+    #[error("HTTP error: {0}")]
+    Http(#[from] reqwest::Error),
+    /// A local IO / process error (e.g. invoking `docker`).
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+    /// Any other failure, with a message.
+    #[error("{0}")]
+    Other(String),
+}

werkbank-exec/src/fingerprint.rs

@@ -0,0 +1,32 @@
+//! Finding fingerprint helper (a SHA-256 over the salient parts), shared by the
+//! probe modules for stable dedup keys. Mirrors the agent's `dedup` helper.
+
+use sha2::{Digest, Sha256};
+
+/// A stable fingerprint over the given parts (order-sensitive, separated so
+/// `["ab","c"]` and `["a","bc"]` differ).
+pub fn compute_fingerprint(parts: &[&str]) -> String {
+    let mut hasher = Sha256::new();
+    for part in parts {
+        hasher.update(part.as_bytes());
+        hasher.update(b"|");
+    }
+    hex::encode(hasher.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn deterministic_and_hex() {
+        let a = compute_fingerprint(&["repo", "rule", "1"]);
+        assert_eq!(a, compute_fingerprint(&["repo", "rule", "1"]));
+        assert_eq!(a.len(), 64);
+        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
+        assert_ne!(
+            compute_fingerprint(&["ab", "c"]),
+            compute_fingerprint(&["a", "bc"])
+        );
+    }
+}

werkbank-exec/src/ics/mod.rs

@@ -14,7 +14,7 @@ use std::time::Duration;
 
 use compliance_core::models::{Finding, ScanType, Severity};
 
-use crate::pipeline::dedup;
+use crate::fingerprint as dedup;
 
 /// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
 const MODBUS_PORT: u16 = 502;
@@ -103,6 +103,39 @@ async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration)
         );
         findings.push(f);
     }
+
+    // Exposed process points: coils / holding registers that a read enumerated
+    // and that, over unauthenticated Modbus/TCP, are also writable. This is the
+    // concrete attack surface behind the exposure — the live variables an
+    // attacker can overwrite. (Read-only to detect: we never write.)
+    let coils = probe.coils_readable.unwrap_or(0);
+    let registers = probe.holding_registers_readable.unwrap_or(0);
+    if coils > 0 || registers > 0 {
+        let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed-points", &target]);
+        let mut f = Finding::new(
+            repo_id.to_string(),
+            fp,
+            "ics-probe".to_string(),
+            ScanType::IcsProbe,
+            "Writable process points exposed over unauthenticated Modbus/TCP".to_string(),
+            format!(
+                "Reading the device at {target} enumerated {coils} coil(s) and {registers} \
+                 holding register(s). Coils and holding registers are read/write process points \
+                 in Modbus, so any host that can reach this port can not only read but overwrite \
+                 live process state (force coils, change setpoints) without authentication."
+            ),
+            Severity::High,
+        );
+        f.rule_id = Some("ics-modbus-exposed-points".to_string());
+        f.cwe = Some("CWE-306".to_string());
+        f.remediation = Some(
+            "Segment the Modbus/TCP port to a trusted control network; where the device \
+             supports it use Modbus/TLS or an authenticating protocol gateway; restrict which \
+             function codes and register ranges are reachable from outside the control zone."
+                .to_string(),
+        );
+        findings.push(f);
+    }
     findings
 }
 

werkbank-exec/src/ics/modbus.rs

@@ -21,6 +21,13 @@ pub struct ModbusProbe {
     pub speaks_modbus: bool,
     /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
     pub device: Option<DeviceId>,
+    /// Coils returned by a Read Coils of the first block, if that address range
+    /// exists. Coils are read/write process bits, so an exposed block is an
+    /// unauthenticated write surface on the live process.
+    pub coils_readable: Option<u16>,
+    /// Holding registers returned by a Read Holding Registers of the first block,
+    /// if that range exists. Holding registers are read/write process words.
+    pub holding_registers_readable: Option<u16>,
 }
 
 /// Vendor / product / revision from Read Device Identification.
@@ -31,8 +38,13 @@ pub struct DeviceId {
     pub revision: Option<String>,
 }
 
-/// Probe a Modbus/TCP endpoint. Read-only: issues a Read Holding Registers and a
-/// Read Device Identification request; never writes to the device.
+/// How many coils / holding registers to request when enumerating the exposed
+/// process surface. Read-only: a normal reply means the block exists and is,
+/// over unauthenticated Modbus/TCP, also writable.
+const ENUM_QTY: u16 = 16;
+
+/// Probe a Modbus/TCP endpoint. Read-only: issues Read Holding Registers, Read
+/// Coils, and Read Device Identification requests; never writes to the device.
 pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
     let mut out = ModbusProbe::default();
     let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
@@ -40,13 +52,28 @@ pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
     };
     out.reachable = true;
 
-    // Read Holding Registers (FC 0x03), unit 1, addr 0, qty 1 — a benign read.
-    let rhr = [0x03u8, 0x00, 0x00, 0x00, 0x01];
+    // Read Holding Registers (FC 0x03), unit 1, addr 0 — a benign read that also
+    // enumerates the exposed register block.
+    let rhr = [0x03u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
     if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
         // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
         if matches!(resp.first(), Some(0x03) | Some(0x83)) {
             out.speaks_modbus = true;
         }
+        if resp.first() == Some(&0x03) {
+            out.holding_registers_readable = Some(register_count_from_reply(&resp));
+        }
+    }
+
+    // Read Coils (FC 0x01), addr 0 — enumerates the exposed coil (bit) block.
+    let rc = [0x01u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
+    if let Some(resp) = txn(&mut stream, 1, &rc, budget).await {
+        if matches!(resp.first(), Some(0x01) | Some(0x81)) {
+            out.speaks_modbus = true;
+        }
+        if resp.first() == Some(&0x01) {
+            out.coils_readable = Some(coil_count_from_reply(&resp));
+        }
     }
 
     // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
@@ -60,6 +87,17 @@ pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
     out
 }
 
+/// Coils reported by a Read Coils reply `[0x01, byte_count, data…]` (8 per byte).
+fn coil_count_from_reply(pdu: &[u8]) -> u16 {
+    pdu.get(1).map(|&b| u16::from(b) * 8).unwrap_or(0)
+}
+
+/// Registers reported by a Read Holding Registers reply `[0x03, byte_count,
+/// data…]` (2 bytes per register).
+fn register_count_from_reply(pdu: &[u8]) -> u16 {
+    pdu.get(1).map(|&b| u16::from(b) / 2).unwrap_or(0)
+}
+
 /// Send one Modbus PDU and return the response PDU (function code + data), or
 /// `None` on timeout / malformed reply.
 async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
@@ -154,7 +192,8 @@ mod tests {
                     break;
                 }
                 let reply_pdu: Vec<u8> = match pdu.first() {
-                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register = 0
+                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register (byte_count 2)
+                    Some(0x01) => vec![0x01, 0x02, 0xFF, 0xFF], // 16 coils (byte_count 2)
                     Some(0x2B) if with_device => vec![
                         0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
                         0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
@@ -185,6 +224,24 @@ mod tests {
         assert_eq!(dev.product.as_deref(), Some("PLC"));
     }
 
+    #[tokio::test]
+    async fn probe_enumerates_exposed_process_points() {
+        let addr = mock_server(false).await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.speaks_modbus);
+        // The mock returns a 2-byte holding-register block (1 register) and a
+        // 2-byte coil block (16 coils).
+        assert_eq!(p.holding_registers_readable, Some(1));
+        assert_eq!(p.coils_readable, Some(16));
+    }
+
+    #[test]
+    fn reply_counts_decode_byte_counts() {
+        assert_eq!(register_count_from_reply(&[0x03, 0x08]), 4); // 8 bytes → 4 regs
+        assert_eq!(coil_count_from_reply(&[0x01, 0x03]), 24); // 3 bytes → 24 coils
+        assert_eq!(register_count_from_reply(&[0x03]), 0); // malformed → 0
+    }
+
     #[tokio::test]
     async fn probe_reports_unreachable_for_a_closed_port() {
         // 127.0.0.1:1 is (almost certainly) closed.

werkbank-exec/src/lib.rs

@@ -0,0 +1,18 @@
+//! Shared dynamic-execution logic for Werkbank.
+//!
+//! The soft-PLC provisioning + industrial-protocol probing that turns a control-
+//! logic artifact into findings: provision an ephemeral OpenPLC, load the program,
+//! start it, probe it over Modbus/OPC-UA/EtherNet-IP, DAST its web endpoint, tear
+//! it down. Extracted from the compliance agent (#183) so both the agent (in
+//! process) and the Werkbank runner (WB-04) run identical logic.
+//!
+//! - [`ics`] — read-only industrial-protocol probing.
+//! - [`plc`] — ephemeral soft-PLC provisioning + the provision-and-test loop.
+
+pub mod error;
+pub mod ics;
+pub mod plc;
+
+mod fingerprint;
+
+pub use error::ExecError;

werkbank-exec/src/plc/mod.rs

@@ -0,0 +1,422 @@
+//! Dynamic PLC testing via an ephemeral soft-PLC (#183).
+//!
+//! When a PLC/SPS target ships control logic but no reachable live device, the
+//! agent instantiates that logic itself instead of trying to reach the customer's
+//! OT network: it provisions a throwaway soft-PLC (OpenPLC) container in-cluster,
+//! loads the program, starts the runtime, probes it over industrial protocols,
+//! then tears the instance down. No customer network access, sandboxed, and
+//! reproducible — destructive tests become safe because the target is ours.
+//!
+//! - [`provision`] owns the container lifecycle (sub-task 1 + 5).
+//! - [`openplc`] loads the program into the running instance (sub-task 2).
+//! - [`provision_and_test`] composes them with a hard deadline and guaranteed
+//!   teardown, and runs the ICS probe against the provisioned endpoint.
+
+pub mod openplc;
+pub mod provision;
+
+use std::path::Path;
+use std::time::Duration;
+
+use secrecy::ExposeSecret;
+
+use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
+use compliance_core::models::Finding;
+use compliance_core::PlcRuntimeConfig;
+
+use crate::error::ExecError;
+
+pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
+
+/// The result of a DAST scan against a provisioned web endpoint.
+#[derive(Debug)]
+pub struct DastRunResult {
+    /// The scan-run record (linked to the onboarded target).
+    pub scan_run: DastScanRun,
+    /// The DAST findings.
+    pub findings: Vec<DastFinding>,
+}
+
+/// Everything a provision-and-test run produced: the ICS-probe findings plus, if
+/// it ran, the DAST scan of the provisioned web endpoint. The caller persists
+/// both — keeping this a plain data return means the whole run is portable to a
+/// remote execution backend that just hands the results back.
+#[derive(Debug, Default)]
+pub struct ProvisionOutcome {
+    /// ICS-probe findings from the provisioned Modbus endpoint.
+    pub findings: Vec<Finding>,
+    /// DAST scan of the provisioned web endpoint, if it ran.
+    pub dast: Option<DastRunResult>,
+}
+
+/// A control-logic program ready to load into a soft-PLC: the source text plus a
+/// cosmetic file name (OpenPLC re-stores it under its own name).
+#[derive(Debug, Clone)]
+pub struct PlcProgram {
+    /// The original file name (for the upload form; OpenPLC renames on storage).
+    pub file_name: String,
+    /// The program source — Structured Text or PLCopen XML.
+    pub source: String,
+}
+
+/// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
+/// isolates the OpenPLC session (its Flask login cookie) from every other scan.
+pub fn http_client() -> Result<reqwest::Client, ExecError> {
+    reqwest::Client::builder()
+        .cookie_store(true)
+        .timeout(Duration::from_secs(30))
+        .build()
+        .map_err(ExecError::Http)
+}
+
+/// Pick the control-logic program to run from an ingested PLC source tree.
+///
+/// OpenPLC runs one program, so we choose the best single candidate: a complete
+/// Structured Text program (one carrying a `CONFIGURATION` block) is ideal;
+/// failing that the largest ST file; failing that a PLCopen XML export. Returns
+/// `None` when the tree holds no loadable control logic.
+pub fn extract_program(root: &Path) -> Option<PlcProgram> {
+    let mut st: Vec<(String, String)> = Vec::new();
+    let mut xml: Vec<(String, String)> = Vec::new();
+    for entry in walkdir::WalkDir::new(root)
+        .into_iter()
+        .filter_map(Result::ok)
+    {
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        let path = entry.path();
+        let ext = path
+            .extension()
+            .and_then(|e| e.to_str())
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
+        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
+        if !is_st && !is_xml {
+            continue;
+        }
+        let Ok(content) = std::fs::read_to_string(path) else {
+            continue;
+        };
+        let name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("program")
+            .to_string();
+        if is_st {
+            st.push((name, content));
+        } else if looks_like_plcopen(&content) {
+            xml.push((name, content));
+        }
+    }
+
+    if let Some((name, source)) = st.iter().find(|(_, c)| has_configuration(c)) {
+        return Some(PlcProgram {
+            file_name: name.clone(),
+            source: source.clone(),
+        });
+    }
+    if let Some((name, source)) = st.iter().max_by_key(|(_, c)| c.len()) {
+        return Some(PlcProgram {
+            file_name: name.clone(),
+            source: source.clone(),
+        });
+    }
+    xml.into_iter()
+        .max_by_key(|(_, c)| c.len())
+        .map(|(file_name, source)| PlcProgram { file_name, source })
+}
+
+/// Whether an ST source is a complete, runnable program (has a `CONFIGURATION`).
+fn has_configuration(source: &str) -> bool {
+    source.to_ascii_uppercase().contains("CONFIGURATION")
+}
+
+/// Whether an XML file looks like a PLCopen project export.
+fn looks_like_plcopen(source: &str) -> bool {
+    let lower = source.to_ascii_lowercase();
+    lower.contains("<project") || lower.contains("plcopen")
+}
+
+/// Provision an ephemeral soft-PLC, load `program`, start it, probe it over
+/// industrial protocols, and tear it down. Returns the ICS-probe findings.
+///
+/// Teardown is guaranteed: the load/probe work runs under a hard deadline
+/// (`max_lifetime_secs`) and the instance is removed afterwards on every path —
+/// success, error, or deadline expiry.
+pub async fn provision_and_test<P: SoftPlc>(
+    provisioner: &P,
+    http: &reqwest::Client,
+    cfg: &PlcRuntimeConfig,
+    program: &PlcProgram,
+    target_id: &str,
+) -> Result<ProvisionOutcome, ExecError> {
+    let handle = provisioner.provision(target_id).await?;
+    tracing::info!(
+        target_id,
+        instance = %handle.name,
+        modbus = %handle.modbus_endpoint,
+        "provisioned ephemeral soft-PLC"
+    );
+
+    let deadline = Duration::from_secs(cfg.max_lifetime_secs);
+    let result = tokio::time::timeout(
+        deadline,
+        run_dynamic_test(http, cfg, program, target_id, &handle),
+    )
+    .await;
+
+    // Guaranteed teardown — runs on success, error, and deadline expiry. The
+    // inner future is panic-free (the workspace lint bans unwrap/expect), so no
+    // unwind can skip this; a container leaked by an agent *crash* is swept by
+    // the next run's stale reaper.
+    provisioner.teardown(&handle).await;
+
+    match result {
+        Ok(inner) => inner,
+        Err(_) => {
+            tracing::warn!(
+                target_id,
+                instance = %handle.name,
+                "provision-and-test hit the lifetime deadline; torn down"
+            );
+            Ok(ProvisionOutcome::default())
+        }
+    }
+}
+
+/// The load → start → probe → DAST body, run under the caller's deadline.
+async fn run_dynamic_test(
+    http: &reqwest::Client,
+    cfg: &PlcRuntimeConfig,
+    program: &PlcProgram,
+    target_id: &str,
+    handle: &ProvisionedRuntime,
+) -> Result<ProvisionOutcome, ExecError> {
+    let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
+    openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
+
+    let compile_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
+    openplc::load_and_start(
+        http,
+        &handle.webvisu_url,
+        &cfg.openplc_user,
+        cfg.openplc_password.expose_secret(),
+        program,
+        compile_budget,
+    )
+    .await?;
+
+    // Give the runtime a moment to open the Modbus/TCP server before probing.
+    tokio::time::sleep(Duration::from_secs(3)).await;
+
+    let probe_budget = Duration::from_secs(5);
+    let findings = crate::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
+    tracing::info!(
+        target_id,
+        instance = %handle.name,
+        found = findings.len(),
+        "provision-and-test probe complete"
+    );
+
+    // DAST the provisioned web endpoint (independently bounded so it can't eat
+    // the whole lifetime). On the OpenPLC substrate this is OpenPLC's own web UI,
+    // not a customer HMI — the CODESYS-runtime follow-up raises the fidelity —
+    // but it proves the deploy→run→probe→DAST loop end to end.
+    let dast_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
+    let dast = match tokio::time::timeout(dast_budget, run_webvisu_dast(handle, target_id)).await {
+        Ok(d) => d,
+        Err(_) => {
+            tracing::warn!(target_id, instance = %handle.name, "provision-and-test DAST timed out");
+            None
+        }
+    };
+
+    Ok(ProvisionOutcome { findings, dast })
+}
+
+/// Run a bounded DAST scan against the provisioned web endpoint and tag the
+/// results with our target id. Best-effort — a DAST failure never fails the run.
+async fn run_webvisu_dast(handle: &ProvisionedRuntime, target_id: &str) -> Option<DastRunResult> {
+    let mut dt = DastTarget::new(
+        "provisioned-webvisu".to_string(),
+        handle.webvisu_url.clone(),
+        DastTargetType::WebApp,
+    );
+    dt.repo_id = Some(target_id.to_string());
+    dt.max_crawl_depth = 2; // shallow — the instance is ephemeral
+
+    let orchestrator = compliance_dast::DastOrchestrator::new(100);
+    match orchestrator.run_scan(&dt, Vec::new()).await {
+        Ok((mut scan_run, mut findings)) => {
+            scan_run.target_id = target_id.to_string();
+            for f in &mut findings {
+                f.target_id = target_id.to_string();
+            }
+            tracing::info!(
+                target_id,
+                instance = %handle.name,
+                dast_findings = findings.len(),
+                "provision-and-test DAST complete"
+            );
+            Some(DastRunResult { scan_run, findings })
+        }
+        Err(e) => {
+            tracing::warn!(target_id, instance = %handle.name, error = %e, "provision-and-test DAST failed");
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
+
+    /// A scratch dir removed on drop.
+    struct Scratch(std::path::PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-plc-rt-{}", uuid::Uuid::new_v4()));
+            std::fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn extract_prefers_a_complete_st_program() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("fragment.st"), "PROGRAM P\nEND_PROGRAM\n").expect("w");
+        std::fs::write(
+            s.0.join("full.st"),
+            "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION Config0\n  RESOURCE R\nEND_CONFIGURATION\n",
+        )
+        .expect("w");
+        let prog = extract_program(&s.0).expect("program");
+        assert_eq!(prog.file_name, "full.st");
+        assert!(prog.source.contains("CONFIGURATION"));
+    }
+
+    #[test]
+    fn extract_falls_back_to_largest_st_then_plcopen() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("small.st"), "PROGRAM A\nEND_PROGRAM\n").expect("w");
+        std::fs::write(
+            s.0.join("big.st"),
+            "PROGRAM B\nVAR x : INT; y : INT; z : INT; END_VAR\nEND_PROGRAM\n",
+        )
+        .expect("w");
+        let prog = extract_program(&s.0).expect("program");
+        assert_eq!(
+            prog.file_name, "big.st",
+            "largest ST wins when none complete"
+        );
+
+        // Only a PLCopen XML present.
+        let s2 = Scratch::new();
+        std::fs::write(
+            s2.0.join("proj.xml"),
+            "<?xml version='1.0'?><project xmlns='http://www.plcopen.org/xml/tc6_0201'><pou/></project>",
+        )
+        .expect("w");
+        let prog2 = extract_program(&s2.0).expect("program");
+        assert_eq!(prog2.file_name, "proj.xml");
+    }
+
+    #[test]
+    fn extract_returns_none_without_control_logic() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("readme.md"), "# not a plc program").expect("w");
+        std::fs::write(s.0.join("data.xml"), "<config><db/></config>").expect("w");
+        assert!(extract_program(&s.0).is_none());
+    }
+
+    /// A fake provisioner recording provision/teardown calls, for lifecycle tests.
+    struct FakeSoftPlc {
+        provisions: Arc<AtomicUsize>,
+        teardowns: Arc<AtomicUsize>,
+        fail_provision: bool,
+    }
+
+    impl SoftPlc for FakeSoftPlc {
+        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
+            self.provisions.fetch_add(1, Ordering::SeqCst);
+            if self.fail_provision {
+                return Err(ExecError::Other("provision failed".into()));
+            }
+            // Unreachable address so run_dynamic_test blocks on readiness until the
+            // deadline fires — exercising the teardown-on-deadline path.
+            Ok(ProvisionedRuntime {
+                name: "fake-plc".into(),
+                modbus_endpoint: "fake-plc:502".into(),
+                webvisu_url: "http://fake-plc.invalid:8080".into(),
+            })
+        }
+        async fn teardown(&self, _handle: &ProvisionedRuntime) {
+            self.teardowns.fetch_add(1, Ordering::SeqCst);
+        }
+    }
+
+    fn short_cfg() -> PlcRuntimeConfig {
+        PlcRuntimeConfig {
+            enabled: true,
+            max_lifetime_secs: 1, // keep the deadline path fast
+            ..PlcRuntimeConfig::default()
+        }
+    }
+
+    #[tokio::test]
+    async fn teardown_runs_even_when_the_test_never_completes() {
+        let provisions = Arc::new(AtomicUsize::new(0));
+        let teardowns = Arc::new(AtomicUsize::new(0));
+        let fake = FakeSoftPlc {
+            provisions: provisions.clone(),
+            teardowns: teardowns.clone(),
+            fail_provision: false,
+        };
+        let http = http_client().expect("client");
+        let prog = PlcProgram {
+            file_name: "p.st".into(),
+            source: "PROGRAM P\nEND_PROGRAM\n".into(),
+        };
+        let out = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1")
+            .await
+            .expect("ok on deadline");
+        assert!(out.findings.is_empty(), "deadline path yields no findings");
+        assert!(out.dast.is_none(), "deadline path runs no DAST");
+        assert_eq!(provisions.load(Ordering::SeqCst), 1);
+        assert_eq!(teardowns.load(Ordering::SeqCst), 1, "teardown must run");
+    }
+
+    #[tokio::test]
+    async fn provision_failure_propagates_and_skips_teardown() {
+        let provisions = Arc::new(AtomicUsize::new(0));
+        let teardowns = Arc::new(AtomicUsize::new(0));
+        let fake = FakeSoftPlc {
+            provisions: provisions.clone(),
+            teardowns: teardowns.clone(),
+            fail_provision: true,
+        };
+        let http = http_client().expect("client");
+        let prog = PlcProgram {
+            file_name: "p.st".into(),
+            source: String::new(),
+        };
+        let err = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1").await;
+        assert!(err.is_err(), "provision failure propagates");
+        assert_eq!(provisions.load(Ordering::SeqCst), 1);
+        assert_eq!(
+            teardowns.load(Ordering::SeqCst),
+            0,
+            "nothing to tear down when provisioning failed"
+        );
+    }
+}

werkbank-exec/src/plc/openplc.rs

@@ -0,0 +1,254 @@
+//! Loading a control-logic program into a provisioned OpenPLC (#183, sub-task 2).
+//!
+//! Drives the OpenPLC v3 web UI over HTTP to turn a static control-logic artifact
+//! into a *running* PLC: log in, upload the program, save it, compile it (MatIEC),
+//! and start the runtime — at which point OpenPLC opens its Modbus/TCP server on
+//! 502 and the ICS probe has something to talk to. The endpoint sequence mirrors
+//! the OpenPLC web UI: `POST /login` → `POST /upload-program` (which hands back a
+//! server-assigned `prog_file`) → `POST /upload-program-action` →
+//! `GET /compile-program?file=<prog_file>` → `GET /start_plc`.
+
+use std::time::Duration;
+
+use crate::error::ExecError;
+
+use super::PlcProgram;
+
+/// Default OpenPLC program name/description recorded in its UI.
+const PROG_NAME: &str = "certifai-provisioned";
+const PROG_DESCR: &str = "Uploaded by the Certifai provision-and-test scan";
+
+/// Poll interval while waiting for readiness / compilation.
+const POLL_INTERVAL: Duration = Duration::from_secs(2);
+
+/// Wait until the OpenPLC web UI answers (any non-5xx reply to `/login`), or the
+/// budget elapses. A freshly-started container needs a few seconds to boot.
+pub async fn wait_ready(
+    http: &reqwest::Client,
+    base_url: &str,
+    budget: Duration,
+) -> Result<(), ExecError> {
+    let login = format!("{base_url}/login");
+    let outcome = tokio::time::timeout(budget, async {
+        loop {
+            if let Ok(resp) = http.get(&login).send().await {
+                if !resp.status().is_server_error() {
+                    return;
+                }
+            }
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    })
+    .await;
+    outcome.map_err(|_| ExecError::Other(format!("OpenPLC at {base_url} did not become ready")))
+}
+
+/// Log in, upload the program, compile it, and start the runtime. On success the
+/// OpenPLC Modbus/TCP server is listening on 502.
+pub async fn load_and_start(
+    http: &reqwest::Client,
+    base_url: &str,
+    user: &str,
+    password: &str,
+    program: &PlcProgram,
+    compile_budget: Duration,
+) -> Result<(), ExecError> {
+    login(http, base_url, user, password).await?;
+    let prog_file = upload_program(http, base_url, program).await?;
+    save_program(http, base_url, &prog_file).await?;
+    compile(http, base_url, &prog_file, compile_budget).await?;
+    start(http, base_url).await?;
+    Ok(())
+}
+
+/// `POST /login` — establishes the session cookie (the client must have a cookie
+/// store; see the provision-and-test entry point).
+async fn login(
+    http: &reqwest::Client,
+    base_url: &str,
+    user: &str,
+    password: &str,
+) -> Result<(), ExecError> {
+    let resp = http
+        .post(format!("{base_url}/login"))
+        .form(&[("username", user), ("password", password)])
+        .send()
+        .await?;
+    if resp.status().is_server_error() {
+        return Err(ExecError::Other(format!(
+            "OpenPLC login failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// `POST /upload-program` (multipart `file`) — OpenPLC stores the program under a
+/// server-assigned name and returns it in a hidden `prog_file` form field, which
+/// we parse out for the follow-up save/compile steps.
+async fn upload_program(
+    http: &reqwest::Client,
+    base_url: &str,
+    program: &PlcProgram,
+) -> Result<String, ExecError> {
+    let part = reqwest::multipart::Part::text(program.source.clone())
+        .file_name(program.file_name.clone())
+        .mime_str("application/octet-stream")?;
+    let form = reqwest::multipart::Form::new().part("file", part);
+    let resp = http
+        .post(format!("{base_url}/upload-program"))
+        .multipart(form)
+        .send()
+        .await?;
+    let html = resp.text().await?;
+    parse_prog_file(&html).ok_or_else(|| {
+        ExecError::Other("OpenPLC upload did not return a prog_file handle".to_string())
+    })
+}
+
+/// `POST /upload-program-action` — records the uploaded program in OpenPLC's
+/// program list. `epoch_time` must be close to the server's clock (OpenPLC
+/// rejects stale timestamps), so we send the current time.
+async fn save_program(
+    http: &reqwest::Client,
+    base_url: &str,
+    prog_file: &str,
+) -> Result<(), ExecError> {
+    let epoch = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+        .to_string();
+    let resp = http
+        .post(format!("{base_url}/upload-program-action"))
+        .form(&[
+            ("prog_name", PROG_NAME),
+            ("prog_descr", PROG_DESCR),
+            ("prog_file", prog_file),
+            ("epoch_time", &epoch),
+        ])
+        .send()
+        .await?;
+    if resp.status().is_server_error() {
+        return Err(ExecError::Other(format!(
+            "OpenPLC save-program failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// `GET /compile-program?file=<prog_file>` then poll `/compilation-logs` until
+/// MatIEC reports it finished (or the budget elapses). Errors if compilation
+/// finishes with errors — a program that won't compile can't be started.
+async fn compile(
+    http: &reqwest::Client,
+    base_url: &str,
+    prog_file: &str,
+    budget: Duration,
+) -> Result<(), ExecError> {
+    http.get(format!("{base_url}/compile-program"))
+        .query(&[("file", prog_file)])
+        .send()
+        .await?;
+
+    let logs_url = format!("{base_url}/compilation-logs");
+    let outcome = tokio::time::timeout(budget, async {
+        loop {
+            if let Ok(resp) = http.get(&logs_url).send().await {
+                if let Ok(text) = resp.text().await {
+                    if compilation_finished(&text) {
+                        return !compilation_failed(&text);
+                    }
+                }
+            }
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    })
+    .await;
+    match outcome {
+        Ok(true) => Ok(()),
+        Ok(false) => Err(ExecError::Other(
+            "OpenPLC compilation finished with errors".to_string(),
+        )),
+        Err(_) => Err(ExecError::Other(
+            "OpenPLC compilation did not finish in time".to_string(),
+        )),
+    }
+}
+
+/// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
+async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), ExecError> {
+    let resp = http.get(format!("{base_url}/start_plc")).send().await?;
+    if resp.status().is_server_error() {
+        return Err(ExecError::Other(format!(
+            "OpenPLC start_plc failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// Extract the server-assigned `prog_file` from the `/upload-program` response,
+/// which embeds it in a hidden input. Attribute order varies, so accept both
+/// `value=… name='prog_file'` and `name='prog_file' … value=…`.
+fn parse_prog_file(html: &str) -> Option<String> {
+    // The OpenPLC template renders `value='<name>.st' id='prog_file'
+    // name='prog_file'`. Match the value bound to that input, either order.
+    let value_then_name =
+        regex::Regex::new(r#"(?is)value=['"]([^'"]+)['"][^>]*name=['"]prog_file['"]"#).ok()?;
+    if let Some(c) = value_then_name.captures(html) {
+        return c.get(1).map(|m| m.as_str().to_string());
+    }
+    let name_then_value =
+        regex::Regex::new(r#"(?is)name=['"]prog_file['"][^>]*value=['"]([^'"]+)['"]"#).ok()?;
+    name_then_value
+        .captures(html)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().to_string())
+}
+
+/// Whether the MatIEC compilation log shows the build has finished (either way).
+fn compilation_finished(log: &str) -> bool {
+    log.contains("Compilation finished")
+}
+
+/// Whether a finished compilation ended in failure.
+fn compilation_failed(log: &str) -> bool {
+    log.contains("Compilation finished with errors")
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_prog_file_value_then_name() {
+        let html = "<form><input type='hidden' value='483927.st' id='prog_file' \
+                    name='prog_file'/></form>";
+        assert_eq!(parse_prog_file(html), Some("483927.st".to_string()));
+    }
+
+    #[test]
+    fn parses_prog_file_name_then_value() {
+        let html = r#"<input name="prog_file" id="prog_file" value="12.st" />"#;
+        assert_eq!(parse_prog_file(html), Some("12.st".to_string()));
+    }
+
+    #[test]
+    fn parse_prog_file_none_when_absent() {
+        assert_eq!(parse_prog_file("<html>no form here</html>"), None);
+    }
+
+    #[test]
+    fn compilation_predicates() {
+        assert!(!compilation_finished("Compiling..."));
+        assert!(compilation_finished(
+            "...\nCompilation finished successfully!\n"
+        ));
+        assert!(compilation_finished("Compilation finished with errors!"));
+        assert!(compilation_failed("Compilation finished with errors!"));
+        assert!(!compilation_failed("Compilation finished successfully!"));
+    }
+}

werkbank-exec/src/plc/provision.rs

@@ -0,0 +1,306 @@
+//! Ephemeral soft-PLC container lifecycle (#183, sub-task 1 + 5).
+//!
+//! Provisions a throwaway OpenPLC container per scan, isolated on the agent's own
+//! Docker network with hard resource caps and **no host port exposure**, then
+//! guarantees teardown. The container is reachable in-cluster only, by its name
+//! (the shared user-defined network's embedded DNS resolves it); it is never
+//! published to the host.
+//!
+//! The `docker` argv is produced by pure functions so provisioning is unit-tested
+//! without a Docker daemon — only the thin [`run_docker`] wrapper touches the OS.
+//! It requires the agent's runtime to have Docker access (a socket mount), which
+//! is why the whole path is gated behind [`PlcRuntimeConfig::enabled`].
+
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use compliance_core::PlcRuntimeConfig;
+
+use crate::error::ExecError;
+
+/// The Modbus/TCP port an OpenPLC instance opens once a program is running.
+const MODBUS_PORT: u16 = 502;
+/// The OpenPLC web-UI / WebVisu port.
+const WEBVISU_PORT: u16 = 8080;
+
+/// Label key marking a container as an ephemeral PLC runtime we own.
+const OWNER_LABEL_KEY: &str = "certifai.ephemeral";
+/// Label value for our ephemeral PLC runtimes.
+const OWNER_LABEL_VALUE: &str = "plc-runtime";
+
+/// A running ephemeral soft-PLC instance. Reachable in-cluster by `name`.
+#[derive(Debug, Clone)]
+pub struct ProvisionedRuntime {
+    /// The container name — also its in-network DNS alias.
+    pub name: String,
+    /// `name:502` — the Modbus/TCP endpoint the ICS probe targets.
+    pub modbus_endpoint: String,
+    /// `http://name:8080` — the WebVisu / OpenPLC web UI.
+    pub webvisu_url: String,
+}
+
+/// A source of ephemeral soft-PLC instances. Abstracted so the provision-and-test
+/// orchestration is unit-testable with a fake that never touches Docker.
+pub trait SoftPlc {
+    /// Start a fresh instance for a target and return its handle.
+    fn provision(
+        &self,
+        target_id: &str,
+    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, ExecError>> + Send;
+
+    /// Tear an instance down. Best-effort and idempotent — never fails the scan.
+    fn teardown(&self, handle: &ProvisionedRuntime)
+        -> impl std::future::Future<Output = ()> + Send;
+}
+
+/// Provisions OpenPLC instances by shelling out to the Docker CLI.
+pub struct DockerSoftPlc {
+    cfg: PlcRuntimeConfig,
+}
+
+impl DockerSoftPlc {
+    /// Build a provisioner from the PLC-runtime config.
+    pub fn new(cfg: PlcRuntimeConfig) -> Self {
+        Self { cfg }
+    }
+}
+
+impl SoftPlc for DockerSoftPlc {
+    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
+        // Best-effort sweep of any container leaked by a crashed earlier run
+        // before we add another. Only removes instances past their max lifetime,
+        // so it can never disturb a concurrent run.
+        reap_stale(&self.cfg, now_epoch()).await;
+
+        let name = instance_name(target_id, now_epoch(), &random_suffix());
+        let args = run_args(&self.cfg, &name, target_id);
+        let out = run_docker(&args).await?;
+        if !out.status.success() {
+            return Err(ExecError::Other(format!(
+                "docker run for soft-PLC {name} failed: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            )));
+        }
+        Ok(ProvisionedRuntime {
+            modbus_endpoint: format!("{name}:{MODBUS_PORT}"),
+            webvisu_url: format!("http://{name}:{WEBVISU_PORT}"),
+            name,
+        })
+    }
+
+    async fn teardown(&self, handle: &ProvisionedRuntime) {
+        match run_docker(&rm_args(&handle.name)).await {
+            Ok(out) if out.status.success() => {
+                tracing::info!(instance = %handle.name, "soft-PLC instance torn down");
+            }
+            Ok(out) => tracing::warn!(
+                instance = %handle.name,
+                "soft-PLC teardown non-zero exit: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            ),
+            Err(e) => {
+                tracing::warn!(instance = %handle.name, error = %e, "soft-PLC teardown failed")
+            }
+        }
+    }
+}
+
+/// Seconds since the Unix epoch (0 if the clock is before 1970, which never
+/// happens in practice).
+fn now_epoch() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+/// A short random, docker-name-safe suffix.
+fn random_suffix() -> String {
+    uuid::Uuid::new_v4().simple().to_string()
+}
+
+/// A unique, docker-safe container name that encodes the creation epoch (for the
+/// stale reaper) and the target it belongs to. Shape:
+/// `certifai-plc-<epoch>-<target12>-<rand6>`.
+fn instance_name(target_id: &str, epoch: u64, rand: &str) -> String {
+    let short: String = target_id
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .take(12)
+        .collect();
+    let rand: String = rand
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .take(6)
+        .collect();
+    format!("certifai-plc-{epoch}-{short}-{rand}")
+}
+
+/// The creation epoch encoded in an instance name, if it is one of ours.
+fn parse_epoch(name: &str) -> Option<u64> {
+    name.strip_prefix("certifai-plc-")?
+        .split('-')
+        .next()?
+        .parse()
+        .ok()
+}
+
+/// The `docker run` argv for an ephemeral soft-PLC: detached, joined to the
+/// agent's network, resource-capped, hardened, labelled for reaping, and — by
+/// omitting any `-p` — never published to the host.
+fn run_args(cfg: &PlcRuntimeConfig, name: &str, target_id: &str) -> Vec<String> {
+    vec![
+        "run".into(),
+        "-d".into(),
+        "--name".into(),
+        name.into(),
+        "--network".into(),
+        cfg.network.clone(),
+        "--memory".into(),
+        cfg.memory.clone(),
+        "--cpus".into(),
+        cfg.cpus.clone(),
+        "--pids-limit".into(),
+        "512".into(),
+        "--security-opt".into(),
+        "no-new-privileges".into(),
+        "--stop-timeout".into(),
+        "5".into(),
+        "--label".into(),
+        format!("{OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
+        "--label".into(),
+        format!("certifai.target={target_id}"),
+        cfg.image.clone(),
+    ]
+}
+
+/// The `docker rm -f` argv that stops and removes an instance.
+fn rm_args(name: &str) -> Vec<String> {
+    vec!["rm".into(), "-f".into(), name.into()]
+}
+
+/// The `docker ps` argv listing the names of every ephemeral PLC container we own.
+fn reap_list_args() -> Vec<String> {
+    vec![
+        "ps".into(),
+        "-a".into(),
+        "--filter".into(),
+        format!("label={OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
+        "--format".into(),
+        "{{.Names}}".into(),
+    ]
+}
+
+/// Remove any ephemeral PLC container older than twice the configured max
+/// lifetime — i.e. one a crashed run leaked. The generous threshold guarantees a
+/// container from a *live* run (still within its own deadline) is never swept.
+/// Best-effort: any Docker error (e.g. no daemon) is ignored.
+async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
+    let cutoff = cfg.max_lifetime_secs.saturating_mul(2);
+    let Ok(out) = run_docker(&reap_list_args()).await else {
+        return;
+    };
+    if !out.status.success() {
+        return;
+    }
+    let names = String::from_utf8_lossy(&out.stdout);
+    for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
+        let Some(epoch) = parse_epoch(name) else {
+            continue;
+        };
+        if now.saturating_sub(epoch) > cutoff {
+            tracing::warn!(instance = %name, "reaping stale soft-PLC instance");
+            let _ = run_docker(&rm_args(name)).await;
+        }
+    }
+}
+
+/// Run a `docker` subcommand, capturing its output.
+async fn run_docker(args: &[String]) -> Result<std::process::Output, ExecError> {
+    tokio::process::Command::new("docker")
+        .args(args)
+        .output()
+        .await
+        .map_err(ExecError::Io)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn cfg() -> PlcRuntimeConfig {
+        PlcRuntimeConfig {
+            enabled: true,
+            image: "registry.example.com/openplc:latest".into(),
+            network: "certifai".into(),
+            memory: "512m".into(),
+            cpus: "0.5".into(),
+            max_lifetime_secs: 180,
+            ..PlcRuntimeConfig::default()
+        }
+    }
+
+    #[test]
+    fn instance_name_is_unique_docker_safe_and_reaper_parseable() {
+        let a = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "abcdef123456");
+        assert_eq!(a, "certifai-plc-1700000000-64f0aabbccdd-abcdef");
+        assert_eq!(parse_epoch(&a), Some(1_700_000_000));
+        // Docker names: only [A-Za-z0-9_.-].
+        assert!(a
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')));
+        // A different random suffix yields a different name for the same target.
+        let b = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "zzzzzz999999");
+        assert_ne!(a, b);
+    }
+
+    #[test]
+    fn parse_epoch_rejects_foreign_names() {
+        assert_eq!(parse_epoch("some-other-container"), None);
+        assert_eq!(parse_epoch("certifai-plc-notanumber-x"), None);
+    }
+
+    #[test]
+    fn run_args_cap_resources_harden_label_and_never_publish_a_port() {
+        let args = run_args(&cfg(), "certifai-plc-1-t-r", "target-123");
+        // No host port publishing.
+        assert!(!args.iter().any(|a| a == "-p" || a == "--publish"));
+        // Detached.
+        assert!(args.contains(&"-d".to_string()));
+        // Joined to the agent's own network.
+        let net = args.iter().position(|a| a == "--network").expect("network");
+        assert_eq!(args[net + 1], "certifai");
+        // Resource caps.
+        let mem = args.iter().position(|a| a == "--memory").expect("memory");
+        assert_eq!(args[mem + 1], "512m");
+        let cpu = args.iter().position(|a| a == "--cpus").expect("cpus");
+        assert_eq!(args[cpu + 1], "0.5");
+        assert!(args.iter().any(|a| a == "--pids-limit"));
+        // Hardening.
+        let so = args
+            .iter()
+            .position(|a| a == "--security-opt")
+            .expect("secopt");
+        assert_eq!(args[so + 1], "no-new-privileges");
+        // Ownership + target labels for reaping / attribution.
+        assert!(args.contains(&"certifai.ephemeral=plc-runtime".to_string()));
+        assert!(args.contains(&"certifai.target=target-123".to_string()));
+        // Image is last.
+        assert_eq!(
+            args.last().map(String::as_str),
+            Some("registry.example.com/openplc:latest")
+        );
+    }
+
+    #[test]
+    fn rm_args_force_remove() {
+        assert_eq!(rm_args("x"), vec!["rm", "-f", "x"]);
+    }
+
+    #[test]
+    fn reap_list_filters_by_owner_label() {
+        let args = reap_list_args();
+        assert!(args.contains(&"label=certifai.ephemeral=plc-runtime".to_string()));
+        assert!(args.contains(&"{{.Names}}".to_string()));
+    }
+}