feat(agent): C4 — semantic_stamp_findings + provider load_master_controls

Wires the semantic mapping into a callable scan pass:
- OscalControlsProvider: token-based fetch refactor + load_master_controls()
  (pulls ?framework=master-controls)
- semantic_stamp_findings(): build the ControlIndex from the master-controls
  catalog, then per finding embed its code region, retrieve the top-K nearest
  master controls, grounded-judge confirm, and stamp the confirmed ids onto
  control_refs (alongside the CRA CWE-LUT refs).

Opt-in — the orchestrator doesn't auto-run it, and it rebuilds the corpus index
per call (production should cache it). Live-verifiable once breakpilot #129 deploys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/rules/cra_semgrep.yaml

@@ -1,117 +0,0 @@
-# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
-# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
-# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
-# not matter). Detection here is deterministic; the grounded LLM judge downstream
-# only confirms/refutes — it never detects. Keep patterns tight: a false positive
-# that the judge refutes marks the whole finding a false positive.
-rules:
-  # --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
-  - id: cra-ai-1-flask-debug-enabled
-    languages: [python]
-    severity: WARNING
-    message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
-    metadata:
-      cwe: ["CWE-489: Active Debug Code"]
-      control: cra-ai-1
-    patterns:
-      - pattern: '$APP.run(..., debug=True, ...)'
-
-  - id: cra-ai-1-django-debug-true
-    languages: [python]
-    severity: WARNING
-    message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
-    metadata:
-      cwe: ["CWE-489: Active Debug Code"]
-      control: cra-ai-1
-    patterns:
-      - pattern: 'DEBUG = True'
-
-  - id: cra-ai-1-tls-verify-disabled
-    languages: [python]
-    severity: ERROR
-    message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
-    metadata:
-      cwe: ["CWE-295: Improper Certificate Validation"]
-      control: cra-ai-1
-    patterns:
-      - pattern: 'requests.$M(..., verify=False, ...)'
-
-  - id: cra-ai-1-cors-wildcard
-    languages: [javascript, typescript]
-    severity: WARNING
-    message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
-    metadata:
-      cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
-      control: cra-ai-1
-    patterns:
-      - pattern-either:
-          - pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
-          - pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
-
-  # --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
-  - id: cra-ai-7-weak-password-hash
-    languages: [python]
-    severity: ERROR
-    message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
-    metadata:
-      cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
-      control: cra-ai-7
-    patterns:
-      - pattern-either:
-          - pattern: 'hashlib.md5($PW)'
-          - pattern: 'hashlib.sha1($PW)'
-      - metavariable-regex:
-          metavariable: $PW
-          regex: '(?i).*(pass|pwd|secret|cred|token).*'
-
-  # --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
-  - id: cra-ai-10-session-cookie-insecure
-    languages: [python]
-    severity: ERROR
-    message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
-    metadata:
-      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
-      control: cra-ai-10
-    patterns:
-      - pattern-either:
-          - pattern: 'SESSION_COOKIE_SECURE = False'
-          - pattern: 'SESSION_COOKIE_HTTPONLY = False'
-
-  - id: cra-ai-10-express-cookie-insecure
-    languages: [javascript, typescript]
-    severity: ERROR
-    message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
-    metadata:
-      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
-      control: cra-ai-10
-    patterns:
-      - pattern-either:
-          - pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
-          - pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
-
-  # --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
-  - id: cra-ai-14-python-weak-cipher
-    languages: [python]
-    severity: ERROR
-    message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
-    metadata:
-      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
-      control: cra-ai-14
-    patterns:
-      - pattern-either:
-          - pattern: 'AES.new($K, AES.MODE_ECB, ...)'
-          - pattern: 'DES.new(...)'
-          - pattern: 'DES3.new(...)'
-
-  - id: cra-ai-14-node-weak-cipher
-    languages: [javascript, typescript]
-    severity: ERROR
-    message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
-    metadata:
-      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
-      control: cra-ai-14
-    patterns:
-      - pattern-either:
-          - pattern: 'crypto.createCipheriv("des-ecb", ...)'
-          - pattern: 'crypto.createCipheriv("des", ...)'
-          - pattern: 'crypto.createCipher(...)'

compliance-agent/src/config.rs

@@ -100,8 +100,5 @@ fn load_breakpilot_config() -> BreakpilotConfig {
         base_url: env_var_opt("BREAKPILOT_BASE_URL"),
         token: env_secret_opt("BREAKPILOT_TOKEN"),
         snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
-        semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.semantic_mapping),
     }
 }

compliance-agent/src/controls/index.rs

@@ -6,11 +6,6 @@
 //! requirement text once, then for a code region pull the top-K nearest controls
 //! to hand to the grounded judge. This is the retrieval half of the semantic path.
 
-use std::path::Path;
-
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-
 use compliance_core::control_check::ControlCheckSpec;
 use compliance_core::error::CoreError;
 
@@ -21,34 +16,6 @@ pub struct ControlIndex {
     entries: Vec<(ControlCheckSpec, Vec<f64>)>,
 }
 
-/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
-/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
-#[derive(Serialize, Deserialize)]
-struct PersistedIndex {
-    corpus_hash: String,
-    entries: Vec<PersistedEntry>,
-}
-
-#[derive(Serialize, Deserialize)]
-struct PersistedEntry {
-    spec: ControlCheckSpec,
-    embedding: Vec<f64>,
-}
-
-/// Stable hash of the corpus identity (each control's id + requirement text, in
-/// order). Same catalog → same hash → the cached embeddings are reused instead of
-/// re-embedding the whole corpus.
-fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
-    let mut hasher = Sha256::new();
-    for s in specs {
-        hasher.update(s.control_id.as_bytes());
-        hasher.update([0u8]);
-        hasher.update(s.requirement.as_bytes());
-        hasher.update([0u8]);
-    }
-    format!("{:x}", hasher.finalize())
-}
-
 impl ControlIndex {
     /// Build directly from precomputed embeddings (used by tests + callers that
     /// already embedded the corpus).
@@ -56,70 +23,6 @@ impl ControlIndex {
         Self { entries }
     }
 
-    /// Load the index from `cache_path` if it still matches the current corpus,
-    /// otherwise embed the corpus and persist it there. This turns the per-scan
-    /// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
-    /// that survives across scans; the cache self-invalidates when the catalog
-    /// changes (its [`corpus_hash`] no longer matches).
-    pub async fn load_or_build(
-        llm: &LlmClient,
-        specs: Vec<ControlCheckSpec>,
-        cache_path: &Path,
-    ) -> Result<Self, CoreError> {
-        let hash = corpus_hash(&specs);
-        if let Some(index) = Self::load_cache(cache_path, &hash).await {
-            tracing::debug!(
-                controls = index.len(),
-                "reusing cached control embedding index"
-            );
-            return Ok(index);
-        }
-        let index = Self::build(llm, specs).await?;
-        if let Err(e) = index.write_cache(cache_path, &hash).await {
-            tracing::warn!(error = %e, "failed to persist control embedding index");
-        }
-        Ok(index)
-    }
-
-    /// Read a persisted index, returning it only if its corpus hash matches.
-    async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
-        let raw = tokio::fs::read(path).await.ok()?;
-        let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
-        if persisted.corpus_hash != hash {
-            return None;
-        }
-        Some(Self {
-            entries: persisted
-                .entries
-                .into_iter()
-                .map(|e| (e.spec, e.embedding))
-                .collect(),
-        })
-    }
-
-    /// Persist the index atomically (temp file + rename) keyed by corpus hash.
-    async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
-        if let Some(parent) = path.parent() {
-            tokio::fs::create_dir_all(parent).await?;
-        }
-        let persisted = PersistedIndex {
-            corpus_hash: hash.to_string(),
-            entries: self
-                .entries
-                .iter()
-                .map(|(spec, emb)| PersistedEntry {
-                    spec: spec.clone(),
-                    embedding: emb.clone(),
-                })
-                .collect(),
-        };
-        let raw = serde_json::to_vec(&persisted)?;
-        let tmp = path.with_extension("json.tmp");
-        tokio::fs::write(&tmp, &raw).await?;
-        tokio::fs::rename(&tmp, path).await?;
-        Ok(())
-    }
-
     /// Build by embedding each control's requirement text.
     pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
         if specs.is_empty() {
@@ -204,42 +107,4 @@ mod tests {
         assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
         assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
     }
-
-    #[test]
-    fn corpus_hash_is_stable_and_identity_sensitive() {
-        let a = corpus_hash(&[spec("x"), spec("y")]);
-        assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
-        assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
-        assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
-    }
-
-    #[tokio::test]
-    #[allow(clippy::unwrap_used)]
-    async fn cache_round_trips_and_misses_on_corpus_change() {
-        let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
-        let path = dir.join("control-index.json");
-        let specs = [spec("a"), spec("b")];
-        let hash = corpus_hash(&specs);
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-        ]);
-        index.write_cache(&path, &hash).await.unwrap();
-
-        // matching corpus hash → hit
-        let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
-        assert_eq!(loaded.len(), 2);
-        assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
-        // corpus changed → miss (forces a rebuild)
-        assert!(ControlIndex::load_cache(&path, "differenthash")
-            .await
-            .is_none());
-        // absent file → miss, not an error
-        assert!(
-            ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
-                .await
-                .is_none()
-        );
-        let _ = std::fs::remove_dir_all(&dir);
-    }
 }

compliance-agent/src/controls/scan_triage.rs

@@ -128,11 +128,9 @@ fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegi
 /// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
 /// of findings that gained a master-control ref.
 ///
-/// Gated: the orchestrator runs this only when `breakpilot.semantic_mapping` is
-/// set (default off, flipped on once the master-controls catalog is live). The
-/// control embedding index is built once and cached to `snapshot_dir` keyed by
-/// corpus hash ([`ControlIndex::load_or_build`]), so only the first scan after a
-/// catalog change pays the embedding cost.
+/// Opt-in: the orchestrator does not run this yet. It builds the control embedding
+/// index per call (embeds the whole corpus) — production should cache/persist that
+/// index rather than rebuild it each scan.
 pub async fn semantic_stamp_findings(
     config: &AgentConfig,
     llm: Arc<LlmClient>,
@@ -166,9 +164,7 @@ pub async fn semantic_stamp_findings(
             severity: Severity::Medium,
         })
         .collect();
-    let cache_path =
-        Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
-    let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
+    let index = match ControlIndex::build(&llm, specs).await {
         Ok(i) if !i.is_empty() => i,
         Ok(_) => return 0,
         Err(e) => {

compliance-agent/src/controls/triage.rs

@@ -44,14 +44,10 @@ impl<J: ControlJudge> ControlTriage<J> {
     /// Triage one tool finding. `region` is the code around the finding, used as
     /// the grounding evidence for the judge.
     pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
-        // Match by CWE (off-the-shelf findings) and/or rule id (our custom
-        // detectors, which carry no LUT-bound CWE). A finding with neither is
-        // simply unmapped.
-        let mapped = self.map.controls_for_finding(
-            &finding.scanner,
-            finding.cwe.as_deref(),
-            finding.rule_id.as_deref(),
-        );
+        let Some(cwe) = finding.cwe.as_deref() else {
+            return TriageOutcome::Unmapped;
+        };
+        let mapped = self.map.controls_for(&finding.scanner, cwe);
         if mapped.is_empty() {
             return TriageOutcome::Unmapped;
         }
@@ -166,52 +162,6 @@ mod tests {
         assert_eq!(out, TriageOutcome::FalsePositive);
     }
 
-    #[tokio::test]
-    async fn custom_rule_finding_without_cwe_is_confirmed() {
-        // A custom detector finding carries a rule id but no LUT-bound CWE; it must
-        // still map (by rule id) and confirm.
-        let mut specs = specs();
-        specs.insert(
-            "cra-ai-1".to_string(),
-            ControlCheckSpec {
-                control_id: "cra-ai-1".into(),
-                title: "Secure-by-Default".into(),
-                requirement: "Ship secure defaults".into(),
-                default_cwe: None,
-                severity: Severity::Medium,
-            },
-        );
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "app.run(debug=True)".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs,
-        );
-        let mut f = Finding::new(
-            "repo".into(),
-            "fp".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "flask debug".into(),
-            "desc".into(),
-            Severity::Medium,
-        );
-        f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
-        let region = CandidateRegion {
-            file: "app.py".into(),
-            start_line: 1,
-            content: "app.run(debug=True)\n".into(),
-        };
-        let out = triage.triage(&f, &region).await;
-        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
-    }
-
     #[tokio::test]
     async fn unmapped_cwe_is_left_untagged() {
         let triage = ControlTriage::new(

compliance-agent/src/pipeline/orchestrator.rs

@@ -230,28 +230,6 @@ impl PipelineOrchestrator {
             tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
         }
 
-        // Stage 5c: semantic control mapping — scale path for the master-controls
-        // corpus (no CWE to LUT on): embed each finding's region, retrieve the
-        // nearest master controls, grounded-judge, and stamp confirmed refs. Gated
-        // (default off) as the corpus embedding + per-finding judging is the heavy
-        // path; enabled once verified live against a deployed master-controls catalog.
-        if self.config.breakpilot.semantic_mapping {
-            self.update_phase(scan_run_id, "semantic_control_mapping")
-                .await;
-            let sem = crate::controls::semantic_stamp_findings(
-                &self.config,
-                self.llm.clone(),
-                &repo_path,
-                &mut all_findings,
-            )
-            .await;
-            if sem > 0 {
-                tracing::info!(
-                    "[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
-                );
-            }
-        }
-
         // Dedup against existing findings and insert new ones
         let mut new_count = 0u32;
         let mut new_findings: Vec<Finding> = Vec::new();

compliance-agent/src/pipeline/semgrep.rs

@@ -1,4 +1,4 @@
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use compliance_core::models::{Finding, ScanType, Severity};
 use compliance_core::traits::{ScanOutput, Scanner};
@@ -6,30 +6,6 @@ use compliance_core::CoreError;
 
 use crate::pipeline::dedup;
 
-/// Custom CRA-control detectors bundled into the binary and staged to a temp file
-/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
-/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
-/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
-/// keyed back to its control by the `control-map` LUT.
-const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
-
-/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
-/// rename). Returns `None` on failure — the scan then runs with auto rules only.
-async fn stage_cra_rules() -> Option<PathBuf> {
-    let dir = std::env::temp_dir();
-    let path = dir.join("compliance-cra-semgrep.yaml");
-    let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
-    if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
-        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
-        return None;
-    }
-    if let Err(e) = tokio::fs::rename(&tmp, &path).await {
-        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
-        return None;
-    }
-    Some(path)
-}
-
 pub struct SemgrepScanner;
 
 impl Scanner for SemgrepScanner {
@@ -43,26 +19,30 @@ impl Scanner for SemgrepScanner {
 
     #[tracing::instrument(skip_all)]
     async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let cra_rules = stage_cra_rules().await;
-        let mut command = tokio::process::Command::new("semgrep");
-        command.arg("--config=auto");
-        if let Some(path) = &cra_rules {
-            command.arg(format!("--config={}", path.display()));
-        }
-        command
-            .args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
-            .arg(repo_path);
-
-        let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
-            .await
-            .map_err(|_| CoreError::Scanner {
-                scanner: "semgrep".to_string(),
-                source: "timed out after 10 minutes".into(),
-            })?
-            .map_err(|e| CoreError::Scanner {
-                scanner: "semgrep".to_string(),
-                source: Box::new(e),
-            })?;
+        let output = tokio::time::timeout(
+            std::time::Duration::from_secs(600),
+            tokio::process::Command::new("semgrep")
+                .args([
+                    "--config=auto",
+                    "--json",
+                    "--quiet",
+                    "--max-memory",
+                    "500",
+                    "--jobs",
+                    "1",
+                ])
+                .arg(repo_path)
+                .output(),
+        )
+        .await
+        .map_err(|_| CoreError::Scanner {
+            scanner: "semgrep".to_string(),
+            source: "timed out after 10 minutes".into(),
+        })?
+        .map_err(|e| CoreError::Scanner {
+            scanner: "semgrep".to_string(),
+            source: Box::new(e),
+        })?;
 
         if !output.status.success() && output.stdout.is_empty() {
             let stderr = String::from_utf8_lossy(&output.stderr);

compliance-core/src/config.rs

@@ -75,11 +75,6 @@ pub struct BreakpilotConfig {
     pub token: Option<SecretString>,
     /// Directory for catalog snapshots.
     pub snapshot_dir: String,
-    /// Enable the master-controls **semantic** mapping pass (embed regions,
-    /// retrieve nearest controls, grounded-judge). Off by default: it is the
-    /// scale path and stays gated until verified live against a deployed
-    /// master-controls catalog.
-    pub semantic_mapping: bool,
 }
 
 impl Default for BreakpilotConfig {
@@ -88,7 +83,6 @@ impl Default for BreakpilotConfig {
             base_url: None,
             token: None,
             snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
-            semantic_mapping: false,
         }
     }
 }

compliance-core/src/control_check.rs

@@ -14,14 +14,13 @@
 //! The LLM supplies cross-language / cross-stack pattern recognition; this module
 //! supplies the determinism.
 
-use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
 use crate::models::finding::{Finding, Severity};
 use crate::models::scan::ScanType;
 
 /// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone)]
 pub struct ControlCheckSpec {
     /// Stable control id, e.g. `"cra-ai-8"`.
     pub control_id: String,

control-map/data/cra_control_map.json

@@ -5,21 +5,9 @@
     {
       "control": "cra-ai-1",
       "title": "Secure-by-Default-Konfiguration",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-1-flask-debug-enabled",
-            "cra-ai-1-django-debug-true",
-            "cra-ai-1-tls-verify-disabled",
-            "cra-ai-1-cors-wildcard"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
     },
     {
       "control": "cra-ai-2",
@@ -59,18 +47,9 @@
     {
       "control": "cra-ai-7",
       "title": "Starke Authentifizierung",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-7-weak-password-hash"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
     },
     {
       "control": "cra-ai-8",
@@ -121,19 +100,9 @@
     {
       "control": "cra-ai-10",
       "title": "Sitzungsmanagement",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-10-session-cookie-insecure",
-            "cra-ai-10-express-cookie-insecure"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
     },
     {
       "control": "cra-ai-11",
@@ -169,19 +138,9 @@
     {
       "control": "cra-ai-14",
       "title": "Speicher-Schutz (Data at Rest)",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-14-python-weak-cipher",
-            "cra-ai-14-node-weak-cipher"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
     },
     {
       "control": "cra-ai-15",

control-map/src/lib.rs

@@ -66,14 +66,6 @@ pub struct ControlMap {
 
 const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
 
-/// Whether an authored rule id `bound` matches a scanner's emitted rule id
-/// `actual`. semgrep prefixes local-rule check_ids with a path
-/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
-/// id segment rather than requiring exact equality.
-fn rule_id_matches(bound: &str, actual: &str) -> bool {
-    actual == bound || actual.ends_with(&format!(".{bound}"))
-}
-
 impl ControlMap {
     /// Load the built-in CRA control map (the embedded, authored LUT).
     pub fn cra() -> Result<Self, MapError> {
@@ -88,28 +80,12 @@ impl ControlMap {
     /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
     /// raw tool finding back to the control(s) it's evidence for.
     pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
-        self.controls_for_finding(tool, Some(cwe), None)
-    }
-
-    /// Controls a tool finding is evidence for, matched by CWE and/or the specific
-    /// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
-    /// bind by rule id (precise — a broad CWE would over-attribute and then the
-    /// grounded judge could drop a genuine finding as a control false positive).
-    pub fn controls_for_finding(
-        &self,
-        tool: &str,
-        cwe: Option<&str>,
-        rule_id: Option<&str>,
-    ) -> Vec<&ControlEntry> {
         self.controls
             .iter()
             .filter(|c| {
-                c.scans.iter().any(|s| {
-                    s.tool == tool
-                        && (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
-                            || rule_id
-                                .is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
-                })
+                c.scans
+                    .iter()
+                    .any(|s| s.tool == tool && s.cwe.iter().any(|w| w == cwe))
             })
             .collect()
     }
@@ -184,46 +160,4 @@ mod tests {
         assert!(s.needs_tooling > 0);
         assert!(s.not_code_checkable > 0);
     }
-
-    #[test]
-    fn rule_id_matching_handles_semgrep_path_prefix() {
-        let bound = "cra-ai-1-flask-debug-enabled";
-        assert!(rule_id_matches(bound, bound)); // exact
-        assert!(rule_id_matches(
-            bound,
-            "tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
-        )); // semgrep path prefix
-        assert!(!rule_id_matches(
-            bound,
-            "cra-ai-1-flask-debug-enabled-extra"
-        )); // not a suffix segment
-        assert!(!rule_id_matches(
-            bound,
-            "python.lang.security.exec-detected"
-        )); // unrelated
-    }
-
-    #[test]
-    fn custom_rule_finding_attaches_to_control_by_rule_id() {
-        let map = ControlMap::cra().unwrap();
-        // cra-ai-1 is now tool-covered by custom rules.
-        assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
-        // A prefixed check_id still maps back to cra-ai-1 by rule id.
-        let hits =
-            map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
-        assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
-    }
-
-    #[test]
-    fn custom_rule_controls_do_not_bind_by_broad_cwe() {
-        let map = ControlMap::cra().unwrap();
-        // cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
-        // only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
-        assert!(map.controls_for("semgrep", "CWE-489").is_empty());
-        // The CWE path for off-the-shelf findings is unchanged.
-        assert!(map
-            .controls_for("semgrep", "CWE-798")
-            .iter()
-            .any(|c| c.control == "cra-ai-8"));
-    }
 }